Europe’s Surveillance Rules Are Being Written Around the Exceptions

Rules that look like bans are built with exceptions, and the exceptions are where the policy gets made. Police facial recognition shows the pattern in several countries at once.

A new German federal police bill includes live facial recognition in emergencies, and a Bundestag vote on it still has to be confirmed. Civil society groups warned in 2025 that Hungary planned to use the technology on participants in Pride events. France extended its algorithmic video surveillance experiment past the Olympics that justified it.

The EU rulebook: bans with doors in them

The AI Act, in force since 2024, prohibits real-time remote biometric identification by police in publicly accessible spaces. The exceptions are the substance.

A summary by the advocacy outlet State of Surveillance, which is critical of the Act, lists three: searching for missing persons or victims of abduction and trafficking, preventing a substantial and imminent threat to life or a foreseeable terrorist attack, and locating suspects of serious crimes carrying a sentence of at least four years. Member states can then pass national laws that authorise these uses.

Read also: Europe’s Ankle Tags for People Nobody Convicted

Retrospective identification, which analyses recorded footage after the fact, is not banned. The Act classes it as high risk and attaches conditions: authorisation by a judicial or administrative authority, strict necessity for a specific offence, documentation of each use, and no legal decision based solely on the system’s output. Those high-risk duties were due on 2 August 2026, but a Digital Omnibus on the AI Act moved the date for this category to 2 December 2027.

Elsewhere in Europe: the exceptions get used

Germany. On 17 July 2026 Biometric Update reported that the Bundestag approved a new Federal Police Act, the first overhaul since 1994, covering about 55,000 federal officers. It includes live facial recognition in public places in emergencies involving urgent danger to the state or an individual, legal backing for automated video analysis, and wider digital surveillance.

The vote was taken by a show of hands without enough members present to count as a binding decision. It still needs a confirmed majority and then the Bundesrat. The coalition has enough seats to pass it in a repeat vote.

Read also: When Any Video Can Be Fake, Who Tells the Court?

Hungary. In 2025 civil society groups and a member of the European Parliament warned that Hungary planned to use facial recognition to identify participants in Pride events after a law banning them. The MEP argued this would breach the AI Act. The case is a reminder that a technology approved for terrorism and missing children can be aimed at a protest.

Data retention. Europe has had no common retention law since the Court of Justice struck down the Data Retention Directive in 2014. In 2020 the Court ruled in La Quadrature du Net that general and indiscriminate retention of traffic and location data is allowed only for a serious and genuine threat to national security, for a limited time. Targeted retention is allowed for serious crime.

The result is a patchwork. Germany has had no mandatory retention since 2010 and its cabinet has now proposed that internet providers store IP addresses for three months. Austria, Romania, Slovenia and the Netherlands have no general mandatory retention for criminal investigations.

A European Parliament briefing of July 2026 says the Commission was preparing an EU framework, that its impact assessment had not appeared, and that at least one influential member state had voiced reservations.

Private messages: the scanning fight

The Commission proposed in 2022 a regulation to fight online child sexual abuse that could require services to detect it. Critics call it chat control because scanning encrypted messages means reading them on the device before they are encrypted. The timeline, according to the Brussels Record tracker, which takes a critical view of the proposal, runs like this.

• The Parliament voted in November 2023 against requiring scans of encrypted communications.
• The Council adopted its negotiating position on 14 November 2025 and dropped mandatory client-side scanning, while keeping voluntary scanning, age verification duties and detection orders for known material on unencrypted platforms.
• The old temporary rule that allowed voluntary scanning expired on 3 April 2026. A replacement regulation entered into force on 31 July 2026 and runs until 3 April 2028. Parliament added amendments that exclude end-to-end encrypted communications from its scope.
• The permanent regulation is still in negotiation. The sixth trilogue took place on 29 September and no deal on private messages has been announced.

The tracker counts nine governments on record against mandatory scanning of private messages. Treat that tally as an advocacy count until the Council publishes it.

Strasbourg has already said where the line runs

Courts have not waited for the legislators. In Glukhin v. Russia, decided on 4 July 2023, the European Court of Human Rights found violations of Article 8 (private life) and Article 10 (expression) after Moscow police used facial recognition to identify and prosecute a man who had protested alone in the metro.

The Court called facial recognition highly intrusive, and more so when it is used live. It required a clear legal basis, a high level of necessity and real safeguards, and it found Russia’s practice wanting on all three.

Russia is a convenient defendant. The judgment does not say that every use of the technology is unlawful, and some commentators have criticised it for stopping short of that. What it does is set a test that any European government must pass. A statute that authorises scanning on the grounds of a vague public-order interest, without independent authorisation and records of use, would struggle against it.

A narrower power, limited to named serious crimes and subject to a judge, is closer to the line the Court drew. Whether a given national law stays inside that line is a question for national courts and, in time, for Strasbourg.

France: the experiment that kept going

France offers a case study in how a temporary measure becomes a fixture. For the Paris 2024 Olympics the government authorised algorithmic video surveillance, cameras whose software flags events in eight listed risk situations, with biometric identification expressly excluded.

The experiment was due to end on 31 March 2025. It was extended to 31 December 2027, through an article in the bill on the 2030 Winter Games. French reporting says the official evaluation found the tools of limited operational use, and the data protection authority CNIL oversees the system.

Two details matter beyond France. A trial built around a mega-event outlived the event. And the stated lesson of the evaluation, that the technology did not do much, did not stop the extension. A tool that fails to prove its worth can still win a longer licence if the security case for it is made loudly enough.

Surveillance arrives one exception at a time

Mass surveillance rarely arrives in Europe through a single decision. It builds up through a sequence of narrow decisions, each justified by a grave crime. Each country then borrows the exceptions of the previous one.