Surveillance worldwide: proposed, misused, and pushed back

Canada's Privacy Commissioner found the national police force, the RCMP, broke the Privacy Act by using Clearview AI, after regulators separately ruled Clearview's scraping of more than three billion images was illegal mass surveillance. The RCMP had run far more searches than it first admitted, and Clearview stopped offering its service in Canada.

British Columbia's privacy commissioner ruled that Victoria police must immediately delete plate-reader data on vehicles that do not match a hot list, and that the public must be told the system's full scope, an early limit on Canadian ALPR retention.

After Citizen Lab and Access Now confirmed Pegasus infections on the phones of more than 20 journalists and civil-society members, most of them from the newspaper El Faro, the targeted journalists sued NSO Group in a US federal court. The suit was dismissed on jurisdictional grounds, a setback the plaintiffs appealed.

Mexico's Supreme Court struck down PANAUT on Apr 25, 2022 -- the law that would have tied every one of the country's 120-million-plus mobile lines to a government registry of fingerprints, face and iris data, collected by carriers at the point of sale and available to law enforcement on request. Nine of eleven justices ruled the decree wholly unconstitutional and the remaining two partially so; Justice Norma Lucia Pina Hernandez, who had suspended the rollout in Jun 2021, put the principle plainly: a national registry of mobile users is not a necessary measure in a democracy, because it does not balance limited investigative need against the right to privacy. The challenges came from every direction at once -- the transparency institute INAI, 48 senators, the telecom regulator IFT (which filed over the unfunded mandate), and digital-rights group R3D. The court found the scheme disproportionate: conditioning phone access on surrendering biometrics to fight kidnapping fails data-minimisation when the burden lands on every innocent user. Mexico's FIRST registry, RENAUT (2008), ended with millions of users' data leaked and allegedly sold by officials before being abandoned in 2012 -- the strike-down is the middle chapter, not the end: a 2026 law now routes the same ambition through the biometric CURP national ID, redesigned to dodge the court's centralised-database objection, with a Yucatan tribunal already suspending it. See the CURP record on this map for the third attempt.

In November 2021 Mexico made the first arrest anywhere in the global Pegasus scandal, jailing a technician at a private firm that had brokered NSO's spyware to Mexican agencies on charges of illegally tapping a journalist's phone. Mexico was one of NSO's earliest and heaviest clients, with the spyware turned on journalists and activists, and the case opened the first criminal accountability for that abuse.

A court suspended Buenos Aires's live facial-recognition fugitive system in April 2022 and ruled it unconstitutional that September, upheld on appeal in 2023, after it was used to run unauthorized searches on thousands of people not on any wanted list, including journalists, politicians, and activists. It remains suspended pending audit safeguards.

Brazil's data authority banned Worldcoin in Jan 2025 on the same principle Kenya's court later reached: paying for biometrics breaks consent. The ANPD found that offering cryptocurrency for iris scans violates Brazil's data law, which requires consent for biometric collection to be free, informed and unequivocal -- a financial inducement aimed at people who need the money is none of those. In Mar 2025 the regulator reaffirmed the ban and attached a daily fine of 50,000 reais (about $8,800) should collection resume. Brazil is the largest economy to bar the program outright rather than suspend it, and its reasoning -- that the poorer the subject, the less voluntary the trade -- is the argument against biometrics-for-cash programs generally, not just this one.

Courts suspended Sao Paulo Metro's facial-recognition system in 2022 after a public civil action by civil society groups, and a campaign backed by legislators across 13 states has pushed bills to ban facial recognition in public spaces. The city's larger Smart Sampa camera network has advanced despite the legal challenges.

Austria's DPA found Clearview AI acted illegally. The privacy group noyb filed a criminal complaint against the company and its managers.

THE EU IS ABOUT TO LET US BORDER AUTHORITIES SEARCH EUROPEAN FINGERPRINT DATABASES -- THE PRICE OF VISA-FREE TRAVEL. Negotiations on an EU-US framework for Enhanced Border Security Partnerships closed on 23 July 2026, and on 10 September the Commission asked the Council to sign it and apply it provisionally. It allows reciprocal fingerprint and identity searches of national databases when an official records a serious risk to public security; Biometric Update reports face images are excluded as a search key. Each member state then signs its own deal with the US naming its databases. Washington made these partnerships a Visa Waiver Program condition in 2022 and set 31 December 2026 as its assessment cutoff. The European Data Protection Supervisor warned this would be the EU's first large-scale biometric sharing deal for a foreign border service; Statewatch says the text exceeds the Council's own mandate and weakens protection against profiling. Ireland and Denmark are outside the framework. Not established: when the Council and the European Parliament will vote.

Belgium oversight body for police information, the COC, found in February 2022 that federal police use of Clearview AI facial recognition was not legal, not authorized, and not necessary, with no sufficient basis in police law. It followed a 2019 order to halt a facial-recognition trial at Brussels Airport for the same reason. The interior minister confirmed the tool was illegal under Belgian law, though lawmakers continue to debate a framework that could permit narrow police use.

