AI Systems for Remote Biometric Identification: Regulatory Implications at the Interface of AI Act and GDPR

Jan Bösselmann LL.M.

doi:10.5771/9783689006198

Summary

How can AI-driven biometric remote identification systems be deployed in a legally compliant way? This work offers readers structured guidance at the intersection of the AI Act and the GDPR, demonstrating how both regimes can be combined into a coherent assessment framework. Based on a doctrinal legal analysis, it examines the risks of biometric data processing, clarifies key concepts, and defines obligations for providers of AI systems. Case studies illustrate practical challenges and regulatory gaps. The study combines academic depth with concrete recommendations for practice and regulation. The author’s research focuses on IT law and data protection, with a particular emphasis on AI regulation.

Search publication

Bibliographic data

Edition: 1/2026
Copyright Year: 2026
ISBN-Print: 978-3-68900-618-1
ISBN-Online: 978-3-68900-619-8
Publisher: Tectum, Baden-Baden
Series: Young Academics: Rechtswissenschaft
Volume: 29
Language: English
Pages: 70
Product Type: Monograph

1. Preface No access
2. Vorwort No access
3. Acknowledgement No access
4. Danksagung No access
1. 1.1 Introduction No access
2. 1.2 Research question No access
3. 1.3 Structure of the thesis No access
1. 1. 2.1.1 Biometric data and remote biometric identification No access
  2. 2.1.2 Concept of an AI system No access
2. 2.2 Legal basis No access
1. 3.1 Systematics and objectives of the GDPR No access
2. 1. 3.2.1 Lawfulness of data processing according to Art. 6 GDPR No access
  2. 3.2.2 Processing of special categories of personal data pursuant to Art. 9 GDPR No access
  3. 3.2.3 Data protection impact assessment No access
3. 1. 3.3.1 Transparent information and exercise of rights under Art. 12 GDPR No access
  2. 3.3.2 Duty to provide information under Articles 13 and 14 GDPR No access
  3. 3.3.3 Right of access under Article 15 GDPR No access
  4. 3.3.4 Right to rectification under Art. 16 GDPR No access
  5. 3.3.5 Right to erasure under Article 17 GDPR No access
  6. 3.3.6 Art. 22 GDPR No access
4. 3.4 Summary No access
1. 4.1 Systematics and objectives of the AI Act No access
2. 4.2 High-risk-AI and prohibited AI in connection with remote biometric identification No access
3. 1. 4.3.1 Risk management according to Art. 9 AI Act No access
  2. 4.3.2 Data governance according to Art. 10 AI Act No access
  3. 4.3.3 Technical documentation pursuant to Art. 11 AI Act No access
  4. 4.3.4 Record keeping obligation under Art. 12 AI Act No access
  5. 4.3.5 Transparency and deployer information pursuant to Art. 13 AI Act No access
  6. 4.3.6 Human oversight pursuant to Art. 14 AI Act No access
  7. 4.3.7 Accuracy, robustness, and cybersecurity pursuant to Art. 15 of the AI Act No access
  8. 4.3.8 Quality management system and conformity assessment No access
4. 4.4 Summary No access
1. 5.1 Divergence of objectives No access
2. 1. 5.2.1 Addressees and conceptual logic No access
  2. 5.2.2 Role shifts along the life cycle according to the AI Act No access
3. 1. 5.3.1 Fundamental relationship No access
  2. 1. 5.3.2.1 Standard according to Art. 22 GDPR: “significant” human influence No access
    2. 5.3.2.2 Standard according to Art. 14 AI Act: “effective” human oversight as a system requirement No access
  3. 5.3.3 Art. 22(2) GDPR and the AI Act No access
  4. 5.3.4 Questions of rank and application No access
  5. 5.3.5 Interface between Article 10 of the AI Act and Article 9 of the GDPR No access
4. 1. 5.4.1 Transparency obligations No access
  2. 5.4.2 Interaction between data protection impact assessment and fundamental rights impact assessment No access
5. 5.5 Fundamental rights as a connecting element No access
6. 5.6 Methodology for practice No access
1. 6.1 Case study: “Clearview AI” No access
2. 1. 6.2.1 Risk assessment No access
  2. 6.2.2 Obligations under the AI Act No access
  3. 6.2.3 Result for Clearview under the AI Act No access
3. 1. 6.3.1 Cooperation between the competent authorities No access
  2. 6.3.2 Legally compliant implementation for developers No access
1. 7.1 Conclusion No access
2. 7.2 Outlook No access
Bibliography No access Pages 67 - 70