The High Court in Prague has granted the request of the security system administrator, authorizing the use of technology enabling biometric recognition of individuals via CCTV and artificial intelligence algorithms within the monitored areas of Václava Havel Airport. The system performs real-time comparison of camera footage against the Police of the Czech Republic’s reference database, utilizing facial biometric parameters. Its purpose is to enhance airport security and enable the timely identification of individuals suspected of criminal activity, including those traveling with altered documentation.
According to the court, a CCTV system involving the processing of biometric data constitutes an interference with the right to respect for private life and the right to the protection of personal data. However, the court concluded that within the environment of an international airport—an exceptionally sensitive and high-risk area regarding security—there exists a legitimate and particularly pressing public interest in the timely identification of high-risk individuals, which, under specific conditions, may outweigh an individual's right to privacy.
The regulatory framework for the use of these technologies in the European Union consists primarily of the Artificial Intelligence Act (AI Act, Regulation (EU) 2024/1689), the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), and, in the field of criminal law, the Law Enforcement Directive (LED, Directive (EU) 2016/680).
The AI Act classifies real-time remote biometric identification systems (so-called "standalone systems") as high-risk technologies subject to the strictest regulatory regime, primarily due to their potential impact on fundamental human rights and freedoms. Their use in publicly accessible spaces for law enforcement purposes is exceptional and subject to strict conditions, including prior judicial authorization.
From the perspective of personal data protection, biometric data constitutes a special category of personal data within the meaning of Article 9 of the GDPR. Its processing for the purpose of uniquely identifying a natural person is possible only in exceptional cases—notably when necessary for reasons of substantial public interest—and provided that the requirements of proportionality and minimization of interference with the rights of data subjects are met. Furthermore, in the context of the activities of public authorities, the processing of biometric data is also governed by the Law Enforcement Directive, which emphasizes its sensitive nature and establishes strict conditions for its use in the prevention and investigation of crime.
The application for authorization to implement this standalone system was structured according to different monitoring regimes across various airport zones. The system is intended for use not only in non-public areas following security or border controls, where the movement of persons is already subject to more intensive regulation, but to a limited extent also in publicly accessible parts of the airport, particularly in arrival and departure halls. In these areas, the system serves a predominantly preventive function, and its deployment is limited to selected high-traffic spaces.
When evaluating the application, the court placed particular emphasis on the principle of proportionality regarding the interference with the rights of the affected individuals. The authorization is therefore limited not only to the necessary space but also to the time period during which the system is to be used. Furthermore, the processing of biometric data is confined to a narrowly defined group of persons. If the system proves effective in terms of both efficacy and impact, the applicant may apply for a new authorization. The court also took into account that this does not constitute mass surveillance of all individuals, but rather a targeted use of technology; therefore, it deemed the conditions set for its use to be a proportionate and necessary measure to strengthen security.
This text was translated by AI.
