Without prejudice to paragraph 3, each use of a ‘real-time’ remote biometric identification system in publicly accessible spaces for law enforcement purposes shall be notified to the relevant market surveillance authority and the national data protection authority in accordance with the national rules referred to in paragraph 5. The notification shall, as a minimum, contain the information specified under paragraph 6 and shall not include sensitive operational data.
Each use of an RBI system pursuing one of the objectives listed in Article 5(1)(h)(i)-
AI Act must be notified to the relevant market surveillance authority and the national data protection authority. Notification must take place after each use in order to be able to report about the number of authorisations and their result. The notification does not need to include sensitive operational data. According to Article 3 (38) AI Act, ‘sensitive operational data’ means operational data related to lawenforcement activities (prevention, detection, investigation or prosecution of criminal offences), the disclosure of which could jeopardise the integrity of criminal proceedings.
For the details on the reporting requirement, see section 10.6 below.