EU AI Proposal Impact on Video Surveillance Examined
The EU has released a proposal for how it plans to regulate AI, directly impacting certain video surveillance technologies but exempting many products through a major loophole.
"High-risk" AI like facial recognition will require numerous mandatory compliance measures and will face more "narrow" constraints for law enforcement usage. Lower-risk AI such as emotion/demographic analytics will require being disclosed to passerby.
The law has major loopholes that may be great for manufacturers but undermines the intent of the regulation.
In this post, IPVM examines the proposal for this sprawling, GDPR-style law in detail.
Executive *******
*** **** ***** ************ ******* ** the ******** *******:
- ** ** *********** ** ****** "************" (banned), "****-****" (********* ********** *****), *** "low ****" (******* ********** ********)
- * ***** ******** ** **** ** systems ******** ****** *** **** ***** the *** ** ****** **** ** grandfathered **, ******** *** *****
- ****** *********** ** ****** "**** ****" requiring ******** "*********" ********** ******** **** as ******** * "**** ********** ******", examining ******** *** "******** ****," ******** "human *********," *** ****
- ****** **** **** ** ******* ** use **** *********** ** ****** ***** for ******* ******* ********, ******* **** suspects/victims, *** ************* "********* *******"
- *******/****** ********* **** "************ ***********" ********* disclosure ** *** *****.
********* **** ***** ******* ***** ** 6% ** ****** ******* ** €** million ($** *******), ********* ** ******.
Background *** *******
***** ** ********** **** ** *****'* **** ** ******** *** ****** growth ** ****** ******* ** ****. **** ****-**** 2020 ************ **** *** ** **** over ***** ****-**** ****:
*** ******** ** **** ***** ** ensure "***** *******, *******, ********, ********* and *** **** ** *** *** Union *********** ******" ** ******* *********** on **.
"2023 ** *** ********"
** ****** ****** **** ***** *********** agree ** *** ****; **** **** have *** ***** ** ***** **. There ** ** ******** ******** ****** ********* ***** *********** "*** *********** ** ******** ** 2023 ** *** ********, ********* ** people ********* *** ******* *******."
Major ********: ******** ** ******* ************* **
******** ** ******* *** ***** ******** within *** **** ***** *** *** is ****** **** ** ************* **, avoiding *** ***** ****** ***** ** a "*********** ****** ** *** ****** or *******" ** *** ** ******:
**** ***** ********** *** ***-***** *** avoid *** ********** ** ******* ** purchasing ******* **** **** ******** **** than * **** ***** *** ********** passed. **** **** ******* ****** ********* who **** **** ******** "****-****" ** products *******, *************'* ****** *********** *******.** ********* ***** ********, ** ******, since ***** ******** **** ** ************* highly *********.
Risk **********/"************" ** *********
***************** ** *** ***** **** **** categories: "************" ***** ** ******, "****-****" which *** ********* ********** *****, *** "low ****" ***** ******* ********** ** required.
** ***** ************ ************ *** ********** included ** *** "************" *****. *** only ** ********** ****** "************" ** "AI-based ****** *******" ** ***********. **** means * ***** ********* ******** ***** not **** * ****** ** ****** that ***** ****** ********* ** *** 'suspicious' **** ****, ** **** *** be ****** "**-***** ****** *******."
Face *********** "****-****"
**** *********** ("****** ********* ************** ** natural *******") ** ********** ** "****-****" due ** **** ******* ********* "************** effects":
************ ** ****** *********** ********* **** **** ******* *** **** accurate *** ****** ****** **** ***** home *********.
"High-Risk" ** ********** *********
*** ******** ******** ******** ***** (******** 9-15) *** "****-****" ** ******* **********:
* "**** ********** ******" ** ****** to ******* ******** ***** ********** *** product's ******** ** ********** "**************" *** "evaluation" ** ***** ***** **** "********" of ********** ********. ***** **** ** eliminated ** ******* "******* ******** ****** and ***********", **** ******* ******** "*****" to ******* ****** ** ***** ** achieve ****.
********/******* **** ** ******* ** "**** and **** ********** *********". **** ******** identifying "******** ******" ***** ******** ******** are "********, **************, **** ** ****** and ********." ******** ****** **** *** "state-of-the-art ******** *** *******-********** ********, **** as ****************, ** **********."
