How will the AI-act affect current law and the police’s ability to use facial recognition for law enforcement purposes?

The processing of personal data when carried out by public authorities for law enforcement purposes is currently regulated in Directive 2016/680, Law Enforcement Directive(LED). It corresponds to Article 5 of GDPR with some minor changes to adapt it to processing by law enforcement authorities. The European Data Protection Board has also in Guidelines 05/2022 provided law enforcement authorities with a clarification on how they should use FRT and how to ensure the processing of personal data is lawful in accordance with LED.

Under the AI Act, the use of FRT will be strictly regulated. Certain uses of AI systems, like real-time remote biometric identification in public places for law enforcement purposes, will be prohibited unless certain specific conditions are met. These conditions focus on the targeted search of specific crime victims, including missing children, prevention of a specific, significant, and imminent threat to life or physical safety, and the detection, location, identification, or prosecution of perpetrators of serious offenses.

The Act also defines high-risk AI systems, which are allowed to operate if they meet mandatory requirements and undergo a prior conformity assessment. The requirements include implementation of a risk management system, data accuracy, relevance, and representativeness, clear technical documentation, transparency, user access to processed information, human review, and a robust level of accuracy and cybersecurity. The Act also outlines the responsibilities of AI system providers and the procedures for third-party assessment compliance checks.

The proposed AI Act poses certain challenges for law enforcement authorities seeking to use FRT. While the Act clearly prohibits the use of real-time remote biometric identification in public spaces for law enforcement, it lacks clarity on other aspects of FRT use. This ambiguity could make it difficult for police authorities in the Union to determine the appropriate and legal use of FRT.

Despite these uncertainties, it’s likely that the Act, in its current form, won’t cause significant issues for law enforcement authorities. The real concern lies with those who hoped the Act would restrict the use of real-time FRT by police, as the Act’s exceptions allow for a broad range of FRT uses that seem to contradict the Act’s purpose.

In essence, these exceptions act more as the main rule than the prohibition itself, which seems contradictory if the Act’s purpose is to limit the use of real-time FRT to a few specific objectives. This contradiction is especially notable considering that the Law Enforcement Directive (LED) already seems to prohibit more uses of real-time FRT by law enforcement than the AI Act would.

Regarding the interplay with current law, the AI Act would replace the LED in the context of real-time FRT systems. For high-risk systems, there would be an interaction between the two regulations - a use that is allowed under the AI Act might not be in accordance with the LED, and vice versa.

Potential problems with the act

The AI Act present several significant issues.

First, the Act’s ambiguities make it difficult to interpret and could lead to future problems. The wording of the exceptions to the Act’s rules seems to contradict its purpose, and it’s unclear which uses fall under these exceptions. Moreover, the use of post-FRT (facial recognition not conducted in real-time) by law enforcement appears to be left unregulated, which calls for further clarification.

Second, while the Act is designed to be future-proof, its mechanism for updating the list of high-risk systems seems inadequate. Systems introduced after the Act that do not fall into the described uses may be left outside its scope, creating a loophole for potentially risky general-purpose systems to be unregulated.

Third, the AI Act’s interplay with the Prüm II proposal needs to be more carefully considered. The use of FRT allowed under the Act could lay the groundwork for the automated data exchange that Prüm II proposes, and this intersection must be fully explored.

Solutions to the problems

There are some solutions to the aforementioned problems. For the prohibited uses of FRT, the exceptions should be applicable only in specific cases and to a much smaller extent than what they appear to be today. This would ensure that real-time FRT is only used when it is absolutely necessary to minimize the infringements on fundamental rights.

Regarding high-risk provisions, there are essentially three amendments that need to be made. First of all, clarifications should be made as to what systems are regarded as high-risk. Second, the use of post-FRT by law enforcement should be added to make sure it lives up to the requirements set out in the act. Lastly, it needs to be made easier to make additions to the list found in Annex III to ensure an act that will stand the test of time.

Another solution is to make a separate AI Act for law enforcement, similar to GDPR and LED which would ensure that the distinct balancing of rights that a use of FRT by law enforcement entails is signified.

The AI Act is hopefully a sign of great things to come and a step in the right direction for creating a Union fit for the digital age. However, it leaves much to be desired, and it is evident that the face odyssey has not quite reached its final destination just yet.