Greece is planning a new police program to scan people's faces and fingerprints that is inconsistent with international human rights standards on privacy and likely to amplify ongoing discrimination Human Rights Watch and Homo Digitalis said today. Under the EU-funded program, the police would use hand-held devices to gather biometric information from people on a vast scale and cross check it against police, immigration, and private sector databases primarily for immigration purposes.
In recent years, Greek police have carried out abusive, and often discriminatory, stops and searches of migrants and other marginalized populations, including to enforce Covid-19 movement restrictions. This program would most likely facilitate and increase the unlawful practice of racial profiling. Greece should halt plans for the program.
"The European Commission is funding a program that will help Greek police to target and harass refugees, asylum seekers, and minority groups," said Belkis Wille, senior crisis and conflict researcher at Human Rights Watch. "In a country where the police frequently demand to see documents without reasonable cause, this program would deliver a tech-driven tool to ramp up abuse."
The Greek police signed a contract some time in the first half of 2019 with Intracom Telecom, a global telecommunication company, to help create the "smart policing" program. The police announced the signing of the contract in December 2019.
The program will cost an estimated €4.5 million, 75 percent of it funded by the EU Commission's Internal Security Fund. The start of the program was initially planned for early 2021 and then delayed to August due to Covid-19 related restrictions. On September 15, the police paid Intracom in full, but there were no indications in the streets by the end of the year that it was being used.
Under the program, police will receive smart devices with integrated software to enable them to scan vehicle license plates, collect fingerprints, and scan faces. People's biometric data can be immediately compared with data already stored in 20 databases held by national and international authorities. At least one of the databases and systems cited may already be collecting massive amounts of biometric data in public spaces.
Based on the technical specifications, the system will delete fingerprint scans immediately if there is no match but will store photographs for seven days. If the system finds a match for the fingerprints, photographs, or facial scans, the data will be retained for an unspecified amount of time.
Greece is touting the new program as a more "efficient" way, among other things, to identify undocumented or improperly documented migrants.
The police are currently authorized to ask people for their identification documents. However, Human Rights Watch research in Greece has shown that even when migrants, asylum seekers, and other marginalized groups have documents, police often stop them and detain them in a police station for hours pending verification of their identity and legal status. The Greek police have used these powers in a discriminatory manner to target people based on their race, perceived nationality or ethnicity, or physical appearance.
Combined with police orders to target specific social groups, these powers have enabled repetitive, unjustified identity stops of migrants, asylum seekers, and marginalized groups such as homeless people, people who use drugs, and sex workers. The use of facial recognition technology, which in some studies has been found to more likely misidentify people of color, and the collection of biometrics could exacerbate these abusive police tactics, which constitute racial and other forms of profiling and harassment, the organizations said.
The new program also risks expanding these practices by allowing police to target these communities with stops at a wider scale. The Greek police themselves say that under the new program the number of daily police stops will increase.
Human Rights Watch has said that the Greek police should use their authority to stop people and require them to show identity documents only when based on a reasonable suspicion that the person is involved in an illegal activity. Human Rights Watch also has said that the police should develop and put in place systems to check the validity of identity documents without detaining people or gathering personal biometric data.
In its current form, the new program would not comply with Greek and European law. EU Directive 2016/680 - known as the Police and Criminal Justice Authorities Directive or the Law Enforcement Directive (LED) - is legislation parallel to the GDPR, the EU's data protection and privacy regime, which deals with the processing of personal data for law enforcement purposes. Article 8 of the directive stipulates that personal data must be collected and processed in a lawful manner. Member states must enact laws governing data collection and processing that specify "the objectives of processing, the personal data to be processed and the purposes of the processing."
Article 10 of the directive provides further protections for special categories of personal data, including data that reveals racial or ethnic origin. The collection of biometric data, such as fingerprints and facial scans, must be strictly necessary and subject to appropriate safeguards for the rights and freedoms of the data subject and have a legal basis. The only exceptions are data collection to protect a person's vital interests, or when a person has made the data public.
Since August 2020, the Hellenic Data Protection Authority (DPA) has been investigating the lawfulness of this "smart policing" program, following a related request filed by the Greek digital rights organization Homo Digitalis.
On December 8, Human Rights Watch wrote to the Greek police, European Commission and Intracom, flagging its concerns with the program and asking questions about any measures taken to ensure that the program would not lead to human rights abuses. Only Intracom replied, stating that any questions around the program should be transmitted to the police.
Under international and European law, government collection or use of personal and sensitive data, including vehicle license plate numbers and biometrics, must comply with international human rights standards, specifically article 17 of the International Covenant on Civil and Political Rights (ICCPR) and article 8 of the European Convention on Human Rights on the right to privacy. Interference with the right to privacy is only permissible when it is neither unlawful nor arbitrary, that is, it must be both necessary and proportionate to the end sought.
Greek authorities have other tools at their disposal to enforce immigration laws and conduct policing, the groups said. Collecting this biometric information via the "smart policing" program - and the significant intrusion on privacy and threat to nondiscrimination rights that that it represents - is neither necessary nor proportionate. Greece should not move forward with the program.
The European Commission should not fund any policing programs that collect personal and biometric data in ways that violate international human rights standards or the data protection standards enshrined in EU Directive 2016/680.
As Intracom is playing an integral role in the design and deployment of the "smart policing" program, the company should fulfil its due diligence responsibilities by suspending its support of the program given the serious human rights implications, and conduct and publish a human rights impact assessment of the program.
Under the United Nations Guiding Principles on Business and Human Rights, technology companies have a responsibility to ensure that their products and services do not contribute to human rights abuses, including violations of privacy and nondiscrimination protections.
"This policing program is in fundamental conflict with the essence of human dignity and the protection of fundamental rights and freedoms in public spaces," said Konstantinos Kakavoulis, co-founder of Homo Digitalis, a Greek digital rights organization. "The Greek government should not ignore the high risk this program will pose for enabling unchecked control if it is launched."