********* ************* *** *** ****-**** ** products ***** "*********** **********" **** *** EU's ** ********** *** ******** ******** data ***********.
"******-*******" ** ********* ** "****** * level ** ************" ********** *** ** system's "*********." ******** **** ** ******** to *** ********* *****, ********* *********, input **** ***** *** ** * match, *** ************* ***** ****. *** goal ** ** *** "********** **** may ****** ** *** ** ****** presenting * ****" ** *********** ******.
"************ *** ********* ** *********** ** users" ***** ******* ***** ** "*********** by ************" ***** ******* ******** *******, accuracy ******, ********** *** ****** (***** risk "*********** ******"), *** *********** ** intended ********.
***** *********" ** ****-**** ** ******** is ******** ** ***** *** "***** understand *** ********** *** ***********" ** the ****** *** "*********" ********* *** AI's ****** ******* "****-*******" ** *** AI ******. **** ***** *** ****** must **** * ****** "********" ****** like * "**** ******" ** "******* procedure."
****-**** ** ******* **** *** ******* attention ** "********, ********** *** *************": accuracy ******* "***** ** ******** ** accompanying ************" ***** ******* **** ** "resilient" ** "************ ***** *****" ******* attempts. ******* **** ***** ******* ******** to ********** ******** **** ("**** *********") and ****** ******** ** **** ******** ("adversarial ********") ***** **** ***** ** the *****.
Role ** ********* *******: *************, *********, ************
*** ******** ****** ******* **** ************* (or ***** ***************), ************, *********, *** end-users **** ********* **************** *** ****:
- *************"***** **** *** ************** ** *** compliance ** *** ** ****** **** this **********" (*.*. ********* **** *** Articles *****).
- ************* ******* ********** *********** *** ****** technical ************* ** ** *****. **** must **** ****** "****** ************ ***********" of ******* **** ******* * **** to "****** ** ****** ** ** the ********** ** *********** ****** ** persons *** *********". ** ** ******** cannot ** **********, ************* **** "******* an ********** ************** ***** ** *********** in *** *****."
- Distributors must ensure the "provider and the importer of the system, as applicable, have complied with the obligations set out in this Regulation", not sell products that do not meet conformity standards and inform authorities of risks to "health or safety or to the protection of fundamental rights of persons are concerned."
- Users must follow the provider's "instructions" as well as "Union or national law" and the required "human oversight measures". While following directions, users must ensure "input data is relevant" to the intended purpose of the system, must "monitor the operation" of a system, notifying the provider or distributor and suspending use if it presents a risk to "health or safety or to the protection of fundamental rights of persons are concerned". "Users of high-risk AI systems shall keep the logs" of that system "for a period that is appropriate" and "carry out a data protection impact assessment" as ******** ***** *** ****.
*** ***********, ********, **** ** ***** third-party ***** ** ********** * ********" if **** **** * ****** ** service ***** ***** ****, "****** *** intended *******" ** ******** ******, ** make "*********** ************" ** * ******.
Police *** ** ****-**** **** *********** *******
*** *********** ****** *** *********** *** of ****-**** **** *********** ** ****** places ** ******** *********** (******* ******* or ******* ******), ******* ** ****** or ********* *******, *** ************** ** prosecution ** ********* *** ******* ******* laws:
*******, *********** ****** ** ****** ** deciding **** *********** ********** *** ** face *********** *** ** ********* ***** own ******. *** *******, ****** ********* *********** *** ** ***** ************ ** oppress ******* ** ****-********* *** ******'********* ***** *** ****** *********************, ***** ***** ****** **** ********* to *** ****-**** ****** *********** ** those ****** ******* ********* *** ********.
