Data Protection Authority: Automated Facial Recognition at 2023 Climate Demonstration Was Illegal

Investigations were conducted against a total of 165 climate activists following the demonstration on charges of serious joint violence. The proceedings directly related to the use of facial recognition technology were also dropped. Those affected nevertheless still find themselves confronted with the consequences of the measure to this day, as emerges from the statements of individual defendants.

One of the affected persons described the psychological burden to the APA: „Ich muss immer damit rechnen, wenn ich bei so einer Demo teilnehme, dass ich dann plötzlich strafrechtlich verfolgt werde. Das spielt im Kopf mit und hat einen abschreckenden Effekt." The account illustrates how the use of biometric surveillance can influence behavior even before an actual charge is filed.

Legal Basis of the Decision

The authority bases its decision on the General Data Protection Regulation. According to this, facial matching is a particularly „eingriffsintensiven" (intrusive) processing operation that is only permitted with clearly defined legal bases and effective protective mechanisms. If such a basis is missing, the interference with the fundamental right to data protection and with freedom of assembly weighs particularly heavily.

Sebastian Kneidinger, policy advisor at epicenter.works, emphasized to the APA: „Derlei mächtige Technologien müssen umsichtig und verantwortungsvoll eingesetzt werden. Gerade der Staat darf sich nicht nur ihre Vorteile herauspicken, sondern muss auch für klare Regeln und wirksame Schutzmaßnahmen sorgen." The NGO thus criticizes the absence of a clear legal framework for biometric surveillance in Austria.

Regarding the specific case, Kneidinger added: „Nicht nur aus Datenschutz-Perspektive ist das ein wichtiges Urteil, sondern auch für die Versammlungsfreiheit." In the organization's view, the decision strengthens the position of all those who attend demonstrations without having to fear being identified and prosecuted later with the help of automated systems.

Course of the Demonstration in March 2023

As several media outlets report, citing the APA, the incident took the following concrete form: In March 2023, several activists were stopped and, when they refused to identify themselves, photographed by police officers. The images were later used for criminal prosecution for resisting state authority. The decision now on hand concerns precisely this procedure.

The Ministry of the Interior immediately announced an appeal against the decision. In a press release, it stated that it wanted to fight the „nicht nachvollziehbare Entscheidung" (incomprehensible decision) before the Federal Administrative Court. From the ministry's perspective, the digital image comparison serves a clear purpose: „Straftäter auszuforschen und diese zum Schutz der Menschen in unserem Land aus dem Verkehr zu ziehen." A statement on the specific allegations of illegality was not initially provided.

Reactions from Police and the Ministry of the Interior

Elisabeth Kury, spokesperson for epicenter.works, then called on the federal government to act: „Jetzt können sie in der Regierung zeigen wie ernst das gemeint war." She referred to the former criticism of the current coalition partners. „SPÖ und NEOS haben den Einsatz von Gesichtserkennung noch aus der Opposition heraus zu Recht kritisiert." Now it would have to be shown whether participation in government has changed anything in this stance.

The NGO thus holds both the ÖVP as a governing party and the SPÖ and NEOS as former opposition parties accountable. The accusation aims at the fact that political promises made in opposition evidently find no continuation in governmental responsibility. Concrete legislative proposals for the use of biometric systems have so far failed to materialize.

The dimension of the problem is illustrated by another case that has also become publicly known: In autumn 2023, an Austrian was taken into pre-trial detention in Serbia because an international arrest warrant from the Graz public prosecutor's office had been issued against him. As the case illustrates, automated comparisons with facial images can have serious cross-border legal consequences.

International Dimension and Risks

Precisely because false matches in biometric comparisons can lead to far-reaching consequences, epicenter.works believes a multi-level safeguard system is needed: clear intervention thresholds, independent oversight, and individual legal remedies. Without such guarantees, the use of the technology remains problematic under the rule of law.

The Data Protection Authority's decision is not the first criticism of biometric surveillance in Austria. In recent years, data protection organizations and civil society alliances have repeatedly pointed out the risks of automated facial recognition and called for explicit legal regulation. So far, political reactions have been limited primarily to declarations of intent.

Now, with the Data Protection Authority's ruling, there is at least a legal assessment at the administrative level that calls the use of the technology in this specific case into question. The Federal Administrative Court will have to address in the appeal proceedings whether the lack of an explicit legal basis actually makes the intervention unlawful.

Significance for Future Demonstrations

Even though the criminal proceedings against the 165 affected individuals have already been dropped, the Data Protection Authority's decision remains a precedent. It strengthens the position of all those who oppose the use of biometric surveillance at demonstrations and at the same time increases the pressure on policymakers to finally create clear rules, as Kury of epicenter.works emphasized.

For the demonstrators, the decision has symbolic significance: it confirms retroactively that the police operation overshot the mark. Whether this will result in lasting protection for future assemblies now depends on whether the government draws the necessary conclusions and the announced appeal does not have the final word.

The Data Protection Authority published its decision on Thursday. In the coming weeks, both the Ministry of the Interior and the affected NGOs will announce their further steps. Observers expect that the proceedings before the Federal Administrative Court will also attract attention beyond Austria, as comparable cases are pending in several EU member states.