Introduction
Facial recognition technologies (FRTs) are being increasingly deployed in the name of efficiency and public security from law enforcement to border control. While these AI-driven systems can automate identification and verification, they rely on highly sensitive biometric data, raising urgent human rights concerns. FRTs are prone to algorithmic biases, disproportionately affecting racialised and marginalised communities, and their misuse can enable mass surveillance that undermines freedom of expression and assembly. Cases such as Hungary’s deployment of FRTs at the Budapest Pride March and Clearview AI’s unlawful data collection in Europe demonstrate how these technologies can be weaponised to monitor, control, and intimidate individuals. Despite the existence of regulatory frameworks, which delineate the boundaries of legitimate uses of FRTs, breaches of frames take place and should prompt a concerned response.
FRTs and European Law
In Europe, FRTs are a frequently utilised tool of public security operations from law enforcement to border control. Facial features represent biometric data: unique, permanent, highly personal and thus sensitive information. While FRTs have the power to automate and speed up identification and verification procedures, their use raises concern over respect of individual rights and democratic processes, prompting society and politics to ponder about issues of privacy, discrimination, and mass surveillance.
Facial recognition is an AI-based technology that can identify and categorise biometric data (Laganà, 2022), automatically processing digital images of faces. When it comes to identification, FRTs compare the template of one’s face to those of faces stored in a database and indicate the probability that two images refer to the same person (FRA, 2020). FRTs can also be used to profile individuals based on facial traits, making predictions about one’s ethnicity, sex, or age (FRA, 2020). Algorithmic biases in FRTs have sparked debate around the technology’s significantly lower accuracy when it comes to racialised communities, leading to discriminatory false positives (Madiega, & Mildebrath, 2021; Oliveira et al., 2025).
Aside from its problematic biases, which challenge Art. 14 (“Prohibition of Discrimination”) of the European Convention on Human Rights (ECHR), the debate around FRTs centres around their compatibility with individuals’ rights, their potential to enable mass surveillance and its consequent chilling effects on society. FRTs use has raised concerns over human right abuses and some of the founding principles of democracy, namely freedom of expression and assembly (González Fuster & Nadolna Peeters, 2021). For instance, the use of FRT to arrest protesters in Russia was condemned in 2023 by the European Court of Human Rights (ECtHR) (Business & Human Rights Resource Centre, 2023).
FRTs Employment in Europe: The case of Hungary
Recently, Hungary has drawn attention to its deployment of FRT during the Budapest Pride March (Datta, 2025). Hungary has already been deploying FRTs as part of the Dragonfly project, which runs 35,000 CCTV cameras integrated in one single searchable biometric database (Greens/EFA, n.d.). The National Expert and Research Centre’s (NSZKK) database contains photos from the address registry, ID cards, driving licences, and passports, as well as images from criminal, immigration, and refugee records (Kozák, 2025).
Limitations regarding the collection and processing of biometric data by FRTs are delineated in the recent EU Artificial Intelligence Act. Its Article 5 (“prohibited AI practices”) lays out what use of AI is considered to create unacceptable risks (European Commission, n.d.-a). For example, the use of AI remote biometric identification systems in public spaces for law enforcement is prohibited (European Commission, n.d.-a), and employing FRTs to recognise biometric data of protest attendants is therefore not allowed (Madiega, & Mildebrath, 2021). Post-event categorisation or recognition is permitted, but considered high risk (Madiega, & Mildebrath, 2021). Particularly, use of FRTs is considered high risk when used to profile someone and its results are not complemented by human judgement (European Commission, n.d.-b). In the case of Hungary, in 2024 the country modified its system to not require any human supervision in the case of minor offenses (Kozák, 2025).
During Budapest Pride on June 28, 2025, police forces were authorised to use FRT to identify and fine participants (CAPABLE, 2025). This decision followed the government’s prior ban on the march, alongside any demonstration that depicts homosexuality or gender transition (Harkavy, 2025). Brando Bonifei, co-rapporteur of the AI Act in the European Parliament (EP), and Laura Caroli, AI governance expert who negotiated EU AI rules for the EP, spoke out saying Hungarian usage of FRTs is illegal under the AI Act (Datta, 2025; Harkavy, 2025). However, the compatibility of Hungary’s use of FRTs with the AI Act remains unclear, given the blurred line between what constitutes real-time and post facto facial recognition (CAPABLE, 2025).
What is certain, nevertheless, is that FRTs’ misuse can severely infringe rights of the individual. The use of FRTs at protests by Hungary is intended to have a ‘chilling effect’ on society, discouraging people from voicing their opinion (ECNL, 2025), clearly in contrast with Art. 11.1 of the CFR and Art.10 of the ECHR, guaranteeing the right to freedom of expression (Laganà, 2022). Likewise, Art. 12.1 of the CFR and Art. 11.2 of the ECHR protect individuals’ right to freedom of assembly and association (Laganà, 2022). When individuals are aware that they might be observed, registered, and punished for expressing their opinions or assembling as a community, their behaviour inevitably changes, and self-censorship is likely to occur, effectively depriving the individual of their right (ECNL, 2025; Gabrielli, 2025).
