An Assessment Framework for biometrics in the EU

Annemarie Sprokkereef

ICS - University of Leeds

TILT- University of Tilburg

Research Question:

Are expectations regarding the introduction of biometrics in the EU being met?

Sub-questions:

A. What were the objectives for introducing biometrics

B. What targets have been set?

C. How can the intended outcomes be assessed?

D. How can the unintended outcomes be assessed?

A: objectives for introducing biometrics

First level

goals stated in text of adopted programmes and legislation

Second level

“hidden objectives” as detailed in explanatory memoranda, statements, other documents

Third level

interplay with other international, EU and national policies (policy context)

A: Why biometrics?

The European Council of Thessaloniki:

(19/20 May 2003)

A coherent approach is needed in the European Union on biometric identifiers or biometric data for documents for third country nationals, European Union citizens’ passports and information systems (VIS and SIS II)

Objective: coherence

A: Why biometrics?

The Hague Programme (Strengthening Freedom, Security and Justice in the EU, Summit 5 Nov 2004)

Section 1.7.2 biometrics and information systems:

The management of migration flows, including the fight against illegal immigrants should be strengthened by establishing a continuum of security measures that effectively links visa application procedures and entry and exit procedures at external border crossings. Such measures are also of importance for the prevention and control of crime, in particular terrorism. In order to achieve this, a coherent approach and harmonised solutions in the EU on biometric identifiers and data are necessary

Objective: coherence, control of crime, terrorism

A: Why biometrics?

Council Regulation (EC) No 2252/2004:

• Recital 2: biometrics identifiers should be integrated in the passport or travel document in order to establish a reliable link between the genuine holder and the document

• Recital 3: The harmonisation of security features and the integration of biometric identifiers is an important step towards the use of new elements in the perspective of future developments at European level, which render the travel document more secure and establish a more reliable link between the holder and the passport and the travel document as an important contribution to ensure that it is protected against fraudulent useObjectives: reliable link between holder and document, security, help use of new elements in future developments

A: Why Biometrics?

Proposal for an amendment of Regulation EC No. 2252/2004 Com(2007) 619 final of 18.10.2007

Recital 3:

The harmonisation of exceptions to the (biometric) fingerprinting requirement is essential in order to maintain common security standards and in view of simplifying border controls

Objectives: security and simplification

A: Why Biometrics?

Proposal for a Council Regulation amending the two regulations on uniform formats for visas and residence permits (COM (2003) 558 final

Explanatory Memorandum p 3:

Aim of the proposal is to require Member States to integrate biometric identifiers into the visa and the residence permit for third country nationals in a harmonised way, thus ensuring interoperabilty.

Objective: interoperability?

A: Why Biometrics?

Council Regulation (EC) No 2725/2000 of 11 December 2000

Recital 3:

…It is also desirable, in order to effectively to apply the Dublin Convention,…, to allow each Member State to check whether an alien found illegally present has applied for asylum in another Member State

Recital 4:

Fingerprints constitute an important element in establishing the exact identity of such persons. It is necessary to set up a system for the comparison of fingerprint data

Objectives: identification in a common asylum policy to prevent illegal immigration

A: Objectives Thus Identified:

• Coherence• Identification of aliens• Biometrics as prerequisite for a common asylum

policy• Increase security (prevent crime and terrorism)• Increase safety• Increase efficiency through availability• Increase efficiency through interoperability• Increase efficiency of border procedures through

simplification• Achieve a reliable link between holder and document• Help use of new elements in future developments

B: What targets were set?

The Hague Programme Ten Priorities for the Next Ten Years (COM (2005) 184 final):Annex p 18:Coherent approach and harmonised solutions in the EU on biometric identifiers and data:

• Proposal modifying CCI to include biometric identifiers

• Preparation for the development of minimum standards (for sector specific) national ID cards

• Integration of biometric identifiers in travel documents, visa, residence permits, EU citizen’s passports and information systems

• Communication on enhanced synergies between SIS II, VIS and EURODAC

C. How is the intended outcome assessed?

Reports on the Implementation of the The Hague Programme I

Methodology national implementation (54-63):

• Monitoring of transposal of relevant Directives and Framework decisions by member states (formally and in substance)

• Letters from citizens, questions/petitions from EP• Commission and Council reports (under Title VI EU)• Instruments based on EC Treaty: information

gathered in the context of infringement procedures

C. How is the intended outcome assessed?

Reports on the Implementation of the The Hague Programme II

Methodology EU implementation:

• Monitoring of the adoption of measures as provided for on the programme (through a score board that was already set up in Tampere)

