Examination of Witnesses (Questions 80-99)
Professor Kees Groenendijk, Ms Evelien Brouwer, Professor
Theo de Roos and Professor Elspeth Guild
18 OCTOBER 2006
Q80 Lord Avebury: No, I am talking more
about the process, the existence of the multidisciplinary group
on organised crime and its role in examining the European data
protection framework as it applies to SIS II.
Professor Guild: I would like to begin with
a couple of comments in answer to that question. The first question
was as to how these groups came into existence. I think that one
of the grave difficulties we have in a variety of EU venues is
a lack of a legal base in the introduction of different bodies.
We create bodies and subsequently we may or may not create a legal
base to which that corresponds. We have had this with the police
chiefs. In fact, CEPOL had no legal base when it was set up. Yet
it is all over the place, it happens endlessly, and I think you
have identified one of those difficulties. We set up a body. Its
membership is decided on a mix of political and executive decisions,
and it is then let loose on a subject matter without any self-evident
controls around what it is supposed to be doing, why it is there
or to whom it is responsible, as one would expect if it had a
proper legal base.
Q81 Chairman: Professor de Roos, you
are welcome. I am sorry that you have had trouble getting here,
but we are extremely grateful to you and to your colleagues for
coming from Holland this morning for this session. I will now
move on to the second question that I want to ask which is, does
the agreed text of the regulation satisfy the concern about the
accountability of the agency to be established to run SIS II?
What other specific rules should be adopted to ensure accountability
and should this agency have competence to run any other EU agencies?
Who would like to have a shot at that?
Ms Brouwer: As you know, the management authority
is now only a proposal and there is provision within the Decision
and the Regulation that the Commission will publish a legal proposal
within two years after their entry into force. We think there
are only a few provisions which provide safeguards for the functioning
of this management authority. It only allows the European Data
Protection Supervisor to supervise the data processing that will
be performed by this management authority. The view of the Meijers
Committee is that there are only minor safeguards at this moment.
We have of course to wait for the Commission's proposal on this
issue. The four aspects which we think should be regulated in
general, not only for the management authority for SIS but also
for other independent agencies who are working within the framework
of the EU, are firstly that there should be full competence of
the European Court of Justice to assess the legitimacy and the
lawfulness of acts performed by those authorities. The decision
making and documents which those agencies and authorities are
producing should be transparent. The same transparency rules for
EU institutions should also apply for those institutions. With
regard to liability, I think it is very important that there should
be very accurate provisions on dealing with individuals harmed
by data processing caused by the functioning of the management
authority. There must be a good provision on assuring the liability
of the management authority. There should be no gaps in legal
protection.
Professor Guild: On behalf of ILPA, I would
like to add a couple of points to what Evelien has said which
we very much endorse. The first issue which concerns us is accountability
to whom? What kind of accountability are we talking about? Is
it political accountability, legal accountability, accountability
to the police and immigration authorities, accountability to the
data protection officers, or accountability to the individual?
We have a variety of questions around accountability. We are very
concerned that the weakest of that group of different categories
of persons to whom accountability may be allocated are the individuals
whose information is in the system, and therefore we would like
to see strengthening of the measures of accountability to them.
At the moment, it seems that there will be an indirect system
of accountability via first of all a subcontracted agency, and
the agency will be subject to the European Data Protection Supervisor
and the national supervisors at the national level. We wonder
whether this is really good enough to protect the individual.
Q82 Baroness Bonham-Carter of Yarnbury:
In your written evidence, you say quite strongly that you are
concerned about the setting up of new agencies. What would be
your preferred way of managing the system?
Professor Groenendijk: As regards the Meijers
Committee, it would make things a great deal clearer and solve
a number of problems that Ms Brouwer just mentioned if SIS was
under the Commission. If it was a Community agency, then all the
rules on remedies, liabilities, and the general rules on transparency
of the documents would apply, and I think that is exactly the
only reason why it is outside! That is why we started talking
about Schengen in 1990, because it was kept away from the control
by the parliaments and by the judges. That is the only real reason
that I can mention.
