Under watchful eyes – biometrics, EU IT-systems and fundamental rights FRA Opinions

Providing information in an understandable and transparent manner

Article 5 (1) of the General Data Protection Regulation (GDPR) requires that third-country nationals are informed about the relevant aspects of their personal data being processed in a transparent, intelligible and easily understandable manner. FRA research found that authorities that collect personal data of asylum and visa applicants, as well as of migrants in an irregular situation, and then store these data in IT systems, find it challenging to provide information in an understandable manner. Rights holders are often not fully informed of all aspects of the data processing and have difficulties understanding the information they receive. This is particularly true when the information system at issue serves a number of purposes and processes. With interoperability, ensuring the right to information may become increasingly challenging.

Transparency about the purpose of fingerprinting encourages the persons concerned to cooperate with the authorities, thus preventing situations from escalating. Authorities often find it challenging to provide information covering all aspects of the processing of data of asylum applicants and apprehended migrants, as required by Article 29 of the Eurodac Regulation (Article 30 of the recast proposal), including the use of the data for the Dublin procedure and for investigations of serious crimes and terrorism. Challenges increase when fingerprints are collected in stressful situations. If authorities provide no or only limited information, asylum applicants and migrants in an irregular situation perceive EU Member States to be acting in a non-transparent manner, according to FRA research. This affects their willingness to cooperate with the authorities.

The European Commission carries out evaluations in Member States to assess the implementation of the Schengen acquis. Such ‘Schengen evaluations’ also cover large-scale IT systems. They are an important tool to ensure compliance with the duty to inform, which is included in the legal instruments of all the IT systems, although restrictions apply to certain data recorded in SIS II.

Respecting human dignity when taking fingerprints

Biometric data must be collected in a manner that respects human dignity. Human dignity is inviolable and laid down in Article 1 of the Charter. It is the foundation for all fundamental rights in the Charter.

Individuals may be physically unable – due to disabilities for example – or unwilling to provide fingerprints. Although rare, asylum seekers and migrants in an irregular situation may refuse to provide fingerprints for Eurodac – a phenomenon which does not seem to occur in the context of VIS. People are reluctant to give their fingerprints for different reasons. Many do this to avoid being transferred, under the Dublin procedure, to an EU Member State in which they do not want to be. FRA’s field-research also revealed, however, that some refuse out of fear that their biometrics will be shared with their country of origin. The willingness to provide fingerprints would increase if asylum seekers and migrants in an irregular situation felt treated fairly and had trust in the procedures, and if family re-unification under Dublin were to work smoothly.

According to FRA findings, disproportionate force has been used when fingerprinting asylum seekers and migrants in an irregular situation. Given the vulnerability of the people concerned and the obligation to use the least invasive means, it is difficult to imagine that using physical or psychological force solely to obtain fingerprints for Eurodac would be justified. To enforce the duty to provide fingerprints, EU Member States have in some cases also resorted to detention.

When the authorities have difficulties in taking fingerprints that meet set quality standards, they sometimes suspect the person of having injured his or her fingertips on purpose to avoid fingerprinting, as FRA research shows.

Fingerprinting often takes place in stressful situations – at night or following a large numbers of arrivals for example. In such situations, fingerprinting poses high demands on staff, increasing the risk of inappropriate police behaviour due to exhaustion or stress. This, in turn, may undermine the dignity of the person being fingerprinted. Fingerprinting persons in a vulnerable situation, including those with disabilities or those who have experienced gender-based violence, requires particular attention. According to FRA findings, however, training tends to focus on the technical aspects of fingerprinting, and less on the treatment of the persons being fingerprinted.

Fingerprinting in a child-friendly and child-sensitive manner

Large-scale IT systems affect the rights of children in different ways. Article 24 of the Charter emphasises that the best interests of the child must be a primary consideration in all actions public authorities and private actors take concerning children. This also applies to fingerprinting. Field research shows limited efforts to inform children in a child-friendly and child-sensitive manner, in accordance with their age and maturity, although police and border guards often take extra time during the fingerprinting itself to adapt to the needs of the child. FRA research also points to allegations of incidents involving the use of force to fingerprint children. The risk of re-traumatisation for children is particularly apparent in such instances.

As a child grows, the accuracy of a biometric match diminishes. Taking young children’s fingerprints affects the quality and reliability of future matches to those fingerprints. The risk of a wrong match increases when the fingerprints or facial images are compared more than five years after they were taken.

Optimising the use of IT systems to trace missing children

Many unaccompanied or separated children who enter the EU subsequently go missing. Some of those missing may be subject to abuse and exploitation, including trafficking in human beings. IT systems could better support their protection, according to border guards interviewed. Interviewed experts pointed out, however, that the focus remains on perpetrators and that a more victim-centred approach would be needed.