In 2017 Brussels Airport (Zaventem) quietly installed four facial-recognition cameras for the airport police to match travellers against a blacklist, without informing Belgium's police-information oversight body (COC). When it found out, the COC ruled the deployment fell outside any lawful framework and it was stopped; the system had also proved unreliable, with false positives tied to skin colour and facial hair. Belgium remains one of the EU states that has not authorised police facial recognition.

In Ekimdzhiev and Others v. Bulgaria (January 2022) the European Court of Human Rights found that Bulgaria's systems of secret surveillance and of bulk retention of communications data both violated the right to privacy under Article 8, citing weak authorisation, oversight and notification safeguards that left the regime open to abuse. It built directly on the Court's bulk-interception standards from Big Brother Watch.

Czech police ran the country's only officially operating automatic facial-recognition system at Prague's Vaclav Havel Airport from 2018, converting travellers' faces into numeric 'bio-indexes' and matching them against wanted and missing-person databases. The digital-rights group Iuridicum Remedium complained to the Czech data-protection office in 2021, and its multi-year inspection concluded in mid-2025 that the deployment breached Czech and EU law. Once the EU AI Act's biometric provisions took effect in February 2025 the system needed judicial authorisation it had never obtained, and police switched it off on August 1, 2025 -- by the NGO's reckoning, six months of confirmed illegal operation. The Prague High Court let it back on February 26, 2026, but only on a leash: capture confined to non-Schengen exit passport lanes, no scanning of arrival halls or retail areas, deletion within 36 hours unless a match produces an investigative lead, raw images restricted to senior officers, the system isolated from the internet, quarterly independent audits, and standing power for the data-protection office to suspend it again.

1. Jan 2021 Iuridicum Remedium filed a complaint with the Czech data-protection office, arguing police had no explicit legal basis to process biometric data through airport cameras. edri.org
2. Feb 2025 The EU AI Act's biometric provisions took effect, making real-time biometric identification unlawful without judicial authorisation the airport system had never received. biometricupdate.com
3. Aug 2025 Czech police shut the system down on August 1, 2025, the only officially running automatic facial-recognition deployment in the country. edri.org
4. Feb 2026 The Prague High Court authorised a restart from mid-March 2026 under geofencing, 36-hour deletion, restricted access, and quarterly audit conditions. expats.cz

In Prokuratuur (2021) the EU Court of Justice ruled that police and prosecutors cannot freely reach into retained phone traffic and location data: access to communications metadata must be authorised in advance by a court or an independent authority, and a public prosecutor who directs the investigation is not independent enough. The Estonian case set an EU-wide guardrail on who can access retained data.

The EU AI Act Article 5 bans real-time remote biometric identification (live facial recognition) by law enforcement in publicly accessible spaces, with narrow exceptions. The prohibited-practices rules took effect 2 February 2025.

The European Parliament set up a committee of inquiry, known as PEGA, into the use of Pegasus and equivalent spyware across member states. Active from April 2022, its final report in May 2023 found that spyware had been used to illegally target journalists, politicians, and critics in countries including Poland, Hungary, Greece, and Spain, and it called for a moratorium and binding safeguards on the sale and use of such tools in the EU.

In Schrems II (Facebook Ireland and Schrems, 2020) the EU Court of Justice struck down the EU-US Privacy Shield data-transfer deal because US surveillance law -- letting agencies like the NSA access transferred data with no equivalent protection or redress for Europeans -- was incompatible with EU privacy rights. The EU's top court effectively ruled that US mass surveillance failed European fundamental-rights standards.

The EU's Court of Justice has repeatedly struck down blanket data retention -- the legal backbone that limits indiscriminate systems like ANPR. In Digital Rights Ireland (2014) it annulled the Data Retention Directive as a disproportionate mass intrusion; in Tele2 Sverige (2016) it held that national laws requiring general, indiscriminate retention of traffic and location data are unlawful; and in later rulings (La Quadrature du Net, SpaceNet) it kept the ban while allowing only narrow, targeted exceptions. The principle: mass retention of data, including vehicle-location reads, must be targeted, time-limited and independently overseen.

Finland Deputy Data Protection Ombudsman reprimanded the National Police Board in 2021 for unlawfully processing personal data when the National Bureau of Investigation trialed Clearview AI facial recognition during a child-abuse investigation. The ombudsman ordered the police to have Clearview erase the data they had transmitted and to notify affected people. The police had already dropped the tool, finding it unsuitable for their work.

France's data protection authority moved against Clearview AI in two stages. In December 2021 the CNIL ordered the company to stop collecting and using the face data of people in France and to delete what it held, finding the scraping had no legal basis. Clearview did not comply, and in October 2022 the CNIL fined it EUR 20 million for unlawful biometric processing -- one of a wave of European penalties the company has largely declined to pay, having no establishment in the EU for regulators to enforce against.

In February 2021 France's data-protection authority (CNIL) ruled that FC Metz's experimental stadium system -- meant to spot fans under civil stadium bans, detect abandoned objects and bolster counter-terror measures -- unlawfully processed biometric data. It was one of several French facial-recognition deployments, alongside school entry gates and a citizen-filming app in Nice, that regulators and courts struck down.

