Greece’s AI Smart Policing system ruled unlawful after €4 million public spending\

A high-risk AI surveillance project with limited transparency

In 2019, the Hellenic Police signed a 4 million EUR contract with Intracom Telecom to implement the so-called “Smart Policing” programme. The project involved the procurement of 1000 portable surveillance devices designed to enable facial recognition, fingerprint identification, and the scanning of documents and vehicle licence plates.

More precisely, the “Smart Policing” project relies on portable biometric devices enabling police officers to conduct facial recognition and fingerprint identification during on-the-spot checks in urban areas. Officers can capture individuals’ biometric data and instantly compare it against national, EU, and international databases, including systems such as (Schengen Information System) SIS II, (Visa Information System) VIS, EURODAC, as well as databases linked to Europol, or even third-country authorities.

The system was presented by authorities as a tool to increase efficiency in identity checks, particularly by avoiding the need to transfer individuals without documents to police stations. However, its design indicates a clear focus on (perceived) migrants, raising serious concerns about discriminatory surveillance, profiling practices, and the disproportionate targeting of vulnerable groups.

From the outset, the deployment of such biometric technologies raised serious concerns about fundamental rights and compliance with EU data protection standards. These tools, by their nature, involve the processing of sensitive personal data, increasing the risks of misuse, mass surveillance, and disproportionate interference with individuals’ privacy during police stops.

Civil society action and delayed regulatory response

EDRi member Homo Digitalis, in collaboration with AlgorithmWatch, were the first organisations to publicly expose the project through a joint investigative publication in December 2019. In the same month, Homo Digitalis submitted an access-to-documents request to the Ministry of Citizen Protection, seeking clarity on key issues related to legality and data protection compliance.

The response received failed to address these concerns in a substantive manner, prompting further action. In March 2020, Homo Digitalis filed a formal complaint before the Hellenic Data Protection Authority (HDPA), requesting an investigation into the lawfulness of the programme. The Authority accepted the complaint and officially launched its investigation in August 2020.

During this period, the Greek State proceeded with the full payment of 4 million EUR, 75% of which was financed through EU funds (specifically the Internal Security Fund – ISF), while the devices were delivered, fully functional, to the Hellenic Police in September 2021. This sequence of events raises serious concerns about public spending oversight and the absence of effective ex ante legality checks.

A landmark decision confirms unlawful data processing

On 31 December 2025, the HDPA issued Decision 45/2025, concluding that the activation of the Smart Policing system would constitute unlawful processing of personal data under the applicable legal framework. The Authority explicitly warned the Hellenic Police not to operationalise this AI-enabled system.

The decision found that there was no valid legal basis for the intended data processing and that a required data protection impact assessment (DPIA) had not been conducted in a timely manner during the project’s pilot phase. These failures represent a clear breach of fundamental data protection obligations under EU law.

This outcome confirms that the system was effectively unlawful by design, raising broader worries about how such high-risk technologies are evaluated and approved before public procurement and deployment.

Conclusion: The need for stronger safeguards and oversight

The HDPA’s decision brings a strong sense of vindication for civil society actors who raised concerns as early as 2019. It confirms that the risks associated with the system, particularly regarding data protection violations and mass surveillance practices, were well-founded.

At the same time, the case highlights a significant waste of public resources as four million EUR of taxpayers’ money was spent on a system that could not be lawfully used. The fact that the project was largely financed through EU funds further amplifies issues with the allocation and monitoring of public investments in digital technologies.

Homo Digitalis will continue to monitor developments and advocate for stronger safeguards to prevent similar cases in the future. Ensuring that public funds are not used to support unlawful or harmful technologies must be a priority for both national authorities and EU institutions.

Contribution by: Eleftherios Chelioudakis, Executive Director, EDRi Member, Homo Digitalis