Despite a long period of austerity, there is serious investment in technology-led policing and border management in Greece. Hellenic police and border authorities are experimenting with and implementing facial recognition and other problematic biometric processing technologies, often at the expense of already marginalized groups, and have made widely unregulated use of drones. The challenges for fundamental human rights are substantial and manifold.
The Hellenic Police are significantly expanding their technological capabilities, including deploying facial recognition and biometric processing technologies. New legislation has also enabled the use of drones for policing and border management, areas which have further received a considerable amount of research investment. This significant increase in funds used for technology-led policing and border management over the last years comes despite a long period of intense austerity, which was prompted by the financial crisis beginning in 2009 and which led to a substantial reduction in public spending.
However, the development and use of such technologies could lead to a massive increase in the capabilities for omnipresent state surveillance and catalyse human rights abuse. Thus, the objective of this article is to briefly describe such developments and to critically reflect on their deployment. The first part of the article focuses on the use of facial recognition and automated fingerprint identification in police stops; the second part deals with the new Greek regulations on drones and the use of drones during the Covid-19 pandemic by the Hellenic Police; meanwhile, the third and last part describes research projects in the field of smart policing and border management deployed in Greece.
Facial recognition and automated fingerprint identification in police stops
In the spring of 2019, the Hellenic Police signed a 4 million Euros contract with Intracom Telecom, a global telecommunication systems and solutions vendor, for a smart policing project. Based on the Hellenic Police’s press release, 75% of the project is funded by the Internal Security Fund (ISF) 2014-2020 of the European Commission.
According to the technical specifications of the contract, within 20 months of the signature date, the vendor will develop and deliver to the Hellenic Police smart devices with integrated software enabling facial recognition and automated fingerprint identification, among other functionalities. The devices will be the size of a smartphone, and police officers will be able to use them during police stops and patrols in order to take a close-up photograph of an individual’s face and collect her/his fingerprints. Then, the fingerprints and the photographs collected will immediately be compared with data already stored in central databases for identification purposes.
The Hellenic Police claims that this will be a more “efficient” way to identify individuals, especially third country nationals overstaying in Greece, in comparison to the current procedure, i.e. bringing any individuals who do not carry identification documents to the nearest police station. It should be noted that — based on reports published by Human Rights Watch and Amnesty International — it is a usual practice of the Hellenic Police to conduct massive police stops and identity checks in order to verify the legal status of individuals presumed to be irregular migrants. Thus, it seems likely that the development and deployment of the aforementioned smart policing tools could especially impact migrant communities in urban centers, such as Athens.
In March 2019, my colleagues and I at Homo Digitalis, a Greek digital rights organisation and member of the EDRi network, filed a request for opinion to the Hellenic Data Protection Authority (HDPA) regarding this smart policing contract. The request was based on the national provisions implementing article 47 of the Directive 2016/680 (the Law Enforcement Directive – LED), which provides for the investigatory, corrective, and advisory powers of the HDPA. Homo Digitalis claims that the processing of biometric data, such as the data described in the contract, is allowed only when three criteria are met:
- It is authorised by Union or Member State law;
- it is strictly necessary;
- and it is subject to appropriate safeguards for the rights and freedoms of the individuals concerned.
None of the above-mentioned criteria are applicable in this case. Specifically, there exist no special legal provisions allowing for the collection of such biometric data during police stops by the Hellenic Police. Moreover, the use of these devices cannot be justified as strictly necessary, since the identification of an individual is adequately achieved by the current procedure used. Nevertheless, such processing activities are using new technologies and are very likely to result in a high risk to the rights and freedoms of the data subjects. Therefore, the Hellenic Police is obliged to carry out, prior to the processing, a data protection impact assessment and to consult the HDPA on this matter, according to articles 27-28 LED.
Finally, it is worth remembering that in February 2020, news reports from BuzzFeedNews and Euractiv mentioned Hellenic law enforcement authorities as potential partners of the US facial recognition technology firm Clearview AI. This firm became notorious in early 2020 for illegally harvesting images across the web and selling their facial recognition processing to police in democracies and dictatorships alike as well as in the context of a range of dubious private partnerships, and wherever else money could be made. Homo Digitalis filed an official query with the Hellenic Ministry of Citizen Protection asking for more information about such potential collaborations. In April 2020, the Hellenic Police replied to this query and officially denied collaboration with Clearview AI.
The new rules on drones and their use during the Covid-19 pandemic
In October 2019, new legal rules were adopted as regards to the deployment of drones by the Hellenic Police. More precisely, the Presidential Decree 98/2019 provides, amongst other things, that the Hellenic Police is allowed to use drones in policing and border management activities. Before the adoption of these new provisions, the Hellenic Police could only deploy drones for monitoring forests and observing traffic in motorways.
Undoubtedly, if drones are to be deployed in operations related to policing and border management activities, images and video footage of people will be captured. Thus, the applicable European data protection legal provisions shall be in force when personal data are processed and stored or are intended to be stored. However, the Presidential Decree 98/2019 does not provide any details regarding data processing activities related to the use of drones.
In addition to this, in April 2020, the Hellenic Deputy Minister of Citizen Protection, Mr. Eleftherios Oikonomou, stated that the Hellenic Police deployed drones during the Easter holidays in order to ensure compliance with the movement restriction measures related to Covid-19. Prominent news media also reported the use of drones in urban areas, such as Athens and Thessaloniki, to monitor population movement.
