Biometric Systems in Future Preventive Scenarios - Legal Issues and Challenges

The privacy and data protection challenges posed by biometric systems have been discussed in detail in the last years. Both security opportunities and privacy risks however may develop and change with the technical enhancement of the respective systems, which also induces the emergence of new application scenarios. One group of such new scenarios appears to be the prevention of criminal or in other ways dangerous behaviour. From a legal point of view, this brings about new challenges which go well beyond the problems of authentication as such. While some of the features of the scenarios discussed below may not be feasible in the short term, it is apparent that the associated fundamental rights and data protection law problems will have to be addressed in the future. This applies to the international plane as well as to national legal orders, for which Germany will serve as an example in the following. 1 Biometrics, behavioural Pattern Analysis and the Law From the very beginning of the technical development of biometric systems, this technology has been put into question from the privacy and data protection point of view. This is however in no way a sole characteristic. Rather, it appears that virtually 1 Acknowledgement: The work in this paper has been funded in part by the German Federal Ministry of Education and Science (Bundesministerium für Bildung und Forschung, BMBF) through the Research Programmes under Contract No. 13N10820 – “Digitale Fingerspuren” (Digi-Dak), and Contract No. 13N10814 – “Verteilte, vernetzte Kamerasysteme zur in situ-Erkennung Personen-induzierter Gefahrensituationen (CamInSens)”. 2 For the purpose of this article, it is not necessary to discuss the different notions of these terms. It has been argued that the two concepts differ to a considerable extend. According to [HeGu06] [GuHe08], privacy should be understood as an opacity tool, guaranteeing non-interference in individual matters by the state and private actors. On the contrary, data protection is construed as an transparency tool, meant to compel government and private actors to “good practices” by focusing on the transparency and accountability of governmental or private decision-making and action. However, this useful distinction may be misleading as regards specific legal provisions, which may serve both or other purposes. In addition, “privacy” may have considerable different meanings in different legal orders, and there are further conceptions such as the German right to informational self-determination ([HoSc09]), which may not fall in just one of the two categories.