Václav Havel Airport Prague has deactivated its real-time facial-recognition camera network following a binding opinion from the Czech Data Protection Authority (DPA) that the system violated national and EU privacy law. The shutdown, confirmed on 30 October 2025, ends seven years of biometric surveillance that critics say lacked a clear legal basis and judicial oversight.
The airport-wide system, run by the Czech Police, converted passengers’ facial images into biometric templates and compared them against watch-lists of wanted persons. Civil-rights NGO Iuridicum Remedium (IuRe) first filed a complaint in 2021, arguing that mass biometric processing contravened GDPR principles of necessity and proportionality. The DPA’s multi-year probe concluded in mid-2025 that the deployment breached Czech law and that, under the EU’s new AI Act (in force since February 2025), such high-risk surveillance now requires a specific court order.
Police sources said the cameras had assisted in several criminal arrests but admitted that no cost-benefit study or parliamentary mandate existed. The airport is Europe’s 20th-busiest Schengen gateway, handling 13 million passengers in 2024. Aviation stakeholders fear the deactivation could slow police response times, but privacy advocates counter that targeted, warrant-based use of biometrics is both feasible and lawful.
For airlines and corporate travel managers, the immediate impact is minimal: standard ID checks continue, and no additional procedures are imposed on travellers. However, the case has wider implications for Czechia’s forthcoming roll-out of EU Entry/Exit System kiosks, which will also collect fingerprints and photos. Regulators are expected to issue stricter technical guidelines before the kiosks go live in April 2026.
Legal advisers recommend that multinational companies review any airport-related biometric projects in Czechia, ensure data-protection-impact assessments are up to date, and brief mobile employees that airport police may revert to manual spot checks until a compliant solution is deployed.
The airport-wide system, run by the Czech Police, converted passengers’ facial images into biometric templates and compared them against watch-lists of wanted persons. Civil-rights NGO Iuridicum Remedium (IuRe) first filed a complaint in 2021, arguing that mass biometric processing contravened GDPR principles of necessity and proportionality. The DPA’s multi-year probe concluded in mid-2025 that the deployment breached Czech law and that, under the EU’s new AI Act (in force since February 2025), such high-risk surveillance now requires a specific court order.
Police sources said the cameras had assisted in several criminal arrests but admitted that no cost-benefit study or parliamentary mandate existed. The airport is Europe’s 20th-busiest Schengen gateway, handling 13 million passengers in 2024. Aviation stakeholders fear the deactivation could slow police response times, but privacy advocates counter that targeted, warrant-based use of biometrics is both feasible and lawful.
For airlines and corporate travel managers, the immediate impact is minimal: standard ID checks continue, and no additional procedures are imposed on travellers. However, the case has wider implications for Czechia’s forthcoming roll-out of EU Entry/Exit System kiosks, which will also collect fingerprints and photos. Regulators are expected to issue stricter technical guidelines before the kiosks go live in April 2026.
Legal advisers recommend that multinational companies review any airport-related biometric projects in Czechia, ensure data-protection-impact assessments are up to date, and brief mobile employees that airport police may revert to manual spot checks until a compliant solution is deployed.