A regional plan to install facial-recognition entry gates at two high schools in Nice and Marseille was struck down. The data-protection regulator CNIL warned in October 2019 that the trial was unlawful, and in February 2020 the Administrative Court of Marseille annulled it, ruling that the region had no authority to impose it, that students could not freely consent under school authority, and that the measure was disproportionate. It was the first French court decision applying the GDPR to facial recognition in a public space.

In Ben Faiza v. France (2018) the European Court of Human Rights found that real-time GPS tracking of a suspect's vehicle breached the right to privacy, because French law at the time gave no clear, foreseeable legal basis for such geolocation surveillance. The ruling pushed France to put covert location tracking on a proper statutory footing.

German data protection authorities ordered World in Dec 2024 to delete data that did not comply with the EU's General Data Protection Regulation -- the EU's consent and lawful-basis rules applied to an iris-scanning program headquartered partly in Berlin. Germany's move mattered less for its scope than for its venue: Tools for Humanity is a San Francisco and Berlin company, so this was the program's home-jurisdiction regulator finding its data holdings partly unlawful. Recorded as restricted rather than removed because collection was not barred outright; the order targeted non-compliant data. Marked approximate: the record is pinned at Berlin as a national-scope convention.

German data protection authorities found Clearview AI unlawful and ordered deletion, but the federal government has proposed a law granting police powers to match faces against public internet image databases. Legal scholars and civil society warn it breaches the constitution and EU law.

Hamburg police deleted their G20 facial-recognition database in 2020 -- a system that had biometrically templated roughly 100,000 people. After the 2017 G20 summit riots, police ran Videmo 360 face-recognition across uploaded private recordings, police video, S-Bahn station footage and media material, mathematically templating every identifiable face -- overwhelmingly bystanders never suspected of anything -- for automated matching against suspects. Data Protection Commissioner Johannes Caspar called it a new dimension of state investigation, warned the suspicionless material allowed inferences about behaviour patterns and preferences, objected in Aug 2018, and ordered deletion in Dec 2018 -- the first and only time he used his power to instruct the police. THE HONEST SEQUENCE, because this is not a clean regulator win: Hamburg's Administrative Court OVERTURNED the deletion order, ruling the DPA lacked competence to review the legal basis. The police then deleted the database anyway, telling the DPA it was simply no longer needed for the G20 prosecutions -- and the state government moved to strip the commissioner's instruction power in the new police law. The yield figures argue for themselves: 75 searches commissioned from the BKA after G20, three hits, one in five images unusable. A hundred thousand people templated for three matches, deleted without ever conceding it was unlawful.

Germany's Federal Constitutional Court ruled automatic plate recognition unconstitutional in 2008 and again in 2019, striking down provisions in Bavaria, Baden-Wurttemberg, and Hesse as violating the right to informational self-determination. The systems were built by Jenoptik.

The Predatorgate scandal broke in 2022 when Predator spyware, made by the Intellexa group, was found on the phones of a financial journalist and the leader of the opposition PASOK party, who was also a member of the European Parliament. The national intelligence chief and the general secretary to the prime minister resigned, parliament passed a 2022 law on lifting communications confidentiality, and in February 2026 a Greek court convicted figures behind the Predator operation, a rare instance of accountability in the spyware industry.

Greece's Data Protection Authority fined Clearview AI EUR 20 million, its largest-ever penalty against a private company, for unlawfully processing Greek citizens' biometric data.

Hungary used Pegasus against journalists, lawyers, and opposition figures, with more than 300 people reportedly targeted. The government's own data-protection authority found no wrongdoing, but targeted journalists, backed by the Hungarian Civil Liberties Union, filed the first lawsuits against the state in 2022, the European Court of Human Rights took up a related case in 2023, and the European Parliament's PEGA inquiry condemned Hungary's use and demanded independent judicial authorization.

In Szabo and Vissy v. Hungary (January 2016) the European Court of Human Rights found Hungary's sweeping anti-terror secret-surveillance law unlawful under Article 8, because it let authorities order surveillance without a sufficient factual basis or meaningful judicial control -- effectively enabling untargeted monitoring of virtually anyone. The ruling reinforced the requirement of individualised suspicion and independent oversight for secret surveillance.

Civil society and oversight bodies in Ireland have contested government plans to give the national police, An Garda Siochana, facial recognition powers since 2022. The Irish Council for Civil Liberties, Digital Rights Ireland, the Data Protection Commission, and the Oireachtas Justice Committee all flagged serious deficiencies, and the committee issued dozens of recommended changes in 2024. The opposition delayed the measure for years, though a 2025 bill authorizing Garda biometric analysis was advancing through the Oireachtas in 2026.

In Commissioner of An Garda Siochana (2022) the EU Court of Justice held that Ireland's regime of general and indiscriminate retention of traffic and location data to fight serious crime was contrary to EU law, reaffirming that blanket retention -- the kind that also underpins mass metadata and vehicle-tracking databases -- is permissible only when targeted and properly safeguarded.