Hungary’s progressive expansion of FRTs illustrates how AI-run biometric recognition can shift from an effective tool for crime prevention, to an instrument of population control, resulting in extensive monitoring of citizens. If this is coupled with biases that AI has been shown to possess, this raises the prospect not only of mass surveillance, but also a society where marginalised communities are yet again discriminated against, at greater danger. The Hungarian case illustrates some of the risks of AI use within the EU, as opposed to the already cited misuse of biometric at the borders of the Union (Ozkul, 2023).
Data Protection Concerns: The case of Clearview AI
What must also be taken into account is how data is processed and by whom. FRT providers get access to highly personal information and under Art. 8 of the EU Charter of Fundamental Rights (CFR), everyone has the right to protection of their personal data (FRA, n.d.-a). The data must be processed fairly and only on the basis of consent or legitimate legal basis, with the possibility for the individual to access and know the data being stored and processed about them (FRA, n.d.-a). The General Data Protection Regulation (GDPR), in Article 5, further prompts EU countries to ensure each person is transparently informed about the processing of their data (FRA, n.d.-b).
Europe has seen instances of mismanagement and misacquisition of biometric data. The case of Clearview AI, which is still a provider of FRTs in countries like the USA, illustrates the risks surrounding the employment of FRTs by governments. Clearview AI, a US-based company developing AI models for facial recognition, encountered significant legal actions due to its operations in Europe, facing heavy fines and even bans in several European countries. In March 2022, the Italian Data Protection Agency fined Clearview AI for €20 million after determining that the company had processed personal, biometric, and geolocation data without a valid legal basis, therefore breaching the GDPR (EDPB, 2022a). Similarly, the French data protection authority fined Clearview AI for €20 million in October 2022 (EDPB, 2022b). The Netherlands and the United Kingdom also heavily fined Clearview AI (Luna Sanz, 2022; Davies, 2024).
Because Clearview AI unlawfully collected, processed, and stored personal, biometric, and geolocation data without any legal basis. (EDPB, 2022a; EDPB, 2022b; Luna Sanz, 2022; Davies, 2024) it breached central GDPR principles including transparency, purpose limitation, and storage limitation, all while failing to inform people about the storage and use of their data, and ignoring requests of deletion (EDPB, 2022a; EDPB, 2022b; Luna Sanz, 2022; Davies, 2024). To build its database, Clearview AI illegally scraped the web for biometric data, subsequently failing to cease such activities when ordered by authorities (Davies, 2024). While Clearview AI is not the contractor of Project Dragonfly in Hungary, with GVSX Kft being the FRTs provider, (Sarkadi Nagy, 2021) the case of Clearview AI shows the risks that FRTs can pose to the human rights of Europeans.
Conclusion
FRTs are not neutral tools. Their built-in discriminatory biases risk impacting marginalised communities and vulnerable individuals, as research on EU border checks and asylum requests processing has shown (Giannakou, 2021). Yet, they also pose a threat to European society at large, heightening the risk of privacy breaches and enabling the silencing of individuals and the discouragement of community gatherings. The deployment of FRTs at protests or through unauthorized databases illustrates how states and companies can weaponize technology to control and surveil citizens. European laws like the GDPR and the AI Act exist to protect individuals, however repeated violations reveal gaps in enforcement and accountability. Protecting human rights will require greater attention to be placed on the misuse of FRTs and the gathering of biometric data.
Bibliography
Business & Human Rights Resource Centre. (2023, July 4). European Court of Human Rights rules that Russia illegally used facial-recognition to arrest protestor. https://www.business-humanrights.org/en/. Accessed October 15, 2025.
CAPABLE. (2025, July 07). When surveillance meets protest: The case of Budapest Pride. https://www.capable.design/blogs/notizie/when-surveillance-meets-protest-the-case-of-budapest-pride. Accessed October 15, 2025.
Datta, A. (2025, March 20). Hungary’s use of facial recognition violates EU AI Act. Euractiv. https://www.euractiv.com/news/hungarys-use-of-facial-recognition-violates-eu-ai-act/. Accessed October 15, 2025.
Davies, P. (2024, September 3). Clearview AI fined by Dutch authorities for ‘illegal’ facial recognition database. Euronews. https://www.euronews.com/next/2024/09/03/clearview-ai-fined-by-dutch-authorities-for-illegal-facial-recognition-database. Accessed October 15, 2025.
European Commission. (n.d.-a). Article 5: Prohibited AI Practices.. https://artificialintelligenceact.eu/article/5/. Accessed October 15, 2025.
