In almost all of the lawsuits that are pending against the new Dutch Passport Act, there is one important subject that has so far been little exposed: the use of sensitive personal data by secret services. In this case it’s about biometrics: digital facial scans and fingerprints that end up in all sorts of databases through people's passports and ID cards. At the moment those databases are still only in the hands of municipalities and the passport manufacturer in Haarlem (Morpho, previously called Sagem), in the future they will undoubtedly end up elsewhere too, eventually worldwide. In that sense every Dutchman is a potential globetrotter: in the long term your fingerprints and facial scan may be available even in the farthest corners of the world. Not only in the databases of ‘allies’, but also in the databases of countries with which those ‘allies’ have in turn concluded (possibly secret) exchange agreements. And this is all but transparent. Neither is it publicly known what secret services are willing to use our biometrics for. A Privacy First employee who was eager to examine this for the Dutch Scientific Council for Government Policy (Wetenschappelijke Raad voor het Regeringsbeleid, WRR) soon encountered a wall of research restrictions. So for the time being all we can do is guess... Possible intelligence purposes of biometrics are: 1) identification of suspects unwilling to talk and ‘interesting’ persons in public space, 2) recognition of emotions and lie detection, 3) the use or recognition of doubles, 4) espionage, etc. The first purpose (identification) is being facilitated by the Radio-frequency identification (RFID)-aspect of the biometric chip in your passport or ID card. It’s precisely because of this that the chip can be read from a distance.
Back to the main subject: the use of sensitive personal data by secret services. Today this is as easy as pie: many people unashamedly put half of their private lives on the internet, for instance on Facebook. And if the information can’t be found on the internet, it can be traced in databases of companies and the government. In the way you in your student days perhaps once turned on the TV with a pool cue without leaving your lazy armchair, secret services can nowadays conjure up your whole life including your fingerprints merely at the press of a button. But is this actually allowed? And in this respect, does it make any difference if your fingerprints are stored are stored 1) by the municipality, 2) in a central database or 3) by a passport manufacturer? ‘‘Yes, that’s allowed’’ and ‘‘no, it doesn’t matter where they’re stored’’, the Dutch State consistently implied until mid-2011 through the State attorney:
‘‘Fingerprints will also have to be supplied to the General Intelligence and Security Service (Algemene Inlichtingen- en Veiligheidsdienst, AIVD) and the Military Intelligence and Security Service (Militaire Inlichtingen- en Veiligheidsdienst, MIVD). The provision of information to these services is regulated in Article 17 of the Intelligence and Security Services Act (Wet op de Inlichtingen- en Veiligheidsdiensten, WIVD). This already applied prior to the coming into force of parts of the modified Passport Act and it will be no different now that it’s been modified. The mention in Article 4b, paragraph 2(d) Passport Act (‘state security’) was merely motivated by transparency reasons.’’
(Source: Statement of Defence in the Passport lawsuit by Privacy First dated 28 July 2010, para. 2.17; repeated word for word in, among other things, the statements of defence of the State in the Passport lawsuits by Van Luijk dated 29 October 2010 & 10 June 2011 (paras. 3.17 & 5.8 respectively) and Deutekom dated 23 November 2010, para. 4.17.)
So there the State claims that basically nothing would change with the introduction of the Passport Act since the AIVD would already have had the opportunity to make a request for your fingerprints. Meanwhile however, the development of a central biometric database has been put on hold which means your fingerprints are stored ‘only’ relatively shortly by the municipality and the manufacturer. From a legal point of view this is what the discussion now revolves around. For instance on 27 October 2011 before a single judge at the district court of Amsterdam:
Judge: ‘‘Yes, I just wondered, madam [State attorney], you’re saying that Mr’s fear that intelligence and security agencies have access to his personal data - his fingerprints and facial scan -, is taken actually away by Article 65 [Passport Act].’’
State attorney: ‘‘Article 65 only applies to fingerprints.’’
Judge: ‘‘Mr [X] has pointed at Articles 17 to 34 of the Intelligence and Security Services Act. How do you see that?’’