Italy's data protection authority (Garante) fined Clearview AI EUR 20 million, banned further collection and processing of residents' data, and ordered deletion of the biometric data it held.

In December 2021 Italy became the first EU country to pause facial recognition in public spaces, suspending installation and use of the technology by both public and private actors until a dedicated legal framework is passed. Police and judicial criminal investigations were exempted, which civil-society groups criticized, but the moratorium marked a national stand against biometric mass surveillance and was later extended while a permanent law was debated.

Luxembourg is one of the few European countries to have introduced legal restrictions on the use of facial recognition technology.

The Dutch ANPR Act -- Article 126jj of the Code of Criminal Procedure, in force since 2019 -- has police log the plate and location of every passing vehicle and hold it for four weeks in a central database, whether or not anyone is suspected of anything. Privacy First has been litigating to have it declared unlawful since 2021, arguing the bulk retention of millions of motorists' movements is disproportionate under European privacy law, unsupervised, easy to abuse, and by several studies ineffective at what it claims to do. After summary proceedings, the District Court of The Hague cleared the case to proceed on the merits in early 2024. The appeal was heard at the Court of Appeal in The Hague on July 9, 2026 (Privacy First Foundation v. the State, case 200.347.782/01), in a hearing the foundation opened to the public, and it says it will carry the case to the highest European courts if it has to, citing recent European case law and the Dutch data protection authority's own positions. Judgment pending. Read this against Norfolk, Virginia, where a US federal judge held a 21-day ALPR retention window too short to amount to Carpenter-style surveillance: the Dutch window is twice that, nationwide, and statutory rather than contractual. Same technology, same question about how long is too long, two legal systems arriving from opposite directions.

The Dutch DPA fined Clearview AI EUR 30.5 million and warned Dutch companies against using its facial recognition database.

NORWAY SAYS IT WILL REGULATE CAMERA SMART GLASSES -- WITH AN EXPERT GROUP AND NO DEADLINE. On 25 August 2026 Digitalisation Minister Karianne Tung said she wants stricter rules for smart glasses and other wearables that combine AI with cameras and microphones, saying they must not be used to watch people in public. An expert group will advise the ministry and any proposal will go to public consultation. Outlets differ on how far she went: Biometric Update and AFP report a ban on facial recognition, or on the devices, is being considered; the Norwegian tech site digi.no says she did not specifically announce one. The next day Education Minister Kari Nessa Nordtun said schools and municipalities should set their own rules and rejected a national ban in schools. Not established: who sits on the expert group, what it is asked to do, or when it reports.

In Pietrzak and Bychawska-Siniarska and Others v. Poland (2024) -- brought by lawyers and human-rights activists -- the European Court of Human Rights found Poland's secret-surveillance and communications-data-retention regime in breach of privacy rights, citing weak authorisation and oversight and the absence of any notification to those who had been spied on.

Poland is investigating how the previous Law and Justice government used NSO Group Pegasus spyware, which officials say was deployed against roughly 600 people between 2017 and 2022, including the opposition senator who ran the 2019 election campaign. After the government changed in late 2023, prosecutors opened investigations and parliament created a Pegasus and Illegal Surveillance commission in February 2024. In December 2024 a former security service chief was forcibly compelled to testify, a first in Polish history.

Portugal's CNPD imposed a three-month ban on Worldcoin in Mar 2024, in step with Spain and on the same grounds: insufficient information provided to users, biometric collection from minors without consent, and no adequate age-verification mechanism. Two EU regulators independently reaching identical findings in the same month is itself evidence -- the failures were properties of the program's design, not of one country's rollout. The Iberian bans forced the company to halt orb operations across both countries while it answered the regulators.

In Rotaru v. Romania (Grand Chamber, 2000) the European Court of Human Rights held that Romania violated privacy rights by keeping a secret intelligence-service file on a citizen -- containing old and partly false information about his student-era political activity -- with no way for him to challenge or correct it and no legal safeguards over what the security services stored. A foundational ruling on state files and databases.

In Podchasov v. Russia (2024) the European Court of Human Rights held that requiring a messaging service (Telegram) to give authorities the means to decrypt end-to-end encrypted communications violated the right to privacy. Weakening encryption for targeted users, the Court found, weakens it for everyone and is a disproportionate form of mass surveillance -- a landmark defence of encryption.

In Roman Zakharov v. Russia (Grand Chamber, December 2015) the European Court of Human Rights ruled that Russia's system of covert interception of mobile-phone communications (SORM), which let security services tap networks directly with weak oversight, violated the right to privacy under Article 8. The Court set benchmark standards for authorisation and independent supervision of secret surveillance -- standards Russia has since ignored.

Civil society led by the SHARE Foundation forced the withdrawal of draft laws that would have legalized mass biometric video surveillance in Belgrade, in 2021 and again in 2023. Facial recognition remains legally unauthorized in Serbia, though Huawei cameras are installed and rights groups say the software has been used during protests without a legal basis.

