PerIS: Police bypassed data protection authority with real-time face recognition

The Saxon data protection commissioner Juliane Hundert has stated that she assumes that a biometric comparison of facial images in real time "has not taken place without pre-sorting and restriction in the area of responsibility of Saxon law enforcement authorities". This is according to a letter from the responsible head of the unit, Thomas Mauersberger, to Anne Herpertz, the leading candidate of the Pirate Party for the European elections in Saxony, which was made available to heise online. She had complained to Hundert at the beginning of May about biometric video surveillance, as such systems are "incredibly prone to error" and represent a "disproportionate encroachment on the civil liberties of all".

A few days before the complaint, it had become public that the Saxon police had a personal identification system (PerIS) developed for secret surveillance. The system records license plates of passing vehicles as well as facial images of drivers and passengers. It has now also been used in Berlin on an administrative assistance basis and, according to official information there, can process facial images "with a time delay of a few seconds". All persons recorded in the vicinity are therefore compared with images of suspects from a specific investigation. Hits are then to be checked by police officers.

According to Mauersberger's answer to Herpertz, it is clear: "Considering the Federal Constitutional Court's statements on preventive measures of automated license plate recognition, there should be no doubt that biometric real-time processing and live comparison of facial images of people passing through a surveillance camera in public spaces violates the constitution." It is all the more astonishing that the state data protection commissioner has so far been unaware of PerIS and that the responsible police station in Görlitz has apparently not submitted a data protection impact assessment to the supervisory authority.

Inspector Hundert is now examining PerIS

Things were different at the Dresden Police Directorate (PD) in 2021. At the time, it used a program with a facial recognition function to retrospectively investigate numerous crimes, some of them serious, in connection with the riots surrounding a Dynamo Dresden soccer match on 16 May 2021. According to the activity report by Hundert's predecessor Andreas Schurig for this year, the PD answered the data protection issues raised in this regard "during a discussion and demonstration of the program". An impact assessment was also handed over.

Schurig assessed automated facial recognition in the context of police duties as "fundamentally critical and risky". However, in the "narrowly limited" use case at hand, he had "no serious reservations" about biometric searches. In 2018, the then Hamburg Data Protection Commissioner Johannes Caspar classified the use of automated facial recognition in the search for rioters during the G20 summit in July 2017 as unlawful.

The Saxon data protection commissioner now wants to establish beyond doubt "which measures with which depth of intervention" the Görlitz police department carried out with PerIS and whether there was explicit authorization from a judge. Of course, she is not responsible for checking this. Herpertz points out that Section 59 of the Saxon Police Enforcement Service Act, which made biometric video surveillance for the prevention of cross-border crime possible, expired at the end of 2023. She therefore welcomes the fact that Hundert shares her assessment of the unconstitutionality of PerIS use and is now taking up the matter. The Pirate Party representative also considers it "shocking that it was only my inquiry that led to the practice of real-time facial recognition being discussed and investigated at all".

(nie)