Session
Proposer's Organization: Derechos Digitales
Co-Proposer's Name: Ms. Marianne Diaz
Co-Proposer's Organization: Derechos Digitales
Co-Organizers:
Maria Paz Canales, Civil Society, Derechos Digitales Marianne Diaz, Civil Society, Derechos Digitales
Panelists:
Leandro Ucciferri (ADC) Leandro is a lawyer and researcher working at the intersection of human rights and technology, with a special focus on privacy and freedom of expression issues. He is a researcher at the Association for Civil Rights (Asociación por los Derechos Civiles)
Martin Borgioli (Hiperderecho) Martín is the Project Director at Hiperderecho in Peru; he is a lawyer from Blas Pascal University in Argentina, and he specialises in intellectual property and digital rights.
Smitha Krishna Prasad is the Project Manager at the Centre for Communication Governance at National Law University Delhi, where she specializes in civil liberties and privacy.
Kyung-Sin (“K.S.”) PARK. Professor, Korea University Law School. Co-founder of www.opennetkorea.org. Served as Commissioner at Korean Communication Standards Commission, and as Member of the National Media Commission. Founded Korea University Law Review and the Law Schools' Clinical Legal Education Center and spearheaded www.internetlawclinic.org and www.transparency.or.kr under that Center.
Olivier Alais is a social technologist, a researcher and an entrepreneur. Recently, he has been designing a micro insurance health program for Burmese refugees in Thailand with biometric identification, the open source policy in Mauritius, and the open data initiative in Liberia.
Opening. The moderator will briefly introduce the topic and the panel members. The moderator will address each of the panelist using these talking points to lead the discussion; we will devote about ten minutes to each question:
- Argentina is currently seeing one of the most pervasive uses of biometric technology through the Federal System for Biometric Identification. What do you think are the main and most urgent challenges and risks for human rights as a consequence of this policy?
- Peru is implementing more and more uses of fingerprint identification allegedly for safety reasons, but there seem to be a lack of adequate public policies in place for guaranteeing certain controls with regard to the safeguard of this personal information. Do you think it’s possible to address this issue by creating certain standards of responsibility in the management of these data?
- India is currently building the world’s largest biometric database, which is supposed to help boost the country’s digital economy and help include people who’ve been long excluded from education, health and social services systems. However its validity as a mandatory system is contended and some think it might violate basic human rights. Do you think the trade-off justifies this use of biometric technology?
- In Kenya, biometric identification is being used in many critical areas, most recently in voting technology. In other countries, like Venezuela, this has had implications for political and societal control. Is this a challenge in Kenya? Do you think the use of biometric technology could alter the way people conduct themselves in society?
- Paycasso has been providing biometric identification through facial recognition, and while you have worked to make your system extremely secure, you have also sustained that biometrics is not a panacea on its own, but there needs to be mechanism to prevent misuses of personal information. Which guidelines or measures do you think could companies or governments take to help prevent the issues that our other panelists have addressed?
Question-and-answer: we will take questions from the audience, and we will turn to our panelist for their closing remarks.
Report
Moderator: Argentina is currently seeing one of the most pervasive uses of biometric technology through the Federal System for Biometric Identification. What do you think are the main and most urgent challenges and risks for human rights as a consequence of this policy?
Leandro Ucciferri: Explanation of Federal system of biometric identification in Argentina. The access to information by different governmental bodies does not require warrant. In general, the system has been used to investigate small crimes, without transparency on under which criteria the information is accessed.
This pose a threats in the innocence presumption, it turns it around.
Beside all this, only en 2017 some concerns has been raised. Additional measures were taken where in the neighborhood where the WTO meeting occurred. The neighbors were mandatory enrolled with facial recognition. There was no transparency at all in the collection and use of this information.
In the same line, during the elections in October, the electoral court implemented a pilot program for collecting fingerprints of voters.
In the last 5 years there has been a naturalization of use of biometrics, any device produced in this time introduces some biometric functionality. People are no thinking
in how this affects them and how this interferes with the exercise of their rights.
Another concern is how the biometrics can be use as criminal evidence, because the information is spread without control and biometric cannot be replaced. This is relevant if we think in terms of massive use and collection of biometric.
Discrimination research in algorithm needs to be careful in the accuracy of the information.
Implementation of biometric collection in public space is problematic, because through pictures that someone else can take we don’t have control of it.
Moderator: Peru is implementing more and more uses of fingerprint identification allegedly for safety reasons, but there seem to be a lack of adequate public policies in place for guaranteeing certain controls with regard to the safeguard of this personal information. Do you think it’s possible to address this issue by creating certain standards of responsibility in the management of these data?
Martin Borgioli: Biometric data collection has been implemented in Peru for public safety purpose.
The legal framework is not respectful of rights. There was administratively implemented (not by law) and never has been subject to judicial control.
Peru has biometric verification since 20 years ago. Since the ‘90 to identify in ID cards. In 2006 RENAC (government agency on charge of the biometric register) acquired software to avoid duplication of identity. In 2013 began to collect facial features also. These measure were taken to improve commercial transaction security but without transparency. Today several private actors require biometric verification. Since this year mobile providers require biometric registration for SIM card. These providers are forced to provide metadata to police without judicial order.
Immigration control also requires biometric data to identify travelers.
Biometric is also used as an alternative measure to prison, where people are mandate to register their fingerprints once a month.
Moderator: India is currently building the world’s largest biometric database, which is supposed to help boost the country’s digital economy and help include people who’ve been long excluded from education, health and social services systems. However its validity as a mandatory system is contended and some think it might violate basic human rights. Do you think the trade-off justifies this use of biometric technology?
