French Constitutional Court Bans Law Enforcement Use of National Biometric ID DatabaseKatitza Rodriguez Maira Sutton The proposed legislation mandated compulsory civilian ID cards containing a chip designed to store personal and biometric information, including home address, marital status, eye colour, and fingerprints. Proponents argued that the biometric ID card would be used to stop honest folk from becoming the victims of identity fraud. In fact, the law would have enabled the honest folk database to be used for criminal and judicial purposes. The Conseil correctly determined that such uses constituted a serious incursion into the right to private life, disproportionate to the laws stated objective. Another provision in the law would have allowed for a second, optional chip to be used for online authentication in e-commerce transactions. The Conseil determined that such use would require too broad a range of personal data to be collected without any guarantees of security and confidentiality. Furthermore, it condemned the laws vague conditions for authenticating individuals, especially minors. EFF welcomes the Conseils decision to strike out substantial parts of the legislation to protect privacy. Nevertheless, the Conseil should explain their unmotivated reasoning behind leaving significant anti-privacy portions of the law intact, namely biometric data collection for the purpose of preventing ID fraud. In its decision, the Conseil emphasized that they are not ruling either for or against biometrics [PDF, in French] (p.21): This decision of the Councils should not be interpreted as being either in favour of biometrics or against it. Nor is the Council expressing any opinion either in favour of a register of biometric data or against it. What the Council is saying is that the safeguards involved in the creation and deployment of this register are inadequate. In the circumstances, the Council is not in a position to over-ride the wishes of the legislature. The Conseils ambivalent statement is politically understandable. Regulators tend to romanticize the security and accuracy of biometric systems. In fact, there is a lack of evidence to demonstrate the reliability and proportionality of this new technology. Jean Marc Manach, a blogger and journalist from Owni.fr, argues that biometrics has proven inaccurate and therefore ineffective in fighting identity fraud or anything else. As long ago as August 2009, The Register magazine suggested that our trust in biometric technology is a delusion. Last year, a French report revealed that 10% of biometric passports were fraudulently obtained [French]. The introduction of biometrics is exacerbating the problem of identity fraud instead of solving it. The French government already has several powerful surveillance technologies available to track peoples movements, including mobile phone logs, web usage logs and credit card usage logs. They must provide evidence first that they can use this technology to enhance security before spending taxpayer money on another National ID biometric scheme. French smart card and biometrics companies have lobbied heavily for the honest folks law. Their trade association, GIXEL (Professional Association of Industry and Electronic Components) gained notoriety in 2004 when they won the infamous French Big Brother award, for their systematic attacks on the right to privacy. Ironically, GIXEL got the award for their proposal to educate children under 6 years old and their parents about the need for biometric security. The proposed collection of this vast amount of biometric information gives governments too much unchecked power and opens the door for government abuse. In their referral to the Conseil, French parliamentarians quoted Martin Niemllers chilling poem First they came. They argued that had this kind of database existed during WWII, the Nazis and collaborators in Vichy France could have more easily arrested French Rsistance fighters based on their fingerprints or facial scans. EFF, as one of 80 civil liberties organizations, has requested the Council of Europe in 2011 to investigate if National ID biometrics laws in Europe comply with the Council of Europe Privacy Treaty and the European Convention on Human Rights. In light of the long list of privacy concerns surrounding biometrics, and the guarantee of future security breaches, biometric national ID laws cannot be justified. As more nations continue to adopt and implement biometric ID laws, now is the time for the Council of Europe to comply with its duty to seriously confront all of these issues. Under our watch, we refuse to let states collect massive amounts of biometric data without regard to our privacy rights. Please visit Electronic Frontier Foundation to support Internet freedom and privacy. linkwithin_text=Related Articles: 