Face recognition at airports gets green light from High Court

The use of real-time remote biometric identification systems in publicly accessible areas for law enforcement purposes is generally prohibited under Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (AI Act). There are certain exceptions when this type of system can be used, but only with prior written permission under the Personal Data Processing Act issued by the presiding judge of the High Court.

In December 2025, the security system administrator of the Czech international airport submitted a request to use this isolated system, designed to perform real-time biometric identification of persons moving in monitored areas based on their facial biometric parameters. These persons are then to be compared with persons included in a reference database managed by the police. The results are to be used to search for persons suspected or accused of serious crimes, missing persons, or victims of crime, and to prevent threats to human life and terrorist attacks.

The use of this system represents a significant infringement on individuals' right to privacy. It can create a feeling of constant surveillance and, in the event of erroneous results, can also have discriminatory effects. In its decision, the High Court in Prague therefore focused in particular on its necessity, proportionality of use and impact on the rights of individuals.

Biometric data falls into a special category of personal data, the processing of which is only possible on the basis of strictly defined exceptions and only if appropriate safeguards are provided to protect the fundamental rights of the persons monitored. One of the exceptions is the existence of a significant public interest that must outweigh the right of individuals to privacy.

The purpose of the airport system is to increase security and obtain information important for identifying persons of interest. The High Court acknowledged that the environment of an international airport is characterized by a high concentration and movement of people. At the same time, it is a suitable and frequent location for committing illegal activities. According to the court, this establishes a legitimate and strong public interest in the timely identification of persons associated with criminal activity.

This interest outweighs the consequences that the use of the system has on the rights and freedoms of the persons concerned. The negative consequences are also significantly mitigated by the technical and organisational measures taken by the controller. For example, the operation and processing of the data takes place in isolation in a secure environment at the Ministry of the Interior, access is subject to strict security measures, and in the event of a match with data from the reference database, the evaluation is always carried out under human supervision.

The High Court found it essential that the cameras should only be located at tactical points of the airport with high passenger traffic and that they should not cover areas intended for rest or commercial purposes. This limited territorial scope prevents blanket monitoring of normal passenger movement and minimises infringement on privacy. The court also stated that this type of control cannot be reliably replaced by other measures, such as standard camera recordings, border controls or increased security. These alternatives do not ensure timely and accurate identification of individuals, which is crucial especially in situations of imminent danger.

The High Court in Prague therefore concluded that the reasons for using the system are justified and that the system makes it possible to achieve the legitimate objective pursued while limiting the infringement on the fundamental rights of individuals to the necessary and proportionate extent. The High Court in Prague therefore granted the system administrator's request.