EU: Policing: France proposes massive EU-wide DNA sweep, automated exchange of facial images The French Presidency of the Council is seeking EU-wide comparisons of every DNA profile held by police forces against all those held by other national police forces, as well as EU policing agency Europol, as part of plans to upgrade the ‘Prüm’ network of police databases. It also hopes to automate the police exchange of facial images by eliminating requirements for human review. By Statewatch · April 20, 2022 <https://edri.org/our-work/eu-policing-france-proposes-massive-eu-wide-dna-sw...> *Networking police databases* The proposals come in an amended version of a proposal <https://www.statewatch.org/media/3247/eu-council-prum-presidency-proposals-8...> (pdf) originally published by the European Commission in December 2021, which will upgrade the Prüm network of DNA, fingerprint and vehicle registration databases to include facial images and “police records”, as well as driving licence data <https://www.statewatch.org/news/2022/february/eu-got-a-driving-licence-you-r...>, if the Council has its way. The Prüm system currently allows law enforcement authorities to compare a DNA profile – for example, taken from a criminal suspect or found at a crime scene – and use it to run a search against all other participating member states’ DNA databases. As well as EU member states, this also includes the UK <https://www.statewatch.org/brexit-goodbye-and-hello-the-new-eu-uk-security-a...>. *Mass DNA searches* But the Presidency’s plan goes much further: under the revamped Prüm system, a central “router” would be set up to manage interconnections between different national databases, simplifying the current system which requires mutual interconnections between every participating state <https://www.statewatch.org/media/3249/eu-council-prum-notifications-declarat...> (pdf). The Presidency now aims to use that router for the mass comparison of DNA profiles (emphasis added in all quotes): /“Member States shall, at the initial connection to the router via their national contact points, *conduct an automated search by comparing all their DNA profiles, with all DNA profiles stored in all other Member States’ databases and Europol*. Member States and Europol shall agree bilaterally on the modalities of these automated searches.”/ The same article goes on to say that such mass searches could be a regular undertaking: /“*Member States may agree bilaterally to conduct automated searches also at a later stage* by comparing DNA profiles, with all DNA profiles stored in all other Member States’ databases and Europol. Member States and Europol shall agree bilaterally on the modalities of these automated searches.”/ The Presidency has somehow managed to include these provisions prior to one that says: /“*Searches may be conducted only in individual cases* and in respect of the same guarantees and safeguards that are required for similar searches at national level.” / A mass, automated search and comparison of DNA profiles is evidently not an “individual case”. If it were implemented now, the proposal would involve the processing of millions of items of sensitive personal data – EU member states held a total of almost 17 million DNA samples at the end of 2021, according to the latest statistics on DNA databases circulated within the Council of the EU <https://www.statewatch.org/media/3248/eu-council-prum-statistics-2021-5436-2...> (pdf, see table below). All but two member states’ DNA databases grew during the course of 2021, some substantially: Bulgaria’s by 30%, and Poland’s by 38%. The intention is to have the upgraded Prüm operational by 2027, by which time those databases will have grown even more. The Council may also be seeking to weaken the applicable safeguards, or at least to make them less specific: the phrase “in respect of the same guarantees and safeguards that are required for similar searches at national level” has been inserted in place of the previous text, which required searches to be conducted “in compliance with the national law of the requesting Member State.” *Automating the exchange of facial images* The intention is also for the upgraded Prüm network to include police facial recognition databases, which could form the technical backbone of a Europe-wide mass biometric surveillance system <https://edri.org/our-work/press-release-ec-jumps-the-gun-on-prum/>. Under the Commission’s proposal <https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2021:784:FIN>, member states would have submitted a facial image for a search against all other member states’ databases, and in return would have received a list of potential “candidates” for matches that would require human review before any further personal data could be exchanged. The Commission recently emphasized this point to /Wired/ <https://www.wired.com/story/europe-police-facial-recognition-prum/>, saying that “a human will review the potential matches and decide if any of them are correct, before any further action is taken.” The Council, however, has other plans. The latest proposed version of the text deletes the requirement for human review, and instead makes it optional: /“The national contact point of the requesting Member State may decide to manually confirm a match between two facial images. If so decided, it shall inform the requested Member State and shall confirm this match with facial images reference data received from the requested Member State.”/ The implication is, then, that the matching of facial images should generally be done automatically. Here, as with DNA and other types of data covered by the new Prum system, the Council has changed the requirement for searches to be conducted “in compliance with national law” to “in respect of the same guarantees and safeguards that are required for similar searches at national level.” *National DNA database content (stains and persons), 2021* *State* *01-Jan-21* *31-Dec-21* *% change* Belgium 101,098.00 108,049.00 7% Bulgaria 43,611.00 56,736.00 30% Czechia 277,213.00 287,357.00 4% Denmark 163,614.00 172,574.00 5% Germany 1,244,119.00 1,198,826.00 -4% Estonia 74,259.00 78,874.00 6% Greece 38,408.00 42,014.00 9% Spain 441,165.00 460,309.00 4% France 5,594,676.00 6,025,945.00 8% Croatia 10,085.00 10,802.00 7% Ireland 40,250.00 47,877.00 19% Cyprus 18,565.00 19,432.00 5% Latvia 72,930.00 77,215.00 6% Lithuania 140,770.00 149,523.00 6% Luxembourg 7,835.00 9,073.00 16% Hungary 161,306.00 167,946.00 4% Malta 799.00 156.00 -80% Netherlands 379,826.00 398,931.00 5% Austria 296,422.00 309,155.00 4% Poland 117,287.00 161,702.00 38% Portugal 14,163.00 14,163.00 0% Romania 57,857.00 68,466.00 18% Slovenia 32,948.00 33,684.00 2% Slovakia 94,482.00 99,027.00 5% Finland 207,651.00 212,412.00 2% Sweden 209,048.00 211,814.00 1% UK 6,337,964.00 6,446,391.00 2% 16,178,351.00 16,868,453.00 4% /Figures for the UK are taken from the national DNA database statistics, available here <https://www.gov.uk/government/statistics/national-dna-database-statistics>./