Hamburg data protection authority sued by noyb over inaction on PimEyes

What happened

• The Hamburg DPA concluded that PimEyes’ collection and use of biometric data violates the GDPR but declined to impose remedial measures.
• Noyb alleges the authority’s inaction breaches EU law because the company is based outside the EU.
• The lawsuit seeks a court order compelling the DPA to enforce deletion and access rights for affected individuals.
• The case highlights challenges when data controllers operate from jurisdictions such as Dubai, the Seychelles or Belize.

Why it matters

Other EU data protection authorities may face similar scrutiny if they rely on a controller’s foreign location to avoid enforcement, prompting a review of cross‑border cooperation mechanisms.

Business impact

Organizations processing biometric data should audit their DPA engagement procedures and ensure that cross‑border enforcement triggers are clearly documented to avoid regulatory gaps.

What to check

1. 1

   review cross‑border enforcement policiesHigh priority

   Confirm that your DPA has documented procedures for acting against controllers located outside the EU.

2. 2

   audit biometric data practicesMedium priority

   Ensure any facial‑recognition services you use have GDPR‑compliant consent and deletion mechanisms.