November 30, 2004

An Open Letter to the European Parliament on Biometric Registration of All EU Citizens and Residents

To the Members of the European Parliament,

We the undersigned are calling on you to reject the 'Draft Council Regulation on standards for security features and biometrics in passports and travel documents issued by Member States'. This is an unnecessary and rushed policy that will have hazardous effects on Europeans' right to privacy. This policy process requires additional oversight, and the eventual systems established will require significant controls and a strong legal framework to ensure that this is a proportionate response to the war on terrorism. In particular, we call for the removal of the requirement for fingerprinting all EU citizens.

We are quite alarmed by the political dynamics at play in this policy decision.

1. The Council of the European Union pressed the European Parliament into including the Coelho reports on biometric identifiers on the agenda for the mini-session on Wednesday, 1 December 2004.
2. Behind closed doors on October 25 the Justice and Home Affairs Council decided to introduce mandatory fingerprinting for all EU citizens into the draft regulation.
3. The Parliament's response to this significant shift in policy is even more alarming: a majority of the Presidents of the Political Groups accepted the claim that the change was not sufficient grounds for the report to be sent back to the LIBE Committee for further consideration.
4. If the Presidents had refused to accept, the Council would have called for an urgency procedure.
5. If the Presidents had refused, the Council threatened to delay the introduction of the co-decision procedure for immigration and asylum issues to April 1 instead of January 1.[STATEWATCH04]

These dynamics are irresponsible and unhealthy for a functioning democratic system.

Securing our passports from fraudulent use is indeed a pressing need, particularly considering the substantial number of blank passports lost every year. The proposed policy that is being presented to you for review will however have significant implications. This policy is dependent on an unprepared and under-developed technological infrastructure. It will therefore lead to an increased risk of abuse.

We are calling on the European Parliament to reject this policy. The case still has not been made openly and clearly as to why biometric passports are required. There is a lack of adequate safeguards. We urge the Parliament to oppose the creation of an EU-wide database of personal data. We further urge the Parliament to oppose mandatory fingerprinting as an unnecessary and disproportionate act. Finally, we are calling on the Parliament to reserve the right to question the legal basis of the proposal.

The European Parliament needs to provide sunlight to this policy process through oversight and an open deliberative process.

A Dangerous Policy

The grounds for changing our passport standards are many and varied. Yet the proposed changes in this policy are without foundation. U.S. law does require biometric passports programmes to be in place by the Autumn of 2005 in order for countries to remain part of the Visa-Waiver Programme. U.S. law also requires the standard for these programmes to be established by the International Civil Aviation Organization. However, neither the U.S. nor the ICAO requires biometric passports in the form proposed by the Council.

We would like to take this opportunity to remind you that

• The Council is calling for the use of two biometrics, when the U.S. and the ICAO only require one, and this only involves a digital photograph. The inclusion of a fingerprint biometric is unprecedented.
• The U.S. has no intentions of implementing fingerprints in their passports. [USDOS04]
• The ICAO has itself noted that some States are legally barred from storing biometrics. [ICAO03]
• The U.S. Department of Homeland Security and the Department of State note that privacy issues need to be resolved prior to the implementation of these systems.[RIDGE04]
• The French Government reached a similar conclusion, requiring that any implementation of biometric techniques is systematically subject to prior agreement from its national privacy commission.[FRA04]
• The legal basis offered by the Commission and Council is fundamentally flawed. A legal analysis by Professor Steve Peers (University of Essex) concludes that: "The proposed Regulation on EU passports, with or without mandatory fingerprinting requirements, exceeds the legal powers conferred upon the Community to adopt measures concerning checks at external borders. It furthermore exceeds any other powers conferred upon the Community. If the Regulation includes mandatory fingerprinting requirements, it would also breach the principle of proportionality that is a requirement for the legality of Community acts, and the general principles of Community law, which include the protection of the right to private life." [PEERS04]

We are thus alarmed by the omission of these facts from the current debates.

