• Home /
• News /
• 2017 /
• December /
• EU: EDPS "Reflection paper" on the interoperability of JHA databases poses fundamental questions

EU: EDPS "Reflection paper" on the interoperability of JHA databases poses fundamental questions

02 December 2017

EU  
EDPS "Reflection paper" on the interoperability of JHA databases poses fundamental questions

"Technology should always come in support of policies and user needs, not the other way around. What is technically feasible might not necessarily be legally justifiable or ethically desirable."

"We are concerned that repeatedly referring to migration, internal security and fight against terrorism almost interchangeably brings the risk of blurring the boundaries between migration management and fight against terrorism."

How many terminals and how many officials have or will have access to all the existing and planned JHA databases? In 2003 the SIS alone could be accessed from 125,000 terminals!
2.12.17
Follow us: | | Tweet

---

The European Data Protection Supervisor (EDPS) has published a "Reflection Paper on the interoperability of information systems in the area of Freedom, Security and Justice" (17 November 2017, pdf) which poses fundamental questions for the Commission who will draft new measures and the co-legislators (the Council of the European Union and the European Parliament).

The initiative follows the Commission Communication of 6 April 2016 on Stronger and Smarter Information Systems for Border and Security (pdf), the final report of the High Level Expert Group on interoperability (May 2017, pdf) and the publication of an Inception Impact Assessment (pdf).

1. Ongoing initiatives in the context of “interoperability” of large-scale IT systems

"On 8 June 2017, the Council welcomed the Commission’s view and the proposed way forward to achieve the interoperability of information systems by 2020. It invited the Commission to pursue the work on three dimensions of interoperability (i.e. the European search portal, the biometric matching service and a common identity repository)."

2. The concept of interoperability

"Interoperability is commonly referred to as the ability of different information systems to communicate, exchange data and use the information that has been exchanged. Although interoperability is often considered as a merely technical concept, we consider that in the present context it cannot be disconnected from the questions whether the data exchange is necessary, politically desirable or legally possible. In other words, although interoperability of the information systems will ultimately be implemented through technical means, it must be subject to political debate on its purposes and future scope. [emphasis added throughout]

We observe that making exchange of data technically feasible becomes, in many cases, a powerful drive for exchange these data. One can safely assume that technical means will be used, once they are made available; in other words, the risk is that in such case the means justify the end. To allow a proper debate about the risks and advantages of interoperability, it is fundamental to give it an unambiguous and clear meaning. (...)

while we note that the Commission might have envisaged interoperability as a tool to only facilitate the use of systems, we understand that the Commission now may aim to extend it to new possibilities of exchanging or cross-matching data. For instance, the inception impact assessment refers to the use of a shared biometric matching service (‘the BMS’) to enable matching of biometric data held across the various systems. Similarly, a ‘common identity repository’ would bring together alphanumeric data (such as names and dates of birth) that have been stored in the various systems for border management and security. The combined use of the shared BMS and the common identity repository would enable single identification using alphanumeric and/or biometric data to detect multiple identities. Interoperability thus implies new data processing that are not covered by existing legal bases and their impact on the fundamental rights to privacy and data protection needs to be carefully assessed."

3. Interoperability from a data protection perspective

"We encourage the Commission to clearly describe the specific purposes of the envisaged data processing. Objectives such as “ensuring fast and seamless access to databases” might be a useful means to an end in policy terms. However, they are not specific enough for the purposes of data protection law since they are not linked to specific processing of defined categories of personal data. Consequently, they may not allow individuals to understand which of their personal data are processed for what precise purposes, or to understand the consequences of such processing.(...)

we recommend that the forthcoming legislative proposal clearly set out the precise purposes of the various data processing envisaged (...)"

"only a clear description of the identified problems in view of the objectives pursued will allow the EU legislator to determine the most appropriate legal and technical solutions, in compliance with data protection law. Technology should always come in support of policies and user needs, not the other way around. What is technically feasible might not necessarily be legally justifiable or ethically desirable."

- Purpose limitation with regard to migration, asylum, police and judicial cooperation

"There is an increasing trend in EU policy-making to associate migration management and security purposes. We see this trend in the context of granting access to existing systems for law enforcement purposes, building a new information system, or extending the competences of an existing body. We are concerned that repeatedly referring to migration, internal security and fight against terrorism almost interchangeably brings the risk of blurring the boundaries between migration management and fight against terrorism."

- New uses of data

"In addition, the information systems that would feed the common identity repository had been built for purposes other than combating identity fraud which would constitute a new purpose of data processing. In this context, we see a risk of “function creep” (i.e. a widening of the use of a system or a database beyond the purpose(s) for which it was originally intended). As with any initiative that would potentially allow for further uses of data or systems beyond what was originally foreseen by law, we would advise a cautious approach. The argument that, since the data is already collected, they can just as well be used for other purposes cannot be uncritically accepted, since such new processing might have a bigger impact on individuals."

- New security challenges

"We wish to draw attention on the fact that interoperability - as conceived so far by the Commission - would introduce a fundamental change in the current architecture of large-scale IT systems: a shift from a closed environment to a shared environment with connectivity between the various systems. This would bring about new security risks. To take the case of the European search portal as an example, such risks would arise for instance from the fact that an attacker would have to compromise only one single point of access (instead of multiple point of access, i.e. one for each information systems) to get access to several large-scale information systems."

---

How many terminals and how many officials have or will have access to all the existing and planned databases?

In 2003 a Council Presidency: Report of the ad hoc group for the study of the 3rd pillar information systems (LIMITE doc no: 8857-03, pdf) stated on page 11 that the:

"number of terminals through which the N.SISes can be consulted (approx. !!!): 125 000 (cf. document 6739/02 EU CONFIDENTIAL)" [exclamation marks in original!]

Tony Bunyan, Statewatch Director, comments:

"In 2003 the EU had only 15 Member States and these figures only refer to the Schengn Information System (SIS). How many terminals and officials have or will have interoperable access to the existing and planned justice and home affairs databases?"

Search our database for more articles and information or subscribe to our mailing list for regular updates from Statewatch News Online.