Biometrics matching in Europe
In 2003 the German minister of the interior Otto Schily started an initiative that led to the signing of the Prüm Convention in 2005. Germany, Spain, France, Luxembourg, Netherlands, Austria, and Belgium agreed in that convention i.e. to provide each other mutual on-line access to their police fingerprint and DNA databases. Every country can match fingerprints and DNA data with the other countries databases and see whether information on that person is available there („hit/no hit“). If there is a hit, more information can be requested in a more formal, manual procedure. But the mere fact of a person being registered in a database on (suspected) criminal offenders can obviously result in troubles. Germany, for example, has registered 3 million fingerprints and 500′000 DNA samples in police databases.
The leaked U.S. embassy cables recently published  reveal that as early as 2006 the U.S. government began discussions with Germany on what parts of the Prüm Convention „might be fruitful for the U.S. to pursue with Germany as a prelude to an agreement with the Prüm group of EU countries“. It should be noted that the major difference between exchanging such information among European countries and with the U.S. is that human rights are not protected adequately in the U.S. That is why agreements with the U.S. can never be called „Prüm-like“.
The pilot U.S.-German biometrics matching agreement
The U.S. and Germany established a working group in 2006. In the first meeting in December of 2006, German officials asked important questions:
- Would the U.S. use any data Germany provided for renditions?
- Why had so many travelers complained about U.S. port of entry systems?
These problems were not resolved. There is nothing to effectively prevent the U.S. from using hit/no hit information for renditions to „black sites“, extrajudicial killings and such like. Yet it was Germany, namely ministry of the interior official Andreas Schulz, who voluntarily offered to discuss a program to allow the U.S. to initiate inquiries and receive information pursuant to a request, e.g. in a hit / no hit system.
Schulz pointed out that the Prüm convention envisions DNA and fingerprint data sharing for crime investigation and prevention rather than for border entry controls. The U.S. side insisted on using fingerprint data for border controls „in special cases“ but not routinely. Yet there is nothing in the PCSC biometrics matching agreements to effectively or even nominally prevent the U.S. from matching every traveller from Europe against our databases and subject them to interrogation or arrest. In fact all visitors to the U.S. are required to provide an image of their hands including all finger prints upon entry. This data can be automatically matched in real-time with police databases in countries that have signed PCSC biometrics matching treaties. Nobody knows what the consequences for matched citizens would be.
The U.S. openly admitted that they would not comply with Prüm’s Article 34 on the „Level of data protection“. According to that Article, each Contracting Party shall „guarantee a level of protection of personal data in its national law at least equal to that resulting from the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981 and its Additional Protocol of 8 November 2001 and in doing so, shall take account of Recommendation No R (87) 15 of 17 September 1987 of the Committee of Ministers of the Council of Europe to the Member States regulating the use of personal data in the police sector, also where data are not processed automatically.“ The German side replied that Germany could not agree to a level of data protection „lower than the EU data privacy rules“. Yet all PCSC biometrics matching agreements today ignore the fact that there is no adequate level of data protection in the U.S., and no way of monitoring and enforcing even the inadequate data protection provisions contained in the biometrics matching PCSC agreements themselves.
Interestingly, the U.S. level of protection prevented the matching of DNA profiles: U.S. law prevents direct access to the DNA database by anyone other than the FBI lab. As the U.S. government was, from the start, not prepared to negotiate a proper treaty to be ratified by Congress, there was no way to overcome this issue. Therefore the PCSC agreements‘ provisions on DNA sharing contain the reservation that they shall come into effect only at a later stage.
The U.S. and Germany consequently negotiated the first agreement on transatlantic biometrics matching. In Germany negotiations were led by the ministry of the interior – despite the fact that the biometrics data to be shared are retained for prosecuting crime which comes under the competence of the ministry of justice. The German minister of the interior at the time was Wolfgang Schäuble, infamous for his erosion of fundamental rights in the name of security in many ways. According to a U.S. embassy cable, the social democrat minister of justice Brigitte Zypries, herself a former ministry of the interior official, only „reluctantly agreed to the landmark data sharing initiative on serious crime and terrorism suspects (the Pruem-like agreement) due to privacy concerns.“ She opposed an HSPD-6 agreement on sharing terrorism screening information, though.
Wolfgang Schäuble, Brigitte Zypries, Michael Chertoff and Michael Bernard Mukasey on 11 March 2008 signed the „Agreement between the Government of the Federal Republic of Germany and the Government of the United States of America on enhancing cooperation in preventing and combating serious crime“ (full text here ). Germany was criticised by its EU partners for this unilateral step which weakened the EU’s ability to jointly negotiate an agreement that satisfies fundamental rights.