Problematic Technologies

Lurking behind this policy is the creation of an EU-wide database system that will store the personal information of over 450 million people. This database is neither required nor is it technologically desirable. The European Commission previously advocated a centralised database solution, but even then the Commission noted that further research is necessary to "examine the impact of the establishment of such a European Register on the fundamental rights of European citizens, and in particular their right to data protection." [COMM04]

Centralised EU databases covering passports, visa and residence permits will be linked through SIS II. This risks becoming a mass surveillance infrastructure tracking the movements of all residents and citizens. Plans to give access to all law enforcement and internal security agencies risk the misuse of sensitive personal information. To date, there have been too few studies, if any, of these problems and challenges. Policy as important and far-reaching as this requires more care before being adopted.

We would like to further remind you that the risks to privacy are well known. In particular, European Privacy and Data Protection Commissioners have long warned of the dangers of biometric data collection.

• The Article 29 Working Party on Data Protection rightly notes that fingerprints are usually collected from criminals. The increased collection of highly personal information will de-sensitize us to the effect that this processing will have on our daily life.[ART2903]
• This proposal may not make us any safer and may in fact create more risks, and even greater potential of reuse and abuse. Centralised databases are prone to abuse, and fingerprints can easily be collected without consent, and are thus ideal for additional surveillance.[ART2903]
• Even face recognition technology reveals racial or ethnic origin,[ART2903] which under EU law is of a highly sensitive nature and deserves even greater privacy protection.

Additionally, the International Conference on Data Protection and Privacy Commissioners in 2003 declared that

"In the fight against terrorism and organized crime, countries should determine their responses paying full regard to fundamental data protection principles, which are integral parts of the values being defended."

They recommend that in situations where there are required interventions into the right to privacy,

"they should take place within a framework taking data protection into account, e.g. on the basis of an international agreement stipulating adequate data protection requirements, including clear purpose limitation, adequate and non-excessive data collection, limited data retention time, information provision to data subjects, the assurance of data subject rights and independent supervision."

The current proposal does not sufficiently address these most basic requirements. It lacks a legal framework to protect privacy rights. This deficiency is inexcusable, particularly as the personal information of Europeans is collected and transferred abroad.

Greater Implications

When the U.S. implemented its mass fingerprinting and face-scanning programme for all visitors, the world responded with alarm. All visitors over the age of 13 will now have their fingerprints taken and stored for 75 to 100 years by the Department of Homeland Security, and will be shared with other government departments and agencies, and other governments.[PIVISIT04]

The Council's proposed policy goes well beyond this already problematic US-VISIT programme. The U.S. Government is not fingerprinting its own citizens. The EU policy intends to fingerprint all EU citizens, residents, and visitors. The secondary effect of this policy is that whenever EU citizens travel abroad (not necessarily to the United States), they will again be required to register their fingerprints and face-scans with foreign governments as their passports are verified. As a result, the EU is drastically enlarging the US-VISIT programme by turning it against its own citizens and then globalising this practice.

We would also like to point to the practical implications of this policy.

• Citizens will now have to present themselves at an 'enrolment centre' to be 'processed and have their fingerprints taken by their National passport authority every time they want a passport. Previously, passport renewal could be achieved remotely, even through the post. The increased administrative costs to the authorities and to individuals are likely to be significant.
• The complexities of the database systems involved in the registration, issuance, and verification processes are unprecedented.
• There is no legal framework in this policy to prescribe how this information may be collected, processed, and transferred.
• Error rates in fingerprinting are significant, and poorly understood. Two percent of the general population do not even have fingerprints, while certain ethnic, and demographic groups are more difficult to fingerprint than others.[GAO02] According to a recent review of available systems, only a handful of products achieved an equal error rate of under 3%, and most were much worse.[FVC2004] Furthermore, it would be hazardous and risky for governments to lock their core infrastructure into a single proprietary product while both attack and defence are evolving rapidly.

