When the alarm comes from outside: Detecting, verifying and correcting police facial-recognition misuse in Sweden, Belgium and France

Tom Anciaux Berner

AEGIS

AEGIS Research Paper 01 · Expert Review Edition

When the alarm comes from outside

Detecting, verifying and correcting police facial-recognition misuse in Sweden, Belgium and France

Tom Anciaux Berner · ORCID 0009-0006-1414-7400 · Version 1.0 · 27 October 2026

Read the full paper (PDF, 10 pages)How to cite

In all four documented cases, the supervisor acted after a public report. Once informed, supervisors investigated, established breaches, imposed corrective measures and, in Belgium, halted a deployment. What the public record cannot show is how far each use went, or whether the corrections were carried out.

The paper does not claim that European biometric supervision is failing. It separates three propositions that are often merged: a safeguard exists, it operated, and its effectiveness can be demonstrated.

3

Member States: Sweden, Belgium, France

4

Established cases, reconstructed from primary sources

4 of 4

Supervisory actions that followed a public report

0 of 4

Corrections with publicly verified implementation, in the record assembled

The question

When potentially unlawful biometric processing occurs, what makes it visible to oversight authorities, what evidence allows its extent to be independently reconstructed, and how can the implementation of corrective measures be demonstrated? Each case is examined in four stages.

Stage	Question
S1 Visibility	How and when did the supervisory authority learn that the deployment existed?
S2 Establishment	How was an irregularity identified and legally established?
S3 Auditability	Could the actual extent of processing be independently reconstructed?
S4 Correction	Is there verifiable evidence that corrective measures were implemented?

The four cases

Case	S1 Visibility	S2 Establishment	S3 Auditability	S4 Correction
Sweden · Clearview AI	Supervisor acted after media reports, February 2020.	Breaches found in February 2021. The SEK 2.5 million penalty was annulled on appeal in November 2022.	Extent rests on police replies. The supervisor could not determine what happened to the uploaded data.	Orders documented. Execution and status after appeal not established.
Belgium · Clearview AI	Supervisor acted after press, March 2020. A first inquiry was closed on an answer later found incorrect.	Unlawful use established in February 2022, after a second press report.	No logs in police databases. The 78-search figure came from the vendor and could not be verified.	Deletion request and proof ordered. Execution not established.
Belgium · Brussels Airport	Supervisor learned of the system from the police commissioner-general’s press interview, July 2019. It states it was not aware of it.	No legal basis for a biometric database.	No logs or alert figures reported.	Biometric processing halted, September 2019. Deletion of snapshots not established.
France · BriefCam facial function	Controls followed the Disclose investigation, November 2023.	One use outside the legal framework.	Logs expired after 365 days. The count rests on the services’ declarations.	Formal notices, November 2024. Execution not established.

A separate French allegation, facial matching against the TAJ police records file on NEO mobile devices, is kept as an unresolved research lead. No authority has yet established the specific biometric practice. Every entry is referenced to a page or paragraph of its primary source in the paper.

Five findings

1. In all four established cases, documented supervisory action followed a public report.

In Sweden, Belgium (Clearview) and France, it was press coverage. At Brussels Airport, it was the operator’s own announcement in a press interview, about a system the supervisor did not know about. External disclosure can activate meaningful supervision. This does not establish that proactive supervision was absent or ineffective in other cases.

2. The documented preventive procedures were activated for processing brought within their scope.

Prior consultation and impact-assessment review are documented in Sweden and Belgium. The four established cases concern uses that did not pass through these procedures: two through a commercial service the police organisation had not provided, one on equipment acquired in 2017 and unknown to the supervisor, and one through a function added by a software update. This is an observation on four cases and a hypothesis for further research, not a European finding.

3. Establishing unlawful processing does not establish its full extent.

Different questions need different evidence: how many searches occurred, who conducted them, which images were uploaded, what results were obtained, and what happened to the data afterwards. The Belgian report shows this most clearly, because it separates information supplied by the vendor from facts the supervisor could verify.

4. Corrective orders and verified correction are different outcomes.

The pilot documents investigations, formal notices, orders and the interruption of a deployment. For none of the corrective measures does the assembled public record establish final implementation. This is a limitation of the evidence, not proof that the measures were ignored.

5. Enforcement outcomes must be followed through the whole judicial process.

The Swedish penalty, upheld at first instance, was annulled on appeal. Research on the effectiveness of supervision must track appeals and final outcomes, not stop at the original regulatory announcement.

What this paper does not claim

The cases were selected because enough public information existed to reconstruct them, which biases the corpus towards publicised controversies. The register of institutional controls is incomplete. The study has no access to compliance correspondence, vendor records, inspection annexes or internal police audit trails. Live identification, retrospective matching, verification and general video analytics are not interchangeable.

The pilot cannot estimate the prevalence of unlawful biometric processing or the detection rate of European supervisors. Insufficient public evidence implies neither compliance nor failure.

Open items before a definitive edition

Full judgment of the Administrative Court of Appeal in Stockholm, case 7678-21, 7 November 2022.
Documents filed after 10 February 2021 in IMY case DI-2020-2719, the COC follow-up on DIO21006, and any CNIL closure of decision MED-2024-150.
COC follow-up on DIO19005, including the fate of the stored snapshots.
IGPN annual report 2023, p. 35, and the Senate record of 1 April 2026.
Systematic completion of the register of institutional controls for all three countries.
Independent review by a specialist in EU police data protection law and an audit-methods researcher.

Critical observations, additional evidence and institutional perspectives are welcome, including those that contradict the findings. Corrections must cite a primary source.

How to cite

Anciaux Berner, T. (2026). When the Alarm Comes from Outside: Detecting, Verifying and Correcting Police Facial-Recognition Misuse in Sweden, Belgium and France. AEGIS Research Paper 01, Version 1.0, Expert Review Edition. https://aegis-eu.com/research/police-facial-recognition

Main primary sources

The full reference list, with page and paragraph numbers, is in the paper. Evidence collected up to 27 October 2026.