investigationOngoing
State Commissioner for Data Protection Baden-Wuerttemberg (LfDI) — PimEyes
December 21, 2022 · Germany
The LfDI Baden-Wuerttemberg opened an administrative-fine proceeding against facial-recognition search engine PimEyes, finding it processes biometric facial data for identification without a valid legal basis or explicit consent under Article 9 GDPR.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.