guidance

Prohibitions § 10.4.3

Detailed national law on the authorisation request, the issuance and the exercise

Official source ↗

(416)

As regards the detailed rules that apply for the request, the issuance and the exercise of the authorisation, these are to be determined by national law. Each Member State that wishes to allow the use of the systems at issue must specify in its national laws such rules, which are aimed at providing relevant and complete information as to the use of real-time RBI systems to the authorising authority to enable it to decide as to the strict necessity and proportionality of such use. The national law permitting the use of real-time RBI systems may regulate for example,

  • who are the competent authorities subject to Article 5(1)(h) AI Act and the independent authorities in the M ember State competent for issuing (or refusing) an authorisation;
  • the detailed scope of the objectives for which real-time RBI in publicly accessible spaces may be used for law enforcement purposes (without going beyond the objectives listed in Article 5(1)(h) (i) to (iii), but possibly narrowing them further down;
  • providing that requests shall be in writing and requiring a detailed explanation of the specific use and the intended purpose of use for a specific criminal offence/situation which justifies its use;
  • the requirement of motivation and the submission of supporting evidence (and need of translation if relevant) for justifying the use of the system pursuing the objectives listed in Article 5(1)(h)(i) to (iii) AI Act , in particular relating to place, peri od , and personal scope and justifying the strict necessity and proportionality, including the relevance, sufficiency and the efficiency of the use of the system and the absence of less intrusive means;
  • the description of the technology that will be used and the location points of the data collection;
  • the minimum reliability, threshold used, and accuracy rates of the systems used;
  • the possibility of auditing the submitted information, including the technical details and accuracy criteria any time ex ante and ex post by the authorising authority;
  • the specification of the reference databases used;
  • the retention duration of the data captured and all other related personal data used;
  • the security measures, including against unlawful access to the data;
  • other safeguards (when relevant);
  • the description of any cooperation with private or public authorities, including in other countries, and data transfers and exchanges;
  • the traceability of the process;
  • the name of the responsible personals of the deployers; For the issuance as to other formal elements
  • the possibility of a written procedure complemented with a hearing;
  • the grounds of refusal;
  • the rights of persons for which a search is conducted, the rights of persons whose data is captured, and the possible rights of third parties;235
  • the delays within which the authorities will have to take their decision;
  • any need for formal notifications upon granting/refusal of the authorisation;
  • sanctions for not complying with (formal and substantial) requirements;
  • the right to appeal an authorisation that has been denied; For the exercise
  • the registration of the use of real-time RBI systems in a central register with a summary of the substantive elements;
  • possible further reporting obligations;
  • procedure for extending or modifying the authorisation.