BIOMETRIC DATA: AN ANALYSIS OF BILL 2338/2023 BASED ON THE PARAMETERS ESTABLISHED IN THE EUROPEAN UNION AI ACT

Abstract

This article analyzes how biometric data and biometric systems are regulated in Brazil's Bill of Law No. 2,338/2023 (the proposed Brazilian AI framework) in light of the standards set by Regulation (EU) 2024/1689 (the AI Act). It starts from the premise that biometrics, although classified as sensitive personal data under the LGPD, has expanded rapidly in Brazil across public and private settings, notably through state identification infrastructures and facial recognition deployments in publicly accessible spaces. Such uses have fueled controversy due to error rates, bias, and discriminatory impacts. Using a qualitative, documentary approach, the study outlines core operational concepts (biometric identification, verification/authentication, remote biometric identification, emotion recognition, and biometric categorization), summarizes the AI Act's risk-based architecture (prohibited practices, high-risk requirements, and safeguards for real-time remote biometric identification), and then examines the bill's main biometric provisions. The comparison shows a shared regulatory backbone: a general ban on real-time remote biometric identification in publicly accessible spaces with narrowly defined exceptions, coupled with stronger governance, transparency, and impact-assessment duties for high-risk uses. At the same time, the article identifies gaps and improvement paths for the Brazilian bill inspired by the AI Act, including: more granular procedural safeguards and independent oversight for exceptions; audit trails and clear deletion duties; an explicit prohibition on building or expanding facial databases through untargeted scraping; a clearer framework for 'post' remote biometric identification (ex post searches); and more specific limits on biometric categorization and emotion recognition in asymmetric environments such as workplaces and educational institutions. The article concludes that the EU framework offers actionable parameters to strengthen fundamental-rights protection and accountability in biometric AI deployments in Brazil.