State attorney: ‘‘I can very briefly say something about how you should see this in relation to each other. (...) The point is, quite a few things have of course been said about this in the legal history of this case. So when does the possibility of access arise: once you have a central administration with a biometric search function. There are all sorts of regulations but it’s not as if the AIVD could come up with a fingerprint and say to the municipality ‘show us who this fingerprint belongs to’. But that possibility, it isn’t there. There is simply no biometric search function. In that area the only possibility of what municipalities can do in providing fingerprints, is making a print of it, which comes down to: a sheet of paper with dots. That is the rendering on paper of those fingerprints. Provided the AIVD has complied to the regulations under which they can make a request for information on the basis of the WIVD, it could provide a name to the municipality where the person concerned is registered and could then make a request for personal data. For as far as such a request would concern fingerprints, it wouldn’t thus be any more than a printed page with those dots. So it can never happen, and this is the important point, that the AIVD would come up with fingerprints and say: ‘who are these fingerprints from?’’’
Attorney: ‘‘This is not what my client fears. My clients fears that the AIVD says: ‘we want to see the fingerprints of Mr [X]’.’’
State attorney: ‘‘If the AIVD would like to have the fingerprints of Mr [X], then it wouldn’t need the travel documents registration. They’re on these items over here, so to speak, on this cup...’’
Attorney: ‘‘Well I don’t see anyone of the AIVD taking fingerprints of my client, and it’s not just about him, it’s about him saying: ‘I find it to be in conflict with my conscience to cooperate because in that way the fingerprints of all Dutch citizens could be requested for by the AIVD.’ Not just his, but everyone’s.’’
Judge: ‘‘With the legislation that is in place now, would it be practically possible for the AIVD to step up to the municipality of Amsterdam and say: ‘we would like to have the fingerprints of Mr [X]?’’’
State attorney: ‘‘Eeehm, well [inaudible], Article 65 second paragraph [Passport Act] dictates that fingerprints may only be requested for the application and issuance of a passport. As far as the AIVD would be allowed to make a request for those data on the basis of its own legislation, they wouldn’t be able to obtain anything more than those printed dots because the municipality can’t offer anything different than that.’’
Interruption from the audience: ‘‘They can through [passport manufacturer] Morpho.’’
Judge: ‘‘You are not a party in this lawsuit. I have to ask you not to take part in the litigation.’’
So merely a ‘print with dots’, according to the State attorney. Demanding fingerprints at the passport manufacturer unfortunately was not discussed during the court session. Subsequently the case was redirected within the district court of Amsterdam to a court session with three judges. On 25 January 2012 this point of discussion was again briefly discussed:
Judge 3: ‘‘And what if the information is in the hands of the manufacturer?’’
State attorney: ‘‘Eeeeeeeehm... On what basis would the manufacturer be allowed to provide those data?’’
Judge 3: ‘‘That’s what I’m asking you.’’
To this question no clear answer was given by the State attorney, just a vague reference to Article 65, paragraph 2 of the Passport Act. Then a painful silence followed... and the judges didn’t ask any further questions.
Judge 3: ‘‘And Mr [attorney of X], what’s your take on this point?’’
Attorney: ‘‘I have a different view! [laughter from the audience]
The attorney of X subsequently extensively refers to the relevant legal history of the Passport Act and the provisions of the WIVD 2002.
State attorney: ‘‘Even if the AIVD would be able to make a request for fingerprints on the basis of Article 17 WIVD, then they would never get anything more than a printed page with those dots. (...) They would get a printed page with the fingerprints, which is a printed page with dots.’’ A little later, after having been verbally informed by a civil servant of the Dutch Ministry of the Interior: ‘‘I’ve said something wrong. I said you get a printed page with dots, but now I understand you get a printed page with an image.’’
Hence, after a dozen court sessions about the Dutch Passport Act, the official clarification by the Dutch State on the use of fingerprints by secret services goes as follows: ‘‘a print with an image, from the municipality’’. The question thus remains whether digital requests can also be made to 1) the municipality and 2) the passport manufacturer, and if so, what exactly happens with it. The same goes for facial scans. The upcoming court session in the Passport Act saga will be on Monday, 2 April 2012 (11.00 am) at the Dutch Council of State (Raad van State). It will then be up the Council to clarify this case after all and invite expert witnesses in case necessary.
Update 10 February 2012: As a result of the above article, written questions have been asked by Member of European Parliament Sophie in ‘t Veld to both passport manufacturer Morpho as well as to the European Commission. At the same time Member of the Dutch House of Representatives Gerard Schouw has asked similar Parliamentary questions to the Dutch Minister of the Interior Liesbeth Spies.