IuRe campaign against Prague airport facial recognition system, Czech Republic (2021–2025)

Iuridicum Remedium (IuRe)'s campaign against the Václav Havel Airport facial recognition system is the Czech Republic's primary civil-society enforcement action on biometric surveillance — a four-year complaint-and-investigation arc that began with a 2021 formal filing to the Czech Data Protection Authority and ended in August 2025 with the shutdown of a system that had operated since 2018 without the explicit legal basis Czech and European law required. The campaign spans three distinct phases: IuRe's initial investigation and DPA complaint documenting the system's opacity and legal deficit; a parallel 2023 disclosure that Czech police had deployed a second, covertly-launched biometric identification database; and a 2024 defensive phase in which IuRe countered the Ministry of the Interior's attempt to legalize the airport system in a form IuRe argued would circumvent the EU AI Act's individual-authorisation requirement.

The 2018 deployment and IuRe's initial investigation

Czech police deployed the biometric camera system at Václav Havel Airport in 2018. The system converted passengers' facial contours into numerical "bio-indexes" and compared them in real-time against databases of wanted or missing individuals. Operated by the Foreign Police, it captured the facial images of approximately 3.6 million annual passengers plus hundreds of thousands of individuals passing through pre-transit areas; biometric data was retained for 30 days before deletion.

IuRe's November 2021 investigation established that the system operated in deliberate opacity: the Foreign Police refused to disclose the specific purposes of biometric data processing, the legal justification for collection, who had access to the data, or the actual biometric measurements captured. When a data subject — Václav Mach — submitted a request to access his own records, the 30-day retention period made it structurally impossible to obtain any data; no individual could ever verify what the system had recorded about them.

IuRe's core legal argument was that Czech law required biometric data processing to rest on explicit permission granted by a special statute. No such statute authorised the airport system's architecture. The organisation additionally documented that the Czech Republic had implemented the EU Law Enforcement Directive's mandatory data-protection impact assessment requirement after the airport system launched — meaning the system was built in violation of the Directive's implementation timeline as well as the Czech statutory baseline IuRe considered its binding threshold.

The DPA complaint and freedom-of-information strategy (2021–2025)

IuRe's formal complaint to the Czech Data Protection Authority argued that the biometric data processing at the airport violated both GDPR's proportionality and necessity principles and the Czech Personal Data Processing Act's requirement of explicit legal authority for security-force processing of special-category data. The DPA opened an inspection; the investigation ran for nearly four years.

In parallel with the formal complaint, IuRe pursued a freedom-of-information strategy to obtain the DPA's interim and final inspection findings. This approach — pairing a DPA complaint with FOI requests for the inspection file — served a dual function: it applied procedural pressure on the DPA to report its conclusions within statutory response deadlines, and it enabled IuRe to publish findings publicly as they emerged rather than waiting for a formal DPA decision. In the summer of 2025 IuRe obtained the inspection results through the FOI route; the DPA confirmed violations of national and European personal data protection legislation.

Parallel disclosure: the IS DPO covert system (2022–2023)

While the DPA complaint on the airport system was pending, IuRe disclosed in July 2023 that Czech police had covertly launched a second facial recognition tool — the Information System Digital Image of Persons (IS DPO) — in August 2022. The IS DPO compared photos against a government reference database of approximately 19.67 million photographs from national identity cards and travel documents, with 73 personnel across three police departments authorised for access. Police had operated the system for nearly a year without disclosing it to parliamentary oversight committees; IuRe contested police claims of adequate transparency, stating directly that the claim "is not true." Critical sections of documentation provided in response to IuRe's information requests were redacted, obscuring operational parameters.

The legal conflict over the IS DPO turned on an interpretive dispute: police cited § 66a of Act No. 273/2008 as authorising biometric processing, arguing the amendment permitted the processing of photographs from state registers. IuRe countered that the provision authorised photograph acquisition — not biometric identification, which requires a separate and distinct legal basis. Critically, the "basic parameters and rules of operation" of the IS DPO were regulated only by classified internal police instructions rather than publicly accessible democratic legislation — meaning no external actor could verify or contest the rules governing when, how, and against whom the system was applied. A data-protection impact assessment was completed only after IuRe's investigation, likely prompted by the public disclosure.

