Europe Is Building a Huge International Facial Recognition System

The Prüm II docu­ments, dated from April 2021, when the plans were first being discus­sed, show the huge number of face photos that coun­tries hold. Hungary has 30 million photos, Italy 17 million, France 6 million, and Germany 5.5 million, the docu­ments show. These images can include suspects, those convic­ted of crimes, asylum seekers, and “uniden­ti­fied dead bodies, ” and they come from multi­ple sour­ces in each country.

Jaku­bowska says that while criti­cism of facial recog­ni­tion systems has mostly focu­sed on real-time systems, those that iden­tify people at a later date are still proble­ma­tic. “When you are applying facial recog­ni­tion to footage or images retros­pec­ti­vely, some­ti­mes the harms can be even grea­ter, because of the capa­city to look back at, say, a protest from three years ago, or to see who I met five years ago, because I’m now a poli­ti­cal oppo­nent, ” she says. “Only facial images of suspects or convic­ted crimi­nals can be exchan­ged, ” the Euro­pean Commis­sion spokes­per­son says, citing a guide on how the system will work. “There will be no matching of facial images to the gene­ral popu­la­tion.”

Pictu­res of people’s faces shouldn’t be combi­ned in one giant central data­base, the offi­cial propo­sal says, but police forces will be linked toget­her through a “central router.” This router won’t store any data, the Euro­pean Commis­sion spokes­per­son says, adding that it will “only act as a message broker” between nati­ons. This decen­tra­li­zed appro­ach makes Prüm II more straight­for­ward: Police wanting to compare finger­prints under the current system must connect to other police forces indi­vi­du­ally. Under the new infras­truc­ture, coun­tries only need one connec­tion to the central router and it will be easier to “add addi­ti­o­nal data cate­go­ries to the system, ” the docu­ments obtai­ned by EDRi say.

The Euro­pean data protec­tion super­vi­ser (EDPS), who over­sees how EU bodies use data under GDPR, has criti­ci­zed the plan­ned expan­sion of Prüm, which could take seve­ral years. “Auto­ma­ted sear­ching of facial images is not limi­ted only to seri­ous crimes but could be carried out for the preven­tion, detec­tion, and inves­ti­ga­tion of any crimi­nal offen­ses, even a petty one, ” Wojci­ech Wiewi­ó­rowski, the EDPS, said in early March. Wiewi­ó­rowski said more safe­guards should be writ­ten into the propo­sals to make sure people’s privacy rights are protec­ted. The Euro­pean Commis­sion spokes­per­son says the body has taken “good note” of the EDPS opinion and the thoughts will be taken into account as the Euro­pean Parli­a­ment and Coun­cil discuss the legis­la­tion.

During the deve­lop­ment of the plans, Slove­nia has been one key country pushing for the expan­si­on—in­clu­ding asking for people’s driving license data to be inclu­ded. Domen Savič, the CEO of Slove­nian digi­tal rights group Državl­jan D, says there are signi­fi­cant concerns about the diffe­ren­ces between police data­ba­ses and who is inclu­ded. “I haven’t heard enough to be convin­ced that all of this data gathe­red by indi­vi­dual police forces is sani­ti­zed in the same way, '' Savič says.

Police data­ba­ses are often poorly put toget­her. In July 2021, police in the Nether­lands dele­ted 218,000 photos it wrongly inclu­ded in its facial recog­ni­tion data­base. In the UK, more than a thou­sand young Black men were remo­ved from a “gangs data­base” in Febru­ary 2021. “You could have data­ba­ses that have comple­tely diffe­rent back­grounds in terms of how this data was collec­ted, where it was sour­ced, how it was exchan­ged, and who appro­ved what, ” Savič says. Slove­nia has alre­ady faced simi­lar problems. “And this could lead to misi­den­ti­fi­ca­tion.”

One of the biggest problems for Jaku­bowska is how Prüm II could norma­lize the use of facial recog­ni­tion by police forces across Europe. “What really concerns us is how much this Prüm II propo­sal could incen­ti­vize the crea­tion of facial image data­ba­ses and the appli­ca­tion of algo­rithms to these data­ba­ses to perform facial recog­ni­tion, ” she says. The EU will pay for the cost of connec­ting data­ba­ses to Prüm II, the propo­sal says, and this inclu­des the cost of crea­ting new nati­o­nal facial images data­ba­ses. Sixty years after being inven­ted, facial recog­ni­tion is still just getting star­ted.