- Reliability of automated matches and evidential robustness remain unclear
- eco calls for fundamental revision of the draft acts
Berlin, 21 September 2026 – On the occasion of today’s hearing of the Committee on Internal Affairs on the planned digital investigative powers, eco – Association of the Internet Industry warns of significant technical, security-related and rule-of-law risks posed by the draft acts. Although the proposed rules have far-reaching implications for services developed, operated and secured by companies in the Internet industry, the industry’s expertise is not represented among the eight invited experts.
“The German Bundestag is debating whether to turn the open Internet into a biometric search space without adequately examining the technical consequences”, says Klaus Landefeld, Board Member at eco – Association of the Internet Industry. “Anyone who enables state access to data from the Internet and involves network operators in investigative measures must ensure that the procedures used are secure, traceable and proportionate. Otherwise, these measures undermine the trustworthiness of digital infrastructures and services.”
Automated matches must be traceable and verifiable
The draft acts provide for automated biometric matching against publicly accessible images and videos, the analysis of extensive police datasets and the involvement of external providers. Whether such measures are technically reliable, can be securely controlled and can be effectively limited cannot be assessed solely from a legal or public authority perspective. Incorrect matches, unclear data provenance or processing steps that cannot be traced may implicate uninvolved individuals and make it more difficult for courts to review the results of investigations.
The digital economy has practical experience with data architectures, IT security, error rates in automated systems, international data flows and external service providers. This expertise is needed to determine whether deletion obligations can actually be enforced, how misuse can be prevented and what risks of losing control arise when data processing is carried out by private providers or bodies abroad. It must also be possible to understand what data automated matches are based on and how their reliability can be verified.
Biometric data create lasting risks
“The Internet is not a biometric search archive, and the population’s data are not freely available training material for AI systems that are, in some cases, questionable”, says Landefeld. “Unlike a password, biometric data cannot be reset after misuse. Anyone who outsources their processing to third parties or uses systems that cannot be adequately controlled from a technical perspective creates lasting risks – both to the security of those affected and to reliable rule-of-law procedures.”
Draft Acts must be fundamentally revised
Several submissions to the hearing also identify a significant need for revision. Criticism includes the lack of limits on automated data analysis, the inclusion of uninvolved individuals and inadequate statutory safeguards. The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) does not consider the rules in their current form to be compatible with higher-ranking law.
“Responsible security policy must demonstrate that an instrument is necessary, effective, technically manageable and constitutionally sound”, says Landefeld. “That evidence is lacking. If new investigative powers create security risks, produce error-prone results and the evidential robustness of those results in court remains unclear, this does not serve the rule of law. The German Bundestag should fundamentally revise the draft acts and appropriately involve the technical expertise of the digital economy in the further legislative process.”
eco rejects the proposed automated biometric matching against publicly accessible Internet data. New investigative tools must be limited to clearly defined individual cases, subject to independent oversight and governed by clear requirements regarding data sources, data subjects, the systems used and external service providers. Furthermore, the origin, processing and probative value of automatically generated results must be traceable and verifiable.
