Police forces in a number of countries have deployed AI-based facial recognition technology in publicly accessible spaces, and the Iranian police likewise intend to make use of this technology. Employing a descriptive-analytical method and drawing on documentary sources, the present article seeks to answer the following question: on what reasoning has European case law treated police biometric surveillance as an interference with the right to privacy, and — on the basis of that same reasoning — what criteria must the legal basis authorizing such surveillance satisfy if it is not to result in a violation of citizens' rights? The first finding is that such surveillance, insofar as it entails the automated capture and processing of the facial data of all passers-by, suspects and non-suspects alike, without their knowledge or consent, constitutes an interference with the right to privacy and cannot be equated with ordinary police observation in public places. The second finding is that European judicial and legislative practice has formulated a set of constraints governing the basis for such interference, including: satisfying the "quality of law" requirement; limiting police discretion in determining the persons and locations placed under surveillance; exhaustive specification of permissible purposes; regulated data retention; prohibition of indiscriminate mass collection; prior authorization by a judicial authority; and independent institutional oversight. The implication of these criteria for the Iranian police is that the legitimacy of deploying this technology requires a specific legislative basis incorporating the safeguards outlined above.