An Assessment Framework for
biometrics in the EU
Annemarie Sprokkereef
ICS - University of Leeds
TILT- University of Tilburg
Research Question:
Are expectations regarding the introduction of
biometrics in the EU being met?
Sub-questions:
A.
B.
C.
D.
What were the objectives for introducing
biometrics
What targets have been set?
How can the intended outcomes be assessed?
How can the unintended outcomes be
assessed?
A: objectives for introducing biometrics
First level
goals stated in text of adopted programmes and
legislation
Second level
“hidden objectives” as detailed in explanatory
memoranda, statements, other documents
Third level
interplay with other international, EU and national
policies (policy context)
A: Why biometrics?
The European Council of Thessaloniki:
(19/20 May 2003)
A coherent approach is needed in the European
Union on biometric identifiers or biometric data for
documents for third country nationals, European
Union citizens’ passports and information systems
(VIS and SIS II)
Objective: coherence
A: Why biometrics?
The Hague Programme (Strengthening Freedom,
Security and Justice in the EU, Summit 5 Nov 2004)
Section 1.7.2 biometrics and information systems:
The management of migration flows, including the
fight against illegal immigrants should be
strengthened by establishing a continuum of security
measures that effectively links visa application
procedures and entry and exit procedures at external
border crossings. Such measures are also of
importance for the prevention and control of crime, in
particular terrorism. In order to achieve this, a
coherent approach and harmonised solutions in the
EU on biometric identifiers and data are necessary
Objective: coherence, control of crime, terrorism
A: Why biometrics?
Council Regulation (EC) No 2252/2004:
• Recital 2: biometrics identifiers should be integrated in
the passport or travel document in order to establish a
reliable link between the genuine holder and the
document
• Recital 3: The harmonisation of security features and
the integration of biometric identifiers is an important
step towards the use of new elements in the
perspective of future developments at European level,
which render the travel document more secure and
establish a more reliable link between the holder and
the passport and the travel document as an important
contribution to ensure that it is protected against
fraudulent use
Objectives: reliable link between holder and
document, security, help use of new elements in
future developments
A: Why Biometrics?
Proposal for an amendment of Regulation EC No.
2252/2004 Com(2007) 619 final of 18.10.2007
Recital 3:
The harmonisation of exceptions to the (biometric)
fingerprinting requirement is essential in order to
maintain common security standards and in view of
simplifying border controls
Objectives: security and simplification
A: Why Biometrics?
Proposal for a Council Regulation amending the two
regulations on uniform formats for visas and
residence permits (COM (2003) 558 final
Explanatory Memorandum p 3:
Aim of the proposal is to require Member States to
integrate biometric identifiers into the visa and the
residence permit for third country nationals in a
harmonised way, thus ensuring interoperabilty.
Objective: interoperability?
A: Why Biometrics?
Council Regulation (EC) No 2725/2000 of 11 December
2000
Recital 3:
…It is also desirable, in order to effectively to apply the
Dublin Convention,…, to allow each Member State to
check whether an alien found illegally present has applied
for asylum in another Member State
Recital 4:
Fingerprints constitute an important element in establishing
the exact identity of such persons. It is necessary to set up
a system for the comparison of fingerprint data
Objectives: identification in a common asylum policy to
prevent illegal immigration
A: Objectives Thus Identified:
• Coherence
• Identification of aliens
• Biometrics as prerequisite for a common asylum
policy
• Increase security (prevent crime and terrorism)
• Increase safety
• Increase efficiency through availability
• Increase efficiency through interoperability
• Increase efficiency of border procedures through
simplification
• Achieve a reliable link between holder and document
• Help use of new elements in future developments
B: What targets were set?
•
•
•
•
The Hague Programme Ten Priorities for the Next
Ten Years (COM (2005) 184 final):
Annex p 18:
Coherent approach and harmonised solutions in the
EU on biometric identifiers and data:
Proposal modifying CCI to include biometric
identifiers
Preparation for the development of minimum
standards (for sector specific) national ID cards
Integration of biometric identifiers in travel
documents, visa, residence permits, EU citizen’s
passports and information systems
Communication on enhanced synergies between SIS
II, VIS and EURODAC
C. How is the intended outcome assessed?
Reports on the Implementation of the The Hague
Programme I
Methodology national implementation (54-63):
• Monitoring of transposal of relevant Directives and
Framework decisions by member states (formally and
in substance)
• Letters from citizens, questions/petitions from EP
• Commission and Council reports (under Title VI EU)
• Instruments based on EC Treaty: information
gathered in the context of infringement procedures
C. How is the intended outcome assessed?
Reports on the Implementation of the The Hague
Programme II
Methodology EU implementation:
• Monitoring of the adoption of measures as provided
for on the programme (through a score board that
was already set up in Tampere)
• Quantitative assessment of measures only
culminating in the state of play assessments of:
achieved, delayed, postponed, or not relevant
anymore
C. How is intended outcome assessed?
Reports on the Implementation of the The Hague Programme III:
Section on border management, biometrics, information
systems and visa policy
“substantial progress”
The adoption of the Commission Communication on
effectiveness, enhanced interoperability and synergies
amongst European databases SIS II, VIS and EURODAC is
a significant step towards a coherent approach and the
adoption of harmonised solutions concerning biometric
identifiers and data in the EU. The proposal amending the
common consular instructions on biometrics still in progress.