The Ministry's circumvention attempt and IuRe's counter-campaign (2024)

In September 2024 the Czech government approved a Ministry of the Interior proposal to legalise automated facial recognition at international airports. The proposal, as government-modified, reduced the retention window for unrecognised visitor data from 90 to 30 days. But its central legal architecture raised a deeper problem for IuRe: the EU AI Act, whose biometric surveillance prohibitions had been adopted by that point, requires a court or independent authority to authorise use of a facial recognition system on a specific person. The Ministry proposal instead allowed courts to authorise entire "predefined categories of persons" — a framing broad enough, IuRe noted, that "virtually anyone can be included in the database." The gap between individual-authorisation and category-authorisation was not a technicality; it was the structural distinction between targeted surveillance with individualised justification and mass biometric collection with categorical cover.

IuRe launched a public education counter-campaign titled "Czech Republic is not China" — an interactive online quiz (Czech-language only) that translated the category-authorisation problem into a format accessible to non-specialist audiences, using the China comparison as shorthand for population-scale biometric surveillance architecture incompatible with democratic rights norms. The campaign's explanatory memorandum revealed that the Ministry's long-run intention extended beyond airports: future applications to other public spaces were explicitly indicated. Civil-society pressure had already, by October 2024, limited the current legislative text to airport perimeters — a qualified win IuRe registered alongside its broader rejection of the proposal's constitutional architecture.

The AI Act takes effect and the shutdown (February–August 2025)

The EU AI Act's biometric surveillance provisions entered force in February 2025, requiring judicial approval for each specific deployment. Czech police, having never obtained such approval for the Václav Havel Airport system, continued operating it for six months — from February through August 2025 — in documented illegality, despite repeated public warnings from IuRe and media coverage. The DPA's mid-2025 confirmation of data-protection violations, combined with the structural illegality under the AI Act, left Czech police without any viable legal defence for continued operation. The system was shut down in August 2025 — seven years after its deployment.

IuRe's post-shutdown demands framed the airport shutdown not as a campaign endpoint but as a structural opening: the organisation called on Interior Minister Vít Rakušan to initiate a comprehensive legislative review of police biometric data processing in the Czech Republic, grounding future frameworks in democratically enacted statutes subject to public scrutiny rather than classified internal instructions. The IS DPO — the 19.67-million-photograph identification database that had also operated without adequate authorisation — remained active, a second front the campaign had documented but not resolved. IuRe's warnings that the IS DPO could be repurposed for surveillance of demonstrators or journalists, against police claims that it served only the identification of deceased persons, remained unaddressed by any legislative action.

Significance

This campaign is the corpus's primary entry on civil-society enforcement of biometric surveillance accountability in the Czech Republic, and it occupies a distinctive structural position in the EU AI Act's first enforcement window. Unlike the Hungarian case (TASZ-led coalition against Hungary's March 2025 biometric surveillance laws) — which involved coalition escalation to the European Commission against a Member State's deliberate legislative choice — the IuRe airport campaign achieved enforcement through the domestic DPA complaint mechanism: a single organisation, filing before the Act existed, prevailing through the combination of a pre-Act legal argument about domestic Czech law and the AI Act's arrival as compounding legal authority. The four-year investigation timeline reflects both the scale of the victory and its cost: a system operating on 3.6 million annual passengers remained active for the full duration of the inquiry, with the DPA's measured pace only becoming decisive when the AI Act added a categorical prohibition the inspection alone could not supply.

The campaign's architecture — DPA complaint paired with FOI requests for inspection findings, a parallel counter-campaign against legislative circumvention, and public education timed around the AI Act enforcement deadline — is the IuRe template applied across multiple fronts simultaneously rather than sequentially. In the European civil-society map of biometric surveillance resistance, this campaign sits alongside the EDRi-led Reclaim Your Face EU Citizens' Initiative and the TASZ Hungary enforcement campaign as one of the three documented cases where Central European civil-society organisations have moved a biometric surveillance system from deployment through legal challenge to shutdown within the AI Act's first enforcement period. IuRe is the Czech anchor of this pattern, as TASZ is the Hungarian anchor, and the IS DPO disclosure as collateral output of the airport campaign — a second surveillance system IuRe surfaced as a side-effect of FOI requests for the airport file — illustrates the compound audit logic that strategic-litigation organisations in this space exploit: each information-request thread opens the next.