Children avoid being registered or go missing for multiple reasons. These include lack of trust in family reunification under Dublin; fear of being prevented from reaching their intended destinations; and lengthy processing times for their asylum applications. Data processed on children could be used more effectively for child protection purposes. Interoperability may bring new opportunities to trace missing and abducted children, provided EU Member States more systematically create an SIS II alert when an unaccompanied child goes missing and referrals improve between police and child protection authorities.

Ensuring that industry consults fundamental rights experts when designing new solutions

In technical terms, the state of the art of technology determines the options that the EU and its Member States have when creating new systems or improving existing ones. Industry and the scientific research community can play an important role in developing technical solutions that promote respect for fundamental rights, including the protection of personal data. They should continue to embed data protection by design and by default in the technical solutions they devise for IT systems.

Strong safeguards to prevent unlawful access to data

The principle of purpose limitation – as mirrored in Article 8 (2) of the Charter, as well as in Article 5 (1) (b) of the GDPR and Article 4 (1) (b) of the Police Directive – requires that personal data are processed only for specified purposes, which must be explicitly defined. By optimising the use of IT systems for combating irregular migration, as well as serious crimes and terrorism, there is a risk of function creep – meaning that the data may be used for purposes that were not initially envisaged. This risk is particularly high in the case of interoperability between IT systems.

Article 28 and Article 32 of the GDPR require EU institutions and EU Member States to take necessary measures to avoid that data are disclosed to, or accessed by, unauthorised persons or organs. Private actors, such as carriers, may in some instances access limited parts of the EES (Articles 13) and ETIAS (Article 39). If IT systems are made interoperable, personal data stored in one system will be used across all systems to ensure correct identification of a person. Ensuring purpose limitation in such scenarios is particularly challenging.

IT systems that include data on asylum applicants may be particularly attractive for hacking by oppressive regimes or persecuting agents. Strong data security safeguards must limit such risks.

Ensuring respect for the right to seek asylum

FRA research findings reveal that some people with injured fingertips are suspected of deception although they are not intentionally avoiding to provide fingerprints. A suspicion that a person wishes to deceive the authorities affects their right to asylum, protected under Article 18 of the Charter. The physical inability to provide fingerprints due to the texture of one’s fingertips or a disability must not result in unequal treatment or discrimination prohibited by Articles 20 (equality before the law) and 21 (non-discrimination) of the Charter.

Many people seek to hide their identity when fleeing their country of origin to protect themselves. Others may be physically unable to obtain the documents necessary for legal entry, such as a passport and visa, when escaping conflict or persecution. Interpol runs two databases:

  • one for stolen and lost travel documents, the Stolen and Lost Travel Documents (SLTD) database;
  • one for individuals who are subject of an Interpol alert, the Interpol Travel Documents Associated with Notices (TDAWN) database.

Oppressive regimes may include information about political opponents in these Interpol databases to prevent them from leaving the country or to track their movements. These databases are to be included among the interoperable IT systems the EU is setting up.

Persons assessed to be in need of international protection but subject to an entry ban can still be issued a visa with limited territorial validity, according to Article 25 of the Visa Code. Such a visa allows them to cross the EU’s external border and provides them with the possibility to seek safety.

Prohibiting the transfer of data to third countries

Article 18 of the Charter protects the right to asylum. Effective access to international protection also forms the basis of protection from refoulement as enshrined in Article 19 of the Charter and Article 78 of the Treaty on the Functioning of the EU.

Sharing personal data with third countries can lead to particular risks for persons in need of international protection. They or their families may be subject to retaliation measures, ranging from criminal sanctions upon return to persecution of family members. The legal instruments for the IT systems generally prohibit sharing information with third countries, which reveals that a person is, or has been, an applicant for international protection in the EU. In practice, such safeguards are not always systematically followed, FRA research shows.

Under certain conditions, and typically for return purposes, personal data stored in IT systems may be shared with third countries. To prevent harm, in the case of asylum applicants, information is normally only shared with the third country at the end of the asylum procedure. However, in specific circumstances this may also be done before the procedure is completed – for example, following rejection of the application by the administration but where an appeal to the court is still pending. Such an approach can put people at risk. Safeguards are required to avoid that such transfers endanger the safety of asylum applicants or of their family members.

At the same time, IT systems can also be used to confirm an asylum applicant’s claimed identity, thus reducing the risk of a removal in violation of the principle of non-refoulement.

Evaluating carefully how access by law enforecement affects fundamental rights

All EU IT systems except for SIS II and ECRIS-TCN contain data on persons not suspected of having committed any crimes. Nevertheless, law enforcement authorities are allowed to access data stored in Eurodac, VIS, EES and ETIAS for the purposes of fighting serious crime and terrorism, provided they adhere to the safeguards specified in the legal instruments. One of these safeguards is the ‘cascade system’, which obliges EU Member States to first consult national databases that are directly linked to criminal investigations, and only then consult EU-level IT systems. When consulting EU IT systems, they must consult VIS before requesting access to Eurodac, because information on asylum applicants is particularly sensitive. This is to ensure that data sets on asylum applicants – a group particularly vulnerable to fundamental rights violations – are only consulted as a last resort.

