UOOU (Czech DPA) — Police of the Czech Republic (Vaclav Havel Airport facial recognition)
A completed UOOU inspection found the Police CR facial-recognition camera system at Prague Airport, matching faces against a 'persons of interest' database, processed biometric special-category data without an explicit legal basis; the Police deactivated the system on 1 Aug 2025 and deleted the biometric data.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from a report on 2026-09-18. Every holding carries a short verbatim quote from that text (in CS, the document's language).
- Decided by
- Úřad pro ochranu osobních údajů
- Parties
- Úřad pro ochranu osobních údajů v. Policie ČR
- Remedy
- The automated facial recognition system at Vaclav Havel Airport was deactivated as of August 1, 2025, and all biometric data was deleted.
- Appeal
- Appeal status not stated
Key holdings
The processing of biometric data violated law enforcement data protection rules because the Police Act lacked explicit legal authority to process biometrics for unique identification.
“předmětné zpracování biometrických údajů je v rozporu s čl. 10 trestněprávní směrnice, neboť žádné z ustanovení zákona č. 273/2008 Sb.”
The Czech Police deactivated the automatic facial recognition system at the airport and erased all biometric data as of August 1, 2025.
“byl k 1. srpnu 2025 systém automatického rozpoznávání obličejů na letišti deaktivován a veškeré biometrické údaje smazány.”
In plain English
The Office for Personal Data Protection conducted an inspection into the Police of the Czech Republic regarding its operation of a camera system utilizing automated facial recognition technology at Vaclav Havel Airport Prague. The system matched faces captured by cameras in public and non-public areas of the airport against photos of persons of interest stored in a reference database. The data protection authority concluded that this biometric data processing violated data protection rules because the law governing the Czech Police did not explicitly grant the authority to process biometric data for the unique identification of individuals. While the police filed objections concerning the retention duration of biometric indices, which were accepted, the Chairman of the Office confirmed the remaining findings of the inspection report. Following the investigation, the Czech Police informed the authority that the automated facial recognition system at the airport was deactivated as of August 1, 2025, and all associated biometric data was deleted. Subsequent amendments to legislation introduced provisions for isolated real-time remote biometric identification systems at international airports.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.