夜雨聆风Glukhin v. Russia — Facial Recognition Used to Identify and Track a Peaceful Protester Violated Privacy and Freedom of Expression
2023年7月4日，欧洲人权法院第三审判庭在 Glukhin v. Russia（Application no. 11519/20）一案中作出判决。本案涉及俄罗斯警方利用网络照片、地铁监控录像及面部识别技术识别、追踪并逮捕一名和平示威者，以及这种个人生物识别数据处理是否违反《欧洲人权公约》第8条所保障的私人生活权和第10条所保障的表达自由。
2019年8月，俄罗斯政治活动人士Konstantin Kotov因多次违反公共活动规则而被刑事起诉，引发社会关注。8月23日，申请人Nikolay Glukhin携带一个与Kotov真人等高的纸板人像乘坐莫斯科地铁。纸板人像手持横幅，表达对Kotov可能因参与和平抗议而被判处五年监禁的不满。
警方的反极端主义部门在监测互联网时，发现公共Telegram频道发布了申请人携带纸板人像的照片和视频。警方保存了有关截图，并调取多个地铁站的闭路电视录像。有关材料并未直接包含申请人的身份信息，但警方在不到两日内确认了其身份及住址。数日后，申请人在地铁站被捕。申请人称，警方向其表示，警方通过莫斯科地铁的实时面部识别监控系统确定了其位置。
申请人随后被指控违反公共活动程序。俄罗斯法律原则上不要求个人示威者提前通知，但使用“可快速组装或拆卸的物体”举行示威的除外。俄罗斯法院认为，带有支架的纸板人像属于此类物体，申请人本应提前通知有关机关，遂判处其20,000俄罗斯卢布罚款。上诉法院维持原判，并认为示威是否和平不影响对程序违法行为的认定。
关于《公约》第10条，欧洲人权法院指出，表达并不限于口头或书面语言，也包括以行为及其他非语言方式传递意见。申请人携带纸板人像及横幅，意在就具有公共利益的政治事件表达立场，属于表达自由的保护范围。将其带往警察局、行政拘留并判处罚款，均构成对其表达自由的干预。
法院认为，俄罗斯法律没有明确说明何种物体属于“可快速组装或拆卸的物体”，相关规定的适用是否具有充分可预见性存在疑问。即使假定干预具有法律依据，并追求防止秩序混乱及保护他人权利的正当目的，该项干预仍非民主社会所必需。申请人的个人示威完全和平，没有阻碍交通、损坏财产、实施暴力或者危害公共秩序及交通安全。国内法院仅强调处罚程序违法行为，没有评估示威的实际影响，也没有考虑纸板人像本身属于政治表达，未对和平示威表现出必要的容忍。因此，有关机关未能提供相关且充分的理由证明处罚具有必要性，构成对《公约》第10条的违反。
关于《公约》第8条，法院首先认定，警方收集、保存申请人在Telegram及地铁监控录像中的图像，并利用面部识别技术识别其身份、确定其位置及实施逮捕，构成对私人生活权的干预。个人在公共场所活动，并不意味着其图像及行动轨迹可以不受限制地被系统记录和处理。面部图像是个人身份的重要属性，对其进行自动化生物识别处理尤其涉及个人对自身信息使用方式的控制权。
尽管政府没有明确承认使用面部识别技术，但法院考虑到申请人举证困难、俄罗斯法律不要求警方记录或告知面部识别技术的使用、警方迅速完成身份确认以及政府对实时识别系统法律依据的陈述，接受了申请人在本案中确被使用面部识别技术识别和追踪的主张。
法院强调，实施面部识别技术必须有详细规则限定其适用范围、目的、对象类别、数据保存和使用方式，并设置足以防止滥用与任意干预的程序保障。实时面部识别能够持续确定个人所在位置，侵入性更强，因而需要更严格的正当理由和保障。然而，俄罗斯法律允许在各类司法程序中处理生物识别数据，没有按照违法行为的性质和严重程度限制技术使用，也未规定明确的授权程序、监督机制、数据保存规则及有效救济途径。
本案仅涉及未提前通知个人示威这一轻微行政违法行为。申请人没有实施暴力或其他应受谴责的行为，其个人数据还揭示了参与和平抗议及政治立场，属于应受更高保护的敏感数据。法院认为，为调查此类轻微行为而采用高度侵入性的面部识别技术，特别是通过实时面部识别系统追踪并逮捕申请人，不符合“迫切社会需要”。此类技术被用于识别和追捕和平示威者，还可能对表达自由及和平集会自由产生寒蝉效应。
欧洲人权法院最终一致认定俄罗斯违反《公约》第8条和第10条，并认为无须另行审查第6条申诉。法院判令俄罗斯向申请人支付9,800欧元非财产损害赔偿及6,400欧元诉讼费用。
本案表明，国家不能仅因个人身处公共场所或相关照片已发布于公开网络，就不受限制地提取并处理其生物识别数据。面部识别，尤其是实时面部识别，属于高度侵入性的监控手段；其用于执法时必须受到明确法律规则、严格必要性审查和有效程序保障的约束。将该技术用于追踪没有危害公共秩序的和平示威者，不仅侵犯个人隐私，也可能通过制造持续受监控的恐惧压制政治表达。
On 4 July 2023, the Third Section of the European Court of Human Rights delivered its judgment in Glukhin v. Russia (Application no. 11519/20). The case concerned the use of online photographs, underground CCTV footage and facial-recognition technology to identify, locate and arrest a peaceful solo demonstrator. The Court examined whether the processing of the applicant’s biometric data violated his right to respect for private life under Article 8 of the European Convention on Human Rights and whether his administrative conviction violated his freedom of expression under Article 10.
