Mass surveillance refers to the monitoring of a large number of people or specific groups, as well as the collection of data on citizens and communities. Governments or large organizations often use specific programs and artificial intelligence to collect and process information about individuals.

Unlike targeted surveillance, mass surveillance is not focused on specific individuals. Its original purpose was to use the collected data for security and law enforcement purposes. However, today the question arises as to how far this surveillance should go and where it starts to infringe on the privacy of the population.

Governments or institutions use advanced technologies for mass surveillance to intercept and monitor communication channels and online activities on a large scale. Data is collected from telecommunications companies, internet service providers, and public surveillance cameras, among other sources. Artificial intelligence is then used to analyse this data for potential threats and patterns.

There are numerous methods of mass surveillance. These include, for example, collecting data from phone calls and emails, reading SMS messages, tracking personal locations, or using programs that can recognise faces through surveillance cameras.





Artificial intelligence is increasingly being used for biometric surveillance. This means that a person can be identified based on their physical, biological, and behavioural characteristics. These types of data are unique to each individual and therefore very difficult to forge. They may include fingerprints, facial features, the iris, or a person’s voice.

According to the AI & Big Data Global Surveillance Index, as early as 2022, at least 97 countries worldwide were actively using artificial intelligence for public surveillance purposes. Among them are countries like China, Russia, and the United States.

However, an increasing number of European countries are also testing or partially implementing AI surveillance through pilot projects. These include France, Germany, Poland, the United Kingdom, and Hungary. In these countries facial recognition technologies are particularly common at critical infrastructure points such as train stations and airports. Their use is intended to ensure state security and support law enforcement agencies.

In Hungary, three legal amendments were passed in March 2025 without any public debate. These amendments criminalise LGBTQ+ demonstrations and significantly expand the use of biometric surveillance. Since 15 April 2025, the new laws have been in force, allowing the use of facial recognition technologies even for minor infractions and during peaceful assemblies.

Previously, such technologies were only permitted in Hungary for criminal offences that could lead to imprisonment. With the new changes, individuals can now be identified even for minor violations, such as crossing the street at a red light.

Hungary's legal changes violate the EU AI Act and significantly restrict demonstrators. According to civil society analyses, Hungary uses images that are automatically matched with government databases in real or near-real time. This allows individuals to be identified within seconds – even for petty offences.

This level of surveillance poses a serious risk: people may choose not to attend protests out of fear of being identified and punished, and thus may no longer fully exercise their rights to freedom of expression and assembly. This directly contradicts the aims of the EU AI Act and the EU Charter of Fundamental Rights.

The situation in Hungary has made it clear to the European Commission that it is time to draw a firm line and reach a consensus on how seriously privacy and fundamental rights are to be protected in the digital age.

Poland has also seen significant developments in the area of AI surveillance. On 24 May 2025, the Polish Parliament passed a new law expanding the use of artificial intelligence in public surveillance. The legislation now permits the use of facial recognition and behavioural analysis by police and municipal authorities.

Furthermore, the law – approved by the government and several allied MPs – allows the use of AI systems for real-time crowd monitoring, movement analysis, and border control in public spaces.

Poland is by no means alone in expanding AI for public security. Other countries, such as Romania or, as mentioned earlier, Hungary, are also extending laws and applications in this area. These measures are often introduced under the guise of increasing efficiency at major events or addressing security concerns. However, the Polish law was passed without judicial oversight or parliamentary control.

The new provisions are set to come into force by the end of 2025. Human rights organisations have criticised the lack of accountability and transparency, while the Polish opposition has condemned the fast-tracked process and absence of public consultation.



TIMELINE:

This timeline outlines Poland’s evolving stance on the EU AI Act. From the initial stakeholder consultations to the proposal of a dedicated supervisory body, Poland has taken a proactive role in shaping its national approach to AI governance. The timeline highlights important political developments, including the country's EU Council Presidency and the involvement of key institutions like the national data protection authority.