Negotiations had been kept secret before the date of signing. The Working Group on Data Retention (AK Vorrat) was the first to publish the agreement in 2008. The activist group warned  that ratification of the agreement would „expose Germans to the risk of systematic human rights violations by U.S. authorities“ and called on the German parliament to refuse ratification. „Germany is to allow an unspecified number of U.S. authorities such as law enforcement, border control and intelligence agencies to match fingerprints and DNA samples on-line with German fingerprints and DNA databases […] Currently German laws on international cooperation permit a transmission of information only to countries with an appropriate level of data protection in place.“ „Disproportionality, lack of precision and predictability, deficient purpose limitation, lack of safeguards, no effective access to the courts – this deal defaults on basically all of the preconditions set out by the German Constitutional Court for interferences with our basic rights“, criticised jurist Patrick Breyer from the Working Group. In detail, AK Vorrat criticised the PCSC agreement for the following reasons:
- Access to the German databases is not to be conditional upon a reasonable suspicion or a specific reason. Matching would be allowed to take place arbitrarily with any person’s fingerprints and DNA, for example upon entry of tourists to the U.S.
- The deal does not specify which U.S. authorities are to be given access.
- The use of information obtained from Germany in the U.S. is not limited to the purpose of the request, nor is it limited to criminal proceedings. The U.S. may thus insert obtained information in mass databases for an unlimited period of time and hand it on to other U.S. authorities, whenever the U.S. believes it necessary.
- Nobody will ever find out that their information was passed on to the U.S. Even if they knew they are given no effective right to access the information, and they cannot effectively enforce a correction of false information in the U.S.
- Affected citizens from Europe will have no access to independent courts in the U.S. to stop erroneous or illegal measures. Nor do independent data protection authorities exist in the U.S.
- Ignoring the low level of human rights protection in the U.S., the German ministers simply copied parts of the Prum Treaty – which had been drafted exclusively for member states to the European Convention on Human Rights – and applied them to a country where no similar guarantees exist.
- The director of U.S. civil liberties NGO ACLU Barry Steinhardt only recently warned: „If Europe agrees to data-sharing with the United States […], then European citizens will have far fewer protections for their data in the United States than U.S. citizens will have in Europe. U.S. privacy laws are weak; they offer little protection to citizens and virtually none to non-citizens.“   In regard to the protection of human rights, the U.S. are a developing country. Its level of data protection is ranked between the Philippines and Thailand by British civil liberties NGO Privacy International. 
- Countless cases document what are clearly standard procedures in the United States: The arrest of travellers from Europe upon entry to the U.S. without giving any reason, without allowing any contact to the outside world and without providing even the most urgent medical treatment; the blanket monitoring of law-abiding citizens and businesses in Europe using financial data (SWIFT) and telecommunications surveillance (ECHELON); the issuing of no-fly lists and the freezing of assets without court orders; the killing of Europeans by way of capital punishment; the abduction of people from Europe to extraterritorial camps where they are imprisoned for an unlimited period of time, without any court order, and subjected to torture.
Publication resulted in widespread criticism, including by trade unions (the sharing of information on trade union membership is mentioned in the agreement). The German parliament subsequently still ratified the agreement. However one chamber passed a resolution pointing out that the agreement in its present form did not satisfy fundamental rights. The state of Hamburg, represented by a green-party member minister of justice, refused to give its consent to the agreement, preventing the Federal government from bringing the Agreement into force. On 12 December 2009 the federal ministers of the interior and justice sent a letter to Attorney General Holder and DHS Secretary Napolitano that described „limitations on Germany’s ability to share information on sensitive areas (e.g. labor union membership, religious affiliation), a need to more fully define serious and terrorist crimes, as well as interpretations of some additional data protection elements“ due to the concerns raised by federal states in the Bundesrat. Germany wants to negotiate an implementation agreement to address those issues. The new federal minister of justice Leutheusser-Schnarrenberger initially refused to bring the PCSC agreement into force before the concerns have been dealt with. However, after the green-party minister of justice of Hamburg stepped down, Hamburg dropped its veto against the agreement. Thus the federal government brought  the agreement into force on 19 April 2011. An implementation agreement is currently being negotiated. No data has been exchanged under the agreement so far.
The U.S. visa waiver program
In August of 2007, Congress established new requirements for countries participating in the U.S. visa waiver program. 8USC1187 now states :
Except as provided in subsection (f) of this section, a country may not be designated as a program country unless the following requirements are met: […]
(F) Passenger information exchange
The government of the country enters into an agreement with the United States to share information regarding whether citizens and nationals of that country traveling to the United States represent a threat to the security or welfare of the United States or its citizens.