In August 2019, the detention and criminal prosecution of the Russian political activist Konstantin Kotov for repeated breaches of public-event regulations attracted considerable public attention. On 23 August, the applicant, Nikolay Glukhin, travelled on the Moscow underground carrying a life-size cardboard figure of Kotov. The figure held a banner criticising the possibility that Kotov could receive a five-year prison sentence for participating in peaceful protests.
While monitoring the Internet, the police anti-extremism unit discovered photographs and a video of the applicant on a public Telegram channel. The police retained screenshots and obtained CCTV recordings from several underground stations. Although the online material did not contain information directly identifying the applicant, the police established his identity and home address in less than two days. Several days later, he was arrested at an underground station. According to the applicant, the police told him that he had been located through live facial-recognition cameras installed in the Moscow underground.
The applicant was charged with breaching the prescribed procedure for holding public events. Russian law generally did not require prior notification for a solo demonstration, except where the demonstrator used a “quickly assembled or disassembled object”. The domestic courts held that the supported cardboard figure fell within that category and convicted the applicant for failing to give prior notice. He was fined 20,000 Russian roubles. The appellate court upheld the conviction and considered the peaceful nature of the demonstration irrelevant to the procedural offence.
Under Article 10, the European Court emphasised that protected expression is not confined to spoken or written words. Opinions may also be communicated through conduct and other non-verbal means. By carrying the figure and banner, the applicant had expressed his views on a matter of public interest, an area in which there is little scope for restrictions. His transfer to the police station, administrative arrest and conviction therefore constituted an interference with his freedom of expression.
The Court doubted whether the rule governing “quickly assembled or disassembled objects” was sufficiently foreseeable, as it contained no criteria defining the objects covered. Even assuming that the interference was prescribed by law and pursued the legitimate aims of preventing disorder and protecting the rights of others, it was not necessary in a democratic society. The demonstration had been indisputably peaceful and non-disruptive. It had not obstructed traffic, damaged property, involved violence or endangered public order or transport safety.
The domestic authorities had focused exclusively on punishing the applicant’s failure to comply with the notification requirement. They had neither assessed the actual consequences of the demonstration nor considered that the cardboard figure and banner constituted an expression of political opinion. They had therefore failed to display the required degree of tolerance towards peaceful expression or to provide relevant and sufficient reasons for the interference. The Court accordingly found a violation of Article 10.
Turning to Article 8, the Court found that collecting and storing images of the applicant from Telegram and underground surveillance recordings, and using facial-recognition technology to identify, locate and arrest him, interfered with his private life. The fact that a person acts in public does not permit the authorities to record and process that person’s image and movements without limitation. A facial image is a central attribute of personal identity, and its automated biometric processing affects an individual’s control over the use of personal information.
The Government did not expressly acknowledge that facial recognition had been used. Nevertheless, the Court accepted the applicant’s account in the particular circumstances. It relied on the difficulty he faced in proving the use of the technology, the absence of a domestic requirement to record or disclose its use, the speed with which the police identified him, the absence of any alternative explanation and the Government’s references to the legal basis for live facial-recognition cameras in the underground.
The Court stressed that facial-recognition systems must be governed by detailed rules defining the scope and application of the measures and accompanied by strong safeguards against abuse and arbitrariness. Even stronger safeguards are required for live facial recognition because of its capacity to locate and track individuals in real time. Russian law, however, permitted biometric-data processing in broadly formulated judicial contexts without limiting the seriousness of the offences, the purposes of processing or the categories of persons who could be targeted. Nor had the Government identified adequate authorisation procedures, supervisory mechanisms, retention rules or effective remedies.
The applicant had been prosecuted for a minor administrative offence consisting solely of failing to notify the authorities of a peaceful solo demonstration. He had not committed any violent or otherwise reprehensible act. Moreover, the data processed revealed his participation in a peaceful protest and therefore his political opinion, placing them within a sensitive category deserving heightened protection.
The Court concluded that using highly intrusive facial-recognition technology to identify the applicant—and, even more seriously, live facial recognition to locate and arrest him—did not correspond to a pressing social need. Using such technology against peaceful protesters was also capable of producing a chilling effect on freedom of expression and peaceful assembly. The processing was therefore not necessary in a democratic society and violated Article 8.
The Court unanimously found violations of Articles 8 and 10 and held that it was unnecessary to examine the Article 6 complaint separately. It awarded the applicant EUR 9,800 in respect of non-pecuniary damage and EUR 6,400 for costs and expenses.
The judgment confirms that appearing in public or in publicly accessible online material does not deprive an individual of protection against unrestricted biometric processing. Facial recognition—and particularly live facial recognition—is an exceptionally intrusive surveillance technique that requires a precise legal framework, strict necessity and proportionality review, and effective safeguards. Its use to pursue a peaceful protester who posed no threat to public order infringed both privacy and freedom of political expression.