State Commissioner for Data Protection Baden-Wuerttemberg (LfDI) — PimEyes
The LfDI Baden-Wuerttemberg opened an administrative-fine proceeding against facial-recognition search engine PimEyes, finding it processes biometric facial data for identification without a valid legal basis or explicit consent under Article 9 GDPR.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-19. Every holding carries a short verbatim quote from that text (in DE, the document's language).
- Decided by
- Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
- Parties
- Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg v. PimEyes
- Appeal
- Appeal status not stated
Key holdings
The data protection authority initiated fine proceedings against PimEyes due to a lack of data protection compliance and deficiencies in technical and organizational measures.
“eröffnet der Landesbeauftragte daher nun ein Bußgeldverfahren gegen PimEyes.”
Any photo depicting or relating to an individual constitutes personal data, and processing biometric data for identification requires explicit consent or a statutory exception.
“Jedes Foto, auf dem eine Person abgebildet ist oder über welches ein Bezug zu einer Person hergestellt werden kann, stellt ein personenbezogenes Datum dar.” — Fotos von betroffenen Personen sind personenbezogene Daten
Private companies cannot claim to act in the public interest or perform law enforcement tasks without express authorization from a public authority.
“Private Stellen können nur dann im Rahmen der Strafverfolgung oder im öffentlichen Interesse tätig werden, wenn sie dazu ausdrücklich von einer öffentlichen Stelle ermächtigt wurden.” — Öffentliches Interesse/Aufgabe und Strafverfolgung
Requiring individuals to submit additional photos in order to delete their existing data from a database is contradictory and non-compliant.
“Daten durch die Vorlage von noch mehr Daten aus einem Verzeichnis löschen zu lassen, erscheint außerdem widersprüchlich.” — Opt-Out
In plain English
Following media reports in 2021 regarding PimEyes scanning internet photos for facial features and storing biometric data, the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg opened an investigation and issued a questionnaire to the company. On November 1, 2022, PimEyes responded, contending that it only processes publicly available images without linking them to specific persons, meaning no personal data processing occurs. PimEyes further argued that any potential processing was justified by public interest, public tasks, or protecting vital interests. The Commissioner firmly rejected PimEyes' arguments, emphasizing that photos depicting individuals constitute personal data and that processing biometric data for identification requires explicit consent or a legal exception. The authority stressed that private companies cannot act in the public interest or substitute for police investigation work without official authorization. Additionally, the authority criticized PimEyes' opt-out process as contradictory and inadequate. Concluding that PimEyes failed to ensure data protection compliance and technical measures, the authority initiated administrative fine proceedings.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.