The case, explained

AI Regulation and Biometrics: The Legislative Path Between Security and Privacy

6 min read · Updated July 2026 · Editorial oversight: Avv. Federico Papa

The issue of real-time facial recognition in public spaces represents one of the most contentious battlegrounds between public safety requirements and the protection of fundamental rights. According to press reports over recent years, attempts by law enforcement authorities to implement biometric surveillance systems have triggered a complex regulatory process aimed at balancing crime prevention and suppression with individual liberty, reaching a crucial phase of European framework implementation. In this analysis, we reconstruct the key stages of this development, from the blocking measures issued by national authorities to the final adoption of Regulation (EU) 2024/1689. Through the analysis of a specifically constructed twin case, we examine how the new Artificial Intelligence (AI) rules will impact law enforcement operations and the limits imposed on technology to prevent forms of indiscriminate mass surveillance.

In brief

The article analyzes the regulatory evolution of biometric surveillance in Italy. Starting from the suspension of the SARI Real Time system and the 2021 national moratorium, it examines the impact of the European AI Act, which prohibits real-time remote biometric identification except for strictly enumerated exceptions. Through a hypothetical case, it illustrates impact assessment obligations and the strict requirement for national statutory authorization when using these technologies in judicial and public safety contexts.

  1. The fact

    The case stems from the Ministry of the Interior's attempt to introduce the SARI Real Time system for automated facial recognition. According to news agency reports, in March 2021, the Italian Data Protection Authority issued a negative opinion, blocking the initiative due to the lack of a suitable legal basis and the violation of the principle of proportionality.

    Subsequently, through the so-called Decreto Capienze (D.L. 139/2021), the legislature imposed a moratorium on the use of such systems until December 31, 2025. Following the final approval of the AI Act in May 2024, the framework entered an institutional adaptation phase: Italy must now define the procedures for exercising the derogations provided for the prevention and suppression of serious crimes and security threats.

  2. The rules at play

    The cornerstone of the European framework is Regulation (EU) 2024/1689 (AI Act). Article 5 prohibits the use of real-time remote biometric identification (RBI) systems in publicly accessible spaces, allowing exceptions only under strictly defined and exhaustive conditions. These derogations must comply with Article 9 of the GDPR, which protects biometric data as special categories of personal data.

    At the national constitutional level, Articles 13 and 15 of the Constitution on personal liberty and secrecy of communications are key, imposing a strict statutory reserve: only Parliament may authorize limitations on fundamental rights. Finally, the Data Protection Code (D.Lgs. 196/2003) requires a specific primary legal basis for any data processing carried out by public authorities for statutory purposes.

  3. What case law says

    Jurisprudence and supervisory authorities have established strict principles. The Data Protection Authority clarified that indiscriminate biometric surveillance is fundamentally incompatible with the data minimization principle. The Court of Justice of the European Union has reiterated that any monitoring measure must be strictly limited to what is strictly necessary and grounded in objective, verifiable criteria.

    Furthermore, the European Court of Human Rights has emphasized that widespread facial recognition can generate a deterring effect, the so-called *chilling effect*, discouraging citizens from exercising their civil and political rights in public spaces.

  5. Analysis drafted and verified with edit.legal

    To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

    Try edit.legal AI

  8. What it teaches professionals

    First, it highlights the strict obligation to conduct a prior Data Protection Impact Assessment (DPIA) before deploying AI systems. Second, professionals must verify compliance with the statutory reserve, as in the Italian legal system the deployment of remote biometric technologies cannot rely on mere local administrative resolutions.

    Finally, it is crucial to distinguish between ex-post identification, which is permissible within ordinary criminal investigations subject to procedural rules, and real-time identification, which is subject to a special authorization regime and exceptionally narrow prerequisites.

References: Regolamento (UE) 2024/1689 (AI Act)Regolamento (UE) 2016/679 (GDPR)Decreto Legislativo 196/2003 (Codice Privacy)Articoli 13 e 15 Costituzione ItalianaD.L. 139/2021 (Decreto Capienze)

Related cases

22/07/2026Beach Concessions Case: Plenary Assembly on Title Expiration15/07/2026Legitimacy and nature of the Milano-Cortina 2026 Foundation: between private law and public control07/07/2026Landscape Protection in South Tyrol: The Constitutional Court to Decide
Avv. Federico Papa
Editorial oversight: Avv. Federico Papa·ICAM

Frequently asked questions

What are the penalties for unlawful use of biometric AI?

The AI Act establishes severe administrative fines, reaching up to 35 million euros or 7% of total global annual turnover for the most serious violations, without prejudice to civil liability and statutory damages.

Is facial recognition always prohibited for law enforcement?

No. However, 'real-time' use is restricted to exhaustive cases (counter-terrorism, search for crime victims, prevention of specified serious offenses) and requires prior authorization by a judicial or independent authority, except in extraordinary cases of extreme urgency governed by law.

What remedies are available to a citizen suspecting unlawful biometric surveillance?

Citizens may lodge a complaint with the Data Protection Authority or initiate judicial proceedings before the ordinary courts to obtain an injunction against processing, deletion of data, and compensation for damages suffered.

Verified legal research and drafting with edit.legal

Legal research and drafting with citations checked against official databases. edit.legal is free to try, no credit card.

Try edit.legal for free