UOOU on biometric identification of unwanted persons at football stadiums

f) GDPR.[1] Essentially, it involves visual identification of a person in connection with their specific behavior (for example, capturing a perpetrator without regard to nationality, religious beliefs, ethnic origin, health status, or biometric characteristics). This does not exclude the potential subsequent processing of latent personal data contained in the part of the record depicting a specific incident or suspected perpetrator, such as biometric characteristics of individuals or other personal data, which are extracted by special police tools during further investigation after the footage is handed over. Misuse or other compromise of biometric data thus poses a permanent risk to the data subject, such as use for further identification without the person's knowledge or more detailed evaluation of other characteristics against the interests of the data subject (emotional, psychological, or health aspects). It is important to emphasize that this exception explicitly requires that such processing is carried out for the purpose of significant public interest based on Union or member state law, which is proportionate to the pursued goal, respects the essence of data protection rights, and provides appropriate and specific safeguards for the protection of the fundamental rights and interests of the data subject. Act No. 110/2019 Coll., on personal data processing, under which personal data may only be processed by the Czech Police, and only at international airports and with prior written permission from the chairman of the senate of the High Court, for a maximum of 12 months with the possibility of repeated extension for another 12 months. [1] If the controller decides to process personal data based on legitimate interest, they must always conduct a comprehensive assessment (balancing test, proportionality test) before starting the intended processing, to compare whether the legitimate interest of the controller outweighs the interests or fundamental rights and freedoms of the data subjects.