The EDPB and EDPS have adopted a joint Opinion on the European Commission’s Proposal for an Artificial Intelligence Act. The EDPB and the EDPS strongly welcome the aim of addressing the use of AI systems within the EU, including the use of AI systems by EU institutions, bodies or agencies. At the same time, the EDPB and EDPS are concerned by the exclusion of international law enforcement cooperation from the scope of the Proposal.

The EDPB and EDPS also stress the need to explicitly clarify that existing EU data protection legislation applies to any processing of personal data falling under the scope of the draft AI Regulation.

While the EDPB and the EDPS welcome the risk-based approach underpinning the Proposal, they consider that the concept of “risk to fundamental rights” should be aligned with the EU data protection framework. They recommend that societal risks for groups of individuals should also be assessed and mitigated. Moreover, they agree with the Proposal that the classification of an AI system as high-risk does not necessarily mean that it is lawful per se and can be deployed by the user as such. The EDPB and the EDPS also consider that compliance with legal obligations arising from Union legislation, including on personal data protection, should be a precondition for entering the European market as a CE marked product.

Considering the extremely high risks posed by remote biometric identification of individuals in publicly accessible spaces, the EDPB and the EDPS call for a general ban on any use of AI for automated recognition of human features in publicly accessible spaces, such as recognition of faces, gait, fingerprints, DNA, voice, keystrokes and other biometric or behavioural signals, in any context. Similarly, the EDPB and EDPS recommend a ban on AI systems using biometrics to categorise individuals into clusters based on ethnicity, gender, political or sexual orientation, or other grounds on which discrimination is prohibited under Article 21 of the Charter of Fundamental Rights.

Further, the EDPB and the EDPS consider that the use of AI to infer a person’s emotions is highly undesirable and should be prohibited, except for very specified cases, such as some health purposes where recognising the patient’s emotions is important, and that the use of AI for any type of social scoring should be prohibited.

Andrea Jelinek, EDPB Chair, and Wojciech Wiewiórowski, EDPS, said: “Deploying remote biometric identification in publicly accessible spaces means the end of anonymity in those places. Applications such as live facial recognition interfere with fundamental rights and freedoms to such an extent that they may call into question the essence of these rights and freedoms. This calls for an immediate application of the precautionary approach. A general ban on the use of facial recognition in publicly accessible areas is the necessary starting point if we want to preserve our freedoms and create a human-centric legal framework for AI. The proposed regulation should also prohibit any type of use of AI for social scoring, as it is against the EU fundamental values and can lead to discrimination.”

The EDPB and the EDPS welcome the fact that the Proposal designates the EDPS as the competent authority and the market surveillance authority for the supervision of EU institutions, agencies and bodies. However, its role and tasks should be further clarified, specifically when it comes to its role as the market surveillance authority.

The EDPB and EDPS remind the Commission that data protection authorities (DPAs) are already enforcing data protection law on AI systems involving personal data. Therefore, they say that DPAs should be designated as national supervisory authorities pursuant to Article 59 of the Proposal to ensure the smooth application of the Regulation.

Finally, the EDPB and EDPS question the designation of the EU Commission to a dominant role in the “European Artificial Intelligence Board” (EAIB), as this would conflict with the need for an AI European body independent from any political influence. To ensure its independency, the Proposal should give more autonomy to the EAIB and ensure it can act on its own initiative. To read the EDPB press release in full, click here. To read the Opinion in full, click here.