Lower Saxony data protection officer complains about police law

The Niedersächsische Datenschutzbeauftragte, Denis Lehmkemper, has strongly criticized a proposed amendment to the Niedersächsischen Gesetzes über die öffentliche Sicherheit und Ordnung (NPOG). The draft law, introduced by the state government in Hannover, aims to expand police powers through new surveillance tools, including artificial intelligence and biometric technologies. In his annual report released in early 2025, Lehmkemper warned of significant infringements on fundamental rights, emphasizing the need for stricter oversight. His concerns were previously kept confidential but have now been made public following the release of his report. The proposed changes include provisions for “intelligent” video surveillance, real-time biometric identification in public spaces, and post-hoc data matching with publicly available internet information. The legislation also seeks to establish legal grounds for automated data analysis, expand drone usage by police forces, and broaden the use of electronic ankle bracelets in cases of domestic violence. These measures are justified by the government as necessary due to rapid technological advancements and evolving threat scenarios. However, critics argue they represent a major expansion of state control over personal data and privacy. Lehmkemper’s official stance, outlined in his report, highlights several key objections. He expressed particular concern over the scope of video surveillance, arguing that current requirements are insufficient given the potential impact on individuals' privacy. Regarding real-time biometric identification, he deemed the application area too broad, noting the large number of people affected and the extensive spatial reach of such technology. For the post-hoc data matching with internet sources, he pointed out a lack of clear guidelines regarding the use of AI, which could lead to violations of existing regulations. Additionally, he found the described data volumes to be ambiguously defined, raising further concerns about compliance with data protection laws. The proposed automated data analysis system, which would centralize all stored police data into one platform, has drawn sharp criticism. Lehmkemper called this a paradigm shift in policing, warning that it would eliminate the requirement for purpose-specific data storage, a core principle under German data protection law. He emphasized that the system would process not only data related to suspects but also information from witnesses, victims, and innocent bystanders. This includes telecommunications data, such as call records and conversation content, which raises serious ethical and legal questions. The absence of clear boundaries for AI systems exacerbates these concerns. In addition to voicing his concerns, Lehmkemper offered recommendations for implementing surveillance measures in a manner compliant with data protection standards. He praised the inclusion of a clause requiring the review of private life domains and the obligation to involve the data protection authority in case of doubt. Despite these suggestions, the Interior Ministry largely ignored them, prompting Lehmkemper to renew his criticisms during a public hearing in February 2025 within the state parliament's interior committee. His findings align with broader concerns raised by non-parliamentary groups, such as the NoNPOG alliance, which has long opposed the planned surveillance measures and criticized the lack of transparency in the legislative process.