Biometric data in large EU IT systems in the areas of borders, visa and asylum – fundamental rights implications

What?

The information technology systems (‘IT systems’) initially set up by the European Union (EU) for asylum- and migration-management purposes are increasingly also serving internal security purposes. Virtually all large-scale European IT systems have provisions allowing their use for immigration control purposes and for fighting serious crime and terrorism.

The EU has set up three large-scale IT systems in the areas of asylum, borders and visa:

  • SIS II – the Schengen Information System – to aid police and border checks;
  • Eurodac – standing for European Dactyloscopy – to support the application of the Dublin Regulation;
  • VIS – the Visa Information System – for visa processing.

Advanced plans exist to set up three new systems:

  • EES – the Entry-Exit System for registering travel in and out of the EU (Regulation (EU) No. 2226/2017 already adopted);
  • ETIAS – the European Travel Information and Authorisation System for conducting pre-border checks for visa-free travellers (Commission proposal under negotiation);
  • ECRIS-TCN – extending the European Criminal Records Information System to third-country nationals (Commission proposal under negotiation).

At the end of 2017, the European Commission tabled legislative proposals to make these systems ‘interoperable’ by creating a common search portal. The proposal also suggests establishing a common identity repository (CIR) with core biographical data of persons whose data are stored in the different IT systems, and adding a multiple identity detector (MID) to create links between different identities of the same person stored in the CIR. These systems increasingly rely on biometric data – fingerprints and facial image – in the processing of the data. The biometric identifier serves to connect the individual to the information stored.

This project analyses the fundamental rights implications of inserting, storing and using biometric data – such as fingerprints – in these IT systems. Both the negative as well as the positive fundamental rights implications have been studied.

Why?

The risks and benefits to fundamental rights that modern technologies create, including the use of biometric identifiers, are not fully known. For instance, biometrics can help prevent mistaken identity. They could also potentially be used to optimise the tracking of people who are reported missing.

However, there are also potential fundamental rights challenges in the collection, storage and use of biometrics; for example, the use of coercive measures when fingerprinting asylum seekers or those who have been apprehended at the EU’s external borders as part of the Eurodac system. Moreover, a person may be unable to physically provide fingerprints. This may happen when the fingerprint has been damaged due to manual work. The right to asylum may be affected if the person who cannot provide fingerprints is automatically suspected of having deliberately destroyed them, as fingerprinting is mandatory under Eurodac. Also, in the context of VIS and in consideration of non-discriminatory treatment, alternatives are needed in cases where a person is physically incapable of providing fingerprints.

As biometric identifiers are reliable indicators of a person’s identity, there is a need to ensure that the data connected with the biometric identifier is correct and of high quality. For instance, in the context of SIS II, if an entry ban remains in the system even though it has expired a third-country national will wrongfully be denied a visa or entry to the EU. An expired alert for arrest that has not been deleted may threaten the right to security and liberty of the person concerned. Safeguards need to be in place to ensure that data is lawfully stored, accessed and used in accordance with its purpose. Hence, the right to protection of personal data remains central to the treatment of biometric and other data stored in databases.

How?

In 2015 the project mapped administrative practices and case law related to the use of biometric and related data in the 28 EU Member States. It also assessed to what extent civil society is active and aware of the issues in this field.

In 2016, the project carried out fieldwork to look at practices in selected Member States and how these impact on fundamental rights. This research considered the potential vulnerabilities of those concerned, such as asylum seekers, refugees, migrants in an irregular situation, or third-country nationals that applied for a visa or were banned from entering the EU. In addition, the project can look at issues related to the general population, as data on EU citizens may also be included in some systems.

Throughout the project there has been close engagement with EU agencies such as eu-LISA (The EU Agency for large-scale IT systems), Frontex (The European Agency for the Management of Operational Cooperation at the External Borders), and EASO (The European Asylum Support Office). There has also been cooperation with the European Commission, relevant Council working groups, the European Data Protection Supervisor (EDPS) and national data protection authorities. In addition, the project has also looked at how civil society and academia have been raising fundamental rights questions related to the use of large-scale IT-systems.