Recital 159
Artificial Intelligence Act · UE 2024/1689
| (159) | Each market surveillance authority for high-risk AI systems in the area of biometrics, as listed in an annex to this Regulation insofar as those systems are used for the purposes of law enforcement, migration, asylum and border control management, or the administration of justice and democratic processes, should have effective investigative and corrective powers, including at least the power to obtain access to all personal data that are being processed and to all information necessary for the performance of its tasks. The market surveillance authorities should be able to exercise their powers by acting with complete independence. Any limitations of their access to sensitive operational data under this Regulation should be without prejudice to the powers conferred to them by Directive (EU) 2016/680. No exclusion on disclosing data to national data protection authorities under this Regulation should affect the current or future powers of those authorities beyond the scope of this Regulation. |
In Luxembourg, the AI market surveillance authority has not yet been formally designated at the time of writing. The CNPD nevertheless retains all its investigative and sanctioning powers on personal data protection, including biometric processing operated by the Grand-Ducal Police, the Police General Inspection and judicial authorities, under the law of 1 August 2018 on the protection of natural persons with regard to the processing of personal data in criminal matters which transposes Directive (EU) 2016/680.
Luxgap practice: build today a single inspection file usable both by the CNPD and the future Luxembourg AI authority, to avoid rebuilding two separate evidence sets on inspection day.