Q83 Baroness Bonham-Carter of Yarnbury:
As I understand it, the Commission is going to start off running
it; is that correct?
Professor Groenendijk: My impression from the
documents I have read is that it will be an ongoing battle between
the Member States and the Commission and this is a phase in that
battle. I hope that, in the end, the same will happen that happened
with the Schengen that was incorporated in the EU Treaty. For
reasons both of efficiency and democracy it will be good, but
this will be a long battle.
Q84 Earl of Listowel: Please forgive
me if I am asking this question out of turn, but we heard last
week that there is a team looking across Europe at how different
countries access the information and checking that the access
to information is secure. I think that you also said in your evidence
that you would be interested in seeing better monitoring of who
accessed the information, how often it is accessed and so on.
That may come in our later questions but it does seem to bite
on the accountability of what happens with SIS. Are you able to
help me with information on those teams and how effective they
are in actually checking that?
Ms Brouwer: I must admit that this is new information
for me, so thank you for providing this information. I am not
aware of teams looking at different countries. I think it would
be a good opportunity if it is happening at this moment. I am
only aware of the Joint Supervisory Authority which is functioning
at this moment for the Schengen Information System, which has
made some inquiries through the data protection authorities of
the different countries into Article 96 on the actual input in
SIS. And now there is an inquiry into Article 99 on the alerts
for special searches. If I had come across the teams you are mentioning,
I would be able to help you but...
Q85 Lord Corbett of Castle Vale: Would
you tell us your particular concerns about the interoperability
of databases.
Ms Brouwer: I can be very brief. There are two
major concerns. The first concern is that it is absolutely contrary
to the purpose limitation principle, which sounds like the old-fashioned
principle of data protection but I think the data protection authorities
agree with us that it is a central basic principle of data protection
law, and it is important for protecting the transparency of the
use of databases holding personal information. It is important
for balancing the powers between different institutions and important
for giving the person concerned information on how his or her
information is used. I think that allowing interoperability is
going contrary to this principle and it is a very critical argument.
The second major concern is that it will affect the reliability
of the information and it includes a risk of contaminated information.
It is not very difficult to understand that, if you allow many
organisations to use the same information and the same information
goes through one database to another database, then different
databases will become contaminated if the basic information is
not reliable, and we know from the practice of the Schengen Information
System that the information which is reported by the different
national authorities at the local level is not reliable all the
time. I am very concerned about this principle of interoperability
and about the proposals stating that we should connect Eurodac
with VIS and VIS with the Schengen Information System, and to
Europol, and Europol can transfer data further to third parties
and third countries. I think that is a major problem for my Committee.
Q86 Lord Corbett of Castle Vale:
We have problems with the accuracy and motivation of the police
national computer. There is a high level of inaccuracy in those
records.
Ms Brouwer: Exactly, and that is what you hear
from all the countries. In France, there are complaints about
the reliability of immigration data bases and, in Germany, the
Federal Police are laughing about the immigration administration
because everybody knows that the immigration administration is
not very reliable and causes problems. In the Netherlands, we
have the same problems. Thinking about the impact of the Schengen
Information System II, which will be applicable in more than 28
states now that we have Bulgaria and Romania joining the European
Union, ,I think it is a very important problem.
Professor Groenendijk: From the study which
Ms Brouwer is writing right now for her PhD, it appears that in
France 40 per cent of cases where the French Data Protection Authority
checked individual registrations in SIS they were either incorrect
or unlawful; and, in the reports of the Data Protection Authorities
of the German Länder, the percentage of registrations which
were unlawful, records that were not allowed under the present
Schengen rules, included between 10 to 50 per cent. of the data.
The present proposal is to use these kind of data for completely
different purposes with far-reaching consequences for individuals.