It is also worth noting that never has a system of the scale of 450 million individuals' fingerprints ever been tested, because a surveillance system of this magnitude is unprecedented.

According to one expert, our understanding of fingerprints "is dangerously flawed and risks causing miscarriages of justice". [MNOOKIN04] Amongst the many cases of mistaken identification through fingerprinting, we would like to remind the Parliament of the recent case of Brandon Mayfield. After the Madrid Bombings of March 11, 2004, Spanish National Police managed to lift a fingerprint from an unexploded bomb. Three highly skilled FBI fingerprint experts declared that Oregon lawyer Brandon Mayfield's fingerprint matched. U.S. officials called it "absolutely incontrovertible" and a "bingo match." As a former U.S. soldier, his fingerprint was on the national fingerprint system. Mayfield was imprisoned for two weeks. The fingerprint, however, was not his. According to one law professor,

"The Mayfield misidentification also reveals the danger that extraneous knowledge might influence experts' evaluations. If any of those FBI fingerprint examiners who confidently declared the match already knew that Mayfield was himself a convert to Islam who had once represented a convicted Taliban sympathizer in a child custody dispute, this knowledge may have subconsciously primed them to "see" the match. ... No matter how accurate fingerprint identification turns out to be, it cannot be as perfect as they claim." [MNOOKIN04]

When all of his personal information was combined, however, the FBI was convinced. Yet according to a recent panel of experts, they were wrong.[HARDEN04] As we increase the collection of biometric information away from criminals and other select groups, errors are likely to increase. The technologies in our midst, and our methods, are not perfect.

The Council and the Commission are busy implementing many other systems of surveillance that will involve increased personal data collection, data mining, and data sharing. These policies together ensure that instead of achieving certainty and security, we only create more risk, danger, misplaced suspicion and abuse.

Greater Oversight is Required

The fatal flaw in this entire policy process is the lack of adequate supervision, oversight, and deliberation. This must be rectified. We call on the European Parliament to play this key role in democratic process.

We call on the European Parliament to:

• Re-establish essential safeguards for the proposed systems, including those that were set out in the Parliament's report, and in particular the abandonment of an EU-wide database.
• Require and/or establish a legal framework for the collection and use of personal information in travel documents and border programmes. This framework must be consistent with the European Convention of Human Rights, and in particular Article 8. This would include requiring clearer statements of necessity, purpose and proportionate uses, so that the data collected is not used for generalised surveillance or other purposes.
• Require that this legal framework also ensure that the systems supporting this policy are secure, with clear lines of accountability, and that the collection procedures are well understood. Only then can we begin to understand the complexity of the system involved, and in turn the potentially severe cost implications.
• Call for the establishment of mechanisms to provide for the oversight of the planning, implementation, testing, and use of biometrics in travel documents.
• Remove the unnecessary requirement of mass fingerprinting of EU residents and citizens.
• Review the technological implications of this and related policies. In establishing what could be one of the largest database systems in existence, we are alarmed by the lack of publication, public discourse, and scrutiny of the costs and implications of this policy. We need valid research of the problem, which can then be relayed to the Parliament, focussing on economics, legal, and technological implications, as well as potential for abuse.
• Call on the research and policy community to propose alternative solutions that are privacy-friendly. Alternative systems and technologies exist, as we already see that the U.S. is not intending on generating a fingerprint registry of its own citizens. Innovative solutions must be brought to the forefront to preserve European values, rights, democratic standards, and laws.
• Reserve the right to question the legal basis especially as the Parliament will have no chance to examine or change the implementing rules.

The EU is embarking on a policy that will make our most personal information the currency of travel, while creating one of the world's largest surveillance infrastructures. This is unprecedented and unnecessary.

