Airport facial recognition system long criticised

The Czech Republic Police used a camera system with facial recognition capabilities at Václav Havel Airport in Prague from 2018, until it was shut down in August 2025. The system enabled real-time recognition of the faces of people passing through the airport. Their so-called bio-indexes, or, simply put, facial contours converted into numbers, were compared with a database of wanted or missing persons.

EDRi member IuRe drew attention to the situation back in 2021. At the time, IuRe lawyers argued that the processing of biometric data in Czechia is only possible on the basis of explicit permission granted by a special law. IuRe ultimately filed a complaint with the Czech Data Protection Authority (DPA), requesting an investigation. The result of the inspection, which IuRe requested in the summer of 2025 under the Freedom of Information Act, confirmed the suspicion of a violation of personal data protection legislation.

Biometric surveillance ended thanks to the AI Act

Criticism of the facial recognition system only increased after the AI Act came into force because the law explicitly requires judicial approval for each use of such a system, which wasn’t provided for the airport.

Therefore, since the specific portion of the AI Act related to biometric surveillance came into force in February 2025, till the airport facial recognition systém was shut down in August 2025, the police’s use of this system was illegal. It was in operation despite the fact that the police had been repeatedly warned of its illegality and the media had also taken an interest in the matter.

Set clear boundaries for the police

The inspection by the Czech DPA took almost four years. During that time, no effective action was taken. However, the results are clear: police need to be given clear guidelines for processing biometric data, which should be enshrined in laws approved by elected representatives of the people and thus subject to public scrutiny. The current situation, apart from violating European legislation, creates a fertile ground for various forms of abuse of these technologies.

The police systematically violate laws when processing biometric data

The Czech police are also ignoring the law in the case of another biometric tool – Digital Personal Image Information System. This was also pointed out by IuRe and subsequently by the Czech DPA. The system works with a reference database of approximately 20 million photographs of all persons who have been issued identity cards or passports, and compares them with photographs of persons of unknown identity.

This makes it possible to trace their probable identity retrospectively. According to the police, the system is used, for example, to identify the deceased. However, the same system can also be concievably used to identify people participating in demonstrations.

The obvious systemic problems with the use of facial recognition tools by the police should therefore be a matter of concern for the new Czech Minister of the Interior, who should initiate a review of the legislation. The current national legislation does not comply with the European directive in terms of legal safeguards for the processing of biometric data.

IuRe will continue to monitor biometric surveillance in Czechia, thanks in part to financial support from the public received through their informational website about biometric surveillance called Czechia is not China. The website was created with the support of EDRi and was linked to a crowdfunding campaign.

Contribution by: EDRi member, Iuridicum Remedium (IuRe)