EUROPEAN DIGITAL RIGHTS A LEGAL ANALYSIS OF BIOMETRIC MASS SURVEILLANCE PRACTICES IN GERMANY, THE NETHERLANDS, AND POLAND By Luca Montag, Rory Mcleod, Lara De Mets, Meghan Gauld, Fraser Rodger, and Mateusz Pełka EDRi - EUROPEAN DIGITAL RIGHTS 2 INDEX About the Edinburgh 1.4.5 ‘Biometric-Ready’ International Justice Cameras 38 Initiative (EIJI) 5 1.4.5.1 The right to dignity 38 Introductory Note 6 1.4.5.2 Structural List of Abbreviations 9 Discrimination 39 1.4.5.3 Proportionality 40 Key Terms 10 2. Fingerprints on Personal Foreword from European Identity Cards 42 Digital Rights (EDRi) 12 2.1 Analysis 43 Introduction to Germany 2.1.1 Human rights country study from EDRi 15 concerns 43 Germany 17 2.1.2 Consent 44 1 Facial Recognition 19 2.1.3 Access Extension 44 1.1 Local Government 19 3. Online Age and Identity 1.1.1 Case Study – ‘Verification’ 46 Cologne 20 3.1 Analysis 47 1.2 Federal Government 22 4. COVID-19 Responses 49 1.3 Biometric Technology 4.1 Analysis 50 Providers in Germany 23 4.2 The Convenience 1.3.1 Hardware 23 of Control 51 1.3.2 Software 25 5. Conclusion 53 1.4 Legal Analysis 31 Introduction to the Netherlands 1.4.1 German Law 31 country study from EDRi 55 1.4.1.1 Scope 31 The Netherlands 57 1.4.1.2 Necessity 33 1. Deployments by Public 1.4.2 EU Law 34 Entities 60 1.4.3 European 1.1. Dutch police and law Convention on enforcement authorities 61 Human Rights 37 1.1.1 CATCH Facial 1.4.4 International Recognition Human Rights Law 37 Surveillance Technology 61 1.1.1.1 CATCH - Legal Analysis 64 EDRi - EUROPEAN DIGITAL RIGHTS 3 1.1.2. Foreign National Introduction to Poland country Database 67 study from EDRi 100 1.1.2.1 Foreign National Poland 103 Database - 1. The Domestic Legal Legal Analysis 68 Framework 105 1.1.3 Clearview AI 70 1.1 An Overview 105 1.1.3.1 Clearview AI - 1.2 The Constitution 105 Legal Analysis 71 1.3 The GDPR 106 1.1.4 Camera in Beeld 71 1.3.1 The Act of 10th May 1.1.5. Smart doorbells 71 2018 106 1.1.5.1 Camera in Beeld 1.3.2 The Act of 21st and Smart Doorbells February 2019 107 - Legal Analysis 75 1.4 The Office of Personal 1.2. Municipalities 77 Data Protection (“UODO”) 107 1.2.1 Municipalities - 1.5 Other Acts Governing Legal Analysis 78 Surveillance 109 1.3 Conclusion 80 2. “Kwarantanna Domowa” – 2. Deployments by Private Poland’s Home Quarantine Entities 81 App 110 2.1 Retail 81 2.1 An overview 110 2.2 Casinos 82 2.2 Analysis 112 2.3. Football clubs and 2.2.1 Legal Basis 112 stadiums 83 2.2.2 Necessity and 2.4 Schiphol airport 85 Proportionality 113 2.5 Public transport 85 2.2.3 Government 2.6 International Legal Motivations for Biometric Framework 86 Surveillance 115 3. ‘Living Labs’ 88 2.2.4 Mass Surveillance 3.1 Roermond 88 Concerns 116 3.2 Eindhoven ‘Living Lab’ 89 3. The Use of Fingerprints in 3.2.1 The CityPulse Biometric IDs 118 Project 90 3.1 The Current Law 118 3.2.2 The De-Escalate 3.2 The Proposed Project 92 Amendments 119 3.2.3 The European 3.2.1 Inability to Consent 120 Project 93 3.2.2 Necessity and 3.3 Utrecht 93 Proportionality 121 3.4 Enschede 94 3.2.3 Mass Surveillance 3.5 Legal Analysis 95 Concerns 122 4. Conclusion 97 EDRi - EUROPEAN DIGITAL RIGHTS 4 4. Pegasus Spyware 124 4.1 An overview 124 4.2 Legal Analysis 126 4.2.1 Surveillance Oversight 126 4.2.2 The Inadequacy of Domestic Law 127 4.2.3 Mass Surveillance Concerns 129 4.2.4 Human Rights Concerns 130 5. Conclusion 132 General Summary 134 Bibliography 136 Appendices 157 EDRi - EUROPEAN DIGITAL RIGHTS 5 About the Edinburgh International Justice The EDRi Brussels office lead for this Initiative (EIJI) piece of work was Ella Jakubowska, Policy The Edinburgh International Justice Advisor, with support from Diego Naranjo, Initiative (EIJI) is a student run initiative Head of Policy. that seeks to help institutions working to ensure justice for victims of international The EDRi Brussels office would like to crimes and strengthen the international express our sincere gratitute to the whole justice system by providing pro-bono EDRi network, upon whose work this report legal research assistance that can make a builds. In particular, we would like to thank practical difference. the following organisations for making a particular contribution to this report: About European Digital Rights (EDRi) EDRi is the biggest European network Bits of Freedom (the Netherlands); defending rights and freedoms online. Chaos Computer Club (CCC) (Germany); The EDRi network is a dynamic and resilient Fundacja Panoptykon (Poland); collective of 45 NGOs, as well as experts, Electronic Privacy Information Center advocates, and academics working to (EPIC) (International). defend and advance digital rights across Europe and beyond. Brussels, 7 July 2021. Together, the EDRi network builds a