Deleuze replied: IRIS may be legally permissible, but only if the collection of facial imagery and heart-rate data is strictly necessary, proportionate, transparent, secure, and demonstrably linked to the safety purpose of fatigue detection. Under the EU AI Act, the provider must document representative data governance, bias testing, risk management, human oversight, accuracy, robustness, and cybersecurity. Under GDPR, the controller must separately justify the processing of biometric or health-related data under Articles 6 and 9, minimise data use, prevent secondary use, and protect drivers from discriminatory or unsafe outcomes.

Deleuze replied: A first legal nuance is important: facial images are not automatically special-category biometric data under GDPR. They become biometric data in the Article 9 sense where they result from specific technical processing relating to physical, physiological, or behavioural characteristics and are used to allow or confirm unique identification. Heart-rate data, however, is more likely to fall within health data if it reveals information about the driver’s physical or mental health status. GDPR Article 4 defines both biometric data and health data in this way. Assuming IRIS’s processing does fall within Article 9, the first issue is that processing is prohibited unless a specific Article 9 exception applies, in addition to a normal Article 6 lawful basis. The controller cannot simply rely on a privacy policy or general user acceptance. It must identify a valid legal basis, such as explicit consent, employment/safety law obligations, substantial public interest, or another applicable condition. GDPR also allows Member States to impose additional conditions for biometric and health data. Under the EU AI Act, IRIS would likely be treated as high-risk if it is used as a safety component of a regulated vehicle product or otherwise materially affects driver safety. Article 6 classifies AI systems as high-risk where they are intended to be used as safety components of products covered by EU harmonisation legislation and subject to conformity assessment. The most critical AI Act issue is data governance. Article 10 requires high-risk AI systems to use training, validation, and testing datasets that are relevant, sufficiently representative, as complete and error-free as possible, and appropriate to the specific context of use. For IRIS, this means the provider must document and test whether facial imagery and heart-rate data are representative across driver demographics, lighting conditions, skin tones, age groups, gender, facial characteristics, glasses, hats, medical variation, and real-world driving contexts. Article 10 is especially relevant because it allows providers to process special-category personal data only exceptionally for bias detection and correction, and only where strictly necessary. The provider must show that bias detection cannot be effectively achieved using other data such as anonymised or synthetic data; must apply technical limits on reuse; must use security and privacy-preserving measures such as pseudonymisation; must restrict access; must avoid onward transfer; and must delete the data once the bias has been corrected or the retention period ends. This creates a practical obligation for IRIS: it cannot collect sensitive biometric or physiological data on a “just in case” basis. The company would need to justify why each data type is necessary, why less intrusive alternatives are insufficient, and why the same safety goal cannot be met through local processing, non-identifying features, steering behaviour, eyelid metrics without identity recognition, or anonymised/synthetic data.