Examination of Witnesses (Questions 40-59)
Mr Mike Fitzpatrick, Mr Jonathan Sweet, Mr Kevan
Norris and Mr Marek Rejman-Greene
11 OCTOBER 2006
Q40 Lord Avebury: Can I ask you whether
the government support the idea that other EU databases should
be co-located with SIS II and, if so, which seems to be a suitable
candidate? For example, would Eurodac be in the frame for co-location?
Mr Sweet: I do not think the government has
any objection in principle to the idea of other EU database systems
co-locating with SIS II. Co-location presumably in that sense
means the physical proximity to those databases. There would clearly
of course be resource implications if one were to move existing
databases elsewhere. Our basic approach is if there were to be
operational advantages and additional effectiveness as a result
of co-location we would certainly support that in principle.
Q41 Chairman: Following on Lord Marlesford's
earlier question, if other databases are being co-located and
this led to us being excluded from those other databases, surely
there would be very serious implications for us?
Mr Sweet: Yes. I was talking simply in the sense
of physical, geographical proximity. You are absolutely right.
Q42 Viscount Ullswater: If I could move
to the interim period, does the government believe that the provisions
in the draft regulation concerning the accountability of the Member
States which will manage SIS II for the transitional period—France,
Strasbourg and Austria—are likely to prove adequate in practice?
Could you say a little bit more about what you feel the right
accountability should be for this Commission inspired agency,
or is it a Member State inspired agency which might ultimately
be managing the system?
Mr Sweet: My understanding is it is an agency
which will have representation from all Member States and in that
sense it is not a Commission body. That is part of the argument
about the extent to which the Commission should manage the entire
project.
Q43 Viscount Ullswater: Does that mean
it will be a Commission funded body? Does it fall within the Treaty
as being a Commission funded body or is it something like Europol?
I do not think Europol is yet.
Mr Sweet: Europol is not yet.
Q44 Viscount Ullswater: Would it become
like Europol?
Mr Sweet: I would have to check. I do not know
the answer offhand.
Q45 Viscount Ullswater: I interrupted
your train of thought on accountability.
Mr Sweet: Essentially we do think that there
will be adequate provisions in place in relation to accountability
for the management authority. The legal base specifically ensures
that any delegation of the management of SIS II by the Commission
does not adversely affect any effective control mechanism under
Community law, be it by the Court of Justice, the Court of Auditors
or the European Data Protection Supervisor. That is explicitly
written into one of the Articles. In addition, the data protection
aspects will be scrutinised by the European Data Protection Supervisor
who must be given access to data and facilities as necessary to
carry out his task. There are relevant provisions in the regulation
and the Council decision providing for a review of the function
of SIS II. Those relevant provisions include analysis of the output,
cost effectiveness, security and quality of service. Reports on
those, as I understand it, will be presented to the European Parliament
and Council two years after SIS II becomes operational and thereafter
every two years. We also expect that there will be further reports
carried out by the Commission itself to evaluate the central system
and the bilateral and multilateral exchange of information between
Member States. Given that range of elements in it, we believe
that the provisions in the regulation do provide appropriate accountability
for the management of SIS II.
Q46 Lord Avebury: You mentioned the European
Data Protection Supervisor who will have jurisdiction over the
data protection aspects of the management of the project. Does
that mean that you will have that duty on a day-to-day and ongoing
basis and will you report in private to the management of the
project or will these reports be available to Member States and
the public?
Mr Sweet: I am not an expert on the data protection
aspects, I fear, and it may be a question that might be better
addressed to the Department for Constitutional Affairs when they
come along, as they in fact have responsibility specifically in
relation to the data protection issues that arise in relation
to this instrument.
Q47 Lord Marlesford: This is really a
question about biometric data, so I think it must be for Mr Rejman-Greene.
First of all, perhaps you could remind us exactly what biometric
data it is proposed to incorporate in SIS II which is not in SIS
I and what biometric data, if any, is in SIS I.