This provision applies to new candidates to the visa waiver program only. There is nothing that required countries like Germany to agree to additional information sharing. Also the provision covers information on travellers to the U.S. only. Automated or routine information exchange, or the kind of the information sought, is not mentioned. It is unlikely that Congress had the sharing of information on perpetrators of serious crime for law enforcement purposes in mind, considering that no such agreement had been concluded at the time. The biometrics matching PCSC agreements, in fact, are not at all aimed at „citizens and nationals […] traveling to the United States“. The U.S. itself said that such information is to be used for immigration purposes only exceptionally.
Yet the U.S. Department of „Homeland Security“, in consultation with other agencies, determined  that visa waiver program countries could satisfy the legal requirement on „passenger information exchange“ only by entering into the following three bilateral agreements:
- sharing lists of known and suspected terrorists according to Homeland Security Presidential Directive 6 (HSPD-6),
- sharing information on perpetrators of serious crime according to biometrics matching agreements (officially known as Preventing and Combating Serious Crime (PCSC) agreements), and:
- sharing lists of lost and stolen passports (LASP).
Countries joining the visa waiver program after the 9/11 Act entered into force are required to enter into these agreements as a condition of admission into the program. Since it is the Attorney General, in consultation with the Secretary of State, that „may designate any country as a program country“, the U.S. government can set conditions to participation that go far beyond the legal requirements.
The U.S. embassy cables reveal that as early as in July of 2008, the programmes set out above were presented to the government Estonia as a condition to Estonia joining the visa waiver program. Estonia accepted these conditions and signed the agreements required. Many other countries followed suit.
Negotiations with Austria on a PCSC biometrics matching agreement are well documented in embassy cables. Austrian officials were initially reluctant to enter into negotiations and, in 2009, asked the U.S. delegation about the following problems of the proposed agreements:
- Questions focused on the application of U.S. data protection and privacy law to non-U.S. citizens. (Even the few inadequate enforceable data protection provisions that exist in U.S. law do not apply to EU citizens.)
- The Austrian side sought assurances or evidence that U.S. law provided protection equivalent to that in Austrian law (knowing that there is no equivalent protection).
- Austria thought that citizens should have the same rights of access to law enforcement and national security data bases that they have to other databases. The Austrian side asked why the U.S. had been willing, in the Eurojust agreement to establish an individual right of EU citizens to seek corrections to their personal data, but did not propose to do so in the HSPD-6 and PCSC agreements. The U.S. side explained that the right in Eurojust to ask did not mean that changes would be made. (sic!)
- They focused on legal redress. Austrian data protection officials were sceptical of the effectiveness of data protection regimes built on anything other than explicit legal obligations. (PCSC agreements with the U.S. government and the data protection assurances contained therein are not enforceable. No European can take the U.S. government to court over non-compliance. There is not even an independent data protection commissioner to control the application of the provisions.) The Austrian Data Protection Office (DPO, part of the Federal Chancellery) outlined constitutional provisions guaranteeing all persons individual rights and access to judicial redress and an effective remedy. They (rightly) doubted that the diplomatic mechanisms provided for in the PCSC and HSPD-6 agreements would be adequate correctives.
- Austria questioned the legal basis for agency programs and policies on data protection. They pointed out that U.S. policies and programs not specifically required by law can be changed at any time.
- Because the data that would be exchanged under the HSPD-6 data comes from intelligence sources, its level of reliability is such that it could affect the rule of law, the DPO explained. Specifically, if an Austrian agency were to make a decision on the basis of information received from the U.S. that was then challenged in court, the Austrian court would not have the necessary access to the information to rule on the substance of the case. Moreover, the Schengen rules that apply to operating „discreet surveillance“ systems (i.e. tracking persons without plans for specific action) would not apply to the U.S. use of data provided by Austria. There was, the DPO representatives maintained, a big difference between the case-by-case sharing of data foreseen in the PCSC and the „en bloc“ sharing of data (even if very limited in nature) that the HSPD-6 would establish.
Austrian newspapers reported critically on the negotiations which prompted the U.S. to publicly deny that „there had been any U.S. threat to the VWP“. However, the cables reveal that in November 2009, the U.S. Ambassador did threaten that „the lack of progress could endanger Austria’s status in the VWP“. Austria subsequently entered into a biometrics matching PCSC agreement with the U.S.
In 2009 the U.S. had plans to cooperate with Spain in order to broaden their mutual PCSC agreement „into a U.S.-EU agreement“. It appears those plans have not been pursued however.