These are serious times and we need serious policy based on effective deliberation. Rushing this policy through the European Parliament is not required, when careful scrutiny is necessary. The EU's respect for privacy is often considered the global gold-standard, and yet now the EU is revolutionising surveillance. When combined with data profiling and data sharing proposals also being developed by the Commission and the Council, Europe faces the real prospect of creating a surveillance behemoth.

We call on MEPs to oppose this proposed policy, and we look forward to working with you in the future on establishing effective policies for securing our societies whilst simultaneously securing our rights and liberties.

Signed,

Additional Endorsements

European Commissioners and Officials

Dr. Johann Bizer, Deputy Data Protection Commissioner, Schleswig-Holstein, Germany

Dr. Alexander Dix, Commissioner for Data Protection and Access to Information, Brandenburg, Germany

Sven Holst, Data Protection Commissioner of Bremen, Germany

Dr. László Majtányi, former parliamentary commissioner for FOI & Data Protection, Hungary

Burckhard Nedden, Data Protection Comissioner of Niedersachsen (Lower Saxony), Germany

Dr. Attila Péterfalvi, National Data Protection Commissioner, Hungary

Bettina Sokol, the Data Protection and Information Commissioner of North Rhine-Westphalia, Germany

Gyula Veszelei, President of the Office for Personal Data Protection, Slovak Republic

Dr. Thilo Weichert, Head of the Independent Center for Privacy Protection and Data Protection Commissioner, Schleswig-Holstein, Germany

Organisations

686e, Germany

AMARC (World Association of Community Radio Broadcasters) ,UK

Association Electronique Libre, Belgium

Association for Progressive Communications, International

Big Brother Awards, Denmark

Big Brother Awards, Germany

Bits of Freedom, The Netherlands

catpipe Systems, Denmark

ChangeNet, Slovak Republic

Chaos Computer Club, Germany

Commonwealth Centre for e-Governance, Canada,

CRIS (Communication Rights in the Information Society),Italy

CSDPTT, France

Der Grosse Bruder, Germany

Deutsche Vereinigung fuer Datenschutz e.V., Germany

Digital Rights, Denmark

Electronic Frontier Finland, Finland

European Association for Human Rights (FIDH-AE),International

Fédération Informatique et libertés, France

FoeBuD e.V.,Germany

Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e.V., Germany

Foundation for Information Policy Research, UK

GreenNet, UK

Hungarian Civil Liberties Union, Hungary

Hungarian Helsinki Committee, Hungary

IN2, Switzerland

Institut fuer Buergerrechte und oeffentliche Sicherheit e.V., Germany

IRIS - Imaginons un réseau Internet solidaire, France

IT Solutions,Germany

Liberty, UK

Ligue des droits de l'homme, France

monochrom, Austria

musikmaschine, Austria

netzwerk neue medien, Germany

Normasys, France

Ouvaton France/Afnet, France

quintessenz, Austria

Redaktion akin / Freie österreichische Jugend, Österreich

samizdat.net,France

Security6.net, Denmark

Solberga byalag, Sweden

Swiss Internet Users Group (SIUG), Switzerland

Technology for People (TEA), Hungary

Union des Initiatives Lotoises, France

VIBE.AT, Austria

Individuals (Last, First Names)

Amort Michaela, Austria

Anderson Garry, UK

Angenendt Ralph

Anzinger Gunnar, Germany

Bárány Balázs, Austria

Bargmann Monika, Austria

Bassler Marcus, Germany

Baumann Ralph, Switzerland

Behrs Jan, Germany

Berk Michelle van den, Netherlands

Berkemeier Christoph, Germany

Bessler Manuel, Germany

Binkhorst Cees, Netherlands

Böheim Marc, Germany

Bonk-Kassner Christian, Germany

Breinbauer Bernhard, Austria

Brown, Ian Dr., University of College London (UK)

