The objective for requiring prior authorisation (‘authorisation ex ante’)for any use of a ‘real-time’ RBI system in publicly accessible spaces for law enforcement purposes is the need for an assessment and a decision as to whether any envisaged use of such a system for such purposes is:
- necessary and proportionate to achieve any one of the objectives listed in Article 5(1)(h)(i) to (iii) , i.e. for the targeted search of specific victims, the prevention of specific threats, or the localisation or identification of offenders; and
- limited to what is strictly necessary concerning the time period and the geographic and personal scope.
The consequence of th ese requirements is that a double necessity and proportionality assessment should occur prior to the deployment of any real-time RBI system in publicly accessible spaces for law enforcement purposes . First, an assessment should be made by the user when performing a FRIA , as required by Article 5 (2) AI Act. Second, in accordance with Article 5(3) AI Act,a judicial or independent administrative authority must also assess the necessity and proportionality of using such a system within the limits of the national law providing the legal basis for any such use, taking the Charter and other Union law into consideration. As a consequence, any such system may only be used 1) after a FRIA and 2) when the competent national authority has authorised such use.
Article 5(3) AI Act must be read and understood in conjunction with Article 5(5) AI Act: for the use of a real-time RBI system to be authorized, a national law adopted in the Member States concerned must exist authorising such use.217 Certain Member States already have a system of prior authorisation in place for the use of biometric systems under other Union or national law, such as data protection law.