Prohibitions § 10.2.2.2

The authorisation may only be granted by a judicial or an independent administrative authority whose decision is binding.

The CJEU has interpreted the concept of ‘independence’ in different contexts. In HK v Prokuratuur, for example, the CJEU explained that independence means that the authority maintains a‘neutral stance’.²²² The CJEU specified that an authority involved in previous investigations, in that case the public prosecutor, does not have such independence. Similar considerations may apply as regards the independence required by Article 5(3) AI Act, implying that the authorising authority needs to be independent from the authority using the RBI system. This would apply not only for the police, but also cases of investigative judges or prosecutors that supervise the work of police and the use of RBI for which authorisation is sought.

In Commission v Poland , a case dealing with the question when a body can be considered to be independent in the context of railway safety, the CJEU found that, ‘as regards public bodies, independence usually refers to a status that ensures that the body in question is able to act completely freely in relation to those bodies in respect of which its independence is to be ensured, shielded from any instructions or pressure’.²²³ Similar indications may apply in the context of Article 5(3) AI Act.

The judicial authorities in a democratic society are in general also independent authorities. The judiciary plays an important role when it is independent from the executive government(s) and from the legislator, covering and reviewing the application of the legislation and fundamental rights and freedoms in an autonomous and independent way. Judicial independence is one of the crucial facets of the rule of law and is guaranteed by Article 47 (Charter) and Article 6(1) ECHR.²²⁴

The authorisation must be addressed to the authority that is competent according to national law.²²⁵

Any authorisation to use real-time RBI in publicly accessible spac es for law enforcement purposes must assess whether the requirements of Article 5(3) AI Act have been met. Highly intrusive

In the data protection context, the use of biometric data, in particular facial recognition technology, has been considered by the European Data Protection Board (EDPB) in its Guidelines 5/2022 and the European Data Protection Supervisor (EDPS) as affecting several fundamental rights and freedoms. That view is shared by The EU Agency for Fundamental Rights and by the Council of Europe . ²²⁶ Both the CJEU²²⁷ and the ECtHR²²⁸ have confirmed the sensitive nature of processing biometric data.

Any interference in fundamental rights and freedoms must always respect the essence of the rights and freedoms. This follows from Article 52(1) Charter.

The notion of ‘essence’ of fundamental rights and freedoms has been developed in the CJEU’s case-law and is an independent value in the Union’s legal order. If the essence of a fundamental right or freedom is not respect ed, it means that a right or freedom is unduly touched by a measure so that no interference shall be allowed upfront. Only ‘if necessary and proportionate’

Any interference with fundamental rights and freedoms requires ‘a law’that should in principle respect the necessity and proportionality pursuant to Article 52 Charter. (See below under Article 5(5) AI Act.) Article 5(3) AI Act requires that the national law permitting the use of real-time RBI in publicly accessible spaces for law enforcement purposes must provide that authorisation for such use is pe rmitted ‘only where it [the authority] is satisfied [..] that the use is necessary for, and proportionate to, achieving one of the objectives specified ’ in Article 5(1)(h) AI Act. National authorities need to verify whether the biometric identification is strictly necessary .²²⁹ This assessment should be based on the FRIA that should have already include an assessment of the necessity and the proportionality in a general manner prior to requesting the authorisation for each use with the specific circumstances.