In September 2021 Serbia withdrew its Draft Law on Internal Affairs, which would have legalised permanent, indiscriminate biometric video surveillance of Belgrade's public spaces and made Serbia the first country in the region with such a system. The reversal followed a sustained campaign by the SHARE Foundation (Thousands of Cameras / hiljadekamera), EDRi and pressure from members of the European Parliament. The interior ministry has kept trying since -- installing NEC NeoFace Watch and Russian FindFace and floating new draft laws -- but the 2021 win stalled full legalisation.

In Benedik v. Slovenia (2018) the European Court of Human Rights found a privacy violation because Slovenian police obtained the subscriber identity behind a dynamic IP address without a court order, under a law that lacked clarity and safeguards against abuse. A key ruling treating the link between an IP address and a named person as protected private data.

Across 2025 and 2026 Spain's data-protection regulator built Europe's most aggressive line of biometric enforcement, and its lever was not consent but the data-protection impact assessment. In a decision dated November 6, 2025 the AEPD fined airport operator Aena just over 10 million euros for running facial-recognition boarding at eight airports, including Madrid-Barajas and Barcelona El Prat, on a centralised one-to-many template store, and ordered biometric processing suspended until an adequate assessment exists. Aena had already paused the programme in June 2024 after a complaint from the Eticas foundation and a single passenger, and is appealing. On March 4, 2026 the regulator fined FC Barcelona 500,000 euros over face and voice scans of roughly 143,000 members, minors included, during a 2023 membership census. Six days later it fined age-verification vendor Yoti 950,000 euros: 500,000 for having no lawful basis to process biometrics at account setup, 200,000 for a consent screen users could click past with research use pre-ticked, and 250,000 for holding geolocation data five years and retaining fraudulent ID documents to train its algorithms. Yoti is appealing to the Spanish High Court. The regulator's repeated finding was not that the paperwork was missing but that it was hollow -- and that convenience never establishes necessity.

1. Jun 2024 Aena suspended its biometric boarding programme after a complaint to the AEPD from the Eticas foundation and a passenger. biometricupdate.com
2. Nov 2025 The AEPD fined Aena just over 10 million euros for facial-recognition boarding at eight airports without a valid impact assessment, and ordered the biometric processing suspended. Aena is appealing. idtechwire.com
3. Mar 2026 The AEPD fined FC Barcelona 500,000 euros over biometric face and voice verification of about 143,000 members, including minors, without a compliant impact assessment. idtechwire.com
4. Mar 2026 The AEPD fined age-verification vendor Yoti 950,000 euros across three GDPR breaches and gave it six months to comply; Yoti rejected the finding and appealed to the Spanish High Court. yoti.com

Spain's AEPD issued an emergency three-month ban on Worldcoin's iris scanning in Mar 2024 -- the first European country to stop the orbs -- citing insufficient information given to users, collection from minors, and no adequate mechanism to verify age. An emergency order under the GDPR requires urgency and serious risk, and the AEPD found both in a program paying people, including teenagers who queued in shopping centres, to stare into a sphere. The Spanish ban opened the European front that Portugal joined the same month and Germany's deletion order extended in Dec 2024.

After Citizen Lab documented Pegasus and Candiru infections on the phones of dozens of Catalan politicians, lawyers, and activists, and separate infections of the prime minister and defense minister, Spain opened judicial and parliamentary investigations and dismissed the director of its intelligence agency.

Spain data protection agency, the AEPD, fined supermarket chain Mercadona 2.5 million euros in 2021 for running facial recognition across 48 stores that scanned every shopper, including children, to flag people with restraining orders. The regulator ruled the system unlawful under the GDPR and it was ordered stopped.

1. Jun 2020 Mercadona began a facial-recognition pilot across 48 supermarkets to flag people with restraining orders, scanning all shoppers including children. gdprhub.eu
2. May 2021 After complaints and an AEPD interim order, Mercadona halted the pilot and removed the cameras. gdprhub.eu
3. Jul 2021 The AEPD fined Mercadona 2.5 million euros, ruling the facial-recognition system unlawful under the GDPR. hunton.com

In Centrum for rattvisa v. Sweden (Grand Chamber, May 2021, decided alongside Big Brother Watch v. UK) the European Court of Human Rights examined Sweden's bulk signals-intelligence regime -- the mass interception of cross-border communications by the FRA agency -- and found it lacked adequate safeguards, in violation of the right to privacy under Article 8, particularly around oversight and the sharing of intercepted material with foreign partners.

Sweden's data protection authority (IMY) fined the national police EUR 250,000 for using Clearview AI to identify people unlawfully and without a data protection assessment, and ordered the police to inform affected individuals and have their data deleted.

In Amann v. Switzerland (Grand Chamber, 2000) the European Court of Human Rights found two privacy violations: the interception of a phone call to the applicant, and the secret card-index file the federal prosecutor then created and stored about him -- both without a clear legal basis. An early benchmark that even storing seemingly neutral data on a person engages the right to privacy.

