The Prüm II documents, dated from April 2021, when the plans were first being discussed, show the huge number of face photos that countries hold. Hungary has 30 million photos, Italy 17 million, France 6 million, and Germany 5.5 million, the documents show. These images can include suspects, those convicted of crimes, asylum seekers, and “unidentified dead bodies,” and they come from multiple sources in each country.
Jakubowska says that while criticism of facial recognition systems has mostly focused on real-time systems, those that identify people at a later date are still problematic. “When you are applying facial recognition to footage or images retrospectively, sometimes the harms can be even greater, because of the capacity to look back at, say, a protest from three years ago, or to see who I met five years ago, because I’m now a political opponent, “she says. “Only facial images of suspects or convicted criminals can be exchanged,” the European Commission spokesperson says, citing a guide on how the system will work. “There will be no matching of facial images to the general population.”
Pictures of people’s faces should not be combined in one giant central database, the official proposal says, but police forces will be linked together through a “central router.” This router won’t store any data, the European Commission spokesperson says, adding that it will “only act as a message broker” between nations. This decentralized approach makes Prüm II more straightforward: Police wanting to compare fingerprints under the current system must connect to other police forces individually. Under the new infrastructure, countries only need one connection to the central router and it will be easier to “add additional data categories to the system,” the documents obtained by EDRi say.
The European Data Protection Supervisor (EDPS), who oversees how EU bodies use data under GDPR, has criticized the planned expansion of Prüm, which could take several years. “Automated searching of facial images is not limited to serious crimes but could be carried out for the prevention, detection, and investigation of any criminal offenses, even a petty one,” said Wojciech Wiewiórowski, the EDPS. said in early March. Wiewiórowski said more safeguards should be written into the proposals to make sure people’s privacy rights are protected. The European Commission spokesperson says the body has taken “good note” of the EDPS opinion and the thoughts will be taken into account as the European Parliament and Council discuss the legislation.
During the development of the plans, Slovenia has been one key country pushing for the expansion — including asking for people’s driving license data to be included. Domen Savič, the CEO of Slovenian digital rights group Državljan D, says there are significant concerns about the differences between police databases and who is included. “I haven’t heard enough to be convinced that all of this data gathered by individual police forces is sanitized in the same way,” says Savič.
Police databases are often poorly put together. In July 2021, police in the Netherlands deleted 218,000 photos it wrongly included in its facial recognition database. In the UK, more than a thousand young Black men were removed from a “gangs database” in February 2021. “You could have databases that have completely different backgrounds in terms of how this data was collected, where it was sourced, how it was exchanged, and who approved what,” says Savič. Slovenia has already faced similar problems. “And this could lead to misidentification.”
One of the biggest problems for Jakubowska is how Prüm II could normalize the use of facial recognition by police forces across Europe. “What really concerns us is how much this Prüm II proposal could incentivize the creation of facial image databases and the application of algorithms to these databases to perform facial recognition,” she says. The EU will pay for the cost of connecting databases to Prüm II, the proposal says, and this includes the cost of creating new national facial images databases. Sixty years after being invented, facial recognition is still just getting started.
More Great WIRED Stories