(COM (2006) 333 final: 30-37)
“Substantial developments in this area” :
Adoption of SIS II, modified proposal biometrics in residence
permits, Commission adoption of technical specifications.
(COM(2007) 373 final: 38-41)
C. How is the intended outcome assessed?
Reports on the Implementation of the The Hague Programme V
Section on Strengthening Security
sharing of information has received priority:
“Achieved”: Commission proposal on the principle of
availability, and Commission proposal giving law enforcement
agencies access to VIS, adoption of data retention directive
by Council and EP after agreement at first reading (COM
(2006) 333 final: 38-42)
“Mixed results”: German initiative to transpose part of the
Treaty of Pruem into the institutional mechanisms of the EU,
including fingerprints, passenger data proposal progressing,
political agreement between the Council and EP on police
access to VIS
(COM(2007) 373 final: 48-51)
D How can unintended outcome be assessed
BIOprivacy application impact framework
(http://www.bioprivacy.org/bioprivacy_main.htm)
Overt 1. Are users aware of the system's operation? Covert
Optional 2. Is the system optional or mandatory? Mandatory
Verification 3. Is the system used for identification or verification? Identification
Fixed Period 4. Is the system deployed for a fixed period of time? Indefinite
Private Sector 5. Is the deployment public or private sector? Public Sector
Individual, 6. In what capacity is the user interacting with the system? Citizen
Enrollee 7. Who owns the biometric information? Institution
Personal Storage 8. Where is the biometric data stored? Database Storage
Behavioral 9. What type of biometric technology is deployed? Physiological
Templates 10. Does the system utilize biometric templates or images Images
D How can unintended outcome be assessed
Homeland Security Privacy Impact Assessment
(http://www.dhs.gov/xlibrary/assets/privacy/privacy_pia_cis
_bss.pdf)
•
•
•
•
•
•
•
•
•
Information collected and maintained
Use of the system and information
Retention
Internal sharing and disclosure
External sharing and disclosure
Notice
Individual access, redress and correction
Technical access and security
Technology
D. How can unintended outcome be assessed
Ethical framework based on Schomberg (including
unintended consequences)
(Sprokkereef and de Hert: Law, Science and Policy
(3)2007, 177-201)
•
•
•
•
•
•
•
•
•
•
•
•
fundamental principles
secondary principles and rights
dual use of technology
issues of human dignity
surveillance society issues
non-discrimination and social exclusion
function creep
health/hygiene
status of the data
advances in medicine as a challenge to biometrics
risk and societal impact assessment
hype effect
Method
• Use qualitative approach to complement national and
EU reports/documents
• Interview key players at national and European level
• Use privacy impact model and ethical framework as a
basis for the interview agenda
• Find out how goals were defined and phrased
• Identify different national contexts
• Identify obstacles
• Analyse if (and how) they have been overcome
• In the light of all of the above: re assess original
goals and intended outcomes
What do we want to know from key players
Looking back:
•
•
•
•
How were the goals on set and phrased?
What was the timeline?
What were the obstacles to be expected?
(How) did EU policy differ from national policy on
biometrics
Evaluating at this moment in time:
•
•
•
•
•
•
What are the milestones of achievement
Have they achieved targets so far
Have they slipped behind on deadlines
How have they tried/managed to overcome obstacles
How has agreement on adoption in first reading been
achieved
Has the decision making process been transparant?
What do we want to know from key players
Looking ahead:
• Has an implementation structure been put into place
What is being prepared in terms of training,
equipment, reliability trials, fall back procedures
• Are costs (becoming) a factor?
• Is there broad political support
• Have positive or negative unintended outcomes been
identified?
• Can the latter still be avoided
• Will the original objectives be achieved?
• Is there a long term objective/plan
• Is interlinkage going to take place and how
Conclusion
•
•
•
•
•
•
•
Decision making on biometrics has not been very
transparent (co-decision procedure has seen “secret”
trilogues before first reading)
The European Parliament, the European Data Protection
Supervisor, organisations as Statewatch have criticised the
lack of impact assessment
Existing implementation reports focus on quantitative data
and adhering to timetables
Overall database linkage is seemingly unavoidable
Function creep v purpose binding
Regulation of databases with biometrics: as strong as the
weakest chain
Accountability and control
Thank you for your attention.
Comments and suggestions are most
welcome!
A.C.J.Sprokkereef@uvt.nl