The organisation should develop and maintain a clear and easily understandable notice for individuals exposed to an emotion recognition or biometric categorisation system. This notice must explicitly inform them of the system’s operation, its purpose and the processing of their personal data.
A process should be documented and implemented to ensure this information is provided in a timely and accessible manner, appropriate to the deployment context. The process should align with applicable Union data protection legislation, including Regulation (EU) 2016/679, Regulation (EU) 2018/1725 or Directive (EU) 2016/680, as relevant.
Where the system is used for the detection, prevention or investigation of criminal offences under applicable law, the organisation should document the legal basis and safeguards relied upon when assessing the applicability of this obligation.