UOOU (Czech DPA) — Police of the Czech Republic (IS DPO facial-recognition system)
A completed UOOU inspection of the Police 'Digital Images of Persons' system, which uses automatic facial recognition against ID/passport photo databases, found the Police Act does not provide a sufficiently predictable legal basis for the biometric processing and that the Police failed to consult the Office before deployment.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from a report on 2026-09-18. Every holding carries a short verbatim quote from that text (in CS, the document's language).
- Decided by
- Úřad pro ochranu osobních údajů
- Parties
- Úřad pro ochranu osobních údajů v. Policie ČR
- Appeal
- Appeal status not stated
Key holdings
The authority concluded that existing statutory provisions do not set out sufficiently predictable conditions, limitations, or precise purposes to serve as a legal basis for processing digital photos in the IS DPO system.
“z ustanovení § 66a zákona č. 273/2008 Sb. nejsou dostatečně předvídatelné podmínky, omezení či přesný účel využití IS DPO”
The police failed to fulfill their statutory duty to submit a prior consultation request to the authority before processing personal data using the IS DPO system.
“Policie ČR porušila povinnost podat Úřadu žádost k projednání připravovaného zpracování osobních údajů prostřednictvím IS DPO, vyplývající jí z § 38 odst. 1 písm. b) zákona č. 110/2019 Sb .”
In plain English
The Czech Data Protection Office conducted an inspection into how the Police of the Czech Republic processes personal data using its facial recognition tool, known as the Digital Persons Form system or IS DPO. The police utilize automated facial recognition technology within this system to assist in identifying unknown persons of interest during criminal proceedings, such as perpetrators, witnesses, or victims, by matching facial photographs against reference databases. Following information published online as well as a specific complaint from an individual, the authority evaluated whether the processing complied with data protection laws. The inspection concluded that existing statutory law does not provide sufficiently predictable conditions, limitations, or precise legal purposes for operating the system, meaning the police lacked a sufficient legal basis to process subject photographs. Additionally, while the police did perform a data protection impact assessment that generally met statutory requirements despite minor deficiencies, they breached their legal obligation by failing to file a required prior consultation request with the authority before initiating data processing in the system.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.