present developments on biometric recognition – Official Weblog of UNIO – Tech Defend


Maria Inês Costa (PhD Candidate on the Faculty of Regulation of the College of Minho. FCT analysis scholarship holder – UI/BD/154522/2023)

In Portugal, greater than 300,000 folks have already “bought” their iris scan to Worldcoin Basis, which in return gives them cryptocurrency. In March 2024, the Portuguese information safety authority (hereinafter, the CNPD) determined to droop the corporate’s assortment of iris and facial biometric information for 90 days with a purpose to shield the suitable to the safety of non-public information, particularly of minors, following within the footsteps of Spain, which additionally briefly banned the corporate’s actions for privateness causes.[1]

In an announcement, the CNPD explains that the corporate has already been knowledgeable of this non permanent suspension, which is able to final till the investigation is accomplished and a closing resolution is made on the matter. The adoption of this pressing provisional measure comes within the wake of “dozens of stories” acquired by the CNPD within the final month, which report the gathering of knowledge from minors with out the authorisation of their mother and father or different authorized representatives, in addition to deficiencies within the data offered to information topics, the impossibility of deleting information or revoking consent.[2] In CNPD’s press launch, one can learn that “[g]iven the present circumstances, in which there’s illegal processing of the biometric information of minors, mixed with potential infringements of different GDPR guidelines, the CNPD thought-about that the chance to residents’ basic rights is excessive, justifying an pressing intervention to forestall critical or irreparable hurt.”[3]


In its detailed suspension resolution, one is supplied with essential data, particularly the truth that, by means of complaints, it was revealed that some information topics solely grew to become conscious of the dangers concerned within the processing of their information because of media publicity of the matter, and that these dangers have been by no means correctly defined to them; moreover, they have been allegedly not supplied with data on the processing carried out, particularly on the info truly collected and for what functions, nor on tips on how to train the rights offered for within the legislation on the safety of non-public information; and, as reported by the media, there are a variety of residents who authorise this information assortment and subsequent processing as a result of they’re economically susceptible and/or aren’t totally conscious of the goals and implications of their participation within the Worldcoin venture.[4]

And what’s this venture all about? Cofounded by OpenAI CEO Sam Altman, the Worldcoin Basis’s white paper entitled “A New Id and Monetary Community”[5] outlines the objectives of scanning folks’s iris and facial biometrics. In keeping with the doc, “[i]f profitable, Worldcoin might significantly improve financial alternative, scale a dependable answer for distinguishing people from AI on-line whereas preserving privateness, allow international democratic processes, and present a possible path to AI-funded UBI.[6] Worldcoin consists of a privacy-preserving digital identification community (World ID) constructed on proof of personhood and, the place legal guidelines enable, a digital forex (WLD).”

For the corporate, in a world the place AI is changing into increasingly highly effective, there may be an pressing want for “proof of personhood”, and essentially the most viable method to challenge it’s by means of customized biometric {hardware} – the Orb. The Orb captures high-quality iris photographs with greater than an order of magnitude larger decision in comparison with iris recognition requirements, by means of which a ‘World ID’ is created – a “digital identification answer enabling customers to show their uniqueness and humanity anonymously […]”,[7] based on Worldcoin.

Although the aim of Worldcoin considers the actions carried out are preserving of privateness, latest complaints and bans provide a contrasting perspective. Certainly, Eileen Guo and Adi Renaldi from the MIT Know-how Evaluation printed, in April 2022, a protracted article exposing most of the firm’s weaknesses and challenges it presents. For example, they interviewed Iyus Ruswandi, an area Indonesian who was tempted to “promote” his iris to Worldcoin Indonesia, in December 2021. The representatives would accumulate the scans, in return for “free money (typically native forex in addition to Worldcoin tokens) to Airpods to guarantees of future wealth […] What they weren’t offering was a lot data on their actual intentions.”[8] Within the writer’s interview with Ruswandi, he said that representatives even had to assist residents arrange emails and go surfing to the net, main him to replicate on why Worldcoin was concentrating on low-income communities within the first place, somewhat than crypto fans or communities.[9]