I think it is a risky affair.
Chairman: Professor de Roos, I should
have repeated what I said at the beginning of the session before
you were here and that is, please, feel free to intervene whenever
you want or at least to invite yourself to intervene. The reference
to incorrect data takes us straight on to the next question about
biometrics.
Q87 Lord Dubs: From the written evidence,
it seems to be your view that the use of biometrics as identifiers
should be ruled out entirely, that is identified on a one to many
comparison basis. I looked at the evidence and you seem to have
two sets of concerns, one is about technical reliability—or
should I say technical unreliability—and, secondly, privacy
and human rights concerns. Would it not be enough to have adequate
safeguards for the use of biometrics? Secondly, do you have similar
concerns about the use of biometrics for verification, that is
to say on a one to one comparison?
Ms Brouwer: Thank you for the question. The
two concerns you quoted were its reliability and the human rights
impact. I think I could add a third one which is the security
of biometrics. I think there are those three problems. As regards
the reliability, many data protection authorities and also IT
specialists agree with us that it is not clear at this moment
which procedure of biometrics—fingerprints, iris scan or
facial recognition—gives us the maximum guarantee of reliability
which will be 100 per cent right. A one to two per cent false
rejection rate or false acceptance rate for biometrics is considered
normal and this means that introducing these data into databases
where the data on millions of individuals will be stored, will
mean that a huge number of individuals will be permanently accepted
or rejected wrongfully. The second problem is the security of
biometrics. It has been proved last summer by IT specialists that
biometrics are not secure; they can be stolen or there can be
fraudulent use of biometrics by criminal organisations or by other
specialists. There could be unauthorised access to the documents
on which biometrics are stored. I think that, as long as those
problems remain unsolved, it is too early to think about safeguards.
I think that you should first of all be sure that biometrics are
reliable and secure, before developing a central database of biometrics.
However, we have thought about possible safeguards because we
know that the policy will not stop by introducing biometrics.
We agree that there should be safeguards like fallback procedures
if somebody is rejected at the borders. Also, there should be
a procedure whereby one decision that your biometrical features
do not match the registered data, is not enough to deny someone
their rights. But we have a principal objection against the decision
to start running the central database for biometrics and then
say that the safeguards will come afterwards. We agree with those
institutions and specialists who say, "No, first think about
what you are doing and then start applying it in practice".
Q88 Lord Dubs: I understand what
you are saying in relation to the use as identifiers, that is
to say one to many comparisons, but if you are looking at the
use of biometrics for verification of other information, then
surely some of your objections would have less substance.
Ms Brouwer: I agree with you that it makes a
lot of difference what kind of use is intended with biometrics.
Is it just for verifying whether the person carrying the identity
card or passport matches the information stored on the card. or
only to see if the person who is presenting himself is the same
as registered on the card? It might be that a central registration
in future provides an extra tool to safeguard just for this verification:
is this the same person as the person who has applied for a visa
or for a passport? But in the case of the Schengen Information
System II, the policy makers are considering using biometrics
as a search tool and I think that will have a much larger impact.
It is not one to many, it is just using biometrics for searching
in different databases, "is the person we are looking for
registered somewhere?". If there are problems on security
and reliability, I think that is a much larger concern.
Q89 Lord Dubs: It is going beyond
the bounds of our inquiry, but you seemed to have undermined the
American policy on biometric information on passports and British
Government policy on identity cards, but that is not what we are
talking about today.
Professor Guild: May I add a couple of extra
comments that are from a slightly different angle for ILPA. The
first is, what are we seeking with biometrics? What we are seeking
with biometrics is in fact security about the individual and the
document. The difficulty with that is that it is a never ending
search. You will never get to the point where you are absolutely
satisfied, no matter what biometrics you use. You can even use
DNA but there is always the doubt; there is always the search
for further security that the person holding the document is indeed
the person who is entitled to it. We could get to the point where
we are tattooing people's arms but do we want to go there? Is
this what we want to do? Do we want to say, we are willing to
accept a degree of insecurity as regards the identity of the person
in the document? I think that is the first fundamental question
which we have to answer.