Children’s right to such protection and care which is necessary for their well-being, set out in Article 24 of the Charter, requires measures to prevent future stigmatisation of children for acts they have committed in the past. Article 40 of the Convention on the Rights of the Child requires giving special attention to the treatment of children alleged to have, or being accused of or recognised as having infringed the penal law. According to the Charter, the child’s best interests must be a primary consideration (Article 24). Information on criminal records may have a disproportionate effect on the development of the child. In case of immigrationrelated offences, the criminal record could be the consequence of decisions taken by the child’s parents.

Applying apprehension policies in line with fundamental rights

In addition to serving their specific purposes, most IT systems also contribute to the control of irregular immigration. They may be consulted to find and apprehend migrants in an irregular situation. For example, the EES will produce a list of persons whose right to stay in the Schengen area has expired. This list of so-called ‘overstayers’ can be matched with other IT systems, which will be an easy exercise once systems are made interoperable.

FRA has previously highlighted that certain apprehension practices disproportionately affect fundamental rights of migrants in an irregular situation. Accordingly, FRA discouraged apprehensions near providers of essential services – such as schools or healthcare centres. Interoperability of information systems will make it more difficult for migrants in an irregular situation to report a crime to the police, either as victims or as witnesses, as the police will automatically see the person’s irregular residence status and, in most cases, be obliged under national law to initiate return procedures. With an increased risk of apprehension, migrants in an irregular situation will be even more reluctant to approach the police, contributing to impunity for perpetrators.

Improving data quality

Mistakes in the IT systems used in the field of asylum and migration management can have serious consequences for individuals. For example, the police may arrest a person or border guards may not let a person cross the border. In the case of asylum applicants, they may be suspected of having intentionally tried to provide a false identity, affecting the perceived trustworthiness of their whole asylum claim.

FRA research shows that EU IT systems contain inaccurate alphanumeric data, such as names or dates of birth, due to various reasons. According to the GDPR and Police Directive, EU Member States have the duty to verify the quality of personal data before they are made available to data users. Significant efforts are underway, including proposals to strengthen the role of eu-LISA in supporting Member States in improving data quality. Nevertheless, increased attention is needed to avoid having low quality data in the systems negatively affecting individuals’ fundamental rights.

Biometric data connect a person to alphanumerical data stored in an IT system. The quality of the biometric identifier is, therefore, of paramount importance. Although rare, FRA field research did reveal individual incidents of Dublin transfers being carried out based on false biometric matches. Presently, data quality standards for collecting fingerprints in Eurodac, which mainly holds personal data on asylum applicants, are higher than standards for collecting biometric data in VIS, for which a “zero-failure to enrol initiative” is applied, following requests by Member States. This means that for VIS the individual Member States are responsible for controlling the quality, whereas for Eurodac this is centrally carried out by eu-LISA. However, fingerprints collected for Eurodac may be checked against VIS to see if an applicant requested a visa in the past. If IT systems become interoperable, a person’s biometric identifier will connect the person to information contained in all IT systems, regardless of the quality standard according to which it was collected. Interoperability is also foreseen to include measures for improved reporting and collection of statistics, which would enhance data quality.

A person’s physical development over time may reduce the reliability of matches based on biometric data, particularly after longer periods. This may be particularly relevant to cases involving children, especially if data are retained for more than five years.

National authorities and experts attach a high degree of credibility to biometric data, and processing such data is technically complex. This makes it difficult for persons concerned to rebut errors in IT systems, and even more difficult to prove that a biometric match was incorrectly generated. FRA research shows that mistakes can occur when, for instance, a person’s fingerprints are mistakenly linked to another person’s alphanumeric data.

Effectively exercising the right of access, correction and deletion of personal data

Article 8 (2) of the Charter, as well as EU data protection law, provide for the right of access, correction and deletion of one’s own data that are stored. The specific legal instruments regulating the IT systems also mirror this right.

In spite of frequent data quality issues, complaints about incorrect or unlawful data use are rare. There is a lack of awareness and understanding of how to exercise the right of access, correction or deletion of inaccurate data that are stored. The cumbersome nature of the processes, administrative hurdles, language barriers and lack of specialised lawyers also explain why few persons try to exercise these rights.

According to FRA findings, complicated procedures and administrative and language barriers may in practice prevent the persons concerned from exercising their right of access, correction and deletion. Such difficulties may be exacerbated if IT systems are made interoperable. The establishment of a ‘one-stop-shop procedure’ for receiving requests to access, correct and delete data could simplify procedures. According to FRA research, very few lawyers are specialised in seeking to enforce the right of access, correction and deletion of data stored in IT systems, making it even more difficult for the persons concerned to exercise their rights.