"Not everything technically possible can be legally justified" — watchdog rebukes police law
Lower Saxony's data protection commissioner Denis Lehmkemper names four planned powers as especially intrusive. Three of them concern AI systems directly.
Illustration · AI-generated (AI IN LIFE)
At a glance
- Criticism from Denis Lehmkemper, data protection commissioner of Lower Saxony
- Subject: planned reform of the Lower Saxony police and public order act (NPOG)
- Named as especially intrusive: intelligent video surveillance, real-time biometric remote identification, retrospective biometric matching, automated data analysis
- The office rejects real-time biometric remote identification
- Demands: incident-based analysis, shorter retention periods, comprehensive data subject rights, clear alignment with the EU AI Act
Denis Lehmkemper, data protection commissioner for the German state of Lower Saxony, has sharply criticised the planned reform of the state's police and public order act. In his activity report he warns of severe infringements of fundamental rights.
He names four measures as especially intrusive: intelligent video surveillance, real-time biometric remote identification, retrospective biometric matching against publicly accessible data, and automated data analysis. His office rejects real-time biometric remote identification outright — the scope of application is too broad given the number of people affected and the geographic reach.
Lehmkemper describes the automated consolidation and analysis of personal data from different sources as a paradigm shift. This is the legally most delicate point: individually lawful data points, once merged, produce a personality profile that could never have been collected as such. The depth of the intrusion is created by the linkage itself.
His demands are correspondingly concrete: restriction to incident-based analysis, shorter retention periods, comprehensive data subject rights, and a clear definition of AI use in line with the European AI Act. The sentence summarising his criticism: not everything that is technically possible can also be legally justified.
The reference to the AI Act is more than a courtesy. Real-time biometric remote identification in public spaces is among its most tightly regulated applications — prohibited in principle and permitted only in narrowly defined exceptions. A state law permitting it more broadly than the European rule would collide directly with higher-ranking law.
That points to a pattern now repeating across several German states: police law is being extended to cover AI-assisted analysis while European regulation for exactly those applications is only entering practice. Netzpolitik.org likewise reports constitutional concerns about the draft.
FAQ
What is real-time biometric remote identification?
Automatic matching of faces from live camera feeds against a database, without the people captured participating or noticing.
Why is automated data analysis called a paradigm shift?
Because it merges lawfully collected data from separate sources. Only the linkage produces a personality profile that could never have been gathered directly.
What role does the EU AI Act play?
It regulates real-time biometric remote identification in public spaces especially strictly — prohibited in principle, permitted only in narrow exceptions. State law cannot go further.
