Prohibitions § 10.2.2.1

Whilst not specified, it may be assumed that the request will normally be initiated by the deployer, i.e. by the competent (law enforcement) authority . According to the definition of law enforcement authority under Article 3(45) b) AI Act, any ‘other body or entity entrusted by Member State law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security’ is considered a law enforcement authority and could also be the responsible as the ‘competent authority’ for submitting the request for prior authorisation.

The use of a real-time RBI system for activities falling outside the scope of the AI Act does not need to be authorised under Article 5(3) AI Act. If subsequently such a system is being used for law enforcement purposes, the use would fall within the scope of the AI Act and an authorisation would be requiredwhere the requirements of Article 5(1)(h) AI Act are met.

Prior authorisation is needed for the use of ‘realtime’ RBI systems in publicly-accessible spaces for law enforcement purposes, even if the systems are operated by other parties on behalf of law enforcement authorities , for example sport clubs or shopping malls. For example,

• An organisation entrusted with resources for searching for missing children decides to use a real-time RBI system . It has no mandate to exercise public authority and public powers or for preventing criminal offences or tasks for the prevention of threats to public security. Such use does not fall under the prohibition laid down in Article 5(1)(h) AI Act, since it is not for law enforce ment purposes. That system will, however, be categorised as ‘high-risk’ (point 1 (a) of Annex III) and a requirement of prior consultation of the su p ervisory data protection authority may be necessary pursuant to Article 36 GDPR. Depending on the applicable national law and whether one of the exceptions to Article 9(1) GDPR applies, a prior authorisation may also be required for such processing. By contrast, if the same organisation were requested by law enforcement authorities to act on theirbehalf for the search of missing children in a law enforcement contextand under the supervision and instructions of the competent law enforcement authorities, prior authorisation would be needed pursuant to Article 5(3) AI Act.
• A private organisation entrusted with providing resources to aid persons who risk becoming victims of a natural disaster²²⁰ decides to use a real-time RBI system for that purpose. Such use does not fall under the prohibition laid down in Article 5(1)(h) AI Act, since it is not for law enforcement purposes. That system will, however, be categorised as ‘high-risk’ (point 1 (a) of Annex III) and a requirement of prior consultation of the supervisory data protection authority may be necessary pursuant to Article 36 GDPR. Depending on the applicable national law and whether one of the exceptions to Article 9(1) GDPR applies , a prior authorisation may also be required for such processing.

In accordance with Article 5(3) AI Act, prior authorisation is needed for ‘each use’. This implies that the decisive moment for obtaining such authorisation is not the moment prior to installing real-time RBI systems, but each concrete use thereof. For example,

• the police install biometric ready CCTV cameras at the main train station of a city (no authorisation under the AI Act is needed, but the biometric system must comply with the requirements on high-risk systems, a FRIA must be prepared prior to the first use and an individual authorisation by a judicial or independent administrative authority is needed before each individual use of the system). The police has concrete indications that a terrorist will arrive by train in the town (prior authorisation is needed for real-time identification).

Article 5(3) AI Act requires each individual request for the use of real-time RBI to be ‘reasoned’ and hence substantiated and motivated.

Certain Member States allow such requests to be submitted online.²²¹ In accordance with Article 5(5) AI Act, national legislation should lay down requirements regarding the exact content of the request , while fully taking into account the requirements outlined above , including sufficient evidence to determine the strict necessity and proportionality for the use of real-time RBI and other relevant aspects to reflect the exceptional nature of authorising such use.