Biometric Identification

Abstract

Biometric-identification governance covers real-time and post-hoc biometric identification in public spaces — among the most consequential surveillance questions in AI law, and one where the editorial read of the field is settled. Across the catalogued instruments, four govern it directly — the EU AI Act through a prohibition with carve-outs, the GDPR through special-category-data and automated-decision rules, the EU Platform Work Directive through a one-to-many biometric-identification prohibition for platform workers, and China's Deep Synthesis Provisions through a consent requirement for biometric-information editing — while most other regimes address it only implicitly or remain silent. This article maps, with primary-source citations, which instruments govern biometric identification, which touch it implicitly, and which are silent.

Explainer

Biometric identification — matching faces or other physical traits against a database, whether in real time or after the fact — is governed most directly in the European Union, and even there the headline rule is narrower than it first appears. The EU AI Act (Regulation (EU) 2024/1689) prohibits real-time remote biometric identification in publicly accessible spaces under Article 5(1)(h), but the same provision carves out law-enforcement uses — searching for victims, preventing imminent threats, and locating serious-crime suspects — and Article 26(10) permits post-hoc identification subject to judicial authorisation after the fact. The General Data Protection Regulation reaches the same practice from a different angle, treating biometric data used for identification as a special category under Article 9 and giving individuals a qualified right against solely automated decisions under Article 22. Two further instruments govern narrower facets of the same practice: the EU Platform Work Directive (Directive (EU) 2024/2831) prohibits digital labour platforms from identifying platform workers by one-to-many biometric comparison against a database (Article 7), and China's Deep Synthesis Provisions require the separate consent of any person whose facial or vocal biometric information is edited (Article 14).

Beyond these direct governors the catalogued coverage thins quickly. The United States' Executive Order 14110, the United Kingdom's 2023 AI white paper, and the Council of Europe's AI Convention each touch biometric identification only implicitly — through general civil-rights, data-protection, or non-discrimination provisions rather than a dedicated rule — while a further set of instruments, including the G7 Hiroshima code, the OECD AI Principles, China's Generative AI Measures, and the 2024 UN resolution, are silent on it altogether. That uneven map is itself the governance reality: in a comparative US/EU/UK study, Almeida, Shmarko and Lomas (2022) find there is no standardised human-rights framework that applies cleanly to facial-recognition deployment.

The empirical case for scrutiny rests on well-documented accuracy disparities. Buolamwini and Gebru's 2018 'Gender Shades' audit found commercial gender-classification error rates as high as 34.7 per cent for darker-skinned women against under one per cent for lighter-skinned men, and the US National Institute of Standards and Technology's 2019 Face Recognition Vendor Test reported false-positive differentials varying by factors of ten to over a hundred across demographic groups. Those findings underpin the concern that biometric identification, deployed at scale, distributes its errors unequally.

Policy Window records the field's empirical consensus as settled — not because the policy debate is closed, but because the catalogued instruments and the evidence behind them point consistently in one direction: the technology's risks are documented, and the binding governance response is concentrated in the European Union while most other regimes address it only implicitly or not at all. Every claim here traces to the primary instruments and peer-reviewed sources cited throughout this article; the coverage table below shows, instrument by instrument, which regimes govern biometric identification directly, which reach it only implicitly, and which are silent.