Lower Saxony's data protection authority probes secret surveillance
The Hanover police department also uses the PerIS surveillance system developed on behalf of colleagues in Saxony. Shadowing could be illegal.
(Image: Neosiam32896395/Shutterstock.com)
Lower Saxony's data protection commissioner Denis Lehmkemper wants to investigate the use of a covert video surveillance system including biometric facial recognition in Lower Saxony. A spokesperson explained this to heise online. The surveillance technology in question is the controversial Personal Identification System (PerIS), which the Görlitz Police Department (PD) had developed by the Bremen-based company OptoPrecision and has been using for several years. According to its spokesperson, the data protection authority in Lower Saxony only became aware on Tuesday that the Hanover Police Department was also already using PerIS.
Netzpolitik.org and Neues Deutschland (nd) previously reported that the technology had been used in a case concerning gang-related property crime and had provided information on vehicles used by members of the gang. PerIS had proved to be "helpful for the parallel conventional surveillance measures", according to a spokesperson for Hanover police.
It recently became public that the police in Saxony are providing administrative assistance to several federal states with PerIS. The system records license plates of passing vehicles as well as facial images of drivers and passengers. It has been used in Berlin, among other places, and can process facial images "with a time delay of a few seconds", according to official information there. All persons detected in the vicinity are compared with images of suspects from a specific investigation. Matches are then to be checked by police officers. The Saxon state government has since told parliament that the system is also being used in and for North Rhine-Westphalia, Brandenburg and Baden-Württemberg.
Investigative assistance for Lower Saxony from Saxony
A spokesperson for the Hanover police described the case to heise online, stating that the investigators "received investigative support from the police in Saxony". The relevant equipment was not physically located in Lower Saxony and had not been operated by police officers there. The targeted search for license plates, vehicles and persons was carried out based on a court order from the Hanover district court.
Even after several days, the Hanover police were unable to say whether they had carried out a data protection impact assessment for PerIS themselves or whether they had received one from another body. Such a prior analysis is required by EU law. The Saxon data protection officer Juliane Hundert already felt that she had been ignored in this matter.
The photos secretly taken for the Hanover police department were reportedly compared with police databases containing images from identification measures. The police in Hanover cite Section 98c of the Code of Criminal Procedure (StPO) as the legal basis for the operation. It regulates the automatic comparison with existing data to investigate a criminal offense or to determine the whereabouts of a person wanted in criminal proceedings. According to experts in constitutional law, however, this standard leads to problems such as the lack of real thresholds for intervention, i.e. clear requirements for use by investigators.
Data protection impact assessment is mandatory
"According to the fundamental case law of the Federal Constitutional Court, an intensive encroachment on fundamental rights always requires a special legal authorization norm," emphasized Lehmkemper's spokesperson. Whether Section 98c of the Code of Criminal Procedure meets the requirements for the use of the system still needs to be examined because of the guidelines on the use of facial recognition technology in law enforcement issued by the European Data Protection Board (EDPB). It states: "The processing of biometric data constitutes a serious intrusion in all circumstances." This does not depend on the result, such as a positive comparison.
In principle, the EU data protection commissioners pushed for a clear ban on biometric facial recognition as part of the EU Regulation on Artificial Intelligence (AI) systems, but were unable to get their way. In their guidelines, they point out that a data protection impact assessment is required before any use of biometric facial recognition. If possible, this should also be published and the responsible data protection supervisory authority should be consulted.
Automated comparison with databases?
According to the Hanover Police Department, PerIS collects around 6 terabytes of data from faces and license plates every day, which is evaluated using complex software developed in-house. This means that "laborious screening of individual video clips for relevant data" by officers can usually be dispensed with. All data that is no longer required is automatically and irrevocably deleted after 96 hours. The system is not currently used for real-time comparison. Subject to the legal situation, however, the "automated detection" of faces and license plates is also possible in a live mode. Whether this will be activated in future is "a statewide issue" that cannot be decided on alone.
The Saxon Ministry of the Interior assured in October: "An automated comparison with domestic or European databases has never taken place." The PerIS software concept does not allow this "due to a lack of technical interfaces". Manual comparisons are made afterward with the Schengen Information System (SIS), the police information system Inpol, the police information system Saxony (Passport), the European Vehicle and Driving License Information System Eucaris and the Central Traffic Information System Zevis. The Saxon police currently operate ten stationary camera columns and two mobile PerIS devices, which are concealed in a white or orange van. The first version of PerIS-Mobil went into operation in February 2021.
(nie)
