European Digital Rights (EDRi), an association of civil and human rights organisations, published, on September 7th, 2022, its position paper on the European Union’s proposed “Regulation on automated data exchange for police cooperation”, known as Prüm II. The report underlines several issues concerning the draft regulation, the purpose of which is to modify the data sharing process between EU member states, by including, among other things, ‘automated searching of facial images’. The paper also aims to outline the different risks that these modifications may pose for human rights and privacy. EDRi also proposes a series of recommendations, to steer the reforms towards a more human rights based approach.
The paper starts by briefly explaining that Prüm II “is a draft internal security law adopted by the European Commission on 8 December 2021” which governs data sharing between police and judicial authorities in the EU for the “prevention, detection and investigation of criminal offences”. The draft regulation aims to modernise the “Prüm framework” which allows Member States to exchange DNA, dactyloscopic and vehicle registration data via one or more Member States’ national databases. EDRi adds that, according to the European Commission, “the intention of Prüm II is to remove barriers in order to streamline and accelerate the cross-border sharing of data relating to investigations of crimes such as terrorism and organised crime.” In addition, the paper briefly mentions that the draft intends to increase automation of data sharing, include new categories of data such as facial images, standardise the format in which data can be shared, establish new standards and permit missing persons and unidentified human remains to be searched. Hence why this issue is of great relevance to the issue of the development of AI in Europe.
The association highlights a number of issues concerning the impact these modifications may have on human rights. Some of these concerns are as follows:
EDRI fears that such a regulation fails to address certain existing issues such as the implementation of the legal framework and the mismanagement of certain criminal databases. In addition, the association considers that “[n]ot only does Prüm II fail to correct such issues, it furthermore removes vital safeguards from the 2008 Prüm Decisions, such as the requirement for data protection audits and evaluation visits of member states prior to connecting their systems.”
Furthermore, EDRi highlights a number of issues, such as the automated exchange of data, and the risks posed by allowing “mass automated searches” to be carried out during police investigations. In undertaking automated processing of sensitive data, Member States would be unable to assess the necessity or proportionality of the search conducted by the requesting State, which would mean losing the “right of refusal” which they currently enjoy. Furthermore, automated processing would give Member States access to the data of non-EU states held by Europol.
Moreover, EDRi notes that “[t]he Prüm II proposal seeks to add facial images to the Prüm framework without considering the specific fundamental rights risks of the processing of facial images, nor considering the severe risk of enabling and even incentivising mass surveillance by facial recognition.” This, according to the association, could lead to incentivising the creation of police databases on the EU Member States. This is particularly interesting considering the current debate around the use of facial recognition in public spaces. This particular topic is the subject of our current research project, which involves MAPping the Use of Facial Recognition in Europe (MAPFRE project).
In addition, EDRi considers that the Prüm system is not necessary or proportional, and lacks a legal basis to search for missing persons or identify unknown remains. Finally, the paper addresses other concerns such as the lack of harmonisation between police databases amongst Member States, and the fact that, given the aforementioned circumstances, the creation of police databases and their access by other Member States can reinforce and perpetuate discrimination.
It remains to be seen how the system will be implemented and to what extent it will affect cross-border police cooperation in Europe.
The main recommendations proposed by EDRi are as follows:
SCJ