Q90 Lord Avebury: You have some experience
with Eurodac on false policies. If we look at the number of occasions
somebody has been wrongly identified as of interest to the immigration
authorities because of incorrect recognition of his fingerprints
on Eurodac, then that would presumably feed across. You talk about
a 1 or 2 per cent error but I did not think that it was anything
like as high as that in the case of fingerprints.
Ms Brouwer: I am not aware of the percentage
of mistaken identifications in Eurodac.
Q91 Lord Avebury: Would it not be important
to look at that?
Ms Brouwer: Yes, I agree that it would be very
important. I think the problem with using biometrics in the field
of immigration law is that differentiating between applying biometrics
for the use of EU citizens for their passports and identity cards
or for controlling immigrants, for questions such as: "Do
we want him or not? Can we expel him?" Immigrants are not
so aware of their rights and the possibility of going to appeal
and say, "You must be wrong, I am not the same person".
Somebody using a false passport is another problem. I am not aware
that Eurodac will give you the percentage of people who have caused
this problem of wrong identification.
Chairman: I should perhaps say on this
as on any other question, if any of you think when you see the
transcript that there are additional points that you ought to
make to us in writing, we would be very happy to receive them.
Q92 Lord Avebury: I would like to ask
one more question on that topic. Surely, if there were false identification
of people as being of interest to the immigration authorities,
then we would have known about it, because those people, having
been refused entry at a particular border, would be vociferous
in their complaints about the false identification. It is almost
certain that each individual case of error under Eurodac would
be shown up through the complaints which the individual or their
representative would no doubt make to people like us or their
Member of Parliament.
Professor Guild: The poor people who are in
the Eurodac database are amongst the most vulnerable who exist
and their access to lawyers or to anyone who will help them to
make a complaint is extremely weak. If we take the example of
a case which came before the High Court here, it was after a number
of similar cases where the UK authorities had sent back to other
Member States, particularly to Italy, asylum seekers for whom
they said they had a positive match of fingerprints, and they
sent back the wrong person, and the Italian process is that the
person cannot then make an application for asylum because they
are excluded because they have made an application in the UK,
therefore they are excluded from any benefits. These people were
camping in the grounds of the Italian Refugee Council and it was
after numerous of these cases that finally the Italian Refugee
Council got in touch with the Refugee Council here and they started
a case in the High Court to require the Government to bring these
people back to the UK. Yes, the fingerprints matched in the system,
but the individual who was sent back was a different one. They
just picked up anybody out of detention and sent them back—"Oh,
you are a Somali, Mr Ali, we will send you back, you must be the
right one"! It went on for months. Within the system, even
with the fingerprints matching, the wrong person can be sent back
regularly. These individuals have so little access. Most of them
are sent outside the Member State with summary procedures. How
many complaints will get to you?
Q93 Lord Dubs: I would like to move
on to another question altogether. With regard to the draft regulation,
you seem concerned by the vague criteria for the inclusion of
data concerning third country nationals to be refused entry, which
you say will continue to lead to different interpretations from
one Member State to another. What specific harmonised rules should
govern the grounds for issuing alerts on third country nationals
to prevent this?
Professor Groenendijk: As to the last question,
the Commission originally made a proposal to limit the possibility
to register third country nationals in the Schengen Information
System for certain specific crimes only and, from my recollection,
they referred to the list of crimes under the European Arrest
Warrant. If you limit registration to certain specific crimes,
it will be much clearer than now. The only threshold is a maximum
penalty of one year threatened under national law for any infringement
of immigration law. I am afraid that all of us have once upon
a time infringed the immigration legislation of another country.
