Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Baden-Württemberg: LfDI Baden-Württemberg initiates proceedings against PimEyes for lack of compliance with data protection legislation

The Baden-Württemberg data protection authority ('LfDI Baden-Württemberg') announced, on 21 December 2022, that it had initiated proceedings against PimEyes due to an apparent lack of compliance with data protection legislation and deficiencies concerning the implementation of ​​technical and organisational measures. In particular, the LfDI Baden-Württemberg initiated proceedings and prepared a catalogue of questions for PimEyes, following the publication of media reports in 2021 stating that PimEyes scans faces for individual characteristics on the internet and stores biometric data. In this regard, the LfDI Baden-Württemberg specified that, on 1 November 2022, PimEyes had issued a statement addressing the legal basis for processing biometric data to identify individuals and the technical and organisational measures it had in place, which the LfDI Baden-Württemberg found insufficient and had constituted a danger to the rights and freedoms of citizens in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').

More specifically, the LfDI Baden-Württemberg sought to investigate, among others:

  • the legal basis for processing photos of data subjects according to Article 6 of the GDPR;
  • the requirement of express consent according to Article 9(2)(a) of the GDPR;
  • the lawfulness of disclosing and making biometric data publicly accessible according to Article 9(2)(e) of the GDPR; and
  • opt-out options to reject the data processing by PimEyes according to Article 25(2) of the GDPR.

You can read the press release, only available in German, here.