• Quantitative assessment of measures only culminating in the state of play assessments of: achieved, delayed, postponed, or not relevant anymore

C. How is intended outcome assessed?

Reports on the Implementation of the The Hague Programme III:

Section on border management, biometrics, information systems and visa policy

“substantial progress”The adoption of the Commission Communication on effectiveness, enhanced interoperability and synergies amongst European databases SIS II, VIS and EURODAC is a significant step towards a coherent approach and the adoption of harmonised solutions concerning biometric identifiers and data in the EU. The proposal amending the common consular instructions on biometrics still in progress. (COM (2006) 333 final: 30-37)

“Substantial developments in this area” :Adoption of SIS II, modified proposal biometrics in residence permits, Commission adoption of technical specifications. (COM(2007) 373 final: 38-41)

C. How is the intended outcome assessed?

Reports on the Implementation of the The Hague Programme V

Section on Strengthening Securitysharing of information has received priority:

“Achieved”: Commission proposal on the principle of availability, and Commission proposal giving law enforcement agencies access to VIS, adoption of data retention directive by Council and EP after agreement at first reading (COM (2006) 333 final: 38-42)

“Mixed results”: German initiative to transpose part of the Treaty of Pruem into the institutional mechanisms of the EU, including fingerprints, passenger data proposal progressing, political agreement between the Council and EP on police access to VIS(COM(2007) 373 final: 48-51)

D How can unintended outcome be assessed

BIOprivacy application impact framework (http://www.bioprivacy.org/bioprivacy_main.htm)

Overt 1. Are users aware of the system's operation? Covert

Optional  2. Is the system optional or mandatory? Mandatory

Verification 3. Is the system used for identification or verification? Identification

Fixed Period 4. Is the system deployed for a fixed period of time? Indefinite

Private Sector 5. Is the deployment public or private sector? Public Sector

Individual, 6. In what capacity is the user interacting with the system? Citizen

Enrollee 7. Who owns the biometric information? Institution

Personal Storage 8. Where is the biometric data stored? Database Storage

Behavioral 9. What type of biometric technology is deployed? Physiological

Templates 10. Does the system utilize biometric templates or images Images

D How can unintended outcome be assessed

Homeland Security Privacy Impact Assessment

(http://www.dhs.gov/xlibrary/assets/privacy/privacy_pia_cis_bss.pdf)

• Information collected and maintained• Use of the system and information• Retention• Internal sharing and disclosure• External sharing and disclosure• Notice• Individual access, redress and correction• Technical access and security• Technology

D. How can unintended outcome be assessed

Ethical framework based on Schomberg (including unintended consequences)(Sprokkereef and de Hert: Law, Science and Policy (3)2007, 177-201)

• fundamental principles• secondary principles and rights• dual use of technology• issues of human dignity• surveillance society issues• non-discrimination and social exclusion• function creep• health/hygiene• status of the data• advances in medicine as a challenge to biometrics• risk and societal impact assessment• hype effect

Method

• Use qualitative approach to complement national and EU reports/documents

• Interview key players at national and European level • Use privacy impact model and ethical framework as

a basis for the interview agenda • Find out how goals were defined and phrased• Identify different national contexts• Identify obstacles • Analyse if (and how) they have been overcome• In the light of all of the above: re assess original

goals and intended outcomes

What do we want to know from key players

Looking back:

• How were the goals on set and phrased?• What was the timeline?• What were the obstacles to be expected?• (How) did EU policy differ from national policy on biometrics

Evaluating at this moment in time:

• What are the milestones of achievement• Have they achieved targets so far• Have they slipped behind on deadlines• How have they tried/managed to overcome obstacles• How has agreement on adoption in first reading been

achieved• Has the decision making process been transparant?

What do we want to know from key players

Looking ahead:

• Has an implementation structure been put into place What is being prepared in terms of training,

equipment, reliability trials, fall back procedures• Are costs (becoming) a factor?• Is there broad political support• Have positive or negative unintended outcomes been

identified?• Can the latter still be avoided• Will the original objectives be achieved?• Is there a long term objective/plan• Is interlinkage going to take place and how

Conclusion

• Decision making on biometrics has not been very transparent (co-decision procedure has seen “secret” trilogues before first reading)

• The European Parliament, the European Data Protection Supervisor, organisations as Statewatch have criticised the lack of impact assessment

• Existing implementation reports focus on quantitative data and adhering to timetables

• Overall database linkage is seemingly unavoidable• Function creep v purpose binding• Regulation of databases with biometrics: as strong as the

weakest chain• Accountability and control

Thank you for your attention.

Comments and suggestions are most welcome!

A.C.J.Sprokkereef@uvt.nl