Brudermann Sepp R., UK

Burger Helmut, Austria

Cas Johann, Austria

Chateau Mónica, Austria

Choinowski Lutz, Germany

Davies Simon, The London School of Economics and Political Science (UK)

de Larrinaga Christian, UK

Ducournau Catherine, France

Dunbring Daniel, Sweden

Ericson Anders, Sweden

Ericson Eric, Sweden

Ericson Gerd, Sweden

Ericson Peter, Sweden

Farrell Maria, Belgium

Fleer David, Germany

Flueckiger Markus, Germany

Foldes Adam, Hungary

Frank Karl, Austria

Fries Clemens Lucas, Germany

Gent Onno K., Germany

Gibello Pierre-Yves, France

Glorioso Andrea, Italy

Göttlicher Thomas, Austria

Götz Fabian, Germany

Grandin Jakob, Sweden

Gromer Stephan Dr. med. habil., Germany

Güney Saritas, Austria

Güther Burghard, Germany

Hackett Teresa, Ireland

Hammel Maximilian, Austria

Hammerton James, UK

Hanscho Michael, Austria

Hass Veronika, Germany

Hauser Peter, Austria

Herrmann Gregor, Austria

Heydwolff Dr.med. Andreas von, Austria

Hofmann Michelle, Austria

Horvath, Dr. Eva

Jacobsson Johan, Sweden

Jahn Stefan, Germany

Jedlicka Alexander, Austria

Jollčs Jacques, France

Jongerman M.J., Netherlands

Kaindl Bernhard, Austria

Kamenik Boris, Austria

Kloibhofer Robert, Austria

Kruse Jörg, Germany

Kuhm Peter, Austria

Kühne Gunter, Germany

Kuikstra R., Netherlands

Kuntz Georges, France

Kutterer Cornelia, Belgium

Leber Christian, Germany

Lurway Karl, UK

Manske Tina, Germany

Marsden Danielle, UK

Maximilian Renée, Austria

McKinlay Kirsty, Scotland

Michlmayr Thomas "Mike", Luxembourg

Morbey Richard, UK

Moser Steffen, Germany

Mosta Roman, Austria

Müller Alexander Leonhard, Netherlands

Nell Meinrad, Austria

Neuwirt Karel, Dr., Czech Republic

Řstergaard Anne, Denmark

Paulet Martine, France

Pfeifer Gerald, Germany

Plackner Florian, Austria

Planer Torsten, Germany

Pöhlmann Sascha, Germany

Raven Kai, Germany

Reiter Thomas, Austria

Remy Sylvain, France

Rothenburg Annegret, Germany

Rummel Jürgen, Germany

Ruzicka Volkmar, Austria

Ryan Kenneth, The Netherlands

Sadurní Carles, Spain

Saukkonen Timo, Finland

Schlottmann Henning, Deutschland

Schmidt Peter, Germany

Schmitt David, Austria

Scholz Fred H., Germany

Schuering Thomas, Germany

Schuh Wolfgang, Austria

Schuhmacher Thomas, Germany

Seib Hermann, Austria

Serricchio Cristanziano Luca, Italia

Siefkes Christian, Germany

Simon Eva, Hungary

Simoni Manuel, Austria

Siong Han, Netherlands

Sokolov Daniel AJ, Austria

Starhan Franz, Austria

Steinbach Ulrich, The Green Party in the State Parliament of Rheinland-Pfalz, Germany

