Matthias Monroy

In the framework of the Prüm decisions, police forces have networked their files for fingerprints, DNA data and motor vehicle data across Europe. A new regulation is to extend this to faces. Now there is a threat of further tightening.

With a new „Regulation on automated data exchange for police cooperation“, the European Commission wants to network biometric photographs in police databases across Europe and make them searchable with facial recognition. In this way, a police authority can inquire whether information is available on an unknown person in other countries. A proposal to this effect from last December is currently being discussed by the Council of Ministers of the Interior and Justice, after which the Parliament is to deal with it.

The background is the Prüm Treaty, which seven EU member states signed 17 years ago in the Eifel town. It regulates cooperation in the exchange of fingerprints, non-coding DNA data as well as motor vehicle and owner data. In 2008, the multilateral agreement was transferred into the legal framework of the EU via the EU-Prüm Decision. The Schengen states Norway, Iceland, Switzerland and Liechtenstein are also involved in the network, as is Great Britain after Brexit.

Query if national law allows it

The planned extension of the Prüm Decision to files with facial images is known as „Prüm II“. Now, compared to the Commission’s proposal, there is even the threat of a further tightening. Apparently, those member states who also want to query each other’s driving licence data for facial images were able to prevail in the Council’s discussions. In a follow-up document of the current French Council Presidency to the planned regulation, there is a completely new chapter for that. According to the document, such automated searches should be possible for the prevention, detection and investigation of criminal offences.

However, the wording leaves open whether facial recognition may also be used. Searches can be carried out with the driving licence number or with alphanumeric data on the holder. The prerequisite is that national law would also allow such a query in its own databases.

A query within the framework of the Prüm Decision is carried out according to the hit/no hit principle. If information is available, the requesting authority receives a positive notification with a few „core data“. Subsequently, further information can be requested via mutual legal assistance in criminal matters. In the new regulation, this „core data exchange“ is also to be improved.

Obligation to set up a police image database

At present, the Prüm system is organised in a completely decentralised manner, and this architecture will be maintained in part. However, within the framework of „Prüm II“, the planned retrieval of facial images is to take place via a central router. The system is located at the Agency for the operational management of large-scale IT systems (eu-LISA) in Estonia, which is also responsible for the operation of other biometric information systems.

Only eleven participants in the Prüm system currently have anounced to have a police database with facial images. The photos stored there originate from, among other things, identification treatments or asylum applications.

As things stand, however, all other Prüm states would also have to set up a central file with facial images at their own expense; the Commission estimates the number of countries affected at 13 and the costs at around €3 million each. Because this is a regulation and not a directive, it will apply immediately in all EU member states once it has been decided. Whether the Schengen states and Great Britain will also participate in „Prüm II“ is open; they would then be given a deadline for implementation.

Europol should search with photos from third countries

According to the proposal, Europol would also be connected to „Prüm II“ and receive €7 million and five new posts for this purpose. The police agency would itself search the national databases of the member states and be able to use the new central router at eu-LISA for facial images. Conversely, member states would be able to query Europol for biometric data, including those transmitted by third countries. These include fingerprints, DNA data and facial images from war zones such as Afghanistan and Iraq. They were collected there by the US military and transmitted to Europol via the FBI.

Eventually, Europol itself would be allowed to browse the Prüm system with the facial images from third countries for „cross-checking aimed at identifying connections or other relevant links between information“. According to the Europol Regulation, this would be possible in all cases where investigators have „factual indications or reasonable grounds“ that the persons concerned „are suspected of having committed or taken part in a criminal offence in respect of which Europol is competent“.

„Prüm II“ is scheduled to go into operation in 2024 and will cost a total of around 93 million euros. By far the largest part will be spent on the networking of police files, which is also included. These are suspicion files in police investigations that will become searchable among all participating states via a new index system.

Image: Creative Commons.