HmbBfDI (Hamburg) - Einstellung Gerichtsverfahren in Sachen Videmo 360
Following the 2017 G20 summit in Hamburg, the Hamburg Police used automated facial recognition software to analyze video footage.
Status Not cited by any decision here yet
Holding
Before the appeal was decided, the police deleted the database, stating that the investigation had been completed. Due to this deletion, the OVG Hamburg declared the case moot on May 17, 2023. The court ruled that a retrospective determination of the lawfulness of the data processing was inadmissible, as it was a one-time decision with no recognized risk of recurrence.
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
A template database containing mathematical models of faces was created which includes data from private citizen uploads, police surveillance, public transport, and media sources (~32,000 video and image files). The Hamburg DPA (HmbBfDI) determined that there was no sufficient legal basis for this processing and ordered the deletion of the database. The Hamburg Ministry of Interior and Sports, responsible for the police, contested the deletion order in court and won before the Hamburg Administrative Court (VG Hamburg) in 2019. The Hamburg DPA appealed the ruling to the Higher Administrative Court (OVG Hamburg).
Full text 4 findings
Machine translation of the decision, via GDPRhub — not the official text. Read the original
By order of May 17, 2023, the Hamburg Higher Administrative Court discontinued the proceedings concerning the use of software for automated facial recognition by the Hamburg police after the parties unanimously declared the legal dispute to be settled. The judgment of the Hamburg Administrative Court (VG Hamburg, judgment of October 23, 2019 - 17 K 203/19), which was challenged by the HmbBfDI in the appeal before the Higher Administrative Court - according to which the deletion order issued by the HmbBfDI against the Authority for the Interior and Sport was overturned - is therefore ineffective. The court only had to decide on the costs. Taking into account the previous state of affairs and the dispute at its reasonable discretion, the Hamburg Higher Administrative Court imposed the costs on the Authority for the Interior and Sport, since, in the court's opinion, it would probably be unsuccessful in conducting the pending proceedings.
The background to the proceedings was the use of software for automated facial recognition in connection with the G20 summit in Hamburg in 2017. For its use by the Hamburg police, a so-called template database was created with an initially growing size of 17 terabytes, into which private recordings uploaded by citizens to the police, police-owned video surveillance material as well as material from public transport and the media - a total of around 32,000 video and image files - were incorporated. The HmbBfDI was of the opinion that there was no sufficient legal basis for the use of the software and therefore ordered the police to delete this template database, i.e. a database containing all the faces in the video surveillance material converted into mathematical models. The Department of the Interior and Sport, as the supervisory authority of the Hamburg police and addressee of the decision, filed a lawsuit against this and was successful in doing so before the Hamburg Administrative Court.
After the HmbBfDI applied for leave to appeal, the police deleted the template database. According to the police, this was done for reasons of necessity, as the investigations into the riots had been completed. However, the Hamburg Higher Administrative Court subsequently allowed the appeal by the HmbBfDI. However, due to the deletion in the meantime, the legal dispute had to be declared settled. The declaratory action now sought by the plaintiff - i.e. whether the now settled order was at least originally unlawful - was inadmissible in the court's opinion, since the HmbBfDI order in question was a decision made on an individual case and the court could not discern the risk of repetition required for such an action. Due to the inadmissibility of the declaratory action, the court imposed the costs on the Department of the Interior and Sport. A decision on the matter has therefore not been made.
The fundamental questions that this case raises for the practice of the investigative authorities, the data protection supervisory authorities and, last but not least, for the protection of very many uninvolved persons ultimately remain open for the future. Many questions would have to be raised again in the next operation. In particular, thousands of citizens ultimately remain unclear as to whether the processing of their biometric data was carried out correctly or not.