In a recently published report, Homo Digitalis claimed that the new rules on drones do not address the challenges arising from the applicable data protection legislation. More precisely, Presidential Decree 98/2019 includes only one(!) paragraph on the subject, which refers to the use of drones in a vague and unclear manner. The provisions allow for an indiscriminate and blanket use of drones for any kind of policing and border management activities, without specifying, for example, that drones must only be used to fight serious crime subject to prior judicial authorisation in a policing setting or for search and rescue operations in a border management setting. Thus, under the existing rules, drones could be used even in operations related to petty theft crimes without any prior authorisation, thereby increasing state surveillance in public spaces and creating serious interference with human rights, such as privacy, data protection, freedom of expression, and freedom of assembly.
Moreover, Presidential Decree 98/2019 does not provide any safeguards or specific control mechanisms protecting against the abusive use of drones by the Hellenic Police, nor does it include any details about the related data processing activities (retention period of the data collected, information to be made available to the data subjects, records of processing activities, logging, designation of a data protection officer, etc.).
Lastly, based on articles 27-28 of the LED and articles 65 & 67 of the Greek Law 4624/2019, the Hellenic Police, prior to its involvement in processing activities that use new technologies (such as drones), shall 1) consult the HDPA, and 2) carry out an impact assessment of the envisaged processing on the protection of personal data. The Presidential Decree, however, does not make any clear reference to such obligations.
For all the reasons mentioned above, in April 2020, Homo Digitalis filed an official query with the Ministry of Citizen Protection requesting more information about the deployment of drones by the Hellenic Police and notified the HDPA. It is important to recall that in a recent similar case, the French digital rights organisation La Quadrature du Net achieved a first victory against French police drones when the Conseil d’État issued a decision against surveillance drones deployed by the Parisian police during the Covid-19 lockdown.
We also need to closely monitor any future cases in which drones are commissioned for policing and border management purposes. Recent developments indicate that there is likely to be serious commotion around the issue in the coming months and years. For instance, news media reported in late May 2020 that drones are soon to be deployed in the Evros border with Turkey. Moreover, in June 2020 the Hellenic Police announced a public procurement contract of 136.000 Euros for the acquisition of two drones in the context of a project called HEFESTOS (Hellenic anti-Fraud Equipment and relevant trainings for Strengthening the Operability against Smuggling), while just a few days ago the Western Greece Region concluded a contract with the Hellenic Police in order to acquire drones for policing activities within the framework of the project INTERREG 2014-2020. We need to be on our guard to ensure that implementing all these programs will not result in the violation of national and international human rights and data protection law.
Research projects in the field of smart policing and border management
Many research projects in the field of smart policing and border management are funded by the European Commission under the Horizon 2020 scheme “Secure societies – Protecting freedom and security of Europe and its citizens”. While it is true that research projects lie at the heart of innovation and make a critical contribution to the development of Europe’s societies and cultures, a number of Horizon 2020 research projects deployed in Greece raise important challenges for the future of our societies and the protection of human rights.
As described in the latest report of EDRi, “Ban Biometric Mass Surveillance”, the EU Horizon 2020-funded SPIRIT project reinforces the lack of fundamental rights compliance, transparency, and accountability. Five law enforcement-related stakeholders participate in this research project: the Hellenic Police (GR), West Midlands Police (UK), Police and Crime Commissioner for Thames Valley (UK), Serbian Ministry of Interior (RS), and Police Academy in Szczytno (PL). The information available on the project’s website is very limited, even though the project has been up and running since August 2018. Nevertheless, it is evident from the website’s content that the project aims to use tools such as face extraction and matching to correlate information from social media data, which constitutes a form of mass surveillance. According to a successful access to information request filed by Homo Digitalis, the Hellenic Police (Border Unit) is currently involved in trials, which run between January and August 2020.
In the field of border management, another research project that has attracted attention over the past years is iBorderCtrl, which came to an end in August 2019. The project claimed to enable faster and more thorough border control for third country nationals crossing the land borders of EU Member States. It included software and hardware technologies ranging from portable readers and scanners related to: biometric verification, automated deception detection, document authentication, and risk assessment. Pilot trials of the project were implemented on the Hungarian, Greek, and Latvian borders. Based on a successful access to information request filed by Homo Digitalis, no real travellers participated in the Greek pilot runs; rather, the role of travellers was played by border guards, Hellenic Police officers, and staff of government security think tank KEMEA. As EDRi notes, the technologies developed in this project — in particular the automated deception detection — could be considered part of a state mass surveillance apparatus because they rely on technologies of watching, with an unequal power dynamic and a use that is generally targeted against marginalised individuals.
Lastly, another interesting research project in the field of border management is the Horizon 2020 project ROBORDER. The aim of ROBORDER is to deliver “a fully-functional, autonomous border surveillance system composed of unmanned mobile robots including aerial, water surface, underwater and ground vehicles”. The Hellenic Ministry of Defense is one of the Greek stakeholders involved in this research project. One could argue that the expertise and technical knowledge acquired by ROBORDER will in turn feed into the development and deployment of similar tools by the Hellenic Army in the near future. It is notable that the Hellenic Army has already leased the naval drones surveillance system “Heron” from the Israeli Ministry of Defense for a period of three years. Heron is equipped with day and night activity platforms, maritime patrol radars, and satellite communications, and will be used in border management activities.
Conclusion
The use of facial recognition, biometric identification technologies, and drones by law enforcement authorities in Greece is in fundamental conflict with the essence of human dignity and the protection of fundamental rights and freedoms in public spaces, such as the rights to privacy, data protection, freedom of expression, and freedom of assembly. The risk of increased authoritarian societal control outweighs any alleged “benefits” that the use of these technologies promise. As EDRi rightly states: “The use of biometric surveillance systems creates a dynamic where the powerful watch and the powerless are watched.”