movement of organisations and individuals pushing for robust and enforced laws, informing and mobilising people, and promoting a healthy and accountable technology market. EDRi - EUROPEAN DIGITAL RIGHTS 6 INTRODUCTORY NOTE Acknowledgements The way this report is used by the EIJI’s The team would like to thank Benedict partners is at their sole discretion and does Coyne, who provided invaluable support not reflect the views of the EIJI. Where EDRi and detailed feedback as the external has chosen to frame the research within supervisor on this project. The team would the context of EDRi’s advocacy work, this is also like to thank Ella Jakubowska, our clearly marked within this report as EDRi’s point of contact in EDRi, for clarifying contribution. any and all questions, providing us with invaluable guidance throughout, and Research Team linking us with important contacts. Finally, Luca Montag (Research Team Coordinator) the team thanks everyone at EIJI for their is a fourth year LLB student at the hard work and diligence in facilitating this University of Edinburgh with a particular project. Thank you all. interest in the field of digital rights, employment, and public law. He has been Disclaimer involved with the EIJI since June 2020 as a The EIJI is a student-led body. As we are legal researcher and later as a Research not lawyers, we are not giving legal advice. Coordinator. Our role is to provide research assistance to EDRi, and thus we do not assume any liability for how this report is used in the future. Furthermore, the EIJI is an apolitical body. The contents of this report are not to be viewed as a political statement nor as a form of advocacy work. EDRi - EUROPEAN DIGITAL RIGHTS 7 Rory Macleod is in his second year of Mateusz Pełka is a third year LLB student the accelerated LLB at the University of at the University of Edinburgh, with a Edinburgh, having previously completed keen interest in European Union law and a degree in Practical Filmmaking at the intellectual property. He joined the EIJI in University of West London. He has a September 2020 and hopes to pursue a particular interest in constitutional and career working for the European Court of public law and hopes to pursue a legal Justice in the future. career that furthers the public interest in Scotland. He joined the EIJI in October 2020. Context Background Lara De Mets is an LLM student at the Although surveillance measures have University of Edinburgh, pursuing a Masters been a part of human history for decades, in International Law. She previously the digital age has ushered in a myriad of obtained an LLB (Hons) degree in Law and tools and possibilities for the collection, Politics from the University of Glasgow. retention, and processing of information She joined the EIJI in September 2020 and which can identify individuals. has keen interests in issues surrounding gender (in)justice in peace processes and The use of biometrics, such as facial the Israel-Palestine conflict. features, fingerprints, gait, and vein patterns, has become increasingly more Meghan Gauld is a third year International common in recent years. Their use cuts Law and International Relations student across a wide range of practices and at the University of Edinburgh. She surveillance measures are no exception. It is interested in constitutional law, is their use as a mass surveillance tool that international criminal law, and the law of is the subject of this report. international trade. She joined the EIJI in September 2020. Fraser Rodger is a third year Law and French LLB student at the University of Edinburgh, with keen interests in international human rights, criminal law, and constitutional law. He joined the EIJI in September 2020 and hopes to qualify as an advocate or barrister. EDRi - EUROPEAN DIGITAL RIGHTS 8 Research task The research was conducted in two phases. Our task was to produce country reports on The first was the identification of biometric EU member states in respect of biometric processing activities that fell within the mass surveillance practices. The chosen scope of biometric mass surveillance. In research question to be applied to these identifying the major deployments in each reports was a general analysis of the legal jurisdiction, the team relied on a breadth basis of various biometric processing of sources, including: EU legislation, press activities in the respective country, taking statements, government publications, into account multiple deployments in Venice Commission reports, relevant varying levels of detail, in addition to domestic legal acts and judicial decisions, the implications of such activities in ombudsman reports, academic articles, International, European, and national law.