Are CCTV behaviour and emotion alerts allowed in a workplace under the EU AI Act?
Alerts on what people appear to be doing or feeling: aggression, loitering, a fall, a fight, a mood. Some of these may infer emotion and some detect movement only; the vendor documentation says which. Loitering and object alerts detect movement and presence, not emotion.
- Biometric identification
- no
- May infer emotion
- it may; some alerts of this type detect movement only, and the vendor documentation says which
- May infer a sensitive characteristic
- no
- May be an AI system
- yes
- Read from words such as
- aggression detection
Art. 5 of the EU AI Act lists emotion recognition in the workplace and in education among the practices the Act does not allow, with an exception in Art. 5(1)(f) for systems put in place for medical or safety reasons (named here, not quoted). A behaviour alert may or may not infer emotion: aggression and mood alerts may; loitering, fall and object alerts detect movement and presence only. The questions for your lawyer are which this alert is, and whether the exception applies.
Findings it can raise, with the list
- 2 Behaviour or emotion alerts over an area where staff work, at an EU site
- 5 No retention period set, or retention above the maximum you set
- 6 No signage or notice recorded
- 7 Footage stored outside the site's region: who can access it there?
- 8 A third party can view or manage the footage, and no agreement is recorded
- 13 No owner, or no list of who can view
- 14 Disclosures to police or insurers not logged
- 15 Covert camera
Clauses this analytics type adds
3 clausesEU AI Act Art. 4AI literacyAI literacy. Providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy among their own staff and any other persons who deal with the operation and use of AI systems on their behalf. The measures must be calibrated to those persons' technical knowledge, experience, education and training, to the context in which the AI systems are to be used, and to the persons or groups of persons on whom the systems are to be used. The duty attaches to every AI system regardless of its risk class.
EU AI Act Art. 5The practices listed in Article 5Prohibited AI practices. Prohibits a defined set of AI practices, including subliminal/manipulative techniques causing significant harm, exploitation of vulnerabilities, social scoring by public authorities, predictive policing based solely on profiling, untargeted scraping of facial images, emotion recognition in workplace/education, biometric categorisation inferring sensitive attributes, and real-time remote biometric identification (RBI) in publicly accessible spaces by law enforcement (subject to narrow exceptions).
EU AI Act Art. 50Transparency obligations for providers and deployers of certain AI systemsTransparency obligations for providers and deployers of certain AI systems. Providers and deployers of certain AI systems (incl those interacting with natural persons, emotion recognition, biometric categorisation, generative AI producing synthetic content, deepfakes, and AI-generated/manipulated text for public-interest information) shall inform users that they are interacting with AI, label synthetic content in a machine-readable format, and disclose deepfakes and AI-generated public-interest text (subject to free-expression and artistic exceptions).