Finland's Ministry of the Interior has recently proposed amendments to its biometric data regulations, aiming to bolster crime prevention efforts. The proposal, which seeks to expand the use of biometric data—such as fingerprints, stored in the passport and identity card registers, raises serious concerns about privacy, proportionality, and compliance with European Union (EU) law. While the intentions behind the proposal may be rooted in public safety, the execution seems to overlook essential principles of data protection, human rights, and constitutional safeguards.
At the heart of the proposal lies the expansive use of biometric data, which could affect over 70% of Finland's population. With more than four million individuals potentially impacted, the scope of the data reuse raises alarms. Proponents argue that this measure could help identify suspects and victims, prevent serious crimes, and make investigations more efficient. However, a closer examination reveals that the statistical justification for such an invasive measure is woefully inadequate.
According to the Office of the Data Protection Ombudsman (Finnish national data protection authority), only 70 crime reports contained unidentified fingerprints that might match stored biometric data—accounting for a mere 0.0000175% of all cases. This suggests that the vast majority of the population would be subject to biometric data processing without a clear and demonstrable need. Under the EU’s General Data Protection Regulation (GDPR), the processing of sensitive data, such as biometric information, must adhere to the principles of proportionality and necessity. By this measure, the proposed amendments would likely fail to meet these standards, leading to a violation of privacy rights guaranteed by EU law.
Moreover, the proposal fails to demonstrate a compelling connection between the use of biometric data and public safety. The Finnish Constitutional Law Committee has consistently upheld the principle of purpose limitation, which dictates that data should only be used for the specific purpose for which it was collected. Expanding the use of biometric data beyond its original intent without clear justification undermines the core tenets of both Finnish constitutional law and EU legal frameworks. Furthermore, the lack of a comprehensive Data Protection Impact Assessment (DPIA) exacerbates the problem. A robust DPIA is essential in assessing the risks and ensuring that adequate safeguards are in place to protect individuals' rights. The absence of this assessment raises serious concerns about the government's preparedness to address the potential risks of large-scale biometric data processing.
In addition to the legal challenges, the proposal also raises significant human rights concerns. The EU Charter of Fundamental Rights guarantees the protection of private life and personal data. Any restriction of these rights must be strictly necessary and proportional. Yet, the proposal seems to prioritize the broad use of biometric data without adequately addressing the potential harm it may cause to individuals' privacy. With vast amounts of sensitive personal information at stake, data protection must not be compromised in the name of crime prevention.
The proposal also introduces troubling sections of the law that could lead to unchecked surveillance and arbitrary use of data. For instance, Section 15d of the Act on amending the Act on the Processing of Personal Data in Police Operations includes vague language around "danger prevention," which could open the door to excessive data processing. Furthermore, Sections 15e and 15f of the same Act, which expand biometric data use for crime investigations, fail to provide sufficient justification or demonstrate how these measures are proportionate to the intended outcomes. Similarly, Section 21, which allows for the sharing of biometric data between multiple authorities, raises questions about governance, accountability, and data security. Without clear safeguards in place, such expansions could lead to a significant erosion of individual rights and freedoms.
While it is understandable that the Finnish government is seeking ways to prevent serious crimes and enhance public safety, it is essential to recognize that the expansion of biometric data use cannot come at the expense of fundamental rights. Striking a balance between privacy and security is no easy task, but it is possible to achieve a solution that both protects citizens' data and supports crime prevention efforts. A more tailored approach to biometric data access, clearer oversight mechanisms, and a more transparent justification for the use of such data could go a long way toward addressing these concerns.
Other countries have faced similar challenges and found ways to strike a better balance. For example, the United Kingdom's use of biometric data in law enforcement is subject to strict oversight and transparent guidelines, ensuring that data is only used for specific, justified purposes. Finland could benefit from adopting a similar model—one that provides stronger safeguards, enhances accountability and ensures compliance with both domestic and EU legal standards.
Ultimately, Finland's proposed amendments to biometric data regulations, as currently drafted, present a clear risk of overreach, infringing on the privacy, data protection, and other rights of its citizens. The proposal's lack of proportionality, inadequate justification, and failure to comply with EU data protection law make it ethically and legally questionable. The government must revise the proposal to introduce stronger safeguards, more transparent justifications, and a greater emphasis on fundamental rights protections. Only then can Finland truly ensure that its approach to crime prevention does not come at the expense of the very freedoms it seeks to protect.
Kamrul Faisal,
Researcher (Privacy and data protection),
University of Helsinki, Finland.
This is a "Viewpoint" opinion column. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views or position of The Helsinki Times. This column is not fact checked and HT is not be responsible for any possible inaccurate or incorrect statement in this article.
HT
