The Italian data protection authority (DPA) has issued an opinion on the Sari Real Time system submitted for examination by the country’s Ministry of Interior, stating that the system ‘would create a form of indiscriminate/mass surveillance’ if used as designed. Sari – not yet active – is a facial recognition system that would, though a series of cameras installed in specific geographical areas, analyse the faces of individuals captured in real time and compare them with a predefined database of up to 10 000 faces. Sari would be installed ‘where the need arises to have a facial recognition technology to assist the police forces in the management of order and public safety or in relation to the specific needs of the judicial police’. The DPA notes that Sari ‘would carry out a large-scale automated processing that can also concern people present at political and social demonstrations, who are not the object of “attention” by the police forces’. Moreover, the fact that ‘the identification of a person would be achieved through the processing of the biometric data of all those present in the monitored space’ would lead to a ‘transition from targeted surveillance of certain individuals to the possibility of universal surveillance’. The authority has also found that the ministry had not clarified the legal basis under which it would carry out such activities. It noted that ‘an adequate regulatory basis should take into account all the rights and freedoms involved and define the situations in which the use of such systems is possible, without leaving a wide discretion to those who use it’.