(159) Each market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) for high-risk AI systems in the area of biometrics, as listed in an annex to this Regulation insofar as those systems are used for the purposes of law enforcementlaw enforcementmeans activities carried out by law enforcement authorities or on their behalf for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public securityArticle 3(46), migration, asylum and border control management, or the administration of justice and democratic processes, should have effective investigative and corrective powers, including at least the power to obtain access to all personal datapersonal dataAny information relating to an identified or identifiable natural person ('data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)An identified or identifiable natural person to whom personal data relateGDPR Art. 4(1)'). Includes name, ID number, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural or social identityGDPR Art. 4(1) that are being processed and to all information necessary for the performance of its tasks. The market surveillance authorities should be able to exercise their powers by acting with complete independence. Any limitations of their access to sensitive operational datasensitive operational datameans operational data related to activities of prevention, detection, investigation or prosecution of criminal offences, the disclosure of which could jeopardise the integrity of criminal proceedingsArticle 3(38) under this Regulation should be without prejudice to the powers conferred to them by Directive (EU) 2016/680. No exclusion on disclosing data to national data protection authorities under this Regulation should affect the current or future powers of those authorities beyond the scope of this Regulation.