ZPP Newsletter
Warsaw, 31 May 2022
Position of the Chief Expert in digital economy of the Union of Entrepreneurs and Employers (ZPP) on biometrics regulation
In recent times it has been loud about the regulation of biometrics due to the EU’s Artificial Intelligence Act. Biometry is a scientific field that measures living creatures to determine their individual characteristics. It is widely used for identity verification, authorization of access to information systems or for identification of persons, and rapid technological progress is conducive to its popularization. In the Artificial Intelligence Act, the EU has decided to set certain limits for the development of technology in order to protect fundamental rights and freedoms. This is why, among other things, the European Commission’s proposal includes a ban on real-time biometric face recognition in public places.
Using artificial intelligence to recognize faces without explicit permission and processing these data for a closer unknown purpose brings to mind the dystopian visions of sci-fi movies. The European Data Protection Board, together with Wojciech Wiewiórski, the European Data Protection Supervisor, called for a ban on the use of artificial intelligence to automatically recognize the biometric features of people in public space. In their opinion, such tools constitute an unacceptable interference with the rights and freedoms of citizens.
On the opposite side than privacy defenders, there are law enforcement agencies, which emphasize the need to use new technologies to ensure security. Service officers call for the possibility of recognizing faces in the case of persons wanted or suspected offenders to be maintained. As they emphasize, the use of technology would remain limited and it would be used only in specific situations, rather than for screening the population.
Member States remain divided on this idea. Just a few days ago, the French Presidency raised the issue, that it could be difficult to find an agreement on the rules on artificial intelligence for law enforcement authorities, including the ban on real-time face recognition in public space. Some EU countries are demanding stricter bans, while others want more freedom for law enforcement authorities to use face recognition and high-risk technology. After all, the EU is an area without borders, which is exploited by criminals moving between countries and making it difficult for justice to work. According to Europol data, 70% of organized criminal groups in the EU operate in more than three Member States, and in almost two-thirds of cases among their members there are people from different countries.
Here we are coming to another point, namely the regulation that allows law enforcement authorities to exchange certain information, such as fingerprints, DNA data and vehicle owners information across the EU. The exchange of such information is possible under the 2005 Prüm Convention on a cross-border cooperation to combat terrorism, cross-border crime and illegal immigration. The convention was originally signed by seven Member States and, on the basis of this, the EU Council adopted in 2008 the Prüm Decision, which has already been applied to all Member States. In short, if Polish officers suspect that the person they are looking for is in Greece, they may ask the Greek authorities to check the fingerprints in their database. However, there is no centralized, automated system that would facilitate the exchange of information. This is about to change soon.
In December 2021, the European Commission submitted a legislative package to strengthen cross-border police cooperation. The package included a proposal for a Prüm II regulation. The new regulation is intended to significantly automate the exchange of information between Member States’ services, but also to extend the catalog of information that can be processed, to inter alia facial images, photographs, criminal records and driving license data. The final effect will be a huge system for comparing suspects’ images using face recognition algorithms in an automated process.
Human rights defenders warn that in this way the EU can create the largest system of mass biometric surveillance in the world. How has it happened that the EU, on the one hand, wants to prohibit the use of artificial intelligence for face recognition in the Artificial Intelligence Act
and, on the other, is working on a system for the automation of face recognition in the Prüm II Regulation? The difference is in time. The Artificial Intelligence Act prohibits real-time face recognition. The Prüm II Regulation is intended to allow the search of databases, namely the retrospective identification of faces. How does this translate into respect for fundamental rights? EDRi (European Digital Rights) analysts, who are fighting for digital rights say that retrospective face analysis can have equally serious effects – for example, to determine where the person was and with whom the person was seen 5 years ago, which may be completely different in the light of the information currently available. Finally, the automation of the information exchange process is nothing else than a reduction in procedural and judicial safeguards, which ensure that data is only made available to the services of other countries when it is actually necessary.
In conclusion, what we can see is undoubtedly a chaos in the area of biometrics regulation. The EU institutions praise their struggle to respect privacy in regulations such as the Artificial Intelligence Act, while at the same time implementing invasive solutions under the Prüm II Regulation. The ZPP has repeatedly stressed the consequences arising from creating conflicting rules, but we are deeply amazed at the level of inconsistencies in the solutions proposed for the regulation of biometric facial recognition.
Kamila Sotomska
Chief Expert for the digital economy
