Vol. 315 No. 1
I remind Senators that a Senator may speak only once on each amendment on Report Stage, except the proposer of an amendment, who may reply to the discussion on the amendment.
Also on Report Stage, each amendment must be seconded.
Amendment No. 1 arises out of Committee proceedings. Amendments Nos. 1 to 3, inclusive, are related and may be discussed together, by agreement. Is that agreed? Agreed.
I move amendment No. 1:
In page 5, line 14, after “means” to insert “using biometric identification systems to do”.
I second the amendment.
In regard to amendments Nos. 1 to 3, inclusive, we are attempting to bring