Article 5(3 ) AI Act further provides that if an authorisation request in the case of urgency is rejected, the use of the real-time RBI system should be ceased with immediate effect. In such cases, all the data, including the results and outputs of that use, must be immediately discarded and deleted.231 Article 5(3) AI Act is explicit in this regard, without exception. The deployer will have: a) a reference database, containing the biometric information ( e.g., facial images, voice snippets, ….) and related identifying information, if applicable, against which b) captured biometric information from individuals present in the publicly accessible space is compared to identify and single out those individuals. c) This comparison will lead to the comparison result.
The requirement to discard and delete the data collected and processed also means that the reference database(s) used for the unauthorized biometric identification must be removed and deleted if it was built specifically for the contested search. Only where the law enforcement authorities had built and intended to maintain the database used for identification in a lawful manner for legitimate aims other than for the unauthorized use of real-time RBI may the database be maintained.
Besides the deletion of any (unlawful) database with biometric information, all the collected images and other personal data, including the meta data, technical processing data, including the templates and other personal data, and other comparison-and output data obtained during the unlawful use of the real-time RBI system must also be deleted.
Where the law enforcement authority challenges the rejection, the data may be kept by a trustee until a final decision has been taken on the request. During that period, those data should normally not be placed at the disposal of the law enforcement authority.310