The Italian Data Protection Authority gave an unfavorable opinion concerning the system SARI Real-time (25.03.21)
This is a remote biometrical identification system (RBI) that allows through cameras installed in a predetermined and delimited geographical area to analyze in real-time the faces of the subjects filmed there and it compares them with a database («watch-list»).
Every time a face is matched with the faces from the database it generates an alert to the police
IT DPA considered that this system would also carry out automated processing on a large scale of people who is not under police search. And while these images would be immediately erased, the biometric data of every individual in the area would be automatically processed.
As this implies a strong interference with private life, it must have an adequate legal base for its deployment. However, no such a legal base was found.
Would have been different this evaluation under the AIR draft?
– real-time RBI in public areas for LE are forbidden (art. 5(1)(d) AIRd)
— as an exception, they must
a) fulfill certain objectives:
– search of a potential victim
– prevention of a specific imminent threat to life or terrorist attack
– localization of a suspect of a certain crime (decision 2002/584/JHA, long list of crimes)
b) consider the nature of the situation and consequence of its use
c) implement safeguards and comply w conditions of use (temporal, geographic and personal limitations)
d) prior authorization ( 👩⚖️) by judicial or another independent authority (exception: urgency)
— MS law may regulate certain conditions concerning the authorization
So, I guess the important innovation is the prior authorization by an independent authority (be it judicial or administrative) of any individual use of real-time RBI
And while this requirement can be circumvented (e.g. urgency or vague national legislation) it is a strong accountability requirement that adds a layer of security to individuals and the protection of fundamental rights
0 comentarios