Policing: France proposes massive EU-wide DNA sweep, automated exchange of facial images
The French Presidency of the Council is seeking EU-wide comparisons of every DNA profile held by police forces against all those held by other national police forces, as well as EU policing agency Europol, as part of plans to upgrade the ‘Prüm’ network of police databases. It also hopes to automate the police exchange of facial images by eliminating requirements for human review.
Networking police databases
The proposals come in an amended version of a proposal (pdf) originally published by the European Commission in December 2021, which will upgrade the Prüm network of DNA, fingerprint and vehicle registration databases to include facial images and “police records”, as well as driving licence data, if the Council has its way.
The Prüm system currently allows law enforcement authorities to compare a DNA profile – for example, taken from a criminal suspect or found at a crime scene – and use it to run a search against all other participating member states’ DNA databases. As well as EU member states, this also includes the UK.
Mass DNA searches
But the Presidency’s plan goes much further: under the revamped Prüm system, a central “router” would be set up to manage interconnections between different national databases, simplifying the current system which requires mutual interconnections between every participating state (pdf).
The Presidency now aims to use that router for the mass comparison of DNA profiles (emphasis added in all quotes):
“Member States shall, at the initial connection to the router via their national contact points, conduct an automated search by comparing all their DNA profiles, with all DNA profiles stored in all other Member States’ databases and Europol. Member States and Europol shall agree bilaterally on the modalities of these automated searches.”
The same article goes on to say that such mass searches could be a regular undertaking:
“Member States may agree bilaterally to conduct automated searches also at a later stage by comparing DNA profiles, with all DNA profiles stored in all other Member States’ databases and Europol. Member States and Europol shall agree bilaterally on the modalities of these automated searches.”
The Presidency has somehow managed to include these provisions prior to one that says:
“Searches may be conducted only in individual cases and in respect of the same guarantees and safeguards that are required for similar searches at national level.”
A mass, automated search and comparison of DNA profiles is evidently not an “individual case”.
If it were implemented now, the proposal would involve the processing of millions of items of sensitive personal data – EU member states held a total of almost 17 million DNA samples at the end of 2021, according to the latest statistics on DNA databases circulated within the Council of the EU (pdf, see table below). All but two member states’ DNA databases grew during the course of 2021, some substantially: Bulgaria’s by 30%, and Poland’s by 38%. The intention is to have the upgraded Prüm operational by 2027, by which time those databases will have grown even more.
The Council may also be seeking to weaken the applicable safeguards, or at least to make them less specific: the phrase “in respect of the same guarantees and safeguards that are required for similar searches at national level” has been inserted in place of the previous text, which required searches to be conducted “in compliance with the national law of the requesting Member State.”
Automating the exchange of facial images
The intention is also for the upgraded Prüm network to include police facial recognition databases, which could form the technical backbone of a Europe-wide mass biometric surveillance system.
Under the Commission’s proposal, member states would have submitted a facial image for a search against all other member states’ databases, and in return would have received a list of potential “candidates” for matches that would require human review before any further personal data could be exchanged.
The Commission recently emphasized this point to Wired, saying that “a human will review the potential matches and decide if any of them are correct, before any further action is taken.”
The Council, however, has other plans. The latest proposed version of the text deletes the requirement for human review, and instead makes it optional:
“The national contact point of the requesting Member State may decide to manually confirm a match between two facial images. If so decided, it shall inform the requested Member State and shall confirm this match with facial images reference data received from the requested Member State.”
The implication is, then, that the matching of facial images should generally be done automatically.
Here, as with DNA and other types of data covered by the new Prum system, the Council has changed the requirement for searches to be conducted “in compliance with national law” to “in respect of the same guarantees and safeguards that are required for similar searches at national level.”
National DNA database content (stains and persons), 2021
| State | 01-Jan-21 | 31-Dec-21 | % change |
| Belgium | 101,098.00 | 108,049.00 | 7% |
| Bulgaria | 43,611.00 | 56,736.00 | 30% |
| Czechia | 277,213.00 | 287,357.00 | 4% |
| Denmark | 163,614.00 | 172,574.00 | 5% |
| Germany | 1,244,119.00 | 1,198,826.00 | -4% |
| Estonia | 74,259.00 | 78,874.00 | 6% |
| Greece | 38,408.00 | 42,014.00 | 9% |
| Spain | 441,165.00 | 460,309.00 | 4% |
| France | 5,594,676.00 | 6,025,945.00 | 8% |
| Croatia | 10,085.00 | 10,802.00 | 7% |
| Ireland | 40,250.00 | 47,877.00 | 19% |
| Cyprus | 18,565.00 | 19,432.00 | 5% |
| Latvia | 72,930.00 | 77,215.00 | 6% |
| Lithuania | 140,770.00 | 149,523.00 | 6% |
| Luxembourg | 7,835.00 | 9,073.00 | 16% |
| Hungary | 161,306.00 | 167,946.00 | 4% |
| Malta | 799.00 | 156.00 | -80% |
| Netherlands | 379,826.00 | 398,931.00 | 5% |
| Austria | 296,422.00 | 309,155.00 | 4% |
| Poland | 117,287.00 | 161,702.00 | 38% |
| Portugal | 14,163.00 | 14,163.00 | 0% |
| Romania | 57,857.00 | 68,466.00 | 18% |
| Slovenia | 32,948.00 | 33,684.00 | 2% |
| Slovakia | 94,482.00 | 99,027.00 | 5% |
| Finland | 207,651.00 | 212,412.00 | 2% |
| Sweden | 209,048.00 | 211,814.00 | 1% |
| UK | 6,337,964.00 | 6,446,391.00 | 2% |
| 16,178,351.00 | 16,868,453.00 | 4% |
Figures for the UK are taken from the national DNA database statistics, available here.
- French Presidency proposals: Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council (Council doc. 8020/22, LIMITE, 8 April 2022, pdf)
- Statistics for 2021: Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross border cooperation, particularly in combating terrorism and cross border crime, Council Decision 2008/616/JHA of 23 June 2008 on the implementation of Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border-crime (“Prüm Decisions”) – statistics and reports on automated data exchange for 2021 (Council doc. 5436/22, LIMITE, 25 March 2022, pdf)
- Implementation of the provisions on information exchange of the “Prüm Decisions” – overview of documents and procedures – overview of declarations – state of play of implementation of automated data exchange (Council doc. 5183/2/22 REV 2, LIMITE, 25 March 2022, pdf)
This article was first published here.
Image: Hein Boekhout, CC BY-NC-ND 2.0
(Contribution by: EDRi member Statewatch)