The Gist: Humpty Dumpty's Wall of Biometric Bamboozlement

This week Jim O'Callaghan, the Minister for Justice, stood up and explained why his plan to give the Garda Síochána powers to use AI to surveil the public didn't need the safeguards set down in EU law.

You see, he said, all of those EU limits were on the use of "biometric identification". But he had invented a unique new Irish activity called "biometric analysis" that didn't have any of those pesky protections.

This was all delivered in the style of a fellow sitting on a wall in Wonderland.

"‘When I use a word,’ Humpty Dumpty said in rather a scornful tone, ‘it means just what I choose it to mean — neither more nor less.’"

Illegal laws

The AI Act (EU Regulation 2024/1689) defines Biometric Identification in Article 3.35.

(35) ‘biometric identification’ means the automated recognition of physical, physiological, behavioural, or psychological human features for the purpose of establishing the identity of a natural person by comparing biometric data of that individual to biometric data of individuals stored in a database;

You'll notice that the definition does not say that you're only 'identified' if a database has your name. What matters is that you've matched the biometric data from Data Source A to the biometric data from Data Source B. In other words, identification doesn't need the machine to say "This face belongs to Simon McGarr". It just needs to say "This picture of a face matches this other picture of a face."

But Section 43A in the Minister's new Bill tries to rewrite the definition of Biometric Identification, so that it is limited to times where you do have a name.

"‘biometric identification’ means, in relation to an individual, the automated recognition of physical, physiological or behavioural human features for the purpose of ascertaining, or attempting to ascertain, the identity of an individual by comparing biometric data of the individual to biometric data stored in a database of one or more named individuals" (emphasis added)

He's just invented that need for the reference database to be of named individuals from whole cloth.

Now let's look at what he says his novel Irish idea of 'Biometric analysis' will do.

"To put it in the simplest terms, biometric analysis is trying to identify unidentified individuals and figure out whether that person there is the same as the person on the other screen. That is what analysis is."

Buddy. That is the same thing that the AI Act has already defined as biometric identification.

This is the Minister's Humpty Dumpty manoeuvre.

They have Previous

We have, of course seen this semantic shell game being played before. When it was pointed out that the Department of Social Protection had no legal basis for their processing of Biometric data in the Public Services Card, the then Minister Regina Doherty was emphatic;

"We don't collect biometric data. We collect and store photographs." She went further, just to ram the point home. She said the Department "does not ask for or collect biometric data from its customers such as fingerprints, retinal scans or any other items that could be listed as biometric data".

The Minister said she was using facial matching technology on the photographs that sat on the front of every single PSC card. But also she said that the Department didn't collect facial recognition data.

This was a difficult position, in the same way that arguing the sky is green is a difficult position, as exactly these actions are what is defined as processing biometric data by Article 4(14) of the GDPR.

But, as I pointed out a year ago today, after the DPC had hit the Department with the biggest fine ever levied against the State for illegally building a biometric database;

The Minister's position relied on simply denying what words meant.

But at the same time she was saying this, the Department was changing its own references to processing biometric data in its Privacy notice- an action taken on the instruction of its Secretary General when its Data Protection Officer was 'on leave'.

And it was awarding one of the PSC contracts to manufacture the PSC cards to a company called Biometric Card Services.

It was also tendering for the transfer of millions of biometric facial images, while the Minister was asserting it didn't collect biometric data.'

It's not that they didn't know what they were doing. They just had to keep refusing to admit it.

Of course, by the time of the long-delayed DPC decision, the Minister had left her job and gone to the European Parliament and has never faced any questions about her denial of reality.

Similarly, Jim O'Callaghan doesn't intend to be the Minister for Justice when the music stops and the otherwise legitimate prosecutions that relied on this law fall on their arse without a chair beneath them.

That will be someone else's problem.

The Ballad of Biometrics

In both cases, the Ministers have tried to hide inside the details of technical and legal language, and the general unfamiliarity of both the general public and other TDs with what the meaning of the difficult sounding word 'biometric' is.

So, let us travel together through the relevant bits of these laws so that we may immunise ourselves against the virus of bamboozlement. Consider this like the songs in Tolkien. It's here if you want it, but you can always skip to the next bit if you're not in the mood.

