Expats, asylum seekers and foreign students in biometric police database
Police uses residence permit photos for facial recognition of suspects
In 2016, the Dutch police started using the CATCH facial recognition system to identify suspects. The system allows the police to compare images of suspects (from surveillance cameras, for instance) with a criminal justice database, containing photos of 1.2 million convicted and suspected persons. But, as broadcaster RTL Nieuws recently reported, the police also have access to a database containing facial photos of at least 6.5 million people who are registered in the foreigners' registry. "The police are stigmatising innocent foreign nationals, such as expats, asylum seekers and students from outside Europe. They are treated a priori the same as suspects. This constitutes discrimination," says Evelien Brouwer, who is an expert in the field of Public Law, Migration and Technology at Utrecht University.
This second database, which goes by the name CATCH Immigration Law (next to CATCH Criminal Law), contains 8 million facial photos of around 6.5 million people who applied for a residency permit, such as expats, asylum seekers and foreign students from outside the European Union. The fact of its existence and use was not unknown, and earlier received some attention in the media (for example in NRC, on 16 December 2016). RTL Nieuws now raises the issue whether this use of immigration records should be allowed, and specifically whether this form of biometric data use is a legal – according to Dutch and European law – and proportional. Triggered by the news item, members of Parliament asked the Minister of Justice and Security questions about the matter.
At RTL Nieuws, Evelien Brouwer expresses her concern that legal rules on the use of fingerprints of foreigners by the police are now being applied to the use of passport photographs. "The objection is that there is no specific legal basis for police use of facial images as registered in the foreigners' registry, and by that I mean specific, clear legislation regulating what the police may do. And also, an unjustified distinction is made on the basis of nationality between Dutch nationals and foreigners. It is therefore unlawful and discriminatory."
In its defence, the ministry argues that the police operates very cautiously, using the database only with the permission of the examining magistrate (the police informed RTL Nieuws that this happened twice in 2022). Also, it stresses that this use of biometric data is allowed according to the Dutch Foreign Nationals Act. But Brouwer is not convinced. "The ministry's response proves precisely that the legal regulation is very unclear. It shows that they are applying the legal basis for fingerprints to facial images. That is unlawful. It is also disproportional. The country would be in an outrage if it turned out that the police are storing the facial photographs of all Dutch citizens".
Brouwer describes this specific use of the foreigners' database as worrying: "Also because the Dutch Data Protection Authority (DPA) has previously indicated that it lacks a specific legal basis and is unlawful." In 2020 the DPA advised on the collection and registration of biometric data of aliens, and stated that the current practice does not sufficiently protect the privacy of foreigners. "In addition, there is also case law from the Court of Justice of the European Union that sets very strict criteria for the use of this kind of sensitive data." Brouwer is referring to a judgement of 21 June 2022, and also to a still recent judgement of 26 january 2023 (see box below). "For example, in this latest ruling, the Court found that the processing of biometric data by the police is only allowed when the law provides a sufficiently clear and precise legal basis for doing so. Moreover, the processing must be strictly necessary and accompanied by appropriate safeguards", she clarifies.
In its advice, the DPA questioned the necessity and proportionality of the practice, found there is a risk of processing biometric data without a proper legal ground, and also that biometric data may remain stored unnecessarily long. Regarding facial images, it concluded: "There is a lack of clarity about the conditions for using facial images in the aliens records for the investigation and prosecution of criminal offences. This is because there is no specific regulation for facial images in the Aliens' Biometrics Act (Wet Biometrie vreemdelingenketen), as there is for fingerprints."
Parliamentary questions – More about CATCH
MPs, who were alerted to the existence of the database by the news item, asked questions about it in the House of Representatives to Justice and Security Minister Dilan Yeşilgöz-Zegerius: Isn't it discriminatory that basically innocent people are included in a police system just because they come from abroad? According to reports, two crimes have been solved with this so far. Isn't it disproportionate then? Is it not breaking the law?
In her reply, the minister cited the Aliens Act Section 107(5)(c) as the legal basis for providing the facial images to the police. She further refers to the above mentioned Court of Justice of the EU's ruling on police recording of biometric and genetic data. What this ruling may mean for CATCH Immigration Law still needs to be further investigated, the minister says, and then there will be a further response in the form of a letter to the House. Given the intertwining of immigration law and the criminal justice chain in this matter, she points to a possible role here for the State Secretary for Asylum and Migration, Eric van der Burg.
_____________
Following an appeal on the Open Government Act, the police published data about CATCH Criminal Law and CATCH Immigration Law: Cijfers CATCH van politie.nl (in Dutch)
The NRC article on facial recognition with CATCH (dated 16 December 2016) states, among other things, that the police may also search the 'aliens database' with photos of asylum seekers and illegal immigrants, after agreement from the investigating judge. It also says that images from the aliens' database must be removed no more than five years after someone receives a residence permit, for example.
Evelien Brouwer is lecturer Public Law, Migration and Technology at the Utrecht Universit. Her areas of expertise include human rights and technologies and EU asylum and migration law, and she studies the effect of technologies – such as the use of large-scale data systems, AI and biometrics – on the right to effective legal protection, non-discrimination, privacy, and data protection.
At Utrecht University, several interdisciplinary research groups are active at the intersection of legal protection, technology and migration, such as Governing the Digital Society and Migration and Societal Change.