European Commission. (n.d.-b). Article 6: Classification rules for high-risk AI systems. EU Artificial Intelligence Act. https://artificialintelligenceact.eu/article/6/. Accessed October 15, 2025.
European Center for Not-for-Profit Law (ECNL). (2025, April 28). Hungary’s new biometric surveillance laws violate the AI Act. https://ecnl.org/news/hungarys-new-biometric-surveillance-laws-violate-ai-act. Accessed October 15, 2025.
European Data Protection Board (EDPB). (2022a, March 10). Facial recognition: Italian SA fines Clearview AI EUR 20 million. https://www.edpb.europa.eu/news/national-news/2022/facial-recognition-italian-sa-fines-clearview-ai-eur-20-million_en. Accessed October 15, 2025.
European Data Protection Board (EDPB). (2022b, October 20). French SA fines Clearview AI EUR 20 million. https://www.edpb.europa.eu/news/national-news/2022/french-sa-fines-clearview-ai-eur-20-million_en. Accessed October 15, 2025.
European Union Agency for Fundamental Rights (FRA). (2020). Facial recognition technology: Fundamental rights considerations in the context of law enforcement.
European Union Agency for Fundamental Rights (FRA). (n.d.-a). Article 8 — Protection of personal data. https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data#:~:text=Article%2013:%20Obligation%20to%20take,Human%20Rights%20and%20Fundamental%20Freedoms.&text=(19)%20This%20Regulation%20respects%20the,with%20those%20rights%20and%20principles. Accessed October 15, 2025.
European Union Agency for Fundamental Rights (FRA). (n.d.-b). FRA Opinions: Biometrics. https://fra.europa.eu/en/content/fra-opinions-biometrics. Accessed October 15, 2025.
Gabrielli, G. (2025). The Use of Facial Recognition Technologies in the Context of Peaceful Protest: The Risk of Mass Surveillance Practices and the Implications for the Protection of Human Rights. European Journal of Risk Regulation, 16(2). pp. 514-541. https://doi.org/10.1017/err.2025.26.
Giannakou, E. (2021). Migrants’ human rights facing surveillance technologies in immigration enforcement. Jean Monnet European Centre of Excellence, National and Kapodistrian University of Athens.
González Fuster, G., & Nadolna Peeters, M. (2021). Biometric recognition and behavioural detection: Assessing the ethical aspects of biometric recognition technologies, with a focus on facial recognition. European Parliament, European Parliamentary Research Service.
Greens/EFA. (n.d.). Facial recognition in European cities – What you should know about biometric mass surveillance. https://www.greens-efa.eu/opinions/facial-recognition-in-european-cities-what-you-should-know-about-biometric-mass-surveillance/. Accessed October 15, 2025.
Harkavy, R. (2025, March 27). Hungary’s surveillance of Pride attendees may breach EU law. International Comparative Legal Guides. https://iclg.com/news/22439-hungary-s-surveillance-of-pride-attendees-may-breach-eu-law#:~:text=The%20legislation%20imposes%20fines%20on,resistance%20and%20widespread%20international%20condemnation. Accessed October 15, 2025.
Kozák, D. (2025, April 7). The government’s facial recognition system to be used against protesters: Here’s how it works. 24.hu. https://24.hu/belfold/2025/04/07/the-governments-facial-recognition-system-to-be-used-against-protesters-heres-how-it-works/. Accessed October 15, 2025.
Laganà, M. E. (2022, April 1). Facial recognition and human rights in Europe. Human Rights Pulse. https://www.humanrightspulse.com/mastercontentblog/facial-recognition-and-human-rights-in-europe. Accessed October 15, 2025.
Luna Sanz, M. B. (2022, April 6). About ClearviewAI’s mockery of human rights, those fighting it, and the need for EU to intervene. European Digital Rights (EDRi). https://edri.org/our-work/we-need-to-talk-about-clearview-ai/. Accessed October 15, 2025.
Madiega, T., & Mildebrath, H. (2021). Regulating facial recognition in the EU (PE 698.021). European Parliamentary Research Service.
Oliveira, A. M. de, Rodrigues, H. X., Nery, A. S., Mendonça, F. L. L. de, & Ribeiro Junior, L. A. (2025). Influence of racial bias in the use of facial recognition applied to access control: A critical analysis. Research, Society and Development, 14(2). http://dx.doi.org/10.33448/rsd-v14i2.48186.
Ozkul, D. (2023). Automating Immigration and Asylum: The Uses of New Technologies in Migration and Asylum Governance in Europe. AFAR Project / Refugee Studies Centre, University of Oxford.
Sarkadi Nagy, M. (2021, December 9). After terrorists crossed Hungary, surveillance cameras connected through Project Dragonfly. Átlátszó English. https://english.atlatszo.hu/2021/12/09/after-terrorists-crossed-hungary-surveillance-cameras-connected-through-project-dragonfly/. Accessed October 15, 2025.
