Germany’s legislative push known as “Sicherheitspaket 2.0” advanced through the Interior Committee on September 21. The three proposed bills grant police and the Federal Criminal Police Office (BKA) broad powers to deploy automated data evaluation and biometric photo recognition, sparking fierce debate over privacy safeguards and reliance on commercial foreign providers.
Here is the math: under the proposed framework, investigators can download up to one billion publicly available internet photos per search, convert them into digital templates, and match them against target files before purging the non-match data.
The Bottom Line
- Expanded Mandate: The legislative package combines three distinct bills authorizing automated data analysis for criminal prosecution, counter-terrorism via the BKA, and central-office functions.
- Biometric Scale: Law enforcement gains the authority to process up to one billion scraped internet images per search, utilizing template-matching rather than storing raw photo databases permanently.
- Third-Party Risk: Provisions allow outsourcing image processing to private domestic, EU, or—under national security thresholds—extra-European vendors like PimEyes or Clearview.
Legislative Architecture of the Safety Package
The three legislative drafts are not entirely new, having originated in the previous parliamentary term. Originally passed by the traffic-light coalition majority in the Bundestag in autumn 2024, they ultimately stalled in the Bundesrat due to opposition from union-governed federal states.
The recent Interior Committee hearing on September 21 examined the measures despite jurisdiction over the Code of Criminal Procedure traditionally resting with the Legal Committee. Law enforcement agencies stand to gain automated analysis capabilities for general criminal investigations under the first bill, counter-terrorism operations under the second, and central office duties under the third.
Operational Mechanics and Privacy Safeguards
Biometric photo searches rely on converting distinctive facial proportions—such as the distance between eyes and other facial features—into digital templates. Instead of retaining static image libraries, the system compares templates generated from up to one billion scraped internet photos against a suspect’s file.
Proponents argue that privacy protections remain intact. Law professor Markus Löffelmann maintained during the committee hearing that the requirement to purge the massive photo pool and generated templates immediately after each individual search satisfies current regulatory boundaries.
Criminal prosecution searches require authorization under § 100a of the Code of Criminal Procedure. Local criminal investigation departments must route requests through the BKA, which can commission state or private entities within Germany or the European Union.
Commercial Outsourcing and the National Security Threshold
A contentious exception applies when national security is directly threatened. In such scenarios, the BKA retains the authority to commission private providers outside the European Union—companies that routinely maintain permanent databases comprising billions of indexed photographs.
This loophole alarmed privacy advocates and legal professionals alike. Lawyer Kai Kempgens of the DAV criticized the overly broad application scope, noting that the tools are permitted not only for identity verification and locating known individuals, but also for general fact-finding during investigations.
Kempgens questioned the breadth of the mandate during the proceedings, asking what could possibly be excluded from fact-finding under criminal procedural law. Such broad powers, he warned, effectively enable the construction of comprehensive personality profiles detailing an individual’s contacts and social contexts.
Comparative Overview of Investigative Powers
| Bill / Measure | Primary Authority | Data Scope & Processing | External Vendor Access |
|---|---|---|---|
| Bill 1: Criminal Prosecution | Local Police via BKA | Up to 1 billion scraped internet photos converted to transient templates | Domestic or EU state/private entities |
| Bill 2: BKA Counter-Terrorism | Federal Criminal Police Office | Automated evaluation of pre-existing data | Restricted; extra-EU permitted under national security |
| Bill 3: BKA Central Office | Federal Criminal Police Office | Centralized coordination and digital analysis | Restricted; extra-EU permitted under national security |
Systemic Risks and Legal Divergence
Pia Sombetzky of the NGO AlgorithmWatch highlighted international precedents, pointing out that biometric recognition methods in the United States routinely lead to the wrongful detention of innocent individuals, with disproportionate impacts on Black populations due to demographic performance disparities in biometric algorithms.
Sombetzky also voiced concern that resource-strapped police departments might bypass the labor-intensive process of scraping and templating local web data, opting instead for immediate reliance on commercial foreign providers. Consequently, every automated query risks receiving a “national security” designation to justify using external firms.
Countering that assessment, Professor Löffelmann argued that European Court of Justice case law strictly defines national security as the fundamental defensive interest of the state, limiting the applicability of such exemptions. Nonetheless, legal representatives and NGOs remain unified in their skepticism regarding commercial surveillance tools.