Smitha Krishna Prasad: Analysis has two levels: First, rights should not be traded for any cause. In India the system has been promoted for helping people. Second, there are privacy concerns when it comes to the use of biometrics.
In India, the initial idea to use biometric was proposed in 2009, but didn’t pass control of the parliament.
The law only came in 2016 when the Adhar system was already administratively implemented, and it was challenged in the court. Since 2013, the Supreme Court has issue orders to avoid the mandatory use of this Adhar number until decide its validity, preventing it can be mandatory required to link bank information, SIM cards
registration, welfare providing to children, etc.
There is a central database with all this information that is not clear that is secure enough.
There is a law that make illegal to publish Adhar number, but there are several cases of leak, people need to be educated about it.
In 2016 the only leaks prosecuted were the people that report leaks from authority.
In past October, the press covers the case of a girl that died of starvation because she was not in the register, so she didn’t receive welfare food.
There is another problem with villagers who the machines are not able to read their fingerprints.
However, in last October, many ecommerce companies started to require Adhar number for tracking packages, even it is a private company and they don’t have authority to require this as mandatory.
Moderator: In some societies, the use of biometric technologies by private actors is already pervasive and employs fingerprint identification, but vein patterns, facial recognition and many other patterns. Does this entail different concerns than the use of biometrics by States? Is the current data protection framework enough to regulate the use of biometric data by private actors?
K.S. Park: Korea has implemented an ID system for every born. The residence registration is a key data that accompany the person during her whole life. If any criminal has access to the number, then they can access to any aspect of the individual. Korea is hit with periodic massive data breaches.
The result of this is the lost of agency of people, the system is not reliable enough.
The data has two relevant factors for privacy: identifiability and confidentiality. The more identifiable the information, the more privacy implications. There is a need to think more in this than in confidentiality.
Responding to other panelist comments and complementing what has been said, it is necessary to unmask a person through a warrant requirement. The government thinks they are accessing public information, but it is not and it should be required a judicial authorization. It is not only about confidentiality, but rather to control the identity. There is an analogy to unmasking a person and it should be subject to a request. There is a need to take steps in that direction.
Moderator: Most of the initiatives regarding biometric identification systems portray them as an opportunity for the achievement of social and economic rights, such as health and public aid systems. What technological measures can be taken in order to take advantage of the possibilities of biometric technologies while protecting other human rights that are in tension with its current applications?
Olivier Alais: I have personal experience building a health system in Thailand for immigrants coming from Myanmmar, without ID because they are illegal in the majority of cases.
They don’t have access to healthcare when they arrive in Thailand, so some private
clinics tried to help them providing a micro insurance system.
They try different systems and there were not working because they were not able to bring technology to rural areas. They have a design a very light solution, because there is no devices or technical skills available. Finally, they realize that just a card with a picture and a code was the most efficient system, giving up the idea of using more sophisticated biometrics.
The other problem is the building of the database and where the data of all this information of illegal immigrants is storaged. The data has being encrypted, but there is not a real complete solution.
COMMENTS AND QUESTION FROM PARTICIPANTS
Question from the public on good practices in use of surveillance cameras in public space.
KS: we are born anonymous. Even if you see a face you cannot determine identity.
There is no a question about if it is not possible to use, the police can do it. But, with a warrant an when there is criminal investigation involved.
Leandro: I disagree with KS and consider that there is a need to challenge the use of the system in general. The only thing this technology does is to move the hot spots of crimes in the city.
This is used as political propaganda. We need to challenge the propaganda, if there is no prove of the affectivity we should push it publically trough FOIA. With this is possible to change voters’ perspectives.
Martin: Adding to Leandro’s point there is a need to educate people and ask government for the information. The government should inform for what the information is used.
Biometric is a solution looking for a problem. There is a huge risk in the leaking of the database. The risk to loose the data is so huge because the data cannot be changed; the damage is permanent. It is a human right violation.
There is a study that shows the correlation between democratic systems and biometric use. That seems to point out that this is a bigger problem than just education. It is something that needs to be addressed as part of the democratic requirement of government.
In Colombia there is a system with all the information of citizens that cover all the information of the state for each citizen. Can you provide good practices recommendations to address this?
Martin: In many countries there are limitations on use of data protection law against government. So, that poses some limitations in their accountability.
The recommendations can be summarized as the need to require more security obligations in the holding of data and transparency in the use of biometric databases by governments.
Leandro: there is a need to make distinction of sensitive data from other data in the regulations, because the risks are even greater in the later.
Moderator: as closing remarks, how society has reacted to the implementation of biometric systems that are being framed as solutions for social and economic exclusion, do they have embraced or rejected them?
Smitha Krishna Prasad: Today, people in India have increased awareness about the consequences of Adhar because of the leaks. This has started to affect middle class an upper class now. There is not even data protection law in India, so far (hopefully soon). The government considers this system futuristic, so it doesn’t understand the criticism.
Another final relevant point that should take our attention is that there are the same companies providing these same services in different countries, so they are making a lot of money out of biometric system implementation.
Martin: There is an urgent need to educate people about the consequences of use of these biometric systems.
Leandro: There is a need to have more information about why information is collected and how is being used by government. Narrative is pretty strong in keeping people safe and there is a need to over come it pointing out the risks.
Olivier: Accountability of governments is necessary for the use of information.
KS: Recently, SIM card registration was implemented in Korea. This point out to the fact the use of biometric is increasing in different fields, which is problematic by itself and it doesn’t seem to go away.