Privacy First comments on Bekker report on 1TP5Fingerprints
Two research reports on the new Passport Act commissioned by the Scientific Council for Government Policy (WRR) were published in late 2010 and caused a stir. The first report was called "Happy Landings? The biometric passport as a black box" and was written by human rights lawyer Vincent Böhre (since then working at Privacy First). It second report was called "The biometric passport in the Netherlands: crash or soft landing" and had been written by biometrics specialist Max Snijder. Both studies had largely taken place in parallel, incidentally without assistance. The focus of the first study was mainly on political, legal and social aspects, the second on technology and industry. Together, these investigations formed a 'helicopter view' of the matter, so to speak. The tone of both reports was relatively harsh (Minister Donner even characterised the first report as 'combative', the author learned from well-informed sources). Both reports received a lot of media attention and (partly as a result) contributed to the political shift that was necessary at the time: ending the storage of fingerprints under the new Passport Act. After a highly critical parliamentary hearing this political turnaround was a fact. Minister Donner, however, kept a wary eye: he indicated that he only wanted to stop storing fingerprints "for now" and that he still wanted to develop a national biometric database in the long term. Donner also decided to repeat the two studies carried out for the WRR, this time focusing on the political-official decision-making process and the provision of information to parliament and with free access to relevant sources (people and documents). Earlier this week, this long-awaited research report by Prof Roel Bekker. We review some salient aspects from this report below.
1) What is striking, first of all, is Bekker's characterisation of the Data Protection Board: from "not very forceful" and "not in very strong terms" (around 2002) to "marginal role", "not penetrating enough" and "no further reason seen to sound the alarm again" (2007-2008). Privacy First fully recognises this picture.
2) The same applies to the State Council's advice: it was "without critical judgment" around 2002. Even in later years, it was, in the words of the state councils themselves, "insufficiently scrutinised". Privacy First also recognises this aspect.
3) The desire for a central biometric database turned out to come from the Justice Department, and even from Minister Donner personally. The investigative nature of such a database (an old CDA wish from 2001) is thus now beyond dispute.
4) It is all the more worrying that Bekker's report does not take a critical stance against central storage of fingerprints, but instead seems to push for its possible "reconsideration". This is evident both from literal passages and between the lines of his report.
5) Overall, therefore, the report does not demonstrate much privacy and human rights knowledge on the part of the author. This is evident both from the lack of relevant considerations and (non-)used terms. Examples include phrases like "potentially an invasion (...) of privacy" and "presumed invasion of privacy". Here Bekker may be confusing the terms "infringement" and "violation" (unwarranted intrusion). That e.g. a breach on privacy constitutes, after all, has been recognised numerous times even by the State.
6) In privacy law terms, Bekker particularly misses the point in the paragraph on function creep (goal shift). That paragraph is so superficial, naive, one-sided and trivialising that it makes the whole report lose quality.
7) The report consistently mentions combating look-alike fraud as a goal of introducing biometrics on travel documents. This look-alike However, fraud is not quantified anywhere in the report. This while Privacy First knows from a reliable source that the author did do some research on the (relatively small) scale of this. Why is this not mentioned?
8) Virtually all other interests around biometrics in the new Passport Act remain unnamed in the report. As a result, the fog around those interests (and associated 'players') remains unabated. This is particularly true in the domains of state security and disaster relief.
9) The question of whether ministers provided parliament with sufficient information is partly evaded and mainly parried with the accusation that MPs themselves should have asked more critical questions. Salient detail in this context is that already end of 2009 the huge error rate (21%) in fingerprint verification was known to state secretary Bijleveld (BZK). However, the House of Representatives was only end of April 2011 Informed about this error rate. Even more salient in this context is the answer to a question from the CDA during the question time in the House of Representatives at 20 April 2010:
- CDA: "After the debate we had over a year ago, have any new facts or arguments come to the table to justify any unrest or lack of support?"
- State Secretary Bijleveld: "The answer to that question is crystal clear: no."
10) It is also unfortunate that important, confidential sources are not included as annexes to the report. This applies, for example, to the 2004 feasibility study mentioned in footnote 14 of the report.
11) Bekker rightly regrets that no officials from the responsible department (BZK) participated in the parliamentary hearing in April 2011.
12) The report makes a case for biometric conscientious objectors: there should be freedom of choice for them from now on. Privacy First wholeheartedly endorses this aspect.
13) In a general sense, however, the informed reader of this report will not be able to escape the impression that both the official leadership and relevant ministers are mainly kept "out of the wind" in this report. In that sense, this report unfortunately represents a missed opportunity.
Update 13 April 2012: Yesterday, Interior Minister Spies (BZK) published her response to the Bekker report. On the positive side, Spies is in her letter speaks of a "changing zeitgeist" in which "in recent years, the debate about privacy has again become more prominent." "We now live in a different era" in which "in any case there will no longer be any question of central storage of fingerprints," Minister Spies said (pp. 2, 4). Spies also confirms that "a bill will be submitted that should lead, among other things, to the fact that (...) fingerprinting when applying for an identity card can be ended" (p. 3). Privacy First endorses these aspects and will continue to monitor their implementation in the shortest possible time.