From the accounts gathered thus far, it’s doable to witness how this apply has affected susceptible communities, from populations who wouldn’t have entry to essentially the most up-to-date digital literacy, to kids, who can not validly consent to this kind of apply. However there may be additionally an inequality of data between those that have bought their irises and the corporate, just because the latter has apparently not been totally clear about its operations. On this context, it’s related to confer with recital 20 of the EU AI Act which determines that “[i]n order to acquire the best advantages from AI techniques whereas defending basic rights, well being and security and to allow democratic management, AI literacy ought to equip suppliers, deployers and affected individuals with the mandatory notions to make knowledgeable selections relating to AI techniques. These notions might fluctuate with regard to the related context and might embody […], within the case of affected individuals, the data vital to know how selections taken with the help of AI will have an effect on them […]”.[10] (Writer’s daring). And though this reference to digital literacy on this recital includes completely different teams of individuals, it’s true that Article 4 of the AI Act states that “[p]roviders and deployers of AI techniques shall take measures to make sure, to their greatest extent, a adequate stage of AI literacy of their workers and different individuals coping with the operation and use of AI techniques on their behalf […]”, placing the emphasis on those that work intently with the expertise.

The state of affairs examined on this textual content is especially worrying, particularly as we’re coping with biometric information, which “can allow the authentication, identification or categorization of pure individuals and the popularity of feelings of pure individuals”.[11] As mentioned within the European Parliament’s 2021 research “Biometric Recognition and Behavioural Detection”, to uniquely establish pure individuals, “robust”[12] biometric identifiers should be captured, transformed into digital information and finally right into a standardised template. These identifiers might be captured by applicable bodily scanners, with the energetic acutely aware cooperation of the person, remotely with out such cooperation, or with the assistance of present different information. Thus, capturing biometric identifiers means changing an individual’s distinctive bodily traits into digital information, resulting in the “datafication” of people.

As a result of the options that uniquely establish an individual are a part of an individual’s physique, their assortment and use intrude with an individual’s private autonomy and dignity, the report stresses. As soon as a biometric template has been created and saved in a reference database, anybody in possession of that template can establish and find that particular person wherever on the planet, placing that particular person at critical danger of being tracked and monitored. Additionally, it may be used to establish the person for a vast variety of functions and conditions.[13] The truth is, whereas the chance of fraud and the difficulties posed by poor information high quality or lacking information are diminished by fashions that use “robust” biometrics, these “additionally improve moral considerations, as they permit extra environment friendly public surveillance and can be utilized for the creation of elaborate profiles”.[14]

In keeping with Article 5(1)(h) of the AI Act, using “real-time” distant biometric identification techniques[15] in areas accessible to the general public for the aim of sustaining public order is prohibited, until and to the extent that such use is strictly vital for outlined functions within the Regulation.[16] In relation to using “publish” biometric identification techniques (in deferred time),[17] that is thought-about a high-risk apply, and never prohibited just like the one described above, though the end result is similar – large identification of topics with out their consent or data, one thing which is intrusive in nature. A lot criticism has been directed at the truth that the latter just isn’t fully prohibited, and that the previous consists of exceptions to its prohibition.[18] Therefore, that highlights how the apply of biometric identification carries a really excessive danger of threatening primary rights and safeguards,[19] and finally democracy itself.

Now, when contemplating the operations of firms which make use of biometric identification as its fundamental exercise, and the needs for which all of the delicate information shall be used might be very questionable, we step on to very harmful territory. On this regard, it’s related to think about Alfonso Ballesteros’ insights in his article “Digitocracy: ruling and being dominated”: “[d]igitocracy[20] appears to be a brand new type of authorities […] a brand new method to rule an unprecedented variety of folks neatly and effectively. […] Rulers aren’t any extra fashionable technocratic humanists than mere rational entrepreneurs searching for to earn cash. They’re postmodern entrepreneurs [who] have been capable of hybridise their financial pursuits with new postmodern concepts; particularly, those who blur the distinctions between artefacts and people, and a declared pretension to be appearing for the nice of humanity.”[21]

As of late, it is a matter for essentially the most cautious consideration, as with out robust sufficient safeguards, we shall be more and more topic to vested pursuits making use of our most delicate data, and that might result in a path of no return. Thus, within the face of a suggestion of “proof of personhood”, we must be involved as as to whether that is weakening our very personal autonomy and dignity – in essence, our humanness – or if it is going to improve and, quite the opposite, shield our life in coexistence with expertise.

