ABIS is a database used to store biometric data collected from people. Where are people's facial images currently stored? And will ABIS finally also include DNA data?

ABIS does not concern DNA. I want to get that straight right away. Talking about ABIS or the automatic biometric identification system database, it will hold fingerprints and facial images or photos of persons.

Such data is currently scattered between ten databases. It is a long list. There is the state fingerprints register (AFIS) that is used by the Estonian Forensic Science Institute. But we also have the identity documents database, illegals database, entry bans register, short-term work permit holders database.

Today, these databases hold both biographic and biometric data, while biometric data will in the future be stored in the ABIS database.

If a detective finds a fingerprint on the murder weapon, which of these databases can they currently use to try and find a match?

If a serious crime takes place today and the crime scene yields fingerprints that can be used to identify a possible suspect, the detective will have to apply for a permit from the Prosecutor's Office first. A prosecutor will then decide whether fingerprints can be used. Whereas the AFIS inquiry is not made by the detective but the forensic expert.

AFIS is ancient and on the verge of collapse, which is one reason we were in a bit of a hurry with ABIS. The current fingerprints register is not the most reliable anymore.

Can the institute also ask to access fingerprints people have given when applying for an ID?

The ABIS bill will introduce no changes here. Data a person has surrendered to get an ID can be used since 2012. But the decision was not made by the forensic institute. They get a regulation and a list of tasks to perform that requires a permit from a prosecutor. Therefore, the data can already be used with a prosecutor's permit. Relevant legislation was introduced back in 2012.

You just said the AFIS database is used instead.

There are two options. Estonia collects data in administrative proceedings, when people apply for an ID. The other – AFIS – holds data collected in offense proceedings.

Data collected in offense proceedings can be used by the forensic institute also in the case of simpler offenses, such as theft. In the case of severe crime where more extensive use of data is needed, including that collected in administrative proceedings for issuing a passport, a permit from the prosecutor is needed.

That is the difference. And this practice has remained unchanged since 2012.

When I applied for a passport in 2016 and gave my fingerprints, no one told me they could be used to check whether those are my prints on the murder weapon. Why was I not notified?

Yes, I agree that perhaps we should explain it to people.

But the regulation allowing the use of this data had been in place for four years when you got your passport in 2016. However, not regarding all offenses and at all times, which I would emphasize. Only in the case of severe crimes and only with a prosecutor's permit.

What will ABIS change? Will inquiries for all fingerprint data be allowed for lighter offenses in the future?

No. We are still only talking about serious crime. While the regulation was in place back in 2012, we lacked technical capacity at the time. For automatic facial recognition. We had little use for people's portraits in the past, other than asking the public whether they recognize the person.

ABIS will give us the capacity to compare a single facial image to several others. If you have a photograph of an unknown person who has committed a serious crime, you can ask the database to identify them.

But it can never be a case of a random person making inquiries. Every action leaves a trace and the log can be accessed in hindsight.

Therefore, it was possible to compare a set of fingerprints to all known fingerprints before, while it was not the case for facial images?

Yes. There was no corresponding technology. ABIS will give us that capacity and I believe it will render us much more effective at solving severe crime.

My ID recently expired, I applied for a new one and sent the Police and Border Guard Board (PPA) my picture. Once again, no one told me it can be used to make such inquiries.

Now you know.

Now I know, but what about the basic principle of data protection according to which the information is only usable for the purpose it is being collected?

Yes. Talking about public order and security, European data protection regulations and our domestic ones allow the use of such data. However, they are used so we could all feel safer.

Should the PPA notify people about what their data can be used for when they go in for a new ID in the future?

I believe that a lot of people know how it works by now, but your idea is quite welcome. I will be taking it with me.

Will people get the right to ask for their data not to be used in the new database?

The law provides no such possibility. A person will be able to ask who has accessed their data, why and to what effect. This possibility exists today and will remain in the future. That is where a person can verify whether their data has been used legally.

The other side of this is that the law specifies which biometric data is archived and which is deleted. A suspect's fingerprints absolutely must be deleted if they are cleared of particular suspicions.

