Behavioral Biometrics in the European Union: Legal Challenges and Technological Prospects

Introduction

The regulation of behavioral biometrics in the European Union (EU) highlights the importance of addressing data protection and privacy amid a rapidly evolving technological landscape. Biometrics, which includes physical, physiological, and behavioral characteristics used to identify individuals, has been receiving more attention as privacy concerns grow around the world. The EU has continuously updated its legislation to protect personal data since the adoption of the 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108). Key documents such as the Directive 95/46/EC and the General Data Protection Regulation (GDPR) have helped the EU set a global benchmark for the protection of personal data, particularly in the sensitive area of biometric data. Recent developments in the form of the 2024 European Union Artificial Intelligence Act (EU AI Act) have further expanded the scope of these regulations, particularly regarding the use of behavioral biometrics and artificial intelligence in sensitive areas such as security and privacy.

Despite these advances, the regulation of behavioral biometrics presents various challenges, especially concerning the distinctions between physical and behavioral data. The EU’s approach to regulating biometric data has significantly influenced privacy laws globally, yet it has faced criticism for its lack of clarity and specificity in certain areas. This article examines the evolution of EU regulations on behavioral biometrics, analyzing key legislation, its influence on data protection, and existing challenges. It also compares the EU regulatory approach with the United States, where the lack of a national law has resulted in less comprehensive regulation on biometrics.

1. Evolution of Behavioral Biometrics Regulation in the European Union

To get a more comprehensive picture of how biometrics are regulated in the EU, it is essential to understand the context and conditions that contributed to the emergence and implementation of its legal framework (Carrigan & Coglianese, 2011). With the rapid advances in electronic data processing in the 1960s and 1970s, there was a severe necessity to strengthen privacy protection measures, especially in the automatic collection of personal data. This was echoed in the EU and led to the adoption of the Convention 108 and the Directive 95/46/EC (De Hert, 2013). These documents were the first legally binding international normative acts regulating data protection, including biometric data.

Convention 108, signed on January 28, 1981, obliged EU countries to introduce a series of specific changes in their domestic legislation by principles such as fair and lawful collection and automatic processing of data and the presence of concrete, explicit, and legitimate purposes for storing such data; it is not allowed to use data that is inconsistent with these objectives or where the storage process takes more time than needed. These principles also encompass the adequacy, relevance, and not excessiveness of the data. Generally, it is the responsibility of controllers, under the provisions of Convention 108, to manage the processing of personal data¹.

There is now in force a modernized version of the document, known as Convention 108+, Article 6 of which stipulates that the processing of biometric data for personal identification is permitted as long as appropriate guarantees are in place to guard against risks that endanger the individual’s interests, rights, and fundamental freedoms, including the risk of discrimination. At the same time, biometric data used for unambiguous identification belong to the category of sensitive data, therefore their processing must be accompanied by specific guarantees. It requires separate or joint consent of the data subject, a law defining the objectives, methods, and specific conditions under which data processing may be utilized, confidentiality, measures based on risk analysis, and security precautions².

Directive 95/46/EC, adopted on October 24, 1995, was also an important document in the regulation of biometrics that cannot be omitted. The primary focus was on the safeguarding of the individual’s fundamental rights and freedoms during the processing of data within the EU and the free movement of such data. The key responsibility for data protection rested with the supervisory authorities established by each state that adopted Directive 95/46/EC. These are independent bodies that have the power to advise on administrative measures and regulations as well as to initiate legal proceedings if breaches of data protection requirements are found. Although Directive 95/46/EC does not specifically mention the processing of biometric data, Article 29 established a Working Party to provide consultations and opinions on the operation and regulation of biometrics³. For example, in 2003, a “Working Document on Biometrics,” which examines how the provisions of Directive 95/46/EC apply to the use of biometric technologies, was issued⁴. In 2012, the Working Party also published an opinion on revised guidelines on principles and recommendations for enhancing privacy and data protection in biometric applications⁵.

Notwithstanding, today, Directive 95/46/EC is considered no longer in force due to its replacement by the General Data Protection Regulation (GDPR), which has ushered in a new stage of development in the regulation of personal data. GDPR was adopted in 2016 and entered into force in 2018. GDPR, as well as Directive 95/94/EC, applies to all countries in the EU but does not require them to change their domestic laws. All organizations both inside and outside the EU must comply with the GDPR. Meanwhile, the GDPR requires organizations based outside the EU, which provide goods or services that track the behavior and process and store data of EU citizens, to identify their representatives in the EU. In turn, controllers and processors also have certain obligations. Controllers should always remember to follow the steps necessary for effective data protection; they should only process data that is within the scope of their duties and not allow access to it to anyone other than those who are obliged to process it (Nguyen, 2018).

