Hamburg Commissioner for Data Protection and Freedom of Information (Hamburg DPA) – Court Ruling (Germany, 2019)

The Hamburg Police created a reference database containing biometric data (facial recognition templates) to identify suspects in crimes related to the G20 summit in July 2017. The Hamburg police set up the "Black Block" special commission and decided to compile an extensive image file. This consists of images created by the police itself, video surveillance recordings of certain S-Bahn (train) stations, other relevant recordings available on the Internet and of privately created image files. The police came into possession of these files after calling on the public to upload relevant image files to a portal of the Federal Criminal Police Office (BKA). The resulting collection, which comprises around 32,000 image files (the "basic file"), consists of (video) recordings of people at meetings related to the G20 summit, in the run-up to and around such meetings, and during the commission of criminal offenses. The police obtained the disputed reference database from the basic file using specially acquired facial recognition software ("GAS"). It consists of digital extracts of the faces identified by the software in the images of the basic file ("templates"). Based on a measurement of the individual distances between eyes, ears, nose and mouth by the GAS, the templates are intended to enable the automated (re)recognition of individual physiognomies with a high degree of probability. In a letter dated July 5, 2018, the Hamburg DPA informed the police of their opinion that the biometric analysis of the faces of thousands of uninvolved people represented a significant infringement of fundamental rights. In a letter dated July 18, 2018, the Attorney General's Office asserted to the Hamburg DPA that the public prosecutor's office had sole authority to manage the use of the reference database. Attached to the letter was a legal opinion stating that the creation and use of the reference database was legally unobjectionable. In a letter dated July 23, 2018, the police explained to the Hamburg DPA that they considered the creation and use of the reference database to be lawful and therefore did not intend to refrain from using it. On December 18, 2018, the Hamburg DPA ordered the deletion of the database, arguing that it lacked a sufficient legal basis. The City of Hamburg then submitted the case to the Hamburg Administrative Court. The Hamburg Administrative Court annulled the deletion order, ruling in favor of the Hamburg Ministry of Interior and Sports. The court found that the Hamburg DPA had standing to sue, as the order directly affected its authority to process data for criminal prosecution. Moreover, it found that the deletion order was unlawful because the Hamburg DPA failed to identify a specific violation of data protection law. Instead, the Hamburg DPA based the order on hypothetical future uses of the data, which the court found insufficient to justify the deletion order. The court stated that the Hamburg DPA failed to consider less intrusive measures than outright deletion. The Hamburg DPA could have imposed conditions on the use of the database, such as requiring written protocols for searches or automatic logging of access, rather than ordering its deletion. The court determined that the police's data processing was covered by Section 48 of the Federal Data Protection Act (BDSG), which allows the processing of biometric data for criminal prosecution if it is "absolutely necessary." The court concluded that the use of the facial recognition software was indeed necessary for effective criminal prosecution, given the large volume of data and the impracticality of manual review. The Hamburg DPA's argument that Section 48 BDSG was too vague to serve as a legal basis for such intrusive data processing was rejected. The court held that the Hamburg DPA overstepped its authority by conducting a constitutional review of the law, which is the role of the legislature and the courts, not an administrative body.