  This article sheds light on legal implications and challenges surrounding
emotion data processing within the EU's legal framework. Despite the sensitive
nature of emotion data, the GDPR does not categorize it as special data,
resulting in a lack of comprehensive protection. The article also discusses the
nuances of different approaches to affective computing and their relevance to
the processing of special data under the GDPR. Moreover, it points to potential
tensions with data protection principles, such as fairness and accuracy. Our
article also highlights some of the consequences, including harm, that
processing of emotion data may have for individuals concerned. Additionally, we
discuss how the AI Act proposal intends to regulate affective computing.
Finally, the article outlines the new obligations and transparency requirements
introduced by the DSA for online platforms utilizing emotion data. Our article
aims at raising awareness among the affective computing community about the
applicable legal requirements when developing AC systems intended for the EU
market, or when working with study participants located in the EU. We also
stress the importance of protecting the fundamental rights of individuals even
when the law struggles to keep up with technological developments that capture
sensitive emotion data.