Svarre Jesper, Denmark

Szabo Dr. Mate, Hungary

Teege Matthias, Germany

Theininger Martina, Austria

Tiefenbacher Philipp, Austria

Varga Marcus, Austria

Waldmüller Johannes, Austria

Walter Christophe, France

Wessel Andreas, Germany

Wigbels Norbert, Germany

Wirthensohn Christian, Austria

Wölkner Michael, Germany

Wollitzer Mike, Austria

Wright Joss, UK

Wulfmeyer Eike, Germany

Zangerl Albert, Austria

Zangerl Alexander, Austria

Zeltner Michael, Austria

Zoellner Martin, Germany

Zsivkovits Samuel, Austria

International Endorsements

Abrantes Katya, Australia

Afonso Carlos, RITS, Brazil

Alegre Alan G., Foundation for Media Alternatives, Philippines

Ambrosi Alain, Carrefour mondial de l'Internet citoyen, Québec, Canada

Antonov Pavel, Bluelink, Bulgaria

Babic Danijela, ZaMirNET, Croatia

Cadena Sylvia, APC WNSP, Uruguay

Clarke Roger, APF, Australia

Dada John, Fantsuam Foundation, Nigeria

EPIC - Electronic Privacy Information Center, USA

Fressinger Neil, USA

Garton Andrew, C2o, Australia

Lujambio Danilo , Nodo Tau, Argentina

Markovski Veni ISOC Bulgaria, Bulgaria

Primo Natasha, WomensNet, South Africa

Zielke Oliver, Web Community Networks, Canada

Endorsements After the Date of Submission

American Civil Liberties Union, USA

Ralf Bendrath, University of Bremen

Douwe Korff, London Metropolitan University, UK

Stop1984, Germany

References

[ART2903] Article 29 Working Party, Working document on biometrics. Brussels: Article 29 Data Protection Working Party, August 1, 2003. Archived at http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2003/wp80_en.pdf

[COMM04] Commission of the European Communities, Proposal for a Council Regulation on standards for security features and biometrics in EU citizens' passports. Brussels: The European Commission, February 18 2004, COM(2004)116final. Archived at http://register.consilium.eu.int/pdf/en/04/st06/st06406-re01.en04.pdf

[FRA04] French Government, Implementation of Biometric Techniques on French Airports. Cairo, Egypt: Presented to the ICAO summit in Cairo. March 18, 2004, FAL/12-IP/24. Archived at http://www.icao.int/icao/en/atb/fal/fal12/documentation/fal12ip024_en.pdf

[FVC2004] Fingerprint Verification Competition 2004, Open Category Results: Average results over all databases, Preliminary results. Available at http://bias.csr.unibo.it/fvc2004/results.asp.

[GAO02] United States General Accounting Office, Technology Assessment: Using Biometrics for Border Security, November 2002. Available at http://www.gao.gov/new.items/d03174.pdf.

[HARDEN04] B. Harden. "FBI Faulted in Arrest of Ore. Lawyer." Washington Post, November 16, 2004.

[ICAO03] ICAO BIOMETRICS DEPLOYMENT OF MACHINE READABLE TRAVEL DOCUMENTS ICAO TAG MRTD/NTWG TECHNICAL REPORT: Development and Specification of Globally Interoperable Biometric Standards for Machine Assisted Identity Confirmation using Machine Readable Travel Documents. Montreal: ICAO, May 12, 2003. ver 1.9.

[MNOOKIN04] J.L. Mnookin, "The Achilles' Heel of Fingerprints". Washington Post, May 29, 2004.

[PEERS04] Steve Peers, Commission’s EU biometric passport proposal exceeds the EC’s powers. Statewatch, November 26 2004. Archived at http://www.statewatch.org/news/2004/nov/11biometric-legal-analysis-htm.htm

[PIVISIT04] Privacy International, The enhanced US border surveillance system: an assessment of the implications of US-VISIT. London, September 28, 2004. Archived at http://www.privacyinternational.org/issues/terrorism/rpt/dangers_of_visit.pdf

[RIDGE04] Tom Ridge and Colin Powell, Dear Mr. Chairman, letter to the Chairman of the House Committee of the Judiciary. Washington, D.C.: 2004. Archived at http://www.house.gov/judiciary/ridge031704.pdf

[STATEWATCH04] Statewatch, EU governments blackmail European Parliament into quick adoption of its report on biometric passports, November 2004.

[USDOS04]U.S. Department of State, Abstract of Concept of Operations for the Integration of Contactless Chip in the U.S. Passport. Washington, April 26, 2004.