Europe’s top data protection authority has raised significant concerns about the technical rules governing the Prüm Router, the EU system that enables automated cross-border exchange of biometric data among member-state police forces, and is demanding comprehensive logging requirements and limits on how automated search results can be used.
The European Data Protection Supervisor published formal comments on the European Commission’s draft implementing decision under Regulation (EU) 2024/982, the so-called Prüm II Regulation. The Prüm Router handles automated searches across national databases containing DNA profiles, fingerprints, and facial images, allowing law enforcement in one EU country to query the biometric records of another without manual data transfers.
In its comments, the EDPS called for mandatory logging and auditing of every biometric search conducted through the router. The supervisor argued that full audit trails are essential to demonstrate that searches comply with data protection law and that any access to sensitive biometric data can be traced and reviewed after the fact.
Equally significant, the EDPS took a firm position that automated database matches cannot serve as the sole basis for consequential law enforcement decisions. The supervisor stated that a biometric “hit” generated by the router must always be subject to human review before it can support an arrest warrant or any other coercive measure. The concern reflects a broader principle running through EU data protection law: that fully automated decisions with legal effects on individuals require meaningful human oversight.
The EDPS has long stressed the need for robust data protection frameworks in Prüm Treaty initiatives, and the formal comments fit a consistent pattern of scrutiny. The supervisor had previously classified weaknesses in EU biometric databases as high risk in assessments of related cross-border systems.
The Prüm II Regulation, adopted in March 2024, expanded the original Prüm Treaty framework and introduced the centralized router architecture to streamline biometric data exchange at scale. The EDPS issued an earlier opinion in 2022 raising data protection concerns about the proposal, and the formal comments published in late January 2026 represent the latest step in that supervisory engagement.
The Commission’s draft implementing decision, which the EDPS comments address, will set the technical and procedural parameters for how the router operates in practice. The EDPS comments are advisory but carry significant weight, and member states and the Commission are expected to respond to them as the implementing rules are finalized.
Sources: EDPS Formal Comments on the Prüm Router, EDPS Biometrics Overview
–
By the ID Tech Editorial Team
