Introduction
The utilisation of biometric data has demonstrated to be an efficient tool in preventing crime around the world, as well as improving the quality of life of citizens. Nonetheless, it has not been easy to implement this technology in Europe due to legal constraints.
It is a notorious fact that biometric data collection is commonly correlated with authoritarian governments because it provides the State with information that could be used to control its citizens; however, it is undeniable that such data collection could significantly help tackle the high crime rates of various EU cities. This Insight proposes a mid-way approach that would allow democratic states to implement Artificial Intelligence (AI) systems for law enforcement, using a smart solution that could help the State fight criminals on more equal terms. The solution proposed involves the collection of behavioural data, relating to criminal actions committed in a public place, by an AI system that anonymises the data collected,
making it very difficult to identify the data subject and thus allowing law enforcement and the public powers to use that data to prevent crimes.
1 Biometric data and AI
Considering the subject matter of this Insight, it is important to understand what biometric data, and particularly behavioural data, is and how AI could help collect and match the data collected.
Biometric data is any information relating to the physiological/biological and behavioural characteristics of an individual, which can be used to identify that individual. Examples of biometric data include facial images, fingerprints, palms, iris scans, DNA (physiological data), as well as keystroke dynamics, voice, signature, gait and cognitive behaviour (behavioural data).
AI is essentially the simulation of human intelligence processes by machines which are programmed to learn and reason like humans. It is a technological tool that can be used to collect, process, categorise and analyse huge amounts of data, images, documents and much more, with significant potential benefits for law enforcement.
Nevertheless, this data processing must comply with European Union (EU) law. Two main pieces of legislation are particularly worthy of note in this regard, namely, the Law Enforcement Directive, which regulates data collection for law enforcement purposes, and the Artificial Intelligence Act (AI Act).
Since we do not live in a perfect world and technology can be used by states to control their citizens, the EU has created these laws to prevent such abuses and to regulate the use of AI systems for law enforcement purposes. For instance, Article 5 (d) of the AI Act prohibits the use of real-time remote biometrics in public spaces for identification purposes. Furthermore, the LED (Directive (EU) 2016/680) is intended to protect individuals in terms of the processing of their personal data by competent authorities to prevent, investigate, detect, or prosecute criminal offenses or execute criminal penalties. Article 10
states that the processing of biometric data for the purpose of identifying someone is authorized only if it is strictly necessary and if one of the following conditions is met : 1) it is authorized by Union or Member State law, 2) it protects vital interests of the data subject or of another natural person or 3) it covers data that has been made available by the data subject. However, in addition to the hypotheses provided by law the use of behavioural data may be allowed under certain circumstances, provided that appropriate techniques are used to make the data anonymous, in line with the IAPP’s understanding that if data is anonymous it can no longer be considered personal data.
According to a report on the problem of complete, irreversible anonymisation, making data truly anonymous is a complex task that requires careful consideration of various factors such as data utility, privacy risks, and legal requirements. While it is possible to de-identify data in a way that removes personal identifiers, it may still be possible to re-identify the data using certain techniques. Therefore, it is important to take a cautious approach when dealing with anonymous data to ensure that individuals’ privacy is protected. In this regard, the European Data Protection Working Party stated, in Opinion 04/2007 on the concept of personal data, that “A mere hypothetical possibility of singling out an individual is not enough to consider the person as identifiable”, which means that the mere possibility of identifying someone does not prevent the data from being considered anonymised.
An interesting example of anonymisation has already been implemented in Norway, where the police have introduced a non-intrusive surveillance system that anonymises images by automatically covering people with cartoon characters, thus permitting the collection of only behavioural data.
If a technology that can efficiently perform the anonymisation of data is developed, it will be possible to collect and use behavioural data for law enforcement because this data will no longer be considered personal data.
2 Behavioural data as a tool to prevent crimes
Through behavioural data collection, it will be possible for law enforcement officers to create smart and appropriate solutions, together with public policies if applicable, based on a case-by-case analysis.
In this respect, we can identify a successful case in Europe where using behavioural analysis in certain areas allowed the public powers to apply measures to prevent crimes. In Eindhoven, the government installed Wi-Fi trackers, cameras and microphones in areas of the city known for crime or disturbances to detect such misbehaviour, as well as a smart street lighting system with varying intensity and colour of light aimed at calming individuals and ultimately reducing local violence. The cheapest, most efficient, and smart solution for this specific case was implemented without the need to increase police enforcement.
We emphasise that the legal restrictions regarding data collection focus on individual identification. As such, if it is possible to gather information without identifying an individual, the more extensive use of biometric data could be permitted.
Conclusion
The implementation of AI in the EU for law enforcement purposes is not easy, especially if it involves the collection of sensitive data and in real-time; however, security is a pillar to guaranteeing a good quality of life.
Despite the legal limitations preventing the widespread use of personal data for law enforcement purposes, if the data is anonymised it could be more easily used for such purposes because it is no longer considered personal data. Therefore, it is proposed that behavioural data be collected in problem neighbourhoods to identify what types of crime are being committed, their frequency, the number of persons involved, the number of victims and the locations used as HQs by criminals, with a view to developing smart and cheap solutions to improve public security and prevent crimes in those neighbourhoods. The biggest challenge faced is ensuring that the data collected by the AI systems created for this purpose remains anonymous and is not used to create profiles. The law enforcement offices granted access to this technology should also be periodically inspected
