Back to Law enforcement and public security

The use of AI systems in law enforcement may impact Articles 8 (Right to respect for private and family life), 10 (Freedom of expression), 11 (Freedom of assembly and association), as well Article 2 of Protocol no. 4 to the ECHR (Freedom of movement). The Court’s jurisprudence highlights the risks for the full enjoyment of these rights presented by the broad use of AI systems in this sector.

The storing or release of data relating to the private life of an individual by a law enforcement authority or security service amounts to an interference with the right under Article 8[1] and the need for safeguards will be all the greater where the protection of personal data undergoing automatic processing is concerned, especially when such data are used for law enforcement purposes.[2]

Convention 108(+) also allows exceptions to personal data protection provisions on grounds of national security, public safety and the investigation of criminal offences; however, it requires States Parties to establish safeguards and limitations to ensure that any exceptions remain necessary and proportionate.[3] Additionally, processing activities for national security purposes must be subject to independent and effective review and supervision under the domestic legislation of the respective Party.[4]

 Quick links

• Interception of communications and secret surveillance
• Facial recognition

 Interception of communications and secret surveillance

AI-system based surveillance technologies, including facial recognition and remote biometric identification, introduce new challenges in the protection of human rights. These technologies significantly enhance the scope, speed, and scale of surveillance, including bulk interceptions, increasing risks of, for example, mass data collection, serious privacy breaches, or the potential for profiling. At the same time AI systems may be opaque, biased, or be prone to errors.

Surveillance of an individual by law enforcement or security services will generally involve an interference in private life, protected by Article 8 ECHR.[5] Powers of secret surveillance of citizens are permissible under the ECHR only in so far as strictly necessary for safeguarding the democratic institutions.[6] There must be relevant and sufficient reasons for the surveillance and it must be proportionate to the legitimate aim pursued.[7] Secret surveillance must be undertaken in accordance with the law. In general, this entails, that the impugned measure must have some basis in domestic law, which law must be adequately accessible and be formulated with sufficient precision to enable those to whom it applies to regulate their conduct and, if need be with appropriate advice, to foresee, to a degree that is reasonable in the circumstances, the consequences which a given action may entail.[8] In the special context of secret measures of surveillance, such as the interception of communications, “foreseeability” means that the domestic law must be sufficiently clear to give citizens an adequate indication as to the circumstances in which and the conditions on which public authorities are empowered to resort to any such measures.[9]

Measures of secret surveillance must also be “necessary in a democratic society” in pursuit of a legitimate aim. The national authorities enjoy a wide margin of appreciation in choosing how best to achieve the legitimate aims of, among other things, protecting national security.[10] However, “in view of the risk that a system of secret surveillance for the protection of national security may undermine or even destroy democracy under the cloak of defending it”, guarantees against abuse which are adequate and effective are required.[11] Factors such as the “nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorise, carry out and supervise them, and the kind of remedy provided by national law” are relevant to determine compliance with the ECHR.[12]

Six minimum safeguards are required to prevent abuses of power when communications are intercepted in the course of criminal investigations: the nature of the offence warranting interception, categories of individuals affected, time limits, data handling procedures, safeguards for data sharing, and conditions for erasure.[13] In a field where abuse in individual cases is potentially so easy and could have such harmful consequences for democratic society as a whole, it is in principle desirable to entrust supervisory control to a judge,[14] though supervision by non-judicial bodies may also be considered ECHR-compliant if the supervisory body is independent of the authorities carrying out the surveillance and is vested with sufficient powers to exercise an effective and continuous control.[15] Moreover, where a supervising judge or court adopts a passive attitude and merely endorses, without genuinely checking the facts, the actions of security services, such supervision is not compatible with Article 8.[16]

AI systems-based surveillance should be grounded in accessible and foreseeable legislation, pursue a legitimate aim, and include robust oversight, including judicial protection where appropriate, to protect the right to respect for private life (Article 8), freedom of expression (Article 10), and freedom of assembly and association (Article 11).

AI driven surveillance technologies, including biometric monitoring and behaviour-tracking, may be used also to enhance prison security. Placing a person under permanent video surveillance whilst in prison – which already entails a considerable limitation on a person’s privacy – has to be regarded as a serious interference with the right to respect for privacy, as protected by Article 8 ECHR.[17] Recommendation CM/Rec(2024)5 regarding the ethical and organisational aspects of the use of AI and related digital technologies by prison and probation services emphasises that the use of such systems for maintaining safety, security and good order should be strictly necessary, proportionate to the purpose, should avoid any negative effects on the privacy and well‑being of offenders and staff and under no circumstances cause intentional physical or mental harm or suffering to a person.

Violations of Article 8 related to secret surveillance have been identified in cases involving human rights activists[18], members of non-governmental organisations,[19] lawyers,[20] journalists.[21]  With regard to journalists, targeted surveillance measures with a view to discovering their journalistic sources may also infringe their right to freedom of expression (Article 10 ECHR), in the absence of adequate safeguards in the law or any overriding requirement in the public interest justifying such measures in the concrete case.[22] The right of journalists to protect their sources is part of the freedom to “receive and impart information and ideas without interference by public authorities” protected by Article 10 and serves as one of its important safeguards.[23]

Back to top

 Facial recognition

Facial recognition is the automatic processing of digital images containing individuals' faces for identification or verification of those individuals by using face templates.[24] The privacy concern is that public surveillance technology enables the gathering of vast amounts of information about citizens that could be used for different, unauthorised and unlawful purposes.[25] Minimum safety measures regarding the duration, storage, usage and destruction of (biometric) personal data collected with facial recognition technology are required to ensure appropriate safeguards. The use of facial recognition technology to identify participants in peaceful demonstrations may also violate the right to respect for private life (Article 8) and freedom of expression (Article 10),[26] and freedom of assembly (Article 11). Personal data revealing political opinions falls within the special category of sensitive data attracting a heightened level of protection.[27] In the context of implementing facial recognition technology, it is essential to have detailed rules governing the scope and application of measures, as well as strong safeguards against the risk of abuse and arbitrariness. The need for safeguards is greater where there is use of live facial recognition technology.[28] In addition to the Article 8 concerns, the use of highly intrusive facial recognition technology to identify and arrest participants in peaceful protest actions could have a chilling effect[29] in relation to the rights to freedom of expression (Article 10 ECHR) and assembly (Article 11 ECHR).[30]

Facial recognition technologies, especially real-time systems, require heightened safeguards against abuse and chilling effects on freedom of expression and assembly. Member States should provide clear rules, independent scrutiny, and effective remedies to prevent arbitrary or unlawful surveillance practices that risk violating human rights and the principles of human dignity and personal autonomy. The Guidelines on facial recognition of the Council of Europe[31] provide further elaboration of measures that governments, facial recognition developers, manufacturers, service providers and entities using facial recognition technologies should follow and apply to ensure that they do not adversely affect human rights.

Back to Law enforcement and public security