UPDATE */**/****: *** **'* *** *** **** ********** bodies, **************,**** ****** * ***** ******* *** *** ** *********** ** mandate * "******* ***" ** ****** recognition ** ****** ******:
********* ****** ********* ************** ** ******** accessible ****** ***** *** *** ** anonymity ** ***** ******. ************ **** as **** ****** *********** ********* **** fundamental ****** *** ******** ** **** an ****** **** **** *** **** into ******** *** ******* ** ***** rights *** ********. **** ***** *** an ********* *********** ** *** ************* approach.A ******* *** ** *** *** ** ****** *********** ** ******** ********** ***** ** *** ********* ******** ***** ** ** **** ** ******** *** ******** *** ****** * *****-******* ***** ********* *** **. [emphasis added]
*** ****** **** ***** *** * "ban" ** ** *********** ********* *.*. "AI ******* ***** ********** ** ********** individuals **** ******** ***** ** *********, gender, ********* ** ****** ***********":
Similarly, *** **** *** **** ********* * *** ** ** ******* ***** ********** ** ********** *********** **** ******** ***** ** *********, ******, ********* ** ****** ***********, or other grounds on which discrimination is prohibited under Article 21 of the Charter of Fundamental Rights. [emphasis added]
******* ********* *** ** ********* *** only ***** "**** ********* *****".
*** **** & **** **** ** legal ********* ** ***** *** ** their *** ****. ******* ** *** EU's ******** **** ******** **** ** have *********** *********, *** ******* *** EDPS *** * **** ** *** "European ********** ************ *****" ******* ** the ******** ** *****. **** ****** comes ****************** *** *** ** ********** **** too **** ********* *** ****** **** face *** *** *********.
**** **** ****** **** ******* ** this *** *** ******** ****** ** the ** ** ***********.
Disclosure ******** *** *********** *********
***** *******/*********** ********* ******** ********** ** subjects, **** *** *** ******* **** "natural ******* ****** ** ******** **** they *** ******* ** ** ******* recognition ****** ** * ********* ************** system." ****** *** ** ******* ********* is ********** ******** "****-****," *** *** private ***.
*** *******, * ******** ****** ********* whether ******** *** *****/*** **** ******** that ** ******** ******* ***** **** cameras ***** **** ****** **** "***, age, **** ******, *** ******, *******, ethnic ****** ** ****** ** ********* orientation."**** *** ***** ******* *********** ** **** ******* ** ***** so ********** ***** ********* ******* **** see * ******* ******.
Fees ** ** *% ****** ******* ** €***
********* *** ********* *** *** *** capped ** * ******* **** ** 6% ** ****** ******* ** €*** ($36m) *** ********** ********* ** ***-********** with ************ ** ****, *% ** global ******* ** €*** *** ***-********** with ***** *****, *** *% ** global ******* ** €*** *** ********* incomplete ** ********** ***********. ****** ****** will ** ** ****** ** ********** violations ******* **** ********** *********** ** other ******** ******** ********** ******.
Costs ********* *** ****-**** ** *********/*****
*** ** ********* **** **** ******** of ****-**** ** ******* **** **** to ***** ***** €*,*** ** €*,*** ($7,200-$8,400) ** ******* **** ****-**** ** system. *** ****-**** ** *****, ****** costs *** ********* ** ****** €*,*** to €*,*** ($*,***-$*,***) *** **** *** system.
**********
** *********, *** ******** *********** ******** AI ******** **** ******* *** ******** with ***** ******** ******** ** ****-**** products *** ***** *** ********.
** ***** ** *** ******* ********** burden, *** ****** ******** ** **** be *********** *** *** **************. * few ******** ******* *** **** *** face *** ****** ** *** **** for * ******* ********* **** $* ******* ** ********* ****.
*******, *** **** *********** *** *** users **** * ****** ** **** more *********** *** ***** ****** ****** the ******* ************ ** "****-****" ** products ** *** **.
****, ** ************* ***** ******* ** a *** **** ******* ** **** "placed ** *** ****** ** *** into ******* ****** *** **** *** elapsed **** *** **** ** *********** of **** **********" ****** ***** **** the ********* ******* **** ** *** AI ******* ******* ********* *** ***********. I.e. ***** * **** ** ** a ****** ****** **** ** *** AI ****** ** * *** ******** if ** ** ** ********* ** this **********. ** **'* *** ****** a ******** *** ****** *******. ********* EU ********. ** **** ** ** lawyer ** *******!
*******, * ** ****** **** *** are *****.
'****** ** *** ******' ********* ***** available *** **** *********, *** ************ installed ** * ****. *** *******, in**** ** ********** ********, ** ** ******* **:
* ******* ** ****** ** *** market (** *** ** ** **) when ** ** **** ********* *** the ***** **** ** *** ******, i.e. **** ** ** ***** ******** for ************, *********** ** *** ** the ****** ** *** ****** ** a ********** ********, ******* ** ****** for ******* ** **** ** ******.