Mr Rejman-Greene: As far as I understand there
is no biometric data in SIS I and, therefore, the introduction
of biometric data in SIS II is a major step forward. My understanding
is that there will be both face and fingerprint data stored in
SIS II but the use of it will come in a staged process in accordance
with the development of technology and the proving of that technology,
first of all on the basis of use of fingerprints on a one-to-one
basis—so is this a set of fingerprints which matched those
which are asked for in SIS II—and that is obviously dependent
on making sure that the technology is adequate. So there is a
report that needs to be issued at that point, and at a later date
the opportunity for a search of the entire database against those
search requests as a set of fingerprints that the national Member
State requires to match against what is in the database itself.
There is a multi-stage process which depends upon the proving
of the technology at each stage.
Q48 Lord Marlesford: That is face and
fingerprints. I am surprised that you say the technology for fingerprint
matching is not there yet. I thought—
Mr Rejman-Greene: It is certainly there and
we certainly have, in the UK, experience of a very large database
as well as other countries have. What we are talking about now
is the rapid expansion of the database to many millions of records.
We also have to bear in mind that each individual country will
have their own standards and ways of enrolling people into a system
and what needs to be checked is that that is being done across
equivalent quality levels so that we do not get undue numbers
of errors that would actually crop up which would then put a great
burden on any fingerprint bureaux which would be checking that
match process. So the technology is well developed; what is at
issue is the implementation or use of that technology in this
particular application.
Q49 Lord Marlesford: What is the timescale
for this?
Mr Rejman-Greene: My understanding is that SIS
II is expected to be brought in by 2009. There is a period of
time (I believe it is two years) to allow the system to bed down
and then the check on the technological capabilities has to be
made to ensure that the system operates in a way in which a one-to-one
match of a fingerprint or photograph operates correctly. At some
time, which I believe is unspecified in the future, the search
capabilities using identification will come into play.
Q50 Lord Marlesford: Just to recap then:
first of all, the face and the fingerprints are going in tandem,
but if the SIS II is coming in in 2009 they will not even start
to use biometrics until 2011.
Mr Fitzpatrick: My Lord, may I interject at
this point? Member States other than the UK will join SIS II in
2008 on the current timetable. Subject to the checks and so forth,
we are expecting a properly developed programme covering all those
checks to be put together by the Commission which contemplates
implementation of biometrics in 2009, but it would obviously be
subject to the assurance that the things that we have just talked
about have been addressed to a certain extent. So that by the
time the UK joins biometrics will be part of the system.
Q51 Lord Marlesford: Is it a problem
of using them or of collecting them?
Mr Rejman-Greene: The problem is ensuring that
the data is valid, accurate and usable. I believe there is a requirement
within the process to ensure that that is correct for all users
in order to ensure the validity of the results of the matching.
Lord Marlesford: The Information Commission
itself has acknowledged that data protection in the UK is very
complicated. I know that one of your colleagues said earlier that
the Department for Constitutional Affairs was responsible for
data protection but I think it would be very helpful if between
the Home Office and that department you could give us a written
note on exactly what the main points of conflict are between data
protection and the collection and use of this data.
Q52 Lord Avebury: I wanted to pick up
the point that was being made about the validity and usability
of the data. Why does not the technology of Eurodac read across
into SIS II? I appreciate there is not an interoperability treaty
in this system but I would have thought that having developed
a very large fingerprint database in Eurodac the lessons would
have been learned and that it would not be so difficult as appears
to be suggested to ensure that as far as fingerprints are concerned
the new system of biometrics under SIS II will be robust.
Mr Rejman-Greene: I think certainly the lessons
that have been gained through the use of Eurodac will certainly
be implemented in the specification and development of this SIS
II. My understanding is that Eurodac has a very specific role
and a very specific set of requirements which have been developed
in redressing a very, very narrow field, which is, essentially,
the asylum applications.
Q53 Lord Avebury: Yes, but, if I can
interrupt you, that does not affect the methods of collecting
and recording the data, does it? They have to be just as scrupulous
about accuracy and validity of the records as a system which is
collecting fingerprints for some other purpose.
Mr Rejman-Greene: At each level there will be
a different level of competence required and what I understand
from the Eurodac system (I am not an expert in Eurodac and if
I am wrong I will certainly submit a written note) is that it
is a simple return of "yes" or "no" to: "Is
there anybody in the database with that set of fingerprints?"