The Home Office set out its largest-ever facial-recognition expansion in a January 2026 policing white paper, funding 40 new live facial recognition (LFR) vans for a national rollout across England and Wales and pledging 115 million pounds for a National Centre for AI in Policing. LFR was in use by 13 of 43 forces by March 2026, and the first permanent LFR cameras went live in South London in October 2025. Rights groups and the Equality and Human Rights Commission have contested the deployments, with the EHRC joining a judicial review arguing the Metropolitan Police's use of LFR is unlawful. NORTH YORKSHIRE WENT LIVE ON 23 SEPTEMBER 2026. North Yorkshire Police ran its first live facial recognition deployment in York city centre, scanning for people wanted for offences or by the courts and those judged a risk of harm; the force says non-matches are deleted within a fifth of a second. Deputy Mayor Jo Coles said she had sought assurances on oversight and mission creep and would question the force at her public meetings. By June, Statewatch counted 12 force areas using LFR, four of them for the first time in the previous six months. Which forces receive the 40 promised vans, and when, has not been published. Results of the York deployment are not yet reported.

POLICE SCOTLAND WANTS LIVE FACIAL RECOGNITION; ITS BIOMETRICS WATCHDOG WANTS A LAW FIRST. Police Scotland has not used LFR operationally but is building a business case, and the Chief Inspector of Constabulary's 2025-26 annual report urged it to adopt LFR, AI and drones faster. Scottish Biometrics Commissioner Brian Plastow wrote to the Justice Secretary in May 2026 asking for primary legislation before any deployment, so Scotland avoids the legal vacuum he says LFR grew up in south of the border. Justice Secretary Neil Gray answered that committing to legislation now would be premature. On 1 September Plastow called Scotland's 2011 CCTV strategy hopelessly outdated and asked ministers for a national public-space surveillance strategy, a wider remit for his office and a new code of practice. Not established: any government decision on legislation or a deployment date. Coordinates are Edinburgh.

On Jul 27, 2026 the UK Supreme Court ruled 3-2 that Bahrain cannot claim state immunity to block a spyware lawsuit -- holding that remotely infecting a computer physically located in the UK is an act carried out IN the UK. The precedent is the record: a foreign government that hacks a device in Britain from abroad now faces the same civil liability in English courts as one that sends agents in person, which closes the procedural shield transnational spyware campaigns have hidden behind. The claimants are Dr Saeed Shehabi, 71, a journalist and founder of a Bahraini opposition movement, and Moosa Mohammed, a Bahraini refugee, both in London; they allege agents acting for Bahrain infected their computers in Sep 2011 with FinSpy -- the commercial spyware of the now-defunct Munich firm FinFisher, capable of logging keystrokes, tracking location and monitoring communications. Bahrain denied the hacking and argued sovereign immunity; the High Court rejected that in 2023, the Court of Appeal upheld it in 2024, and the Supreme Court has now closed the question. Filed `contesting` because the win is jurisdictional, not final: the case returns to the High Court for full trial. It sits alongside WhatsApp v. NSO in the US as the second front testing whether spyware operations against exiles can be litigated where the victims live.

Keir Starmer announced a free national digital ID on 25 September 2025 -- branded BritCard, held in a GOV.UK wallet, mandatory for right-to-work checks and targeted for full rollout in 2029. The backlash was the largest of any recent UK digital policy: a parliamentary petition against it drew close to three million signatures, one of the biggest in British history, and thousands marched from Marble Arch to Whitehall on 18 October 2025 behind placards calling it a digital prison. Security specialists warned about concentrating that much identity data in a single store. In January 2026 the government dropped the mandatory element and made the scheme voluntary; that concession did not save it. Andy Burnham, sworn in as prime minister on 20 July 2026, confirmed on taking office that the roughly 1.8 billion pound programme is cancelled outright and the money redirected to cost-of-living measures. Separate digital public services and the wider government digital programme continue -- what died is the universal state identity credential. Unlike most wins on this map, this one came from sustained public opposition rather than a courtroom.

1. Sep 2025 Starmer announced BritCard, a free national digital ID mandatory for right-to-work checks, with rollout targeted for 2029. bankinfosecurity.com
2. Oct 2025 Thousands marched from Marble Arch to Whitehall against the scheme; the parliamentary petition against it neared three million signatures. computing.co.uk
3. Jan 2026 Under sustained pressure the government dropped the mandatory element and made the scheme voluntary. aljazeera.com
4. Jul 2026 Andy Burnham cancelled the programme outright on becoming prime minister, redirecting the funds to cost-of-living measures. techcrunch.com

In May 2022 the UK Information Commissioner fined Clearview AI more than 7.5 million pounds and ordered it to stop scraping images of UK residents and to delete the data it already held, after a joint investigation with Australia regulator. Clearview appealed and a lower tribunal threw out the penalty in 2023 on jurisdiction grounds, but in October 2025 the Upper Tribunal restored most of the regulator case, ruling that Clearview does fall under UK data-protection law. The company may still seek further appeal.