[1] See Elizabeth Howcroft, “Portugal orders Sam Altman’s Worldcoin to halt information assortment”, Reuters, 26 March 2024, See additionally Expresso, “Worldcoin: Comissão de Proteção de Dados suspende recolha de dados da íris”, 26 March 2024,

[2] CNPD, “CNPD suspende recolha de dados biométricos”, 26 March 2024,

[3] The total textual content of the press launch is out there at:

[4] CNPD, “DELIBERAÇÃO/2024/137”, AVG/2023/1205, 4,

[5] Worldcoin Basis, “A New Id and Monetary Community”, Worldcoin Whitepaper,

[6] UBI stands for common primary revenue.

[7] Worldcoin Basis, “World ID – The protocol to carry privacy-preserving international proof of personhood to the web”,

[8] Eileen Guo and Adi Renaldi, “Human and expertise – Deception, exploited staff, and money handouts: how Worldcoin recruited its first half 1,000,000 take a look at customers”, MIT Know-how Evaluation, 6 April 2022,

[9] Eileen Guo and Adi Renaldi, “Human and expertise – Deception, exploited staff, and money handouts: how Worldcoin recruited its first half 1,000,000 take a look at customers”.

[10] European Parliament legislative decision of 13 March 2024 on the proposal for a regulation of the European Parliament and of the Council on laying down harmonised guidelines on Synthetic Intelligence (Synthetic Intelligence Act) and amending sure Union Legislative Acts, P9_TA(2024)0138 (COM(2021)0206 – C9-0146/2021 – 2021/0106(COD)), (Hereinafter, EU AI Act or AI Act).

[11] EU AI Act, Recital 14.

[12] These are, based on the research, fingerprint, iris, or retina.

[13] European Parliament, “Biometric Recognition and Behavioural Detection – Assessing the moral facets of biometric recognition and behavioural detection strategies with a deal with their present and future use in public areas”, Research requested by the JURI and PETI committees, Coverage Division for Residents’ Rights and Constitutional Affairs, Directorate-Common for Inner Insurance policies, PE 696.968, August 2021, 44,

[14] European Parliament, “Biometric Recognition and Behavioural Detection – Assessing the moral facets of biometric recognition and behavioural detection strategies with a deal with their present and future use in public areas”, 14.

[15] EU AI Act, Recital 17: “[…] ‘Actual-time’ techniques contain using ‘reside’ or ‘near-live’ materials, reminiscent of video footage, generated by a digital camera or different machine with related performance. […]”

[16] EU AI Act, Recital 33: “These conditions contain the seek for sure victims of crime together with lacking folks; sure threats to the life or to the bodily security of pure individuals or of a terrorist assault; and the localisation or identification of perpetrators or suspects of the felony offences listed in an annex to this Regulation, the place these felony offences are punishable by a custodial sentence or a detention order for a most interval of at the very least 4 years within the Member State involved in accordance with the legislation of that Member State. Such a threshold for the custodial sentence or detention order in accordance with nationwide legislation contributes to making sure that the offence must be critical sufficient to doubtlessly justify using ‘real-time’ distant biometric identification techniques.”

[17] EU AI Act, Recital 17: “[…] Within the case of ‘publish’ techniques, in distinction, the biometric information have already been captured and the comparability and identification happen solely after a major delay. This includes materials, reminiscent of footage or video footage generated by closed circuit tv cameras or non-public units, which has been generated earlier than using the system in respect of the pure individuals involved.”

[18] See Patrick Breyer, Sergey Lagodinsky and Kim van Sparrentak, “Defending privateness: biometric mass surveillance and the AI Act”, The Greens/EFA within the European Parliament, 6 March 2024,

[19] For example, “[…] AI techniques figuring out or inferring feelings or intentions of pure individuals on the premise of their biometric information might result in discriminatory outcomes and might be intrusive to the rights and freedoms of the involved individuals. Contemplating the imbalance of energy within the context of labor or schooling, mixed with the intrusive nature of those techniques, such techniques might result in detrimental or unfavourable remedy of sure pure individuals or complete teams thereof.” – Recital 44, EU AI Act.

[20] “Digitalisation as a type of authorities”.

[21] Alfonso Ballesteros, “Digitocracy: ruling and being dominated”, Philosophies 5, 9 (2020): 11,

Image credit: by Wojtek Paczeu015b on

#present #developments #biometric #recognition #Official #Weblog #UNIO

Leave a Comment