Criticism from Kelber: Private bodies should be given access to e-passport data

In his final days in office, Federal Data Protection Commissioner Ulrich Kelber is up in arms against the German government's plan to give airlines, airport operators and ground handling service providers access to the data stored on the chip in passports, including biometric features. This would authorize non-public bodies for the first time to "access biometric photographs stored in official passports and produced by the state", warns the inspector of massive risks of misuse. These would be "disproportionate to the intended improvement of the individual travel experience". The planned technical protective measures could not eliminate this basic risk, so that "fundamental concerns" remain.

Hundreds of thousands of hours of time saved

The stumbling block: the government has included corresponding changes to the Passport Act and the Air Traffic Act in its draft for the fourth law to reduce bureaucracy. Insofar as passenger check-in may be carried out digitally, the private bodies responsible for this are to be authorized to read out the biometric photo from the chip "for a one-off comparison to check that it matches the physiological characteristics of an image taken by the passenger with their consent at the airport for the purpose of verifying the identity of the passport holder and to check the authenticity of the chip" and data obtained from it. Names and other information from the electronic memory may also be processed.

According to the plan, the image recording must be converted into a biometric pattern for further processing after it has been collected or read out. The read and processed data and this template should then be deleted immediately or no later than three hours after departure. In general, it must be ensured that the checks are carried out "in line with the current state of the art". The executive wants to improve "the passenger's travel experience". It expects around 37.9 million private flights per year. The time saved by implementing the legal changes is estimated at one minute per passenger. In total, this would save citizens around 631,500 hours a year.

Can control over biometric data on the chip still be maintained?

According to Kelber's statement for a Bundestag hearing on the initiative on Wednesday, however, it is not clear to him that the process for reading out data from the machine-readable zone of the passport, which is already possible for private individuals, "differs significantly in terms of speed and convenience from reading out the chip". In both cases, the passenger must bring the document close to a reader "and the data should be read out in a negligible amount of time compared to the overall process". An acceleration of the handling processes is not recognizable. The fact that the data collected for the fulfillment of purely sovereign tasks, which initially only police enforcement authorities, the customs administration and registration offices were allowed to process, "is to be released for the provision of optional convenience services by non-public bodies", "would lead to a fundamental shift in the usage regime of the data stored in the chip of official ID documents" and would also arouse the interest of other private bodies.

Kelber explains that the reading of the photograph by the planned companies is also not necessary for security reasons. For service offers to improve the travel experience, an identity check by visual comparison of the printed photograph is sufficient. In addition, in the subsequent check-in process, it would appear that passengers would generally be identified using biometric procedures instead of simply showing their boarding pass. This would replace the "previously non-intrusive procedure with a process that is much more sensitive to fundamental rights". The required voluntary consent is doubtful if a passenger's refusal to grant access could lead to disadvantages such as a longer waiting time or even missing the flight.

(vbr)