The decision to deactivate facial recognition equipment at Prague's Václav Havel Airport followed sustained advocacy by IuRe, an EDRi member organisation. The Czech Office for Personal Data Protection subsequently validated the concerns raised. Despite this development, law enforcement authorities in Czechia persist in breaching regulations governing the use of biometric identification technologies.
Years of criticism precede airport system shutdown
From 2018 onwards, Czech police operated a camera network capable of identifying individuals at Václav Havel Airport in Prague. The system functioned by converting facial features into numerical values—known as bio-indexes—and cross-referencing them against records of wanted or missing individuals. This operation continued until August 2025, when authorities disabled the equipment.
IuRe first raised objections to this deployment in 2021, contending that biometric data processing in the Czech Republic requires explicit authorisation through dedicated legislation. The organisation subsequently lodged a formal complaint with the Czech Data Protection Authority requesting a formal review. When IuRe obtained the inspection findings through a freedom of information request in summer 2025, the results substantiated allegations of non-compliance with data protection rules.
AI Act compliance triggers system deactivation
Opposition to the facial recognition deployment intensified following the AI Act's implementation, as the legislation mandates judicial authorisation before deploying such systems—a requirement the airport operation had never satisfied.
From February 2025, when the AI Act's biometric surveillance provisions took effect, until August 2025 when the airport system was disabled, police operation of this technology constituted a breach of law. The system remained active despite repeated warnings about its illegality and growing media scrutiny.
Establishing legislative guardrails for law enforcement
The Czech Data Protection Authority's investigation spanned nearly four years without producing meaningful intervention. Nevertheless, findings demonstrate that police require explicit statutory frameworks governing biometric data handling, established through parliamentary processes and subject to democratic oversight. The absence of such safeguards, beyond violating EU standards, creates conditions enabling potential misuse of these surveillance capabilities.
Broader pattern of regulatory non-compliance
Police disregard for biometric regulations extends beyond the airport case. The Digital Personal Image Information System represents another instance flagged by both IuRe and the Czech Data Protection Authority. Operating with a reference database containing approximately 20 million photographs from identity card and passport holders, the system enables retrospective identification by comparing images of unknown individuals against this archive.
Police justify the system's use for purposes such as identifying deceased persons. However, the same technology could theoretically facilitate identification of protest participants or other individuals engaged in lawful assembly.
These structural deficiencies in police deployment of facial recognition warrant attention from the incoming Czech Minister of the Interior, who should commission a comprehensive legislative review. Existing national law fails to incorporate the safeguards mandated by European directives for biometric data processing.
IuRe intends to sustain oversight of biometric surveillance practices in Czechia, supported partly through public contributions via their information platform Czechia is not China. This initiative, developed with EDRi assistance, was integrated with a crowdfunding effort.
Source: EDRi (European Digital Rights)
