Austrian Data Protection Authority finds Vienna police facial recognition at climate protest unlawful
Austria's Data Protection Authority ruled on 26 July 2026 that Vienna police unlawfully used automated facial recognition software to identify climate protesters in March 2023. The authority found no adequate legal basis for the technology's use and determined that all previous police facial recognition matches lacked legal grounds.
What happened
During a climate demonstration against a gas conference in Vienna on 27-29 March 2023, approximately 140 people were arrested and the protest was forcibly dispersed. Multiple activists who refused to provide identification were photographed by police.
One photograph was later matched automatically against the central police records database using facial recognition software. The data protection NGO epicenter.works filed a complaint on behalf of an affected activist.
Reported impact
The Austrian Data Protection Authority determined that automated facial recognition processing constitutes biometric data processing and represents a particularly intrusive form of data processing. The authority stated that no adequate legal basis currently exists for this use.
Index analysis
The authority concluded that all previous facial recognition matches by police were conducted without legal grounds. The Data Protection Authority called for the technology to be discontinued pending establishment of proper legal authority.
Governance controls
The Austrian Interior Ministry announced its intention to appeal the Data Protection Authority's decision.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.