******* ** *********** * ******* ***********:
******* ** *** ****** ** ******* as *** "***** ****** ********* ** the ******" (** *** ************ ** the ********).* ****** ********* ** *** market ** ******* ** "*** ****** of * ******* *** ************, ***********, or *** ** *** […] ****** in *** ****** ** * ********** activity, ******* ** ****** *** ******* or **** ** ******"
** ** *****, ***** *** ****** of *** ***, ************** ** ******** systems ** * ******* ***** ** undercuts *** *** ** ******* *** existing ******* ** ****** *** '****** on *** ******'
** *******,
*** *********** ******* * ******* *************** ********** **** *** **************:
*** **** *** ** "** *** into *******..." ** ******* ** "*** put **** *******..." ********* ******* ***** placed ** *** ****** ** ********** for ********* ******* ********* ***** *** into *******.
** **** ******* *** *** ************ and **** ****** *** *** **** article **** ** ******* **.
Update: The EU's top two data protection bodies, the******** **** ********** *****(* ***** *** *** *** **'* data ********** ********) *** *********** **** ********** **********(* ******** ****** ********** ** **** practices)**** ****** * ***** ******* *** *** ** *********** ** mandate * "******* ***" ** ****** recognition ** ****** ******:
********* ****** ********* ************** ** ******** accessible ****** ***** *** *** ** anonymity ** ***** ******. ************ **** as **** ****** *********** ********* **** fundamental ****** *** ******** ** **** an ****** **** **** *** **** into ******** *** ******* ** ***** rights *** ********. **** ***** *** an ********* *********** ** *** ************* approach.A ******* *** ** *** *** ** ****** *********** ** ******** ********** ***** ** *** ********* ******** ***** ** ** **** ** ******** *** ******** *** ****** * *****-******* ***** ********* *** **.[emphasis added]
*** ****** **** ***** *** * "ban" ** ** *********** ********* *.*. "AI ******* ***** ********** ** ********** individuals **** ******** ***** ** *********, gender, ********* ** ****** ***********":
****** **** ******* *** ********* **** risks ***** ** ****** ********* ************** of *********** ** ******** ********** ******, the **** *** *** **** **** for * ******* *** ** *** use ** ** *** ********* *********** of ***** ******** ** ******** ********** spaces, **** ** *********** ** *****, gait, ************, ***, *****, ********** *** other ********* ** *********** *******, ** any *******.Similarly, *** **** *** **** ********* * *** ** ** ******* ***** ********** ** ********** *********** **** ******** ***** ** *********, ******, ********* ** ****** ***********,** ***** ******* ** ***** ************** is ********** ***** ******* ** ** the ******* ** *********** ******. [******** added]
******* ********* *** ** ********* *** only ***** "**** ********* *****":
***********, *** **** *** *** **** consider **** *** *** ** ** to ***** ******** ** * ******* person ** ****** *********** *** ****** be **********,except *** **** ********* *****, such as some health purposes, where the patient emotion recognition is important, and that the use of AI for any type of social scoring should be prohibited. [emphasis added]
*** **** & **** **** ** legal ********* ** ***** *** ** their *** ****. ******* ** *** EU's ******** **** ******** **** ** have *********** *********, *** ******* *** EDPS *** * **** ** ***"******** ********** ************ *****" ******* ** the ******** ** *****.
**** ****** ***** ****************** *** *** ** ********** **** too **** ********* *** ****** **** face *** *** *********. ****** *******, ** ** ********* ******, *** legislation ****** *** *********** *** ** real-time **** *********** ** ****** ****** to ******** *********** (******* ******* ** missing ******), ******* ** ****** ** terrorist *******, *** ************** ** *********** of ********* *** ******* ******* ****.
**** **** ****** **** ******* ** there ** *** ******** ****** ** the ** ***********.
*** ** **** ******* *********** ** computer ****** ** ******* **** ******** in *** ******** ***** **** *** of *** ******** *********** ****** ***** overseas. ** **** ** **** ****, as ** ** **** ****** *********** tech, *** ** **** *** ** an ********** *********.