Incomplete requirement for EAA "alternative to biometrics"

EAA Annex I(I)(2)(l)

The product shall provide an alternative to biometrics identification and control

Currently in EN 301 549

In the 2025-02-07 draft:

5.3 Biometrics

Where ICT uses biological characteristics,

it shall not rely on the use of a particular biological characteristic as the only means of user identification or for control of ICT.

NOTE 1: Alternative means of user identification or for control of ICT could be non-biometric or biometric.

NOTE 2: Biometric methods based on dissimilar biological characteristics increase the likelihood that individuals with disabilities possess at least one of the specified biological characteristics. Examples of dissimilar biological characteristics are fingerprints, eye retinal patterns, voice, and face.

Issue

Products and services can meet the current EN 301 549 requirement while failing the EAA requirement.

• Clause 5.3 requires either an alternative to biometrics, or biometric methods based on dissimilar biological characteristics.
• EAA is more stringent, requiring simply an alternative to biometrics.

Proposed

Update the existing clause 5.3 or add a new, more stringent clause.

Good observation!

While this EAA requirement is only for products, the user need is probably identical regardless of category of ICT.

If so, I guess the most straightforward way to match the EAA would be to change clause 5.3 to something like this:

5.3 Biometrics

Where ICT uses biological characteristics,

it shall not rely on the use of a particular biological characteristic as the only means of user identification or for control of ICT.

NOTE 1: Alternative means of user identification or for control of ICT could be non-biometric or biometric.

NOTE 2: Biometric methods based on dissimilar biological characteristics increase the likelihood that individuals with disabilities possess at least one of the specified biological characteristics. Examples of dissimilar biological characteristics are fingerprints, eye retinal patterns, voice, and face.

But if the EAA requirement is only to be applied to products, then perhaps the existing 5.3 can remain unchanged as 5.3.1, while a new 5.3.2 should be added, similar to the above modified version, but with a precondition pointing out products.

added EAA Alignment label

I think your suggestion Par is correct.

Except for you comment about products. All ICT are products unless they are given away free.

so I think it means we must change 5.3 to simply

5.3 Biometrics
Where ICT uses biological characteristics,
the ICT shall not rely on the use of a biological characteristic as the only means of user identification or for control\

NOTE 1: Some examples of biological characteristics are fingerprints, eye retinal patterns, voice, and face.

Be careful about the word "product". A lot of ICTs are apps tied to services, and that doesn't fit the European rules around products. For example, in Europe products have to carry the CE mark either on their own casing or on the packaging in which they were sold. You just can't do that for an app or any other downloaded software since neither exists. Yes, this is an artefact of evolving technology that the law did not anticipate, but the law hasn't completely caught up and using the word "product" can imply things that really don't apply. I'm not saying you are wrong, just that we have to be VERY careful with how we use words that carry other implications. CEN/CENELEC JTC25 are currently trying to determine what a "data product" means, and that is more tied to a data object that carries a digital licence that describes how it can be used and who by. Also running into "product" implications. So just be careful. Probably better to avoid the term unless we really need it, or be VERY clear on it.

@jeffreym Unghhhhh. Good point.

it is so hard when legislation re-defines common terms to mean something other than what they mean (more limited or broader - both)

Hmmm on the suggested language I don't use products so I think that will fly. And as long as our coverage covers their "products" I think we are ok. Yes? No?