Prohibition of untargeted scraping of facial images and facial recognition databases

The Future of Privacy Forum (FPF) has published the fifth article in a series exploring the prohibited practices set out in the EU Artificial Intelligence Act (AI Act). 

The fifth article examines the Article 5(1)(e) prohibition on AI systems that create or expand facial recognition databases through untargeted scraping. The practice involves collecting facial images from the internet or CCTV footage without a specific target. FPF notes that the provision is separate from other sections of the AI Act that regulate the actual use of facial recognition technology.

The FPF analysis discusses several important points, including European Commission guidelines that classify untargeted scraping as a particularly intrusive practice. This can result in significant violations of fundamental rights and contribute to the perception of mass surveillance. The FPF highlights that this approach aligns with existing EU General Data Protection Regulation (GDPR) case law, which offers the most comprehensive protections regarding the use of facial recognition technology. In addition, by differentiating between targeted and untargeted scraping, the AI Act limits the scope of this specific prohibition. However, use-cases falling outside this scope, such as scraping images to train models that generate fictitious persons, may still face complex compliance requirements under GDPR and copyright rules.

Training Announcement: The BCS Foundation Certificate in AI examines the challenges and risks associated with AI projects, such as those related to privacy, transparency and potential biases in algorithms that could lead to unintended consequences. Explore the role of data, effective risk management strategies, compliance requirements, and ongoing governance of the AI lifecycle and become a certified AI Governance professional. Find out more.