In the parlance of regulators, the term biometric data first appeared with the introduction of GDPR. Article 4 characterizes biometric data as “personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person”⁶. It is worth noting that the GDPR foresees a category of special data requiring a higher level of protection, which also comprises biometric data. In accordance with Article 9, the processing of biometric data – the objective of which is to determine identity, health, or sexual life and orientation – is strictly prohibited, except under certain conditions. For example, the explicit consent of the subject allows for circumventing the above prohibition⁷ (Meden et al., 2021).

Finally, the EU AI Act, adopted in March 2024, is the most recent and highly relevant regulation to date that also applies to biometrics. Nowadays, AI has a tremendous impact on the advancement of biometrics technologies. In combination with biometrics, AI systems contribute to reducing human error and accelerating decision making (Rawat et al., 2023). Therefore, the EU AI Act incorporates several key considerations designed to regulate biometrics, including behavioral biometrics. Notably, this document covers the following aspects related to biometrics: biometric data, emotion recognition system, biometric categorization system, remote biometric identification system, real-time remote biometric identification system, and post-remote biometric identification system⁸. Among all of them, emotion recognition systems and real-time remote biometric identification systems refer to behavioral biometrics (Xefteris et al., 2016; Alsaadi, 2021; Revett, 2008). For example, an emotion recognition system aims to process characteristics such as gaze tracking, mood, facial movement and expression, gait, and heartbeat. In this regard, the EU AI Act imposes a ban on the use of emotion recognition technologies in the workplace and schools, on predictive policing if it is based on human profiling and personal characteristics assessment, and on AI that involves manipulation of people’s behavior or vulnerabilities. As for real-time remote biometric identification systems, this technology can be used subject to strict safeguards and limitations⁹.

2. Specific Features of Behavioral Biometrics Regulation in the European Union

2.1. Characteristics of the European Union’s Approach to Behavioral Biometrics Regulation

The approach that characterizes the regulation of biometrics in the EU can be considered as risk-oriented. Behavioral biometrics legislation is accompanied by strong restrictive measures intended to protect privacy and civil liberties and to combat bias and discriminatory technologies. Collecting, processing, and storing behavioral data is a riskier process, especially in comparison with other types of personal data (Rezaee, 2025). The point is that the accuracy of analyzing such data does not allow to fully determine a person’s identity but only reveals specific patterns related to his or her character and habits. It is important to consider that factors such as high stress levels or physical condition do not make it possible for behavioral biometrics to accurately capture a person’s behavior. In turn, more accurate profiling of characteristic behavior requires the collection of a significant amount of behavioral data. Furthermore, since behavioral data collection is always ongoing, it necessitates the storage of significant amounts of such information, which also poses additional risks to data privacy¹⁰ (Sharma & Elmiligi, 2022).

Behavioral biometrics are a relatively emerging technology that is actively gaining momentum today but still accompanied by certain challenges and risks. To mitigate them, the GDPR makes it compulsory to obtain data subjects’ consent to the handling and gathering of their biometric data, including behavioral ones. Previously, the GDPR had already classified biometric data as sensitive. However, the recently passed EU AI Act has expanded the categorization system by adding risk levels such as unacceptable risk, high risk, limited risk, low or minimal risk. To determine the level of risk, it is essential to ascertain the nature and the extent of AI application (Arcila, 2024). The category of unacceptable risk that prohibits use includes AI systems that imply social scoring based on behavior or personal traits and manipulation of people’s behavior or vulnerabilities. The use of real-time remote biometric identification is also not allowed, unless this technology can contribute to locating missing individuals, preventing life-threatening situations, including a foreseeable terrorist attack, and identifying criminal suspects. The emotion recognition system falls into the limited risk category, but its application is not allowed in educational institutions or the workplace except for medical or safety reasons¹¹.

2.2. Advantages and Disadvantages of the European Union’s Approach to Behavioral Biometrics Regulation

One of the advantages of the EU’s approach is that its regulatory experience has significantly influenced other countries that are creating and developing their own data protection and biometrics legislation. Greenleaf (2012) examined 39 countries outside Europe and found that there was a wide range of specific similarities with Convention 108 in the legislation of 33 countries. Some of the reasons for this phenomenon include the fact that countries are thereby demonstrating their commitment to become part of European privacy laws. Overall, Argentina, Cabo Verde, Mauritius, Mexico, Morocco, Senegal, Tunisia, and Uruguay decided to accede to Convention 108¹².

