Several German states are preparing to widen police powers by allowing personal data to be used in the training of surveillance technologies.
North Rhine-Westphalia and Baden-Württemberg are introducing legislative changes that would let police feed identifiable information such as names and facial images into commercial AI systems.
Both drafts permit this even when anonymization or pseudonymization is bypassed because the police consider it “impossible” or achievable only with “disproportionate effort.”
Hamburg adopted similar rules earlier this year, and its example appears to have encouraged other regions to follow. These developments together mark a clear move toward normalizing the use of personal information as fuel for surveillance algorithms.
The chain reaction began in Bavaria, where police in early 2024 tested Palantir’s surveillance software with real personal data.
The experiment drew objections from the state’s data protection authority, but still served as a model for others.
Hamburg used the same idea in January 2025 to amend its laws, granting permission to train “learning IT systems” on data from bystanders. Now Baden-Württemberg and North Rhine-Westphalia plan to adopt nearly identical language.
In North Rhine-Westphalia, police would be allowed to upload clear identifiers such as names or faces into commercial systems like Palantir’s and to refine behavioral or facial recognition programs with real, unaltered data.
Bettina Gayk, the state’s data protection officer, warned that “the proposed regulation addresses significant constitutional concerns.”
She argued that using data from people listed as victims or complainants was excessive and added that “products from commercial providers are improved with the help of state-collected and stored data,” which she found unacceptable.
The state government has embedded this expansion of surveillance powers into a broader revision of the Police Act, a change initially required by the Federal Constitutional Court.
The court had previously ruled that long-term video monitoring under the existing law violated the Basic Law.
Instead of narrowing these powers, the new draft introduces a clause allowing police to “develop, review, change or train IT products” with personal data.
This wording effectively enables continued use of Palantir’s data analysis platform while avoiding the constitutional limits the court demanded.
Across North Rhine-Westphalia, Baden-Württemberg, and Hamburg, the outcome will be similar: personal data can be used for training as soon as anonymization is judged to be disproportionately difficult, with the assessment left to police discretion.
Gayk has urged that the use of non-anonymized data be prohibited entirely, warning that the exceptions are written so broadly that “they will ultimately not lead to any restrictions in practice.”
Baden-Württemberg’s green-black coalition plans to pass its bill this week.
Hellbound and Down 