According to the EDPS in a detailed critique of the EU Commission’s proposal for ‘smart borders’, there is no clear evidence that the proposals to create a smart border system for the external borders of the EU will fulfil the aims that the Commission has set out.
Following the publication of his opinion which focuses specifically on the Entry/Exit System, the EDPS said that one of the stated aims of the proposals was to replace the existing ‘slow and unreliable’ system but the Commission’s own assessments do not indicate that the alternative will be sufficiently efficient to justify the expense and intrusions into privacy.
Peter Hustinx, EDPS, said:
‘Improving the management of border controls is a legitimate exercise. But it would be more effective to do this once a clear European policy on the management of over stayers has been established. In the absence of such a policy, the creation of yet another large-scale IT database to store massive amounts of personal information is a disproportionate response to a problem that other recently created systems may be able to help solve. It would be prudent both economically and practically to evaluate the existing systems at least to ensure consistency and best practice.’
The proposed Entry/Exit System relies on the use of biometrics, specifically 10 fingerprints, to verify the identity of individuals at borders in order to calculate the duration of the stay of third country residents. The EDPS questions the necessity for the collection and storage of excessive amounts of personal information, particularly when two or four fingerprints are sufficient for verification.
As law enforcement authorities may potentially be granted access to the database after a period of evaluation of the system coming into force, it appears to the EDPS that the proposals are anticipating such access before demonstrating that the intrusion into the private lives of individuals is actually necessary. The general trend to give law enforcement authorities access to the data of individuals, who in principle are not suspected of committing any crime, is seen by the EDPS as a dangerous one. The EDPS strongly recommends that the precise added value of such access, compared with access to existing biometric databases, be identified.
The EDPS urges that specific attention also needs to be paid to the legal consequences of automating border procedures. For example, the system will automatically calculate the length of stay of a visitor but the avoidance of mistakes through automation – for example, failure to register the exit of an individual because he is undergoing medical treatment or because of technical problems of the system – has not properly been addressed. Individuals must be fully informed in due time of any unfavourable decision taken against them so that they are able to exercise their rights. This is all the more urgent since the multiplication of databases in border management (such as VIS, SIS, CIS, EURODAC) makes it increasingly complicated for individuals to exercise their rights.
The routine functioning of the system will imply a need to exchange personal information with third countries in relation to the return of individuals. The EDPS recommends that the specific conditions and purposes under which those countries may be granted proof of the identity of their nationals needs to be substantiated, all the more important as many third countries do not offer the same level of data protection as is offered in the EU.
The EDPS opinion is available here.
