Real Time Remote Biometric Identification and Its Narrow Exceptions
The eighth prohibited practice covers real time remote biometric identification. This is the use of AI to identify a person in real time from a distance without their knowledge or cooperation, typically using facial recognition on CCTV footage, video feeds, or photographs. Real time means identification as the event is happening, not analysis hours or days later. Remote means the person is not actively participating in the process; they do not consent to biometric capture.
Real time remote biometric identification is a powerful surveillance tool. A person can be identified instantly as they walk through a public space, travel by public transport, or enter a building. When deployed at scale in multiple locations, it enables mass surveillance. Combined with law enforcement databases and integrated with other information systems, it can track individuals across entire cities, building a geographic and temporal map of everywhere a person has been.
The EU considers this use to be prohibited for most purposes because it violates privacy, dignity and freedom of movement in fundamental ways. People cannot move freely through public space if they are at constant risk of being identified and tracked through biometric surveillance. The chilling effect on freedom of expression and freedom of assembly is severe. People may avoid public protests, religious gatherings or political events if they know they will be biometrically identified and recorded.
The prohibition covers real time identification, which means identification as the event happens or within minutes, not retrospective analysis of footage discovered and analysed days later. It also covers remote identification, meaning from a distance without the person’s knowledge or cooperation. It applies to any use in publicly accessible space or in situations where people would not expect or consent to be biometrically identified.
There are narrow exceptions for law enforcement and some border control activities. Law enforcement can use real time remote biometric identification in publicly accessible spaces only for specific purposes: searching for missing persons, especially children; preventing, detecting, investigating or prosecuting specific, serious criminal offences; locating or identifying victims of crime; and preventing an imminent threat to physical safety or public order. Even with these exceptions, the use must be targeted and proportionate to the stated purpose. Police cannot scan everyone at a public event looking for anyone wanted for any offence. They can use it looking for a specific missing child or a specific suspect wanted for a serious crime.
Border control authorities can use real time remote biometric identification for travel control purposes at borders and airport gates, subject to similar proportionality requirements and legal authority.
For private organisations, the prohibition is absolute. A company cannot deploy facial recognition CCTV in a shopping centre to track customers or identify shoplifters. A building owner cannot use it to monitor who enters their office or to create records of who visited premises. Educational and healthcare organisations cannot use it to track students or patients or build records of their movements.
The requirement is that organisations can detect whether they are using real time remote biometric identification and document that use. You need to know if your systems do this. You need to be able to explain and justify any such use in law enforcement contexts to regulators on request.
Examples of prohibited real time remote biometric identification by private organisations include: a shopping mall that deploys facial recognition CCTV to track customer movements through stores and personalise marketing in real time; an office building that uses facial recognition at entrances to track employee entry and departure times, building a detailed movement profile of each worker; a government benefits office that uses facial recognition in waiting areas to identify and flag benefit applicants on watchlists without their knowledge; a retail business using facial recognition to identify repeat shoplifters and deny them entry; a transport authority using facial recognition on public transport to identify and fine fare evaders in real time.
Examples of law enforcement use that would be permitted only in narrow circumstances include: border control identifying a person on an active warrant as they pass through a checkpoint; police using facial recognition CCTV at a public event to locate a specific missing child based on a photo provided by family; police using facial recognition to identify a person suspected of a serious crime based on a warrant from a judge.
In all law enforcement cases, the use must be documented, proportionate, subject to judicial oversight, and limited to the stated purpose.