There is a large amount of extra information that is potentially
available under SIS II. I think there the concerns are that there
is a degree of a higher threshold of accuracy in a match and concern
also in terms of the collection of data: first of all, the large
number of countries and, also, the potential for error and the
implications for criminals in the data protection context.
Q54 Viscount Ullswater: Before we move
away from biometrics, is there any intention or do the regulations
allow for the collection of other biometric data such as DNA?
I am not thinking that DNA will be used for the point of entry
but, obviously, it is an important one when dealing with criminal
matters under pillar three which we might want to transfer from
one European country to another.
Mr Rejman-Greene: I believe there is a provision
there for an extension to other biometric modalities but at present
there is no definite proposal on the table.
Q55 Earl of Listowel: What is the Government's
view of the judgment in Commission v Spain? Is the
Government content with the most recent text of the regulation
as regards its application to family members of European Union
citizens, considering that third-county national family members
of UK nationals and residents could be affected by an SIS listing?
Mr Norris: The Commission v Spain (case
503-03) concerned the movement of, I think, Spanish nationals
who had third-country national spouses—one family group
living in Dublin in Ireland and the other living in London—who
wanted to travel to Spain. Therefore, although they were travelling
within the Community they were crossing the Schengen external
border and there was a Schengen alert on the third-country nationals
concerned. The Spanish Government considered that that in itself
was a sufficient basis for refusing them entry into Spain—i.e.
refusing them entry into the Schengen area. The Court of Justice
said that essentially an alert entered into the Schengen Information
System could not override the rights of free movement of EU citizens
and their family members within the Community. Under the Free
Movement of Persons Directive the movement of EU citizens and
their family members within the Community can only be prevented
on grounds of public policy, public security or public health,
and there are a series of principles which have to be applied
when taking any such decision. Essentially, the European Court
of Justice said those principles had to be observed; it was not
sufficient simply to refuse entry on the basis of an SIS alert
alone. The text of the regulation has been amended since that
judgment and we now have Article 15A, which specifically refers
to the Free Movement of Persons Directive (Directive 2004/38),
and I think we are now content with that article. The position
under European Community law ought to be clear, both under the
SIS II regulation and in the light of the European Court of Justice
judgment.
Q56 Earl of Listowel: What compensation
was offered to the family in question? Do you happen to know?
Mr Norris: I am afraid I do not have any information
on that.
Q57 Chairman: Before I come to the last
question, can I just revert to question two on your hymn sheet?
I may have to ask you to repeat some points you made but I am
not sure that I adequately covered the question. This is really
the question of whether SIS I might be extended to the new Member
States, but also the question of whether the technical limitations
on SIS I would not actually make this quite difficult. Would it
require a new regulation and a new decision? I think you may possibly
have answered some of those questions but can we just do a rerun?
Mr Fitzpatrick: Certainly. I think I mentioned
the issue. I think our view is that it would not require a new
regulation because it would be perfectly possible to extend the
system to the new Member States. However, from a UK perspective,
we have not seen a proper impact assessment both from a technical
perspective in terms of the capacity of the system and the capacity
of the interconnections that would be required between Member
States and the central system, and we have not seen a proper programme
assessment of how long it would take, for instance, the recent
so-called Portuguese SIS I for one4all It was suggested that if
a decision was given on 16 October at a recent Council meeting
to go ahead with that proposal it could be implemented (and there
is a date by which it would be implemented) but there had been
no proper assessment of the impact that pursuing that approach
would have on SIS II, the timetable for SIS II and whether Member
States would be willing to commit the necessary resources to make
it a reality.
Q58 Chairman: As of now it is likely
that neither Bulgaria nor Romania will have any involvement in
SIS when they become members at the beginning of next year?
Mr Fitzpatrick: That is true, yes, but that
is also the same for other Member States who have recently joined.
Q59 Baroness Bonham-Carter of Yarnbury:
On a point of clarification to Mr Norris, the alert that meant
that these families could not go to Spain: was that purely because
they were third-country nationals?
Mr Norris: No, it was an alert entered into
the Schengen Information System flagging up that there are public
security reasons for refusing the third-country nationals entry
into the Schengen area, and that would apply to any third-country
national trying to cross into the Schengen area.
| 