I think that specification would be the answer. As to the problem
with third country nationals, I think there are basically three
categories. First, the third country national family members of
EU migrants who have under community law a right to live with
their EU family members in a Member State. In Article 15(a) of
the proposed Regulation, there has been a solution along the lines
of the ECJ judgment in Commission v Spain that was decided
earlier this year, where Spain had refused a visa and the right
of entry to two third country nationals who are family members
of EU citizens.because they were registered in SIS by Germany.
Spain was told that it should have used its SIRENE contacts to
check whether there was a real danger serious enough to refuse
the entry or the visa. This might be a practical solution in visa
cases but in practice it does not work at borders. Before the
border authorities have contacted their capital and the capital
has contacted the other capital and they have contacted the SIRENE
Bureau, many flights will have gone and many more hours will have
passed. For this limited group it is a solution, but I think there
is a second group of third country nationals who, under the new
directives on legal migration, especially the family reunification
directive and the one on long-term residents, have a Community
law right to remain in the Member State. This group is completely
disregarded. In our view, they should be excluded from the personal
scope of this Regulation altogether because what you will get
is people, third country nationals, who will have a long-term
residence permit under the directive and then they can still be
registered sooner or later in the SIS II. At the time of drafting
that article, the granting of residence permits and the withdrawal
on public order grounds was still a completely national issue
which it no longer is, because now both the issue of granting
or withdrawal of residence permits for family members and for
long-term residents are community law matters. So, what we are
in fact getting are two sets of rules and criteria, one in this
new Regulation with very low thresholds and, in the directives,
you grant a right with only very limited possibilities to withdraw
this title and to refuse people at a border and this is completely
disregarded. I think the drafters have forgotten this category.
More than half the third country nationals live in the Member
States or at least in a Member State where those directives apply,
so it is a pretty large group. There is a nice rule in Article
20AA of the SIS II Regulation which has been more or less copied
from Eurodac which says as soon as a third country national acquires
the nationality of one of the Member States, the Member State
who made the registration in SIS should take care that these data
are deleted; but who knows? In Eurodac, there is a rule that as
soon as a third country national gets a residence status or the
nationality of a Member State, his data should be removed from
the system, but the national authorities which grant nationality
never think of warning another Member State that they should remove
their alert. This is a provision that looks very interesting and
fair but there is actually no implementation of it. Large numbers
of third country nationals are registered in SIS and will be registered
in the SIS II. We see that already right now Member States have
a problem removing from SIS data on people who are notified as
being EU nationals from the system. We have a system that failed
to produce the data that they are EU nationals and thus should
be removed, but of the large group of new EU citizens, nobody
will know, and the system surely will not know that they are EU
nationals and should be out of the scope of the system. On that
point, the draft regulation is really deficient in our view.
Q94 Earl of Listowel: Have you any comments
on the listing of third country nationals, including on foreign
policy sanction lists, such as the UN Security Council travel
ban, and do you have any further comments on family members of
EU citizens? I think you did approach that fairly thoroughly in
your last response.
Professor de Roos: We are fairly concerned about
that, if you recall this example of the United Nations terrorist
lists. There is no control on that whatsoever and that is a huge
problem. There was a judgment of the European Court of Justice
on 12 July 2006 in which the Court made clear that Member States
should provide for accessible remedies to individuals to make
it possibly to apply for a re-examination of listing by the Sanction
Committee. I think that is essential. There has to be a control
and there has to be an effective remedy. If you miss that then
misrepresentation of this sort of information could play a role.
Maybe I could put this in a somewhat broader context. We are wrestling
in our country, but I think the same goes for all countries of
the European Union, with the problem of information stemming from
the security services and information gathered by judicial authorities.