Convention 108+, which replaced Convention 108 in 2018, has also succeeded in becoming an influential benchmark in global data protection regulation practices. In addition to EU member states, the updated protocol was signed by the United Kingdom (then a member of the EU), Uruguay, Cabo Verde, Mauritius, Mexico, Senegal, and Tunisia. Furthermore, Argentina, Burkina Faso, and Morocco were also welcomed to the Convention 108+¹³. Nonetheless, it is the GDPR that has served as the primary benchmark for data protection regulation around the world. As of 2020, countries such as Brazil, Canada, and South Korea have enacted laws similar to the GDPR (Chen et al., 2022). Many African countries including Tanzania, Eswatini, Rwanda, Uganda, and Nigeria have established several new data protection regulations that contain common principles with the GDPR¹⁴. It is worth noting that not only countries but also organizations around the world have been impacted by GDPR requirements. Since the European regulation mandates strict data protection safeguards, organizations whose activities extend to European citizens have had to make significant changes to comply with GDPR (Li et al., 2019; Chen et al., 2022).

The EU’s approach to regulating biometrics, including behavioral biometrics, is distinguished by a robust degree of data protection and privacy. According to Article 9 of the GDPR, biometric data is classified as sensitive data requiring special protection and privacy requirements. This implies that, in general, the processing of such data is only permitted under strict compliance with certain conditions. For instance, it is imperative to acquire the explicit consent of the data subject – the individual whose data is being utilized. Furthermore, the GDPR has given data subjects the right to examine information held by organizations, and to withdraw consent for data collected by organizations. The obligations of an organization collecting and processing data from European citizens include expressing an interest in collecting personal information, justifying the reason to possess this information, and presenting their identity to data subjects. Overall, the GDPR requires organizations to limit data processing, as well as possession and transfer of data between platforms, providing appropriate means of protecting and disposing of data after a set period. It is becoming clear that the GDPR approach can be considered user-centered, which has a positive effect on individual responsibility, reducing security risks and increasing privacy measures (Aseri, 2020).

There are severe sanctions for violating the above biometric data policies. Generally, there are two levels of administrative fines for non-compliance with the GDPR: 1) up to 10 million euros or 2 % of annual global turnover, whichever is greater; 2) up to 20 million euros or 4 % of annual global turnover, whichever is greater. The amount of the fine is determined depending on the specific provisions of the GDPR; it will be less if data security is breached and more if people’s privacy rights are violated. For example, under the application of the GDPR, Meta¹⁵ was fined €1.2 billion by the Irish Data Protection Commission in 2023 for sending European users’ personal information to the US without proper data protection mechanisms. Before that, companies such as Amazon, TikTok, WhatsApp, Google, and others were also sanctioned¹⁶.

The most significant drawback of the European approach is the failure to categorize and be specific in some aspects. In particular, European regulators do not consider the point that different types of biometrics use different types of data; only behavioral biometrics collects data such as keystroke dynamics, mouse movements, touchscreen inputs, eye movements, gesture, and gait (Eberz et al., 2017; Cheung & Vhaduri, 2020). Instead, the European legal framework contains only generic interpretations and guidelines pertaining to physical, psychological, and behavioral features. This shortcoming can be traced both in the past, meaning Convention 108 and Directive 95/46/EC, and up to the present, referring to Convention 108+, GDPR, and EU AI Act. The fact is that the dynamic nature of behavioral data, which does not allow it to be forecasted, modeled, or fabricated as easily, makes it non-adaptable and unsuitable for current EU regulations that cover only physical biometrics. Companies and financial institutions located in the EU, which have already started a consistent implementation of behavioral biometrics, are still guided by regulations for collecting people’s physical data¹⁷ (Kindt, 2018).

The problem of vagueness is also evident in other important provisions of regulations concerning the use of biometrics. For example, the GDPR does not make a significant distinction between the primary comparative functions of biometric technologies, specifically between ‘verification’ and ‘identification.’ Verification involves the use of biometric data on a one-to-one (1:1) basis, while ‘identification’ involves a one-to-many (1:n) basis. It is worth noting that, according to the Council of Europe and national data protection supervisory authorities, the verification function is more secure than the identification method because it does not involve a database. In contrast, the use of biometric identification requires extensive collection and storage of biometric information in databases. Also, it should be noted that biometric identification introduces further risks due to probability-based matching, which adversely affects the level of accuracy. Accordingly, European regulators should objectively consider the relative risks of both verification and identification while introducing appropriate rules for the application of the two main functions of biometric technologies¹⁸.

