1 PROGRESS REPORT ON THE APPLICATION OF THE PRINCIPLES OF CONVENTION 108 TO THE COLLECTION AND PROCESSING OF BIOMETRIC DATA Commissioned by Council of Europe Concluded by Tilburg Institute for Law, Technology, and Society (TILT) Tilburg University Authors Prof. dr. Paul de Hert Koen Christianen LLM BSc April 2013 Tilburg Institute for Law, Technology, and Society (TILT) http://www.tilburguniversity.edu/research/institutes-and-research-groups/tilt/ Telephone +31 (0)13 466 3515 2 Table of Contents 1 Definition of biometrics and structure of the report ...................................................................... 4 2 The Council of Europe’s 2005 progress report ................................................................................ 5 3 Recent developments within the Council of Europe ....................................................................... 8 3.1 The Council of Europe’s 2011 Parliamentary Assembly report ............................................... 8 3.2 The Consultative Committee’s modernisation work of Convention 108 .............................. 12 3.3 The European Court of Human Rights: The Marper judgment ............................................. 13 4 Recent developments in the European Union .............................................................................. 16 4.1 Proposals of the European Commission................................................................................ 16 4.2 European Union’s Eurodac/SIS/VIS/European biometric passport ....................................... 17 4.2.1 Eurodac .......................................................................................................................... 17 4.2.2 The Schengen Information System ................................................................................ 18 4.2.3 The Visa Information System (VIS) ................................................................................ 19 4.2.4 The European Biometric Passport ................................................................................. 20 5 Second generation biometrics ...................................................................................................... 23 5.1 What are second generation biometrics? ............................................................................. 23 5.2 Concerns about second generation biometrics .................................................................... 23 6 Intrinsic errors of and impostor threats to biometric systems ..................................................... 25 6.1 Intrinsic errors of biometric systems ..................................................................................... 25 6.2 Risk analysis of biometric systems ........................................................................................ 27 6.2.1 Introduction ................................................................................................................... 27 6.2.2 Impostor threats ............................................................................................................ 28 6.2.3 Additional threats .......................................................................................................... 28 6.2.4 Biometric template protection ...................................................................................... 29 7 Country responses to the questionnaire ....................................................................................... 31 7.1 Responses of 22 out of 47 countries ..................................................................................... 31 7.1.1 Albania ........................................................................................................................... 31 7.1.2 Austria ........................................................................................................................... 31 7.1.3 Denmark ........................................................................................................................ 32 7.1.4 Estonia ........................................................................................................................... 32 7.1.5 France ............................................................................................................................ 32 7.1.6 Georgia .......................................................................................................................... 34 7.1.7 Hungary ......................................................................................................................... 34 7.1.8 Ireland ............................................................................................................................ 35 7.1.9 Italy ................................................................................................................................ 35 7.1.10 Lithuania ........................................................................................................................ 37 7.1.11 Macedonia ..................................................................................................................... 38 7.1.12 Malta ............................................................................................................................. 38 3 7.1.13 Monaco .......................................................................................................................... 39 7.1.14 Montenegro ................................................................................................................... 40 7.1.15 Netherlands ................................................................................................................... 40 7.1.16 Niger .............................................................................................................................. 42 7.1.17 Poland ............................................................................................................................ 42 7.1.18 Portugal ......................................................................................................................... 44 7.1.19 Romania ......................................................................................................................... 44 7.1.20 Senegal .......................................................................................................................... 45 7.1.21 Serbia ............................................................................................................................. 45 7.1.22 Slovenia ......................................................................................................................... 45 7.1.23 Switzerland .................................................................................................................... 47 7.2 Main results from the questionnaire .................................................................................... 48 7.2.1 Countries which have adopted legislation and regulation specifically aimed at the protection of biometric data ......................................................................................................... 48 7.2.2 Biometrics in the contexts of sports, school and workplace ......................................... 50 8 Conclusions and recommendations .............................................................................................. 52 Annex A: The recommendations in the 2005 progress report .............................................................. 57 4 1 Definition of biometrics and structure of the report The Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108)1 asked the authors of this report to prepare a study on biometrics including an analysis of the Member States’ current regulatory framework on the protection of biometric data. The aim of this progress report is to provide an update of the Council of Europe’s 2005 progress report on the application of the principles of convention 108 to the collection and processing of biometric data.2 The authors of this report use the following definition of biometric data and biometrics: Biometric data (or biometrics3) are measurable, physiological or behavioural characteristics that can be used to determine or verify identity. Biometrics is also defined as ‘the automated use of physiological or behavioural characteristics to determine or verify individuals’. 4 In order to gain information on the use of biometric systems in relation to the principles of Convention 108, the 475 Council of Europe’s Member States have been submitted a 7 questions questionnaire drafted by the authors of this report. 23 countries out of 47 Member States have provided answers to the questionnaire. Section 7.1 summarizes the answers of 22 countries because Portugal has been omitted from the report.6 These 22 answers and the research conducted by the authors of this report will allow the Consultative Committee to form an opinion on the application of 1 Convention for the protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981, ETS No. 108 (Convention 108), entry into force 1 October 1985, Council of Europe, available online at http://conventions.coe.int/Treaty/en/Treaties/Html/108.htm. 2 Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Progress Report on the Application of the Principles of Convention