The UK Information Commissioner's Office fined Clearview AI GBP 7.5 million and ordered it to delete UK residents' data, finding the company built its database by scraping images from the web without consent. Clearview appealed.

In Big Brother Watch and Others v. the United Kingdom (Grand Chamber, May 2021), the European Court of Human Rights found that the UK's bulk interception of communications -- the GCHQ mass-surveillance regime exposed by Edward Snowden -- violated the right to privacy (Article 8) and press freedom (Article 10) because it lacked sufficient end-to-end safeguards against abuse. It was the first Grand Chamber ruling on bulk interception in the post-Snowden era.

In 2020 the Court of Appeal ruled South Wales Police live facial recognition unlawful in the Bridges case, the first successful legal challenge of its kind. In 2022 the ICO fined Clearview AI and ordered UK residents data deleted. Live facial recognition has since expanded to more police forces, and the fight over its limits continues.

1. Sep 2019 The High Court dismissed Edward Bridges challenge to South Wales Police use of live facial recognition. libertyhumanrights.org.uk
2. Aug 2020 The Court of Appeal ruled South Wales Police live facial recognition unlawful, the first successful legal challenge to the technology in the UK. The case was backed by the civil liberties group Liberty. libertyhumanrights.org.uk
3. May 2022 The ICO fined Clearview AI over 7.5 million pounds and ordered it to delete UK residents data. time.com

In Catt v. the United Kingdom (January 2019) the European Court of Human Rights held that police violated the privacy of John Catt -- a lifelong peace activist in his 90s with no history of violence -- by retaining detailed records of his attendance at protests on a national police 'domestic extremism' database. The Court found the collection may have been justified but the open-ended retention, with no clear definition of 'domestic extremism' and no time limits, was not -- a significant check on the surveillance of peaceful protest.

In S. and Marper v. the United Kingdom (Grand Chamber, December 2008) the European Court of Human Rights unanimously ruled that the blanket, indefinite retention of DNA samples, cellular samples and fingerprints of people arrested but never convicted violated the right to privacy under Article 8. The two applicants from Sheffield had been arrested and then cleared, yet police kept their biometric data forever. The landmark ruling forced the UK to overhaul its DNA database; the Court reaffirmed it in Gaughran v. UK (2020), striking down indefinite biometric retention even for a minor conviction.

The strongest Worldcoin outcome anywhere: declared illegal, and the data destroyed under supervision. On May 5, 2025 the Nairobi High Court (Justice Aburili Roselyne) ruled that Tools for Humanity -- the Sam Altman-cofounded operator of Worldcoin -- violated Kenya's Data Protection Act by collecting iris and facial biometrics without valid consent and without a data protection impact assessment. The court's core finding travels: consent obtained by paying people -- 25 WLD tokens, roughly $50-55, in a market where that money matters -- is not free, informed consent. The case was brought by the Katiba Institute after the 2023 Nairobi rollout drew queues long enough that the government suspended operations on public-safety grounds. The court gave the company seven days to delete everything under Office of the Data Protection Commissioner supervision, and in Jan 2026 the ODPC confirmed all Kenyan biometric data had been permanently erased. Counsel Joshua Malidzo Nyawa called it a win for privacy rights. The contrast is part of the record: the same month Kenya's court ruled the model unlawful, World launched sign-ups in six US cities.

HONG KONG POLICE SAY FACE RECOGNITION IS COMING TO THEIR STREET CAMERAS IN 2026. Commissioner Joe Chow said in February 2026 that police aim to add facial recognition to the SmartView public CCTV network this year, after missing an end-2025 target because of what he called legal and technical issues. SmartView began in April 2024; police added about 2,000 camera units in 2025 and planned 2,000 more in 2026, and a second phase for 2026-28 would add some 20,000 cameras a year, partly by pulling other departments' cameras into the police network (Hong Kong Free Press, citing a Legislative Council paper). Police credit SmartView with a 42.5% fall in certain street crimes; that figure is theirs. There is no specific law governing police facial recognition in Hong Kong in any source read. Not established: whether face matching has been switched on, what watchlists it would use, or any rules from the Privacy Commissioner.

After reports that about 300 Indian numbers, including those of journalists, opposition politicians, and activists, appeared in the leaked Pegasus list, the Supreme Court appointed an independent expert committee in October 2021 to investigate alleged government use of the spyware. The committee said the government did not cooperate, and its findings remain sealed.

Indonesia suspended World (formerly Worldcoin) and World ID in May 2025 after public complaints, with the Ministry of Communication and Digital pausing the operator's permit as what its director general for digital supervision, Alexander Sabar, called a preventative measure to mitigate risks to the public. The ministry's investigation gave the suspension its edge: officials said retina data had been collected from Indonesians since 2021, while the local operator only registered as a foreign electronic system provider in 2025 -- four years of collection before the paperwork existed. The app had been offering people between Rp200,000 and Rp800,000 for scans. Two local entities were put under investigation over licensing and unlawful operations.