3. Comparative Analysis of the European Union’s Approach to Regulating Behavioral Biometrics and the US Experience

To better comprehend the regulatory landscape for behavioral biometrics in the EU, it may be useful to examine the experience of the United States and compare it with the EU’s approach. Most notably, the United States differs from the EU in the way that, instead of unified national legislation as in the EU, biometrics are regulated at the state level¹⁹.

Numerous states, including Illinois, Texas, and Arkansas, have various laws aimed at regulating biometrics and biometric data. To begin with, it is worth noting Illinois, which introduced the Biometric Information Privacy Act (BIPA) in 2008, becoming the very first state to start regulating the collection, use, and storage of biometric data. Under BIPA, companies are obliged to acquire written consent from data subjects prior to collecting their biometric information and to limit scanning methods such as retinal or iris scanning, fingerprinting, voiceprints, or facial and hand geometry scanning. In other words, other biological and behavioral data are not considered biometric identifiers under this law (Illman, 2017). Texas provides similar definitions of biometric identifiers related to biometrics in its 2009 law under Section 503.001²⁰.

The State of Arkansas has enacted the Biometric Data Act, which focuses solely on biological parameters, thereby excluding behavioral data. This regulation defines biometric data as information about a person’s biological characteristics, such as fingerprints, facial or eye scans, DNA, and other unique biological features utilized for identification purposes²¹.

Among the various interpretations of biometric data in different United States laws, the California Consumer Privacy Act (CCPA) of 2018 notably broadens the understanding of biometric data. Under the CCPA, biometric information comprises “physiological, biological, or behavioral characteristics of an individual, including DNA, that can be used alone or in combination with other data to establish individual identity.”²² This encompasses not only traditional biometric identifiers but also behavioral patterns such as keystrokes, gait rhythms, sleep habits, health, or exercise data that can identify a person²³. Distinctively, under the CCPA, citizens of the State have greater visibility and control over their biometric data, including the rights to general disclosure, requests for information, deletion of information, and “equal service and prices” (Ghelardi, 2020).

Additionally, The American Privacy Rights Act of 2024, successor to the American Data Privacy and Protection Act of 2021, aims to establish clear national data rights and protections. The legislation was introduced by lawmakers in both the House and Senate in April 2024, and was approved by the Subcommittee on Data, Innovation and Commerce a month later. Now, it will have to pass through a full committee and both houses of Congress prior to potentially gaining enactment into law. This legislation defines biometric information as data derived from the technological processing of unique biological, physical, or physiological characteristics, including fingerprints, facial scans, and gait, among others. Importantly, the bill was modeled on the GDPR operating within the EU²⁴.

In comparison with the EU legislation, the American one is less elaborated. Laws are not adopted at the federal level, but at the state level, which indicates the need for a more comprehensive approach (Neace, 2020). It also becomes apparent that these regulations, like those in the EU, do not clearly distinguish between physical and behavioral biometrics. While some laws mention behavioral characteristics, there is still no explicit legislative definition or regulation of behavioral biometrics within these frameworks. Consequently, issues related to behavioral biometrics remain inadequately addressed, requiring further legislative attention and development. Moreover, the need to focus closely on behavioral biometrics, including characteristics such as hand movements and gaze direction, has been clearly articulated by the executive branch under President Joe Biden’s Executive Order on Artificial Intelligence²⁵.

Conclusions

To sum up, the regulation of behavioral biometrics within the EU has evolved significantly, shaped by key legislative frameworks such as Convention 108, Directive 95/46/EC, and most recently the 2018 General Data Protection Regulation and the 2024 EU AI Act. These regulations have established a solid foundation for protecting personal data, especially biometric data categorized as sensitive information. The introduction of the GDPR’s definition of biometric data and its strict rules for processing has set a global standard, influencing not only European countries but also legal practices across the world. However, certain challenges remain, for example, in distinguishing between physical and behavioral biometrics and in addressing the complexities of biometric technologies like verification and identification.

Comparing the EU’s approach to the United States’ approach highlights the EU’s more comprehensive and unified regulatory framework, in contrast to the fragmented state-level laws in the US. Although the US has made progress through state regulations such as Illinois’ Biometric Information Privacy Act (BIPA) and the more recent American Privacy Rights Act, the lack of the unified national approach raises concerns. For instance, behavioral biometrics are still inadequately addressed in the US. As technologies such as AI continue to evolve and become increasingly interconnected with biometric technologies, it is important to highlight that the EU and the US should continue to strengthen their regulations to safeguard personal data and promote the ethical use of biometrics. Yet given the novelty of behavior biometrics, further research of legal regulation of personal data is required.