Iuridicum Remedium (IuRe)

Iuridicum Remedium — IuRe — is the Prague-headquartered Czech non-governmental organisation that, since its 2001 founding, has combined legal aid on debt, housing, and employment rights with a Digital Freedoms programme focused on surveillance, data protection, and biometric identification. The organisation describes itself as "the only Czech digital rights organization." In the corpus's frame, IuRe occupies a distinctive position on the Central European digital-rights map: a general civil-liberties NGO with a strategic-litigation core, responsible for the two most significant Czech AI Act enforcement actions on the public record in 2025 — the shutdown of the Václav Havel Airport facial recognition system and a Municipal Court ruling that Czech data retention legislation violates European law — and the organisation behind the Czech Big Brother Awards since 2005. IuRe is a full member of EDRi, and its work on Czech biometric surveillance situates it alongside Panoptykon Foundation in Poland and the Hungarian Civil Liberties Union as the three Central and Eastern European civil-liberties anchors of the EU AI Act enforcement coalition now active across the region.

Founding and structure

IuRe was founded in 2001 as a volunteer initiative by Charles University Prague law students and professionalized from 2003 into a standing NGO with offices in Prague and Brno. The organisation operates across two primary programme tracks: a Legal Aid Programme providing counselling on debt, housing, and employment-related social exclusion, and a Digital Freedoms Programme under which IuRe's lawyers address data abuse, privacy violations, and biometric identification systems, with recent emphasis on digital exclusion and what the programme calls "the right to analogue" — the claim that Czechs should not be compelled to engage with state services through exclusively digital interfaces. Jan Vobořil serves as the organisation's principal lawyer and Executive Director; Helena Svatošová has been a named organisational representative. Since 2004 IuRe has received funding from the Open Society Foundations and from Czech-European foundation grants. IuRe joined EDRi as a full member, integrating into the Brussels-level European digital-rights coalition whose Czech work it anchors.

Data retention: a 20-year campaign

IuRe's longest-running structural campaign is its sustained opposition to Czech data retention — the provision of Czech telecommunications law under which mobile operators store metadata on the communications of all Czech citizens for six months: call timing, call duration, location at the time of each call, and internet connection location. Jan Vobořil framed the stakes in terms the organisation had documented across the preceding decade: "Data has been misused in the past, either to obtain information about contacts of influential people, to identify participants of anti-government demonstrations, or to identify journalistic sources."

The campaign's arc spans the organisation's full lifespan. The first decisive moment came in 2011, when IuRe — backed by 53 members of the Czech Parliament — persuaded the Czech Constitutional Court to annul national data retention regulations. The government responded with a modified amendment that continued metadata collection despite the ruling, and in 2019 the Constitutional Court ruled again that retention remained constitutional under the modified framework. IuRe's response was to shift terrain: in January 2021 it launched a crowdfunding campaign to fund a civil lawsuit filed in partnership with journalist Jan Cibulka, who sued the Czech state directly for collecting his location data, call contacts, and messaging partners. The crowdfunding exceeded its target with over 100 contributors.

The civil litigation track succeeded where the constitutional track had not. In 2024 the Supreme Court granted IuRe's appeal, and in April 2025 the Municipal Court in Prague ruled that Czech data retention legislation directly contradicts European law — in the judge's summary, "The state has failed." The court additionally found that the processing of data under the retention regime itself constitutes individual harm, an element significant for secondary litigation: other Czech citizens whose communications metadata was collected during the same period can now claim financial compensation. The case resolved a 20-year campaign spanning two Constitutional Court battles and a full civil litigation arc.

Biometric surveillance at Prague airport and the AI Act

IuRe's second major active file is biometric mass surveillance, with the Václav Havel Airport facial recognition case as the principal milestone. Czech police deployed a facial recognition system at the airport in 2018, converting facial contours into numerical "bio-indexes" and comparing them in real time against databases of wanted or missing individuals. In 2021 IuRe's lawyers, arguing that the system lacked the explicit legal basis required under Czech law, filed a formal complaint with the Czech Data Protection Authority and began a parallel freedom-of-information strategy to obtain the DPA's inspection findings. The DPA's investigation ran for nearly four years before confirming violations of personal data protection legislation. When the EU AI Act's biometric surveillance provisions took effect in February 2025 — mandating judicial approval for each use of such a system, which Czech police had never obtained — the compounding legal pressure led to the system's shutdown in August 2025. IuRe subsequently called on Interior Minister Vít Rakušan to open a legislative review of the Czech biometric surveillance framework. As of late 2025 the Czech police continue operating a separate Digital Personal Image Information System — approximately 20 million photographs from national ID and passport records — for which IuRe has maintained its monitoring work.

