EU: Policing: France proposes massive EU-wide DNA sweep, automated
exchange of facial images
The French Presidency of the Council is seeking EU-wide comparisons of
every DNA profile held by police forces against all those held by other
national police forces, as well as EU policing agency Europol, as part
of plans to upgrade the ‘Prüm’ network of police databases. It also
hopes to automate the police exchange of facial images by eliminating
requirements for human review.
By Statewatch · April 20, 2022
<https://edri.org/our-work/eu-policing-france-proposes-massive-eu-wide-dna-sweep-automated-exchange-of-facial-images/>
*Networking police databases*
The proposals come in an amended version of a proposal
<https://www.statewatch.org/media/3247/eu-council-prum-presidency-proposals-8020-22.pdf>
(pdf) originally published by the European Commission in December 2021,
which will upgrade the Prüm network of DNA, fingerprint and vehicle
registration databases to include facial images and “police records”, as
well as driving licence data
<https://www.statewatch.org/news/2022/february/eu-got-a-driving-licence-you-re-going-in-a-police-line-up/>,
if the Council has its way.
The Prüm system currently allows law enforcement authorities to compare
a DNA profile – for example, taken from a criminal suspect or found at a
crime scene – and use it to run a search against all other participating
member states’ DNA databases. As well as EU member states, this also
includes the UK
<https://www.statewatch.org/brexit-goodbye-and-hello-the-new-eu-uk-security-architecture-civil-liberties-and-democratic-control/>.
*Mass DNA searches*
But the Presidency’s plan goes much further: under the revamped Prüm
system, a central “router” would be set up to manage interconnections
between different national databases, simplifying the current system
which requires mutual interconnections between every participating state
<https://www.statewatch.org/media/3249/eu-council-prum-notifications-declarations-5183-22-rev2.pdf>
(pdf).
The Presidency now aims to use that router for the mass comparison of
DNA profiles (emphasis added in all quotes):
/“Member States shall, at the initial connection to the router via their
national contact points, *conduct an automated search by comparing all
their DNA profiles, with all DNA profiles stored in all other Member
States’ databases and Europol*. Member States and Europol shall agree
bilaterally on the modalities of these automated searches.”/
The same article goes on to say that such mass searches could be a
regular undertaking:
/“*Member States may agree bilaterally to conduct automated searches
also at a later stage* by comparing DNA profiles, with all DNA profiles
stored in all other Member States’ databases and Europol. Member States
and Europol shall agree bilaterally on the modalities of these automated
searches.”/
The Presidency has somehow managed to include these provisions prior to
one that says:
/“*Searches may be conducted only in individual cases* and in respect of
the same guarantees and safeguards that are required for similar
searches at national level.”
/
A mass, automated search and comparison of DNA profiles is evidently not
an “individual case”.
If it were implemented now, the proposal would involve the processing of
millions of items of sensitive personal data – EU member states held a
total of almost 17 million DNA samples at the end of 2021, according to
the latest statistics on DNA databases circulated within the Council of
the EU
<https://www.statewatch.org/media/3248/eu-council-prum-statistics-2021-5436-22.pdf>
(pdf, see table below). All but two member states’ DNA databases grew
during the course of 2021, some substantially: Bulgaria’s by 30%, and
Poland’s by 38%. The intention is to have the upgraded Prüm operational
by 2027, by which time those databases will have grown even more.
The Council may also be seeking to weaken the applicable safeguards, or
at least to make them less specific: the phrase “in respect of the same
guarantees and safeguards that are required for similar searches at
national level” has been inserted in place of the previous text, which
required searches to be conducted “in compliance with the national law
of the requesting Member State.”
*Automating the exchange of facial images*
The intention is also for the upgraded Prüm network to include police
facial recognition databases, which could form the technical backbone of
a Europe-wide mass biometric surveillance system
<https://edri.org/our-work/press-release-ec-jumps-the-gun-on-prum/>.
Under the Commission’s proposal
<https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2021:784:FIN>,
member states would have submitted a facial image for a search against
all other member states’ databases, and in return would have received a
list of potential “candidates” for matches that would require human
review before any further personal data could be exchanged.
The Commission recently emphasized this point to /Wired/
<https://www.wired.com/story/europe-police-facial-recognition-prum/>,
saying that “a human will review the potential matches and decide if any
of them are correct, before any further action is taken.”
The Council, however, has other plans. The latest proposed version of
the text deletes the requirement for human review, and instead makes it
optional:
/“The national contact point of the requesting Member State may decide
to manually confirm a match between two facial images. If so decided, it
shall inform the requested Member State and shall confirm this match
with facial images reference data received from the requested Member
State.”/
The implication is, then, that the matching of facial images should
generally be done automatically.
Here, as with DNA and other types of data covered by the new Prum
system, the Council has changed the requirement for searches to be
conducted “in compliance with national law” to “in respect of the same
guarantees and safeguards that are required for similar searches at
national level.”
*National DNA database content (stains and persons), 2021*
*State* *01-Jan-21* *31-Dec-21* *% change*
Belgium 101,098.00 108,049.00 7%
Bulgaria 43,611.00 56,736.00 30%
Czechia 277,213.00 287,357.00 4%
Denmark 163,614.00 172,574.00 5%
Germany 1,244,119.00 1,198,826.00 -4%
Estonia 74,259.00 78,874.00 6%
Greece 38,408.00 42,014.00 9%
Spain 441,165.00 460,309.00 4%
France 5,594,676.00 6,025,945.00 8%
Croatia 10,085.00 10,802.00 7%
Ireland 40,250.00 47,877.00 19%
Cyprus 18,565.00 19,432.00 5%
Latvia 72,930.00 77,215.00 6%
Lithuania 140,770.00 149,523.00 6%
Luxembourg 7,835.00 9,073.00 16%
Hungary 161,306.00 167,946.00 4%
Malta 799.00 156.00 -80%
Netherlands 379,826.00 398,931.00 5%
Austria 296,422.00 309,155.00 4%
Poland 117,287.00 161,702.00 38%
Portugal 14,163.00 14,163.00 0%
Romania 57,857.00 68,466.00 18%
Slovenia 32,948.00 33,684.00 2%
Slovakia 94,482.00 99,027.00 5%
Finland 207,651.00 212,412.00 2%
Sweden 209,048.00 211,814.00 1%
UK 6,337,964.00 6,446,391.00 2%
16,178,351.00 16,868,453.00 4%
/Figures for the UK are taken from the national DNA database statistics,
available here
<https://www.gov.uk/government/statistics/national-dna-database-statistics>./
_______________________________________________
nexa mailing list
[email protected]
https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa
