Last week Access Now sent a submission to the European Commission in its consultation on the proposed Smart Borders package (see our previous post). The EU Commission will now sift through all the submissions from stakeholders and attempt to take their opinions into account as they revise the proposal. Here’s a quick post-consultation look at the facts and how we responded.
The Smart Borders package consists of three legislative proposals:
1- A new Entry/Exit system to help European countries flag so-called overstayers – individuals staying in the EU longer than is authorised in their visa
2- The Registered Traveller Programme: a fast lane for frequent visitors willing to pay a fee and digital “toll” in private information
3- Amendments to the current Schengen Information System (SIS)
Following are key issues Access Now responded to in the consultation:
The biome-tricks
The package would require collection of biometrics for all non-EU nationals. The consultation was aimed primarily at determining what biometric data should be collected; for example, would it be sufficient for authorities to collect 10 fingerprints, or would facial recognition also be required?
Access Now opposes collecting this kind of data, as well as storing and retaining it, without clear and precise rules to protect it. We are also deeply concerned that there have been no proportionality or necessity tests conducted to see whether such measures are valid. Supporters justify collecting this data by citing the need to identify individuals who overstay in Europe without adequate paperwork. The package therefore includes collecting and keeping individual location data for a five year period. In light of recent EU case law, we believe these measures would violate the EU Charter of Fundamental Rights.
Traveler discrimination: paying for trust?
The stated goal of the Registered Travellers Programme is to simplify and optimise border crossing for frequent travellers. But the programme would subject applicants to an extensive pre-vetting procedure which includes collecting even more of their sensitive data. Apart from the privacy issues, this amounts to a paid-for fast lane for those deemed trustworthy by the European authority. We are concerned that this is inherently discriminatory and the Smart Borders package would entrench such discrimination among travellers. Indeed, there are already hints in the consultation that there could be problems differentiating among “categories” of travellers. This opens the door to discriminatory profiling while also threatening travellers’ fundamental rights to privacy and data protection.
Data retention period
On the subject of data retention, the Commission’s argument is that since border officers can already see decades of our travel history from our passports, there should be little issue with prolonged data retention. We disagree. The Court of Justice of the EU has clearly indicated that excessive retention of personal data is a serious interference with the fundamental rights to privacy and data protection. Should the Commission want to press for these measures, it must verify the proportionality of the retention, adequately supported by impact assessments. Until then, no such mandate can be approved.
Consultation process was flawed
Apart from the issues at stake in the consultation, the process was deeply flawed. For instance, the Commission sought to determine how long data should be retained based on input from the respondents. But as we note in our response, the Commission ought instead to conduct the necessity and proportionality tests required in a democratic society when fundamental rights are at stake.
Several questions were posed in a way that suggests the intention was to mislead the respondents. For example, this question:
“Would you favour granting law enforcement authorities access to the data stored in the Entry/Exit System for the purpose of preventing, detecting or investigating terrorist offences or other serious criminal offences? This access would be granted under strict legal prerequisites in full compliance with fundamental rights.”
If law enforcement access to data were to take place in a context where efficient oversight mechanisms and appropriate safeguards exist to protect fundamental rights, it would be hard to say “no” to this question. However, since respondents are given no indication of the nature of the safeguards and “legal prerequisites”, it is impossible for the respondent to answer the question with any level of certainty.
Commission follow-up statement
At the European Parliament’s plenary on the Smart Borders package — held on 29 October, the same day as the consultation deadline — EU Home Affairs Commissioner Avramopoulos defended the package but failed to address any of the fundamental rights issues.
Access Now will continue to update you on the progress of this proposed legislation. For now, we expect to see the commission’s revised proposal in the early 2016.
You can read our complete submission to the European Commission in the public consultation on Smart Borders here.