But when applying for a passport, they gave their fingerprints that will be maintained for as long as the passport is valid.

But the usage is different.

Why cannot a person designate that their data as stored in the passport chip can be used when they are crossing the border or to identify their body, for example, but not for criminal investigation?

It is not regulated in the law today. Could we have a corresponding public debate? I think so. But again – Estonia is a democratic country, people feel safe here. And if people feel safe here, it means they trust the state. I believe that allowing use of this kind of data is a security matter.

While I would hate to have you imagine yourself as a victim of a crime, one would want the authorities to use as many tools as possible at their disposal to find the culprit. Personally, I see no problem here. It is a matter of how well data is protected and how its use is regulated – it is extremely important.

You said that the data can only be accessed in very particular cases, with permission from a prosecutor. Does the law regulate who can access the data or will that be designated by a government or minister's regulation?

Talking specifically about ABIS, the type of data collected is regulated by the statute. The latter is passed by the government, which process can be taken forward once the ABIS bill is passed. The statute is clear in terms of the database only including fingerprints and facial images. No other data can be collected in ABIS.

We also have work regulations that provide that people working on pretrial proceedings can only use the data to investigate circumstances associated with their case. If an official is working on asylum applications, they can only use the data in that capacity.

But why only fingerprints and facial images?

That is what we need today and what was decided in 2017. Talking about the future or what technology makes possible, there are other options.

In terms of what technology allows us to do and what could be done in Estonia, it requires a proper debate, new legislation etc.

You cannot just do something because the technology exists in a democratic country like Estonia.

But if there is DNA at the crime scene that could possibly be used as evidence, do you feel a pang of regret as a policeman in terms of not having a major DNA database?

We have a DNA database with data from crime scenes, non-personalized data kept in the forensic institute's DNA register. To verify that DNA trace, we need to test the suspect and compare the data with existing samples. We can do that today.

While we have not even considered collecting the DNA of every person in Estonia.

It is not something you dream about?

No, I do not dream about an Orwellian big brother state.

What about should we get a government with more ambition and less noble intentions, seeing as collecting personal information in ABIS has now been introduced on the level of a government regulation? Does this not entail a risk?

Governments are usually made up of several parties and different principles.

Deciding whether ABIS could include additional types of biometric data or reflecting it in its statutes would not be a simple process. The matter being a government level regulation means there needs to be a debate.

A public debate on possibilities of the future is not far. The European Commission has finished its artificial intelligence draft regulation and sent it to member states, including Estonia, for comments. It treats with, among other things, what AI can or cannot be used for. It also makes mention of facial recognition in public places.

The European Commission has said that this solution should not be used, except in certain situations. Examples include searching for victims of crimes and missing children, anti-terrorism efforts, looking for suspects of crimes for which a minimum punishment of three years is prescribed. There are about 30 such crimes in Estonia. Kristian Jaani, could this system be adopted in Estonia?

Different ways of adopting new technology need to be seized or at least considered to achieve good results, and anti-terrorism efforts were indeed a part of it. We all know of unfortunate examples, such as China where basically all people are monitored constantly. That is, of course, the most heinous extreme. Talking about a safe and democratic country like Estonia, adopting such tools requires debate, including parliamentary debate. Whether it would be sensible to use such tools here.

However, we should not close the door completely to technological solutions that can be used for security and safety. Whether and what to adopt in the future requires broad debate.

Would such a system be needed?

Different technological solutions that can boost security and help detectives identify persons are positive developments. It needs to be regulated, personal data needs to be protected, there needs to be subsequent control. But we cannot close the door to technological advancement.

Are relevant debates underway in the PPA or the interior ministry, in terms of how to use facial recognition software in public places?

If you mean official discussions or projects, then to the best of my knowledge, there aren't any. Estonian legislation makes it impossible to use such technology.

What is the timeline here, when could such a system be in use? A decade?

Hard to say. We could have technology we cannot even dream about today ten years from now. But who knows. I cannot foretell the future.

--

Follow ERR News on Facebook and Twitter and never miss an update!