Cognitec in policing

Legal basis

The Crime and Policing Act 2026 (Royal Assent 29 April 2026), section 181, creates an authorised person gateway for police access to DVLA driver records including the photograph, via the Law Enforcement Data Service, expanding access beyond road traffic matters.

Oversight

Biometrics Commissioner; ICO, which reported a bias finding and is monitoring a planned algorithm replacement; subject of long-running custody image retention criticism

The Home Office states the Act does not itself create a process for searching the DVLA image gallery to identify unknown individuals, and that which non-police galleries may be searched is deferred to a forthcoming Police Reform Bill. Over 25,000 retrospective facial recognition searches are run each month against a pool of more than 19 million custody images. The statutory position changed in 2026 and any account citing only the absence of a framework is now stale. The Crime and Policing Act 2026 opened police access to DVLA driver records including photographs; the Lords rejected an amendment to block facial recognition searching of the roughly 50 million image DVLA database by 123 votes to 40 in March 2026. The substantive framework for which galleries may be searched has been deferred to a further bill. The National Physical Laboratory published an accuracy and equitability evaluation of Cognitec FaceVACS-DBScan ID v5.5 in December 2025, and the ICO's 18 August 2026 statement is explicit about the finding: the algorithm's bias increases the likelihood of incorrect matches for people in some demographic groups. The Home Office and NPCC have put mitigations in place (staff training, oversight reporting, equality impact assessments) alongside plans to replace the algorithm. The ICO continues to engage with HMICFRS, the Home Office and NPCC on the replacement and is reserving the right to take further regulatory action if warranted. A Home Office consultation on the facial recognition framework closed on 12 February 2026 with a government response promised within 12 weeks. That response remained unpublished more than three months past its due date as of August 2026; a July 2026 Lords session shows the Home Secretary being directly pressed on the delay.

Source: Biometrics Commissioner annual reports · last checked 2026-08-26

Legal basis

Contested. The Code of Criminal Procedure restricts real-time TAJ checks to specially authorised officers during an investigation; independent reporting finds the database used for on-the-spot street identity checks outside that basis.

Oversight

CNIL (French data protection authority); internal Gendarmerie monitoring tool 'Citar' introduced December 2025; no dedicated facial recognition legislation exists

French police and gendarmerie officers carry handheld devices, branded NEO (nouvel equipement operationnel), that run facial recognition software developed by the German company Cognitec, matching photographs taken in the field against the TAJ criminal records database. Facial matching became available on these devices from 2025; a desktop version had existed since 2022. TAJ (Traitement des Antecedents Judiciaires) holds around 17 million records on arrested and accused individuals, 48 million on victims, and roughly 9 million frontal photographs, operated by the Ministry of the Interior. Queries against it rose from 375,000 in 2019 to nearly 1 million by 2024. An investigation by the non-profit outlet Disclose, published in partnership with La Quadrature du Net in March 2026, found the database being used for real-time identity checks on public streets, which the French Code of Criminal Procedure does not permit: TAJ may only be used by specially authorised officers during an investigation, not for on-the-spot verification. Disclose spoke to six individuals in Paris, Marseille and Lyon photographed by police in the preceding four years, in some cases without consent, including one person scanned at a pro-Palestinian protest in Paris. A 2023 report from the police's own internal inspectorate, the IGPN, had already found the database was 'very frequently used on public streets during identity checks'. The Gendarmerie disputes the characterisation. An editorial in its own newspaper, L'Essor de la Gendarmerie, states the tool is limited to criminal investigations, identity checks where a person lacks or refuses identification, and intelligence gathering, describing its purpose as an investigative aid rather than mass surveillance. An internal memo states that results 'must be carefully reviewed by users' and 'must not be considered as evidence'. The Gendarmerie states access is restricted to judicially authorised officers, excluding volunteer deputy gendarmes and reservists. TAJ is monitored by the French data protection authority CNIL, and the Gendarmerie introduced an internal monitoring tool called Citar in December 2025 intended to reduce unauthorised access. La Quadrature du Net, which has previously and unsuccessfully sued over French police use of facial recognition, argues there is no legislation specifying how the technology may be used, by whom, or under what oversight, and that equipping thousands of officers with it amounts to surveillance authorised by the state without a legal framework. This site records a genuine dispute between an internal memo describing careful, restricted use and independent reporting describing frequent use outside the permitted legal basis, rather than resolving it.

Source: Disclose; La Quadrature du Net; Biometric Update; L'Essor de la Gendarmerie · last checked 2026-08-30

Legal basis

Police have relied on section 75 of the Sicherheitspolizeigesetz. In a decision reported on 26 July 2026 the Datenschutzbehoerde found that provision insufficient to authorise automated biometric comparison, holding that there is currently no adequate legal basis for it. The Interior Ministry said it would appeal to the Bundesverwaltungsgericht, and the decision was not final when reported.

Oversight

Datenschutzbehoerde, the Austrian data protection authority, which upheld a complaint brought by the digital rights organisation epicenter.works on behalf of an activist photographed at a climate protest in Vienna in March 2023 and later matched using facial recognition. Parliamentary scrutiny has run through written questions to the Interior Minister.

The deployment itself is well established. ORF, the Austrian public broadcaster, reported on 8 September 2020 that the system passed from roughly a year of testing into regular operation at the start of August 2020, that it had been used 581 times and had identified 83 suspects by that point, that it cost 450,000 euros, and that it compares images against an Interior Ministry photograph database of suspects. Netzpolitik.org, 16 September 2020, gives the vendor as Cognitec Systems of Dresden, the software cost as 448,813 euros, the database as the police Lichtbilddatei of photographs from earlier criminal proceedings, the same figure of 581 searches, and reports that the system was used on images from the summer 2020 protests in the Favoriten district of Vienna, where 47 known persons were identified. The two cost figures are the same number reported gross and net and are not treated as a conflict. All usage figures date from 2020 and no current figures were found; they are recorded here rather than in a field for that reason. The legal finding is the significant recent development: reporting by the Austrian news agency APA on 26 July 2026, carried by Salzburger Nachrichten and others, and by epicenter.works on 23 July 2026, establishes that the Datenschutzbehoerde found the use of automated facial recognition on protest photographs unlawful for want of a sufficient legal basis. The status remains operational because nothing read establishes that use has stopped - the Interior Ministry publicly defended the system and announced an appeal. No parliamentary answer was read directly in this run: the Austrian Parliament's page for answer 6962/AB confirms the answer was given by Interior Minister Karl Nehammer on 16 August 2021 but the substance sits in a linked PDF that was not retrieved.

Source: ORF · last checked 2026-09-06