Now we have some brand new legislation which is not working yet
but will be able to be used in our country to make it possible
to interrogate witnesses against the accused, witnesses who are
working for the security services. It is a hell of a job to make
that compatible with Article 6 of the Human Rights Convention,
the fair trial provision. There has been an effort to make that
control a little bit possible, but the problem remains that the
function of security service information is completely different
from the function of judicial information. Judicial information
is gathered in order to find the truth and then put the accused
to trial, and see to it that there is a fair trial as well, of
course. That is one thing. The other thing is that for the security
services it is not really important for them to go into procedural
truth-finding, but they want to know what is going on and work
on it. In the end, if there is a link, if there is a serious risk
of committing an offence or making plans to commit a serious offence,
then of course the security services have a duty to get the information
through to the judicial authorities. That is in an extreme situation.
We have had some trials in our country and our experience is that
criminal trials in which security service information plays a
necessary role are quite hard to handle. We have had acquittals
and now there are some procedures in which the idea is to use
information gathered by the security services. As this is not
in itself reliable information or information that can be used
in a fair trial. That is a general problem which also plays a
role, I think, in this context.
Q95 Lord Avebury: You made a comment
about remedies for individuals put on this list. Can I ask about
a particular case of persons who are declared non-conducive to
the public good, and I believe there is a category similar to
that in many other European countries, but that is how we describe
it in our law? Those people never have a right to challenge their
inclusion on the list which is promulgated by the Home Office,
and I presume the same is true in France, Germany, et cetera.
Are you suggesting that they should now have such a right as part
of the Schengen system?
Professor Groenendijk: I would respectfully
disagree. I think this category is a typically British one, at
least under the system of immigration control. I know that in
our country under the immigration legislation, if any non-citizen
that is on the point of being expelled or of having his residence
permit withdrawn, even if the legislator has tried to reduce his
remedies there is access to court. The civil courts in our country
have accepted the task of allowing at least one form of a day
in court in these kinds of cases. There is always a remedy, either
in immigration law or in the general administrative law, and if
both fail there is a remedy in the normal civil court. It is not
possible for the Dutch Government to expel somebody without him
having at least an hour or so to apply before a judge.
Q96 Baroness Bonham-Carter of Yarnbury:
Are you aware of SIS immigration data used by relevant authorities
in other Member States for the purpose of determining the merit
of asylum applications and, if so, what are your concerns about
this?
Professor Groenendijk: In order to be able to
answer this question I contacted the Dutch Refugee Council, and
since they were unable to be of help I contacted a colleague in
Austria. She gave almost the same answer I would have given for
the Netherlands, that the Dutch authorities deny that they do
so, and it is unclear whether they actually do it. I could mention
two occasions in an asylum procedure where authorities would be
interested in checking with the Schengen Information System first
for the application of the Dublin Regulation. Is there another
country that has already registered? Of course, it is unclear
whether it would be a useful idea, because this is not mentioned
under the Dublin Regulation as proof of an asylum seeker having
been in the other Member States that have registered him in the
Schengen Information System. The other moment is at the very end,
at the moment when the immigration authorities are on the point
of granting refugee status. Then I think, implicitly under the
Schengen Implementing Agreement, they are under a duty to check
whether this person, the third country national, has been registered
by another Member State, because then either the alert has to
be removed or the residence permit has to be refused. That is
in Article 25 of the Schengen Implementing Agreement. I think
the Commission originally also considered the possibility of expanding
the access by the asylum authorities to SIS, but I think Member
States now are more interested in using VIS for this purpose because
evidently there will be a lot more data, a lot more persons who
will be registered under VIS than under SIS. That is also the
answer from my Austrian colleague, that for the time being Member
States do not want to have access for asylum cases through the
SIS because they are thinking about VIS. But this does not say
anything about the actual practice whether they are using it right
now for that purpose.
Q97 Baroness Bonham-Carter of Yarnbury:
But you do not have concerns about their use of VIS rather than
SIS?
Professor Groenendijk: Our concerns would be
the same as already have been formulated by Ms Brouwer, that the
data are so unreliable. I think that makes the system also not
very effective for Dublin purposes because the data in the system
are so unreliable.
