PimEyes: Belgian and Hamburg regulators and the noyb lawsuit

What happened in Hamburg?

In July 2020 Matthias Marx, a member of the Chaos Computer Club, complained to the Hamburg data protection commissioner that PimEyes had processed his biometric data without consent: a search for his face returned photos of him he had not uploaded. Hamburg was competent because the complainant lives there, while the Baden-Wurttemberg authority ran a parallel inquiry into the company itself (see Baden-Wurttemberg v PimEyes).

The Hamburg authority took more than five years to decide. On 7 November 2025 it issued a decision that, according to noyb's case file, found PimEyes's processing of the complainant's data unlawful under Article 9 of the GDPR but ordered no corrective measure, reasoning that measures against a company seated in the Seychelles could not be enforced.

1. 2020-07

   Complaint filed in Hamburg

   Matthias Marx complains that PimEyes processed his face without consent.

2. 2021-05

   Baden-Wurttemberg inquiry

   Parallel proceeding against the company opens.

3. 2024

   Belgian order reported

   Secondary sources describe a Belgian DPA order; no primary record found.

4. 2025-11-07

   Hamburg decision

   Processing found unlawful; no enforcement measure taken.

5. 2026-04-30

   noyb sues the Hamburg authority

   Action filed to compel the authority to act on the complaint.

6. 2026-11-06

   Reviewed

   Lawsuit pending; no further decision published.

What is the noyb lawsuit about?

On 30 April 2026 noyb filed a lawsuit on behalf of the complainant against the Hamburg authority, represented by lawyer Jonas Breyer and backed by the Chaos Computer Club. The claim is that a supervisory authority that finds a violation must use its corrective powers under Article 58 of the GDPR, and that giving up because enforcement might be difficult is not a lawful option. If the court agrees, the authority would have to reconsider the complaint and take measures that give the complainant effective relief. As of 6 November 2026 no ruling had been reported.

Why does it matter for face search?

• It tests whether EU regulators can decline to enforce against a face search engine because it sits outside the Union, which is the enforcement gap visible in every Clearview decision.
• It is the only European proceeding about a consumer face search engine that has reached a court, even if indirectly.
• For people in the EU it confirms that an access request to an engine, and a complaint to the local authority, are available routes, whatever the outcome.

What about Belgium?

The Belgian Data Protection Authority published a recommendation on biometric data in December 2021 and a 2024 decision fining an employer EUR 45,000 for unlawful biometric time registration. Neither concerns PimEyes. If an order against PimEyes exists, it has not been located in the authority's decision database or in Belgian legal reporting. This entry will be updated if a primary source appears.

What happened next?

PimEyes continued operating and, in 2024, announced that it blocks searches of faces its system classifies as children. The UK organisation Big Brother Watch filed a complaint with the ICO in 2022 that has not produced a published decision. The Baden-Wurttemberg fine proceeding opened in December 2022 also remained without a published result. For removal routes that exist regardless of enforcement, see the opt-out routes directory.