UOOU on biometric identification of unwanted persons at football stadiums

In 2026, the Office for Personal Data Protection has recently expressed its views on the processing of personal data through camera systems that handle biometric data to prevent unwanted persons from entering football stadiums. This involves visual identification of individuals related to specific actions, such as capturing a perpetrator regardless of nationality, religion, ethnicity, health status, or biometric characteristics. It does not exclude subsequent processing of latent personal data contained in recordings of incidents or suspected perpetrators, including biometric features or other personal data, which may be extracted by the Czech Police as a new data controller during further investigations. Such processing is only permitted if justified by a significant public interest based on Union or Member State law, proportionate to the goal, respecting data protection principles, and providing appropriate safeguards for individuals' rights. According to Act No. 110/2019 Coll., only the Czech Police may process personal data in this context, limited to international airports and with prior written approval from the President of the Supreme Court, for a maximum of 12 months with possible extensions. If the data controller relies on legitimate interests, a comprehensive assessment must be conducted beforehand to balance the interests of the controller against the rights and freedoms of data subjects.