We'll start with the Bill the Minister was pushing through the Seanad this week. This is the Garda Síochána (Recording Devices) (Amendment) Bill 2025. It's intended to add a new section to the pre-existing Part 6 of the Garda Síochána (Recording Devices) Act 2023. Back in the distant past of 2023, the government recognised there were limits to what law enforcement could do when accessing and analysing live feeds from CCTV. Part 6 of that 2023 sets out the rules, including the need to get prior authorisations from a court (Section 39).

Our Minister's new bill will insert a fresh Part 6A into that dusty old 2023 law with a brand new activity he has invented, just for Irish law, of "biometric analysis".

"43A. In this Part—
‘biometric analysis’ means any or all of the following:
(a) in relation to individuals generally, the automated recognition and
categorising of instances of physical, physiological or behavioural
human features by the use of specific technical processing of
documents obtained by An Garda Síochána in the course of an
investigation;

(b) in relation to a particular, but unidentified, individual, the
automated recognition and categorising of physical, physiological
or behavioural human features by the use of specific technical
processing of documents obtained by An Garda Síochána in the
course of an investigation, in respect of instances of the particular
unidentified individual;

(c) in relation to a particular, identified, individual, the automated
recognition and categorising of physical, physiological or
behavioural human features by the use of specific technical
processing of documents obtained by An Garda Síochána in the
course of an investigation, in respect of instances of the particular
identified individual for the purpose of localising that particular
identified individual;

but does not include biometric identification;"

Emphasis on that last line, as they say, added.

During the Seanad debate the Minister complained that he was getting criticised for not following EU law when

"Sometimes the criticism is that we just adopt everything that is happening in Europe."

This is a strange thing for a Minister for Justice, and a lawyer, to say, given that we are obliged by EU Treaties and our own Constitution to adopt EU law domestically.

So let's head over to EU law, a superior and binding class of law to domestic legislation, to see what the Minister is proud not to have adopted.

The AI Act (EU Regulation 2024/1689) sets out the accepted uses and limits on the use of AI in processing data. And it sets out a special category of processes as 'High Risk' in Annex III of the regulation. And the very first of those high-risk processes?

High-risk AI systems pursuant to Article 6(2) are the AI systems listed in any of the following areas:

1. Biometrics, in so far as their use is permitted under relevant Union or national law

In particular, Recital 54 says that "Remote biometric identification systems should therefore be classified as high-risk in view of the risks that they pose."

Recital 95 sets out the problem with the use of AI on CCTV footage which the Minister's Bill proposes to introduce:

"considering the intrusive nature of post-remote biometric identification systems, the use of post-remote biometric identification systems should be subject to safeguards"

And in Article 26.10 of the AI Act the general need for prior judicial oversight as the key safeguard on this intrusive technology is set down;

"the deployer of a high-risk AI system for post-remote biometric identification shall request an authorisation, ex ante, or without undue delay and no later than 48 hours, by a judicial authority or an administrative authority whose decision is binding and subject to judicial review"

OK, that's enough Elf Songs. Let's get back to the plot.

Scofflaw As A Service

During the Seanad debate, the Minister outlined what his real idea was in all of this.

By introducing this baseless carve-out from the protections given to citizens to misuse of AI by the police he would give courts and police an excuse to avoid the judicial oversight EU law has required.

"The court and the garda will not be going to a definition of “biometric analysis” or “biometric identification” in the AI Act. For the purpose of this legislation, it is the definition of “biometric analysis” set out here.

The part of the legislation we are discussing here is called the carrying out of biometric analysis by members of the Garda Síochána. What is clear from a plain reading of this legislation, if enacted, is that it establishes a distinction between "biometric analysis" and "biometric identification".

Irrespective of what the AI Act says, here we are establishing a distinction between the two and only biometric analysis is permitted in this legislation."

Irrespective of what the AI Act says?

That is the wall Humpty Dumpty has decided to balance on. He will pass his law irrespective of the actual terms of the AI Act, and if it falls later he doesn't intend to be there to see it.

The mad yoke.