European Fundamental Rights Agency balks at adding more biometric modalities to identity systems

The European Union Agency for Fundamental Rights (FRA) is warning of privacy risks imposed by a pair of changes to EU identity rules.

The European Union asked the FRA to give an opinion on the fundamental rights implications of using biometrics in identity documents, and the FRA has responded with several recommendations, including that fingerprints be excluded. The European Council endorsed a mandate to provide an interoperability framework for biometrics in June to support EU plans to unify all identity and residence documents of EU residents with fingerprints and facial imagery.

The FRA states that if fingerprints are included in the identity documents, they should be protected from misuse by adequate safeguards, and that the duty of member states to collect biometrics could lead them to violate privacy principles by storing them in national databases. It also notes that the biometrics of certain vulnerable populations, including children, the elderly and those with disabilities may be less reliable, and warns that manual checks by biometrics experts may be necessary to avoid wrongly applying negative consequences.

The agency also echoed a call made by the European Parliament and Council when EURODAC rules for asylum applicants and irregular immigrants were updated, saying that force should not be used in biometric data collection, and children should be dealt with in an age-appropriate way.

The FRA was also asked for an opinion on the proposals for revising the EU’s Visa Information System (VIS), which include adding facial recognition to biometric matching modalities, as well as extending the system to long-stay visa and residence permit holders. The inclusion of facial biometrics should only be carried out if the technical reliability of the matching service can be ensured, the FRA says. It also recommends finding ways to reduce the false matches that could occur due to the changing of children’s biometrics over time.

The agency also recommends that the EU explore alternatives to extending the VIS system to long term residents, as their data could end up being retained indefinitely in databases ostensibly meant for short-term use. Several procedural changes are also suggested in order to minimize inaccuracy and disruption to travelers.

New EU regulations for transaction authentication which go into effect next year are expected by Mastercard to significantly increase the use of biometrics for purchases.

Article Topics

biometrics  |  data collection  |  EU  |  identity document  |  privacy