EUDPR· Article 10

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the one-to-one verification is under the sole control of the data subject, subject to appropriate safeguards laid down in Union law to protect the fundamental rights and the interests of the data subject.

(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 4;,;and without prejudice to the prohibited practices outlined in Article 5, the rules for classifying high-risk AI systems laid down in Article 6, the obligations imposed on operators of high-risk AI systems in Article 26 and the transparency obligations imposed in Article 50 of this Regulation.

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), using a one-to-one comparison carried out locally on the data subject’s device, where the biometric data or the means needed for the verification is under the sole control of the data subject. This point shall only apply to verification and shall not cover the identification of a natural person using a comparison between his or her biometric data and the biometric data stored in a database within the meaning of Regulation (EU) 2024/1689; it shall not affect the prohibition provided for in Article 5(1), point (e), of this Regulation.;

(a) in paragraph 2, the following points are added: (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 4. (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.’

Justification

Adaptation in line with amendments to Regulation (EU) 2016/679

(a) in paragraph 2, the following points are added: (k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 4. . (l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject.’

(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 4.

Justification

By analogy with GDPR.

(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 4. .

(k) processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 4, and without prejudice to the prohibited practices laid down in Article 5, the classification rules for high-risk AI systems laid down in Article 6, the obligations of deployers of high-risk AI systems laid down in Article 26, and the transparency obligations laid down in Article 50 of that Regulation..

(k) strictly incidental and residual processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 4..

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), by means of a one-to-one comparison performed locally on the data subject’s own device, where the biometric data or the means needed for the verification is under the sole control of the data subject. This point applies solely to verification and does not cover the identification of a natural person by comparing their biometric data to biometric data stored in a database within the meaning of Regulation (EU) 2024/1689; it is without prejudice to the prohibition laid down in Article 5(1), point (e), of that Regulation.

(l) processing of biometric data is strictly necessary and proportionate for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject., and subject to apropriate safeguards to protect the fundamental rights and the interest of the data subject, as laid down in Unio law or Member State law, in accordance with paragraph 4 of this Article.

(l) processing of biometric data is strictly necessary for the purpose of confirming the identity of a data subject (using one-to-one verification), where the biometric data or the means needed for the verificationrecognition is under the sole control of the data subject and occurs on the data subject’s device, except in highly exceptional cases where this is strictly necessary, proportional and uses state of the art privacy preserving technology, such as encryption and zero knowledge proofs.

(l) processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data orand the means needed for the verification isare under the sole control of the data subject, are not stored centrally and are not processed for other purposes.’

Justification

By analogy with GDPR.

4. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data, such as pseudonymisation, data minimisation and filtering at the point of collection, at-source filtering of training data, access restrictions as well as state-of-the-art privacy-preserving and privacy-strengthening methods. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data without undue delay. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. In order to determine whether the deletion of the data involves disproportionate effort, consideration shall be given to the state of the art, the implementation costs, the volume of data in question, the technical feasibility of isolating or extracting the data as well as the nature, scope and purposes of processing.

(b) the following paragraph 4 is added: 4. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

Justification

Subsequent adaptation in line with amendments to Regulation (EU) 2016/679

(b) the following paragraph 4 is added: 4. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

(b) the following paragraph 4 is added: 4. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

(b) the following paragraph 4 is added: 4. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.’

4. For processing referred to in point (k) of paragraph 2, appropriatestrict organisational and technical measures shall be implemented to avoidprevent the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing, the controller shall erase such data without undue delay prior to completion of the training phase of the Ai system or validationAI ormodel. inIf theerasure of those data from an already trained AI system or AI model proves to be technically impossible, the controller shall removefully such data. If removal of those data requires disproportionate effort,document the controllertechnical shallimpossibility, notify the competent supervisory authority, and, without undue delay and in any event effectively protect withoutsuch unduedata delayby applying state of the art filtering or aligment techniques to guarantee such data fromcannot beingbe further procesed, used to produce outputs, from beingre-identified, disclosed or otherwise made available to third parties. Processing referred to in point (k) of paragraph 2 should exlude the processing of special categories of personal data originating from data provided by, or generated through, the activity of end users on an online platforms or a core platfrom services as defined in Regulation (EU) 2022/1925, irrespective of whether such processing occurs during the development, training, or operational phase of any AI system or AI model.

4. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid the collection and otherwise processing of special categories of personal data, such as pseudonymisation, data minimisation and filtering at the point of collection, input filtering of training data, access restrictions, and state-of-the-art privacy-preserving and privacy-enhancing techniques. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data, without undue delay. If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties. In assessing whether the removal of those data requires a disproportionate effort, account shall be taken of the state of the art, the costs of implementation, the volume of data concerned, the technical feasibility of isolating or extracting the data, and the nature, scope and purposes of the processing.

4. For processing referred to in point (k) of paragraph 2, appropriate organisational and technical measures shall be implemented to avoid v the collection and otherwise processing of special categories of personal data. Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data. If removal of those data requires disproportionate effort, taking into account technical feasibility, available resources, the nature of the AI system or model, and state of the art technology, the controller shall in any event effectivelytake protectappropriate measures proportionate to the risks posed that without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.