The Gist: Face/Off

Yesterday we learned that the Irish Government had been contacted by four (4) United Nations Special Rapporteurs. These are people appointed for their expertise, to speak for rights, freedoms and people under threat around the world.

The Irish Government’s plans to pass a law to allow Gardaí to run facial recognition on the public through CCTV cameras had managed to upset four of them at once.

So UNhappy

The UN's experts especially didn’t like the “proposed use of FRT [Facial Recognition Technology] by law enforcement for ‘real time’ analysis of footage of large numbers of persons to identify them, then possibly track and apprehend them, raises significant human rights concerns, particularly with regards to the exercise of the right to freedom of peaceful assembly.”

because

“these forms of identification and data collection violate the individual’s anonymity in public spaces and exert significant “chilling effects” on decisions to participate in public gatherings...FRT represents a clear interference with individuals’ rights to privacy.”

And, finally;

“we recommend that your Excellency’s Government not pursue the proposal to authorize the use of FRT in law enforcement via amendments to the Bill at the committee stage.”

The Government, in a letter signed by Simon Coveney, sniffly replied. He pointed out that, although the EU are, right now, debating a piece of superior legislation which will supersede any national notions Ireland has about the proper use of AI, that UN Special Rapporteurs weren’t the Boss of them.

The Governement could pass completely off-the-wall bonkers legislation about things the Civil Service only dimly understood if they wanted to. Why should they wait for a thought-out, international norm that is already in front of the EU Parliament?

“as a sovereign Member State of the European Union, Ireland is fully entitled to introduce its own legislation that regulates an area of the activities of citizens …Ireland, in common with any Member State, cannot be obligated to withhold legislation that it views as necessary and domestically required pending the development and negotiation of a law at European Union level”

But take a step back from the intervention of the UN and let’s try to work out how and why the Government ended up announcing it wanted to pass a Facial Recognition law in the first place. Because, the thing is, the law they put through the Oireachtas Pre-Legislative scrutiny system in 2021 didn’t have any such proposals in it.

We learned of the plan, not in the Dáil, but in a speech by the Minister for Justice in June 2022 to the police’s representative body, the GRA.

And, at that stage, the details were so sketchy that all we could make out was that the Govt wanted a law, even if it wasn’t quite sure where the limits of that law could be. There was even a suggestion of a new role for the Gardaí of proving people innocent- something hitherto left up to Jessica Fletcher.

“As well as helping to identify suspects in a crowd, it will also be able to exonerate innocent people by showing they were elsewhere at the time of a crime”

Simon Coveney’s reply to the UN goes further, confirming;

“It is proposed to introduce both retrospective and live facial recognition facilities into An Garda Síochána.”

But, in a return of the mental gymnastics that gave us a PSC card that was “mandatory but not compulsory”, although the plan is to use live facial recognition, the Minister assures the UN bods “there are no proposals for the use of FRT for ‘real time’ analysis in any such manner”. “Any such manner” doing quite a lot of lifting there.

So. to recap, that’s a plan to legislate for Live facial recognition, “identifying suspects in crowds” but not ““real time’ analysis of footage of large numbers of persons, to identify them”.

A blueprint that includes a need for a square circle usually suggests the plan isn't ready to leave the drawing board.

The Data Protection Bit

But now we come to the mystery- why did the minister for Justice suddenly announce in June 2022 she was going to so significantly amend a piece of legislation which had already gone through pre-legislative scrutiny back in December?

Why was Ireland asserting its sovereign right to urgently pass dumb local laws on matters of the most intense international debate, even as the EU was in the middle of the same debate on a law that would supersede ours?

What happened between Dec 2021 and June 2022 to make this a legislative emergency?

Well, come with me to look at the missing piece of this puzzle.

In May 2022, just a few weeks before the Minister’s GRA speech, the collective group of Data Protection Authorities in the EU, called the European Data Protection Board, issued their “Guidelines” on when it would and would not be lawful for the police to use facial recognition technology for law enforcement.

The most crucial statement they made was to say that just transposing the current EU law governing use of data by law enforcement absolutely did not give a legal basis for FRT. In Ireland’s case, this transposition was done by the Data Protection Act 2018.

“the national provision transposing Article 10 LED into national law - with a similarly general and abstract wording - cannot be invoked as a legal basis for the processing of biometric data involving facial recognition“

This meant that any police force which had read the law as giving them that power- and so did not believe they needed any additional legislation to let them run FRT- suddenly would urgently need a law passed to justify that usage.

But the EDPB go on to explain all the strict limitations that would apply to that law. The first- and most significant- is that it must be only used when “strictly necessary”.

“It restricts the margin of appreciation permitted to the law enforcement authority in the necessity test to an absolute minimum. In accordance with the settled case-law of the CJEU, the condition of “strict necessity” is also closely linked to the requirement of objective criteria in order to define the circumstances and conditions under which processing can be undertaken, thus excluding any processing of a general or systematic nature”.

So, saving manpower by automating a laborious task wouldn’t be a sufficient legal justification- the law could only allow for uses which could not- in any way- be done without FRT.

But they have some specific thoughts on the legality of the Minister for Justice’s suggestion to use FRT to “identify suspects in crowds”

“with regard to data subjects for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with the legitimate aim according to the LED, there is most likely no justification of an interference” with their privacy and data protection rights.

And, just to ram the point home, they do an analysis of a sample use of live FRT to identify suspects in a crowd.

They conclude

“remote processing of biometric data in public spaces for identification purposes fail to strike a fair balance between the competing private and public interests, thus constituting a disproportionate interference with the data subject’s rights under Articles 7 and 8 of the Charter.”

Two questions remain with me at the end of this sequence of statements and laws.

1. Before the May 2022 EDPB guidelines, had the police here engaged in any use of Facial Recognition Technology, basing its legality on a misinterpretation of the Law Enforcement Directive and the Data Protection Act 2018?
2. Why does the Department of Justice think it is a good idea to legislate in haste, on a matter of critical international debate, in the face of an impending law agreed by the EU as a whole, on exactly this point?

What does Ireland know that the best brains in the world have missed to assure the Government that they are the ones to have got this balance right?

Or, from the citizens’ point of view, perhaps the question is blunter.

Why should we trust that the government which illegally used Public Services Cards across the state, that is under investigation for the use of biometric data, that asserted for years that its unlawful mass surveillance Data Retention laws were fine, has got this one right?