The Definition of Biometric Data in the Context of French Legislative Experimentation and the Implementation of the AI Act
摘要
Following the publication of EU regulation on artificial intelligence, which came into effect on August 2nd, 2024, the issue of biometric data—as excluded from Article 10 of French legislation of May 19th, 2023, which introduced an experimentation of augmented cameras for the Paris 2024 Olympic Games—arises once again. The definition of biometric data has evolved significantly since the earliest legislations (EU 1995 Directive/46/EC and the 1978 French Law Informatique et libertés), influenced by the opinions of authorities such as WP29, the EDPB, and the CNIL. It has ultimately been enshrined in the GDPR (Article 4, paragraph 14) and the Law Enforcement Directive (Article 3, paragraph 13). The definition therein includes purposes of identification or authentication, which the AI regulation (Article 3, paragraph 34) has moved away from, allowing for the inclusion of categorisation and emotion recognition. The question then arises regarding the interplay between French legislation and the new European regulation, whose definitional provisions and prohibitions on certain AI systems—such as specific types of categorisation—will be applicable (February 2nd, 2025) before the end of the French experimentation period (March 31st, 2025). Indeed, the purported absence of biometric data in the experimental algorithms has been widely criticized. Furthermore, there arises a broader question of coherence between the AI regulation and data protection Law (GDPR and the Law Enforcement Directive), with the former needing to be interpreted in light of the latter.