Data protection in policing

Michael O’Flaherty
FRA Director Michael O'Flaherty delivers a speech at Europol’s Data Protection Experts Network (EDEN) conference on data protection in law enforcement. The conference took place in Rome on 18 October 2021.

Dear colleagues,

It is an honour for me to be here.

I very much appreciate the topic that you chose for this year's EDEN Conference.

The ultimate purpose of policing is the pursuit of human welfare and any technologies we employ must serve that purpose.

The conversation that you have designed for the conference is particularly needed now in the context of rapid technological advances, and I am referring to artificial intelligence here. It is already at a point where there is a debate about whether it should be given subjective identity and legal personality.

In addressing some of the issues, my focus will be very much on human and fundamental rights.

In a policing or a security context, far too often the discussion of security and human rights is expressed as a zero-sum game. More security, less respect for human rights. More respect for human rights, less effective security. I strongly disagree with this understanding.

I first had a deep appreciation of how false it is when I was Chief Commissioner of the Northern Ireland Human Rights Commission over a decade ago. On one of my first days in office, I was visiting a town where a very large bomb was detonated. Fortunately, property was damaged but nobody was killed.

The reason that nobody was killed was effective policing. That day it was brought home to me more than ever that effective policing is in the service of human rights. Ultimately, indeed, in the service of the very basic human right of life itself.

Of course, turning to the other side of the same equation, when policing itself shows a deep respect for human rights, it delivers better outcomes. Such approaches do, and will, help build public trust in policing, which is so essential for secure societies. We need to invest in the strengthening, the building of that trust right now, for instance, in the context of the use of biometric data applications in public settings.

Back in 2019, my agency asked people in the EU how willing they were to share facial images with the state for identity purposes. Just 17% of people across EU Member States said that they were comfortable with this. A mere 17%.

How do we build trust, then? How do we embed human rights ever more strongly in modern day policing, particularly in the context of the application of the new technologies?

This question has been the subject of sustained research by the Fundamental Rights Agency. We have gone in-depth to look at issues from facial recognition technology to the question of how we avoid discrimination in the design and use of algorithms.

Last year, we concluded a major study mapping the range of fundamental rights issues that occur in four major AI contexts. One of these was predictive policing. All the research that we have done, and will continue to do, is highly applied, working with practitioners on the ground to get a better understanding of how the application of technologies engages respect for human rights.

From our work, and the studies over recent years, we have identified and derived a number of principles to which attention needs to be paid, including, for example, in the context of developing strong regulation. Now, not all these principles are original, some are familiar. But through the case studies, we see that particular attention is needed to deliver them effectively.

The first is that the issue of protecting rights in the context of the use of the new technologies is about all human rights. Certainly, it is about privacy and quite correctly. Privacy will always be at the heart. But we must also pay attention to such issues as the avoidance of discrimination and protecting such rights as freedom of movement and expression, because of how the application of this technology could have a chilling effect for these rights.

The second principle that we have to keep in mind is that, while all of these rights can, and must, on occasion be subject to limitation, it must be done in strict respect for the principles of legality, necessity and proportionality. This is a well-known principle, but we have seen through our work the extent to which that assessment must be context specific.

The third principle is that effective respect for the range of human rights involved demands full technological transparency. It means we need to know what is in the algorithms. We need to know the content of machine training data. And again, the point needs to be made repeatedly and loudly, because, there is a pushback from parts of the industry. We are hearing voices, for instance, saying it is too difficult, it is too complicated, it is too hard to understand and therefore we cannot deliver on transparency. 

The fourth dimension is that high-risk AI applications, and other related technologies, require a priori human rights risk assessments. Again, a point can be made here that such risk assessments cannot be generic or homogenous. They must be context specific.

Fifth, we need independent oversight of the use of high-risk technologies. Interestingly, we find in our research that there is a considerable degree of openness to put in place such oversight. Where we see intention needed, however, is with regard to the mandate of oversight bodies. It is imperative that they be mandated, not only to address issues of, let's say, privacy, but also the other rights to which I made reference. Oversight bodies also need to be given adequate resources and training.

The sixth of my principles has to do with impacted individuals. A right is an empty thing without a remedy. So, it is very important that impacted individuals who believe that their rights have been violated have the possibility to seek a remedy. In the AI context, this includes within it, the dimension of making people aware that they have been subject to the application of technology that has impacted their life.

Finally, in terms of these principles, we need to remember that beyond regulation and strong oversight, we must continue to invest in digital literacy. We need high degrees of digital literacy, not only in the security communities, but also in the general population.

I take this opportunity to reaffirm the commitment of the Fundamental Rights Agency to continue researching this area and supporting you in delivering on those principles that I outlined. We look forward particularly to doing so in the context of the EU Innovation Hub for Internal Security.

I would like to wrap up with some words of Pope Francis.

In a one-minute video from last November, he spoke about AI. He mentioned that it is at the heart of epochal change for our civilization. He said that artificial intelligence can make a better world possible if it is used for the common good. For that, he said, it must be oriented towards respecting the dignity of the person.

In other words, it must be at the service of humanity. That is our challenge and our goal.

Thank you.

See also