Updated Council of Europe Guidelines Warns Against Biometric Voter ID

The Council of Europe is taking a stand against the use of biometrics for voter registration and authentication, arguing that such biometric systems “should only be introduced if other existing (legacy) forms of identification and authentication have been demonstrably shown to be inadequate, inaccurate and/or contrary to the rights of the individual.”

The position comes by way of a set of guidelines under “Convention 108”, prepared by the Consultative Committee of the Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data.

The European Commission is the executive branch of the European Union, responsible for proposing legislation, implementing decisions, upholding EU treaties, and managing day-to-day operations. Convention 108 is an international treaty adopted by the Council of Europe in 1981, which aims to protect personal data and privacy rights. It has been updated with Convention 108+ to address emerging challenges, such as biometrics and digital identity.

Risks and Regulatory Safeguards

The guidelines point to risks associated with using biometric data, including its ability to uniquely identify individuals, making it a highly sensitive category of personal data. The sensitivity stems from the fact that biometric data, when misused, can infringe on privacy and human rights in ways that other data types cannot.

The guidelines urge that any adoption of biometric technology must be grounded in a clear legal framework, which should specify the purpose of the biometric use, the accuracy standards of the technology, and safeguards against misuse.

Moreover, the guidelines prohibit certain uses of biometric data in the electoral context. For example, biometric data should not be processed to infer characteristics such as race, ethnic origin, age, or health. And biometric data collected through voter registration should not be shared with third parties, including political parties or campaign organizations.

The guidelines also emphasize that biometric data should not be derived from online images, social media, or surveillance systems.

Securing Data and a Call for Transparency

The security of biometric data is a key concern in the guidelines. It stresses that data controllers, particularly electoral management bodies (EMBs), must ensure that biometric data is protected using the highest security standards. This includes continual testing to eliminate any bias in biometric systems, especially with respect to ethnicity, age, and gender.

Developers of biometric systems are urged to follow the principle of data protection by design, embedding privacy and security measures at every stage of the technology’s development.

The European Commission also calls for transparency and public accountability in the procurement and deployment of biometric technologies. This includes making all contracts and technical documentation related to biometric systems publicly available to ensure that citizens can trust that their data is being handled securely and responsibly. EMBs are also required to consult supervisory authorities before deploying biometric systems to ensure that the implementation complies with data protection laws and safeguards human rights.

In addition to its guidance on biometrics, the European Commission addresses the broader issue of digital identity, noting that pressures to use digital ID systems for voter registration and authentication are growing, particularly in developing countries. The guidelines caution that while these systems may offer advantages in terms of convenience and security, they must be implemented with great care to avoid undermining privacy and democratic rights.

Source: Council of Europe

–

September 18, 2024 – by Cass Kennedy and Alex Perala