Germany’s top criminal police authority is facing legal action over the handling of biometric data.
On September 19, 2025, IT-security expert Janik Besendorf, with the support of the Chaos Computer Club (CCC), brought a case before the Administrative Court in Wiesbaden.
He argues that photographs taken of him during a 2018 police matter, which was later dismissed, were unlawfully fed into facial recognition testing programs instead of being deleted.
According to Netzpolitik, images from Besendorf and millions of others stored in the police database INPOL-Z were repurposed without consent or statutory approval.
The legal complaint points in particular to the BKA’s “EGES” initiative, a 2019 project aimed at improving its facial recognition capabilities.
In this program, Fraunhofer IGD ran trials of four commercial recognition systems using roughly five million frontal photos of around three million individuals, in addition to volunteer contributions.
Freedom of information records show that officials had already raised doubts about whether the project had any legal footing.
The BKA maintains that the testing was conducted safely, emphasizing that all work was carried out on isolated internal systems, with no direct handover of personal data to outside partners.
It also insists that the program is qualified as research under the BKA Act. Regulators have taken a different view, arguing that benchmarking market-ready tools cannot be described as scientific research and pointing out the absence of a clear legal mandate.
A judgment against the BKA would set limits on how police photo archives can be repurposed for experimentation and product vetting.
Hellbound and Down 