For Heads-of · Practitioner
Biometric categorisation of sensitive attributes
A biometric categorisation system infers race, political opinions, trade union membership, religious belief, or sexual orientation.
- critical
- prohibited-practice
- biometric
- sensitive-attributes
- eu-ai-act
How it happens
A biometric system, built for an ostensibly different purpose like age estimation or access control, is used or extended to infer one of the specifically prohibited sensitive categories from a person's biometric data.
Why it matters
These categories map directly onto UK GDPR's special category data; inferring them from biometrics compounds a data protection breach with a standalone AI Act prohibition.
Mitigating controls
The controls that address this risk, ranked by effectiveness.
No controls mapped to this risk yet.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| EU AI Act | Article 5(g) | Biometric categorisation of sensitive attributes |
| UK General Data Protection Regulation | Article 5 | Principles relating to processing of personal data |
Related resources
The external sources behind this risk, from the Resources library.