Q98 Earl of Caithness: Can I follow up
what Professor de Roos was saying about the security services?
There seems to be a disagreement between the Council and the European
Parliament on this. Could we have a bit more of your thoughts
on whether the SIS II data should be available to the security
services, and do you differentiate between the security services
in the Schengen countries, the security services in the non-Schengen
but EU countries, and what I would call the third parties, all
the other security services? Do you envisage a situation emerging
with SIS II which happened with the similar system where the CIA
would get involved with our friendly Belgians?
Professor de Roos: As I have already many concerns
about the use by Schengen countries of this information and the
combination of criminal law information with security service
information, the more I have concerns about the CIA having access.
I have the impression that the way the CIA works is rather rough
as compared to our European methods. For instance, we have FBI
officials working with the knowledge of our judicial authorities.
That is okay, but then immediately you see that the FBI methods
are dramatically rougher than not only the continental but also
the British ways of working.
Ms Brouwer: I am concerned about the proposal.
I am aware that Germany is now trying to include it in a compromise
text as agreed upon by the LIBE Committee in the European Parliament.
There should be access for internal security agencies not only
to criminal law information but also to information on immigrantsI
think it is institutionally wrong to include this information
in the Decision as it will concern the use of information which
is regulated in the Regulation. Secondly, exactly as Professor
de Roos and Professor Groenendijk are saying, internal security
agencies using this information which is stored in SIS for other
purposes cannot be further controlled. Why? Because we accept
that there is less control on how security agencies are working.
This means that you lose control on how the information is used.
With regard to your question on the use by third parties, bilaterally
information is already shared between security agencies and between
the police and other authorities in the United States or other
third countries. One of the problems with the Schengen Information
System, and the problem we were referring to at the beginning,
is that there is no transparent all-round view of what we are
dealing with. For example, Member States have readily provided
Europol with direct access to SIS information and we know also
that Europol already has bilateral agreements with the United
States and authorities in the United States for further data processing,
so it is very easy to see that information stored in SIS II will
find its way to the United States. It is one of the problems which
should be dealt with more elaborately within the national parliaments
but also at the level of the European Parliament.
Professor Guild: May I add a comment from a
slightly different perspective? The first issue which one would
have to accept is that if an individual's information is in the
SIS II that will be a presumption that that person has done something
wrong. You have in all the mechanisms by which the individual
is put into the system a presumption against them. Once you have
a presumption against the individual, the wider you spread the
presumption around the world the worse the consequences are for
that individual. We have already discussed the question of how
you get into the SIS, and there have been substantial concerns
raised about the extraordinarily flexibility of the criteria on
the basis of which somebody may be registered in the SIS, and
the very wide degree of discretion which is left to a particular
Member State official to insert someone's information into the
SIS. The consequences of that are amplified when that information
is then passed around. We are concerned about two things in particular
in relation to these databases. One is fishing and the other is
data mining. One is going in and trying to find something about
somebody and fishing around in different databases to pull out
bits of information to construct some kind of a bigger picture
of suspicion in order to justify or support concerns about an
individual, and the other is having a profile of what you are
looking for and seeing who out there fits that profile. Both of
these techniques are very widely used by the security services.
There are much greater limitations on these techniques within
the police and judicial authorities. We have had the decision
of the German Constitutional Court prohibiting the use of data
mining, but security services, because of the consequences of
the type of work they do, use (and probably use justifiably) these
mechanisms, but then to give them access to a database which raises
suspicions on very limited grounds seems to me to be an error.
Q99 Earl of Caithness: How do you control
it? Any suggestions?
Professor Guild: How does one control data use?
Quite simply—you state that they shall not have access.
Access will be limited. This is one of the problems that we spoke
about earlier, about interoperability, and, of course, the EU's
principle of availability. Availability to whom and under what
circumstances? These are issues which we have to be very careful
about because they are at the heart of due process and democracy.
|