As of January 2011, the following 17 European countries have signed  unilateral biometrics matching PCSC agreements with the U.S.: Austria, the Czech Republic, Denmark, Estonia, Finland, Germany, Greece, Italy, Latvia, Lithuania, Hungary, Malta, the Netherlands, Portugal, Slovakia, Spain, and the United Kingdom. Biometrics matching is not operational in any of those countries so far though. The U.S. expects  queries of Spain’s and Germany’s criminal databases to be possible as of 2011.
Some of the countries listed above have not completed ratification. The Netherlands, for example, are reported  to have called the current PCSC text „unacceptable“. As of January 2011, 10 EU member states had resisted U.S. pressure to sign a biometrics matching PCSC agreement: Belgium, Bulgaria, Cyprus, France, Ireland, Luxembourg, Poland, Romania, Slovenia, and Sweden. France apparently complained  about the „aggressive tone“ of the U.S. side and recommended other states not to accept U.S. demands prematurely.
On a side note, a memo dated 17/10/2008 proves that there were attempts to „accommodate a confidential addendum to the HSPD-6 ratification legislation“ in Greece which the public was not to see. Apparently the Greek government promised that they had „some ideas how to overcome this problem“. How often the U.S. has negotiated „confidential addenda“ to agreements and what their content is, is unknown.
How should Europe react?
Although the DHS has not publicly confirmed this, there is ample evidence in embassy cables that the U.S. is threatening to remove countries from the visa waiver program if they do not agree to hand over personal data unrelated to travellers. In April of 2009 the U.S. told the government of Slovenia that „completing HSPD-6 and PCSC was essential to Slovenia remaining on the visa waiver program“. A Belgian memo dated 21/12/2009 notes that „HSPD-6 and the PCSC [are] required under U.S. law to remain in the program“. In negotiations with the government of Portugal, a PCSC agreement was claimed by the U.S. to be „mandated by the 9/11 Act for VWP countries“.
As it is up to the Secretary of Homeland Security to remove any country from the U.S. visa waiver program at their discretion, there is a risk that the U.S. might do so. However in practise this risk is small. The U.S. acknowledges  that, particularly in the larger VWP countries, such a step would „overwhelm consular offices and discourage travel to the United States, thereby damaging trade and tourism“. No country has ever been removed from the visa waiver program due to its refusal to share personal data with the U.S. According to the embassy cables, the U.S. routinely threatens states that are unwilling to enter into data sharing agreements but ultimately accepts the situation with no further consequence.
Inclusion in the visa waiver program does not make travelling to the U.S. much easier anyway. Instead of applying for a visa a complicated electronic application via ESTA and the paying of a fee is required which is not much of a difference.
The systematic sharing of personal data with the U.S. violates the European Convention on Human Rights (detailed legal analysis here ). Any transfer of personal data to a U.S. public authority currently entails the real risk of ensuing a violation of human rights as guaranteed in the ECHR. Firstly, the processing of that information in the U.S. violates the human rights to the protection of personal data and to effective remedy. Secondly, the United States routinely violate human rights when dealing with suspected terrorists and criminal offenders, subjecting them to torture and cruel, inhuman or degrading treatment, killing them extra-judicially or applying death penalty, depriving them of a fair trial, arresting and detaining them extra-judicially.
Europe should therefore strongly reject any sharing of personal information with the United States, especially for as long as the U.S. will not ratify in a self-executing manner the International Covenant on Civil and Political Rights including its First Optional Protocol as well as the American Convention on Human Rights.
Existing PCSC and HSPD agreements should be politically terminated and, in the meantime, legally contested for violating fundamental rights.
EU member states should agree to jointly require visa from U.S. citizens if any European country is excluded from or not included in the visa waiver program due to its refusal to share information with the U.S. It is likely that if the EU jointly rejected the U.S. demands, the U.S. would drop them. After all, the U.S. realises that excluding the EU from the visa waiver program would „overwhelm consular offices and discourage travel to the United States, thereby damaging trade and tourism“. Yet such solidarity among EU member states is not in sight at present. Many states are willing to unilaterally give in to U.S. demands. The EU Commission, too, is unwilling  to negotiate on behalf of the EU an agreement covering all conditions related to the access to the visa waiver program „in view of the present situation, where already a significant number of Member States have concluded with the U.S. agreements on terrorist screening and agreements on enhancing cooperation in preventing and combating serious crime“.
There are lessons to be learned here. Let us see who will teach them.
Update of 12 March 2012:
PCSC Agreements have been signed with 18  European VWP countries: Austria, Belgium, the Czech Republic, Denmark, Estonia, Finland, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Malta, the Netherlands, Portugal, Spain and Slovakia. In addition, the UK was deemed to have an equivalent agreement or arrangement in place to exchange information on potential criminals.