Your fingerprints in the Twilight Zone

In almost all Lawsuits now pending against the new Passport Act an important issue has so far remained underexposed: the use of sensitive personal data by secret services. In this case, it revolves around biometrics: digital facial scans and fingerprints that end up in all kinds of databases via passports and identity cards. Currently, those databases are still at municipalities and at the passport manufacturer in Haarlem (Morpho, formerly Sagem), in the future undoubtedly elsewhere, eventually worldwide. In this sense, every Dutch citizen is a potential globetrotter: in time, your fingerprints and facial scan may be found in the farthest corners of the world. Not only in the databases of "allies", but also in the databases of countries with which those "allies" have in turn concluded exchange treaties (secret or otherwise). And there is absolutely no visibility on this. Nor is it publicly known what secret services want to use our biometrics for. A Privacy First contributor who would have liked to research this for the WRR quickly ran into a wall of research restrictions. So it remains guesswork for now... Possible intelligence-purposes of biometrics are: 1) identification of silent suspects and "persons of interest" in public spaces, 2) emotion recognition and lie detection, 3) deployment or recognition of doppelgangers, 4) espionage, etc. The first purpose (identification) is facilitated by the RFID aspect of the biometric chip in your passport or ID card. Indeed, that chip is thereby remotely readable.

Back to our main topic: the use of sensitive personal data by secret services. These days, this is "piece of cake": many people now unabashedly post half their private lives on the internet, for instance on Facebook. And insofar as that information cannot be found on the internet, it can be traced in corporate and government databases. Just as you might have turned on the television from your armchair with a billiard cue in your student days, secret services can now "at the touch of a button" conjure up your entire life, including your fingerprints. But is this actually allowed? And in this context, does it matter whether your fingerprints are stored with 1) the municipality, 2) a central database or 3) the passport manufacturer? "Yes, they are allowed", and "no, it doesn't matter where they are stored", the State (through its national lawyer) consistently implied until mid-2011:

"Fingerprints will also have to be provided to the intelligence services AIVD and MIVD. Providing information to these services is regulated in Section 17 of the Intelligence and Security Services Act. This applied before parts of the amended Passport Act came into force. It does not change with the amended Passport Act. The entry in Section 4b(2)(d) of the Passport Act ("state security") is only motivated by transparency considerations."
(Source: Conclusion of Reply in the Passport Case of Privacy First dated 28 July 2010, para 2.17; repeated verbatim in, among others, the State's defences in the Passport Cases of Van Luijk dated 29 Oct 2010 & 10 June 2011 (paras 3.17 & 5.8 respectively) and Deutekom dated 23 Nov 2010, para 4.17). 

In it, the State thus argued that essentially nothing would change because of the new Passport Act, as your fingerprints could have been requested by the AIVD long ago. Meanwhile, however, the development of a central biometric database has been halted and your fingerprints are still "only" stored for a relatively short time at the municipality and the manufacturer, which means that the discussion in court has now turned into thereon focuses. For example, on 27 October this year in a single-judge court in Amsterdam: 

Judge: "Yes, I was just wondering, Ms [country lawyer], you say, the fear of sir that intelligence and security services can have access to his personal data, his fingerprints and facial scan, that [fear] is actually removed by section 65 [Passport Act]..."
Country lawyer: "Article 65 deals only with fingerprints."
Judge: "Mr [X] pointed to sections 17 to 34 of the Intelligence and Security Services Act [WIVD]. How do you see that?"
Country lawyer: "I can say something about that very briefly, how you should see that in relation to each other. (...) The point is, there's also been some discussion about that in the legislative history, of course, when does that become a perusal possibility: if you have a central administration with a biometric search function. There are all kinds of regulations, but it's not like the AIVD could arrive with a fingerprint, so to speak, and say to the municipality "let's see who that fingerprint belongs to". But that possibility, there is no such thing. There is simply no biometric search function. The only provision option in that area, what can municipalities do with fingerprints, they can make a print of that, and a print means a sheet of paper with dots. That is the representation on paper of those fingerprints. So the AIVD, assuming for a moment that the conditions under which it can request information under the WIVD are met, could give a name to the municipality where that person is registered, and then request personal data there. So to the extent that that would involve fingerprints, that is no more than that printout with those dots. So it can never be the case, and this is surely an important point, that the AIVD would arrive with fingerprints, and would say: who do these fingerprints belong to?"
Lawyer: "That is not my client's fear. My client's fear is that the AIVD could say: we want to see Mr [X]'s fingerprints."
Country lawyer: "If the AIVD wanted Mr [X]'s fingerprints, the AIVD does not need the travel document records to do that. They are right here on the documents, on the cup, so to speak..."
Lawyer: "Well, I don't see anyone from the AIVD here taking my client's fingerprints, and it's not just about himself, it's about him saying: I find it contrary to my conscience to cooperate with the fact that in this way, in fact, the fingerprints of all Dutch citizens can be requested by the AIVD. Not just his, but everyone's."
Judge: "With the regulations in place now, is it then practically possible for the AIVD to go to the municipality of Amsterdam and say: we would like to have Mr [X]'s fingerprints?"
Country lawyer: "Uuh, well [unintelligible], section 65 second paragraph [Passport Act] says that the fingerprints may not be requested other than for application and issuance authority. So to the extent that the AIVD, under its own regulations, would be allowed to request that data, it could be no more than those dots. After all, the municipality has nothing else either."
Interruption from audience: "Well through [passport manufacturer] Morpho."
Judge: "You are not a party to this litigation. I still have to ask you not to join the litigation." 

Purely a "print with dots", therefore, at the municipality, according to the country's lawyer. Requesting fingerprints from the passport manufacturer unfortunately remained unmentioned during this court hearing. The case was then referred within the Amsterdam District Court to the three-judge panel. There, on 25 January this year, the issue was briefly discussed as follows:

Judge 3: "And what about when the information is with the producer?"
Country lawyer: "Uuuuhhh.... Then on what basis would it be allowed to provide that data?"
Judge 3: "Well, that's what I'm asking you."
There is no clear answer to this question on the part of the country's lawyer, only a vague reference to Section 65(2) of the Passport Act. Then a painful silence falls ... and the judges do not ask further on this point.
Judge 3: "And Mr [lawyer for X], how do you see that at this point?"
Lawyer: "Different!" [audience hilarity] X's lawyer then refers at length to the relevant legislative history of the Passport Act and the provisions of the WIVD 2002.
Country lawyer: "Even if it were the case that the AIVD could ask for fingerprints on the basis of Article 17 WIVD anyway, they would never get more than just a print with those dots. (...) Then they would get a print of the fingerprints, and that is therefore a print with dots." Moments later, after being verbally pointed out by a Home Office official: "I just said something wrong. I said you get a print with dots, but I understand now that you get a print with a picture."

So, after a dozen court hearings on the Passport Act, the State's official explanation on the use of fingerprints by secret services reads as follows: "a print with a plate, at the municipality". So the question remains whether e.g. digital can be requested from 1) the municipality and 2) the passport manufacturer, and if so, what exactly happens to it afterwards. Ditto for the face scan. The next court hearing in the Passport Act saga will follow on Monday 2 April (11am) at the Council of State. It will then be up to the Council to still clarify this issue and, if necessary, call expert witnesses to do so.

Update 10 Feb 2012: Following the above report, written questions were submitted by MEP Sophie in 't Veld to both passport manufacturer Morpho and to the European Commission. In parallel, Member of Parliament Gerard Schouw similar parliamentary questions asked To home affairs minister Liesbeth Spies.