The shutdown occurred against a parallel political escalation. In September 2024 the Czech government had approved a Ministry of the Interior proposal to legally authorise automated facial recognition at international airports, which IuRe read as an attempt to circumvent the AI Act's individual-authorisation requirement by allowing courts to issue approvals for "predefined categories of persons" — a framing broad enough to encompass virtually any traveller. In response IuRe launched The Czech Republic is not China, an interactive-quiz public education website, and the explanatory memorandum accompanying the proposal indicated a long-run interest in extending the authority to other public spaces beyond airports; IuRe's civil-society pressure was credited with limiting the current text to airport perimeters only.

Big Brother Awards Czech Republic

IuRe has organised the Czech Big Brother Awards annually since 2005, a ceremony naming the most egregious surveillance, privacy-violation, and data-abuse actors of the preceding year. The 20th edition was held in March 2025, with awardees that year selected for biometric surveillance infrastructure and corporate loyalty-application data practices. The Awards serve a public-mobilisation function within IuRe's theory of change: by naming concrete actors and practices — police camera deployments, state ministry data policies — the organisation translates specialist digital-rights arguments into Czech public discourse at a register accessible to non-technical audiences. The ceremony is the principal annual public-facing output of IuRe's surveillance-accountability programme and has run across two decades as a standing fixture of Czech civil-society privacy advocacy.

Google Analytics and public-sector data hygiene

A shorter-arc campaign illustrates IuRe's approach to state data practice. In June 2021 IuRe sent an open letter to the Czech Ministry of Health identifying the use of Google Analytics and Microsoft analytics tools on the official COVID-19 vaccination registration system — a deployment routing sensitive public-health user data through US surveillance-ad-tech infrastructure. The letter catalysed a stakeholder meeting with the National Agency for Communication and Information Technologies (NAKIT) and the Czech DPA; by October 2021 Google and Microsoft analytics had been removed from the vaccination forms. NAKIT subsequently replaced Google Analytics with Matomo — an open-source, privacy-respecting tool keeping metadata within government systems — and by September 2022 the deployment had been extended across Czech government websites more broadly.

DNA and early structural victories

IuRe's record includes an earlier structural win with a different institutional register: in April 2016 the Czech Data Protection Authority ordered the destruction of approximately three million newborn blood-sample cards — held by state health institutions — following an IuRe complaint. The cards contained DNA data collected at birth; the order established that mass retention of biometric genetic data without specific legal authority and continuing consent violated Czech and European data protection rules. The 2016 DNA victory is the domestic predecessor of the 2025 facial recognition and data-retention wins and reflects the consistent programme logic: identify a mass state data-collection practice without adequate legal basis; file with the DPA or the courts; press until the practice is halted or the collection is destroyed.

Coalition posture and position in the movement

IuRe's position in the corpus is as the Czech Republic's sole digital-rights NGO and as the principal Central European voice on AI Act enforcement against law-enforcement biometric surveillance. Three features orient its position among European peers. The first is the dual-programme architecture — Legal Aid alongside Digital Freedoms — which situates IuRe closer to the general civil-liberties model of TASZ in Hungary and Panoptykon in Poland than to the single-mandate digital-rights organisations that dominate Western Europe's EDRi roster. The second is the strategic-litigation first register: IuRe's two 2025 victories were achieved through sustained complaint-filing, DPA engagement, freedom-of-information requests, and civil litigation across timescales of four to twenty years — not through legislation or campaign alone. The third is the AI Act enforcement test role: like TASZ in Hungary, IuRe is running the first enforcement tests of the EU AI Act's biometric surveillance prohibitions against a Central European government that built domestic practice ahead of the regulation, and doing so as a small-team EDRi member NGO rather than a large litigation shop. The parallel between the two organisations is structural and documented: both are prosecuting AI Act cases against Member State governments in the same enforcement window, both are working alongside EDRi as the Brussels coordination layer, and the Czech and Hungarian biometric surveillance files together are the most advanced national tests of the AI Act's Article 5 prohibitions currently on the public record.