Czech police use facial recognition system, IuRe finds out details

The Czech police have been using a facial recognition system for almost a year.

The database consists of nearly 20 million photos of ID cards and passports.

EDRi member Iuridicum Remedium (IuRe) found out that the system works by comparing the face of a person in an inserted photograph with the faces of all persons, or their vector characteristics, in a so-called reference database. The source of these photographs are mainly two registers – the ID card register and the travel document register.

Each photograph in the database is linked to an individual identifier, through which the police officer can then easily access other data such as the first name, last name, residence or date of birth of the person in the selected photograph.

Police avoid responsibility, unwilling to divulge details

The Czech police claim that they informed the government Committee for Human rights and Modern Technologies about the system in advance, but according to the minutes of the meeting between the committee and the police, this is not true. In June 2022, just two months before the launch of the facial recognition system, IuRe also held a day-long seminar on biometric systems. Although the police were well represented there, they did not mention the “Digital Personal Image Information System”.

According to IuRe, the use of such a system is illegal. The police are citing a 2019 amendment of the Police Act that allows them to use it, but that amendment only gives them the power to obtain and then process digital photographs from state records. It does not allow the use of these photographs for biometric identification. The basic parameters and rules of operation of such an information system and rules of its use are missing in the law and are regulated only by the secret instructions by the Chief of Police. Needless to say, it is theoretically possible to upload photographs from social networks or cameras into such a system for identification purposes. The police argument that identification can only be done retrospectively and not in real time is therefore not very reassuring.

What now?

Although the police do not want to divulge the details and throw requests for information off the table, IuRe has successfully appealed to the Home Office for more information. Latest available information shows that 149 requests have already been processed through the system. There are more than 19.6 million photographs in the database, and 73 people from three different police departments in the Czech Republic have access to it.

IuRe also found that the Data Protection Impact Assessment of this system was not drawn up until a year later, presumably on the basis of the IuRe’s findings and media pressure. The Office for Personal Data Protection was not consulted either.

Based on IuRe’s findings, the system is now being examined by the Office for Personal Data Protection. Politicians, like from the Czech Pirate Party, also became interested in the system and they are asking for further clarification from the police.

Both BiometricUpdate and POLITICO have reported on the Czech system.

Contribution by: EDRi member, Iuridicum Remedium