The following AI practices shall be prohibited: h) the use of ‘real-time’ remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement, unless and in so far as such use is strictly necessary for one of the following objectives: i) the targeted search for specific victims of abduction, trafficking in human beings or sexual exploitation of human beings, as well as the search for missing persons; ii) the prevention of a specific, substantial and imminent threat to the life or physical safety of natural persons or a genuine and present or genuine and foreseeable threat of a terrorist attack; iii) the localisation or identification of a person suspected of having committed a criminal offence, for the purpose of conducting a criminal investigation or prosecution or executing a criminal penalty for offences referred to in Annex II and punishable in the Member State concerned by a custodial sentence or a detention order for a maximum period of at least four years. Point (h) of the first subparagraph is without prejudice to Article 9 of Regulation (EU) 2016/679 for the processing of biometric data for purposes other than law enforcement.
Several cumulative conditions must be fulfilled for the prohibition in Article 5(1)(h) AI Act to apply:
The AI system must be a RBI system,
The activity consists of the ‘use’of that system,
in ‘real-time’,
in publicly accessible spaces, and
for law enforcement purposes.
The second condition, i.e. the ‘use’ of the AI system ,has been already analysed in section 2.3. of these Guidelines. The other conditions listed above are further described and analysed below.