After the Pegasus revelations and the US blacklisting of NSO Group and Candiru, Israel's Defense Ministry cut the list of countries its cyber firms may sell surveillance and hacking tools to from 102 to 37 in November 2021, dropping clients with poor rights records such as Morocco, Mexico, Saudi Arabia, and the UAE, and reportedly revoked thousands of export licenses over the following year. It is a rare case of the source country reining in its own spyware industry.

The Philippines' National Privacy Commission ordered Tools for Humanity to immediately halt operations in Oct 2025, citing consent failures and the exploitation of vulnerable populations -- the regulator saying out loud what the token model implies: the program's growth ran through people for whom the payout was the point. The Philippine order made it the fourth Asia-Pacific jurisdiction to stop the program in a single year, after Indonesia's suspension and amid continuing scrutiny in Hong Kong, and it landed while the company was signing identity-verification partnerships with Tinder, Zoom and Docusign in the US -- the same biometric network regulators were halting abroad being sold as fraud protection at home.

Pro-democracy activist Jatupat Boonpattararaksa, whose phone was infected with Pegasus three times in 2021, sued NSO Group in the Bangkok Civil Court. Amnesty International filed an expert brief in the case in September 2024, part of a wider effort to hold the spyware industry accountable in Thai courts.

Australia privacy regulator, the OAIC, ruled Clearview AI breached privacy law by scraping Australians images and ordered it to stop and delete the data. In 2024 the regulator also found retailer Bunnings breached privacy by running in-store facial recognition on hundreds of thousands of shoppers, a finding a tribunal later softened in part on appeal.

1. Nov 2021 The OAIC found Clearview AI breached the Privacy Act by scraping Australians faces and ordered it to stop collecting and to delete the data. theconversation.com
2. Nov 2024 The Privacy Commissioner ruled Bunnings breached privacy by running facial recognition on shoppers across more than 60 stores, and ordered it to stop and destroy the data. oaic.gov.au
3. Feb 2026 A review tribunal upheld the notification and governance breaches but found Bunnings could use the technology for the limited purpose of fighting serious retail crime. The Commissioner did not appeal. oaic.gov.au

Australia's Privacy Commissioner ruled on Nov 19, 2024 that Bunnings -- the country's biggest home-improvement chain -- breached privacy law by running facial recognition on likely hundreds of thousands of customers across 62-63 stores in New South Wales and Victoria between Nov 2018 and Nov 2021, without consent and without telling anyone. The system compared every entering face against a database of people flagged for past crime or violent behaviour, deleting non-matches automatically -- and Commissioner Carly Kind's finding is the one that travels: efficient and well-intentioned does not mean lawful, because the technology interfered with the privacy of everyone who walked in, not just the flagged. The orders after a two-year investigation: stop, never repeat, destroy all retained personal and sensitive data after 12 months, and publish a public statement of the mishandling within 30 days. No fine was imposed. Bunnings called itself deeply disappointed, released CCTV of staff being assaulted in its defence, and is seeking Administrative Review Tribunal review -- so the orders stand but the fight continues. Pinned at Melbourne (company HQ) as a national-chain convention.

Electronics chain The Good Guys, owned by JB Hi-Fi, paused its facial-recognition trial in Jun 2022 within a day of consumer group CHOICE naming it in a complaint to the Office of the Australian Information Commissioner -- the complaint called the use unreasonably intrusive and potentially unlawful, and named Bunnings and Kmart alongside it. The company said it was confident it had complied with the law and paused anyway pending OAIC clarification, which is the point of recording it: the pause came from a consumer-group complaint and press attention, before any regulator ruled. The three chains named in that one complaint ran to about A$25 billion in annual sales across 800 stores; the Bunnings arm of it produced the landmark 2024 determination. Pinned at Melbourne as a national-chain convention.

The Australian Information Commissioner ordered the 7-Eleven chain in 2021 to destroy the faceprints it had collected at roughly 700 convenience stores -- gathered through iPads set up to run customer feedback surveys, which photographed the faces of the people filling them in. A survey tablet doubling as a biometric collector is the detail that makes this record generalise: the collection surface was disguised as something mundane, and nobody tapping a satisfaction screen understood they were being faceprinted. The destruction order made 7-Eleven an early marker in what became the OAIC's retail-biometrics line -- the same regulator ordered Clearview AI to destroy Australian data and stop scraping the same year, and reached the landmark Bunnings determination in 2024. Date marked approximate: sourced reporting places the order in 2021 without a confirmed day. Pinned at Melbourne as a national-chain convention.

New Zealand Police secretly trialed Clearview AI in 2020 without sign-off from the Police Commissioner, the Privacy Commissioner, or Cabinet. After the trial was exposed and halted, an independent review led police to commit not to use live facial recognition until its privacy, legal, and ethical impacts are understood.

1. May 2020 Reporting revealed police had secretly trialed Clearview AI without authorization. The trial was halted and the Police Commissioner ordered a stocktake of surveillance tools. rnz.co.nz
2. Dec 2021 An independent review prompted police to halt plans for live facial recognition, with police stating they will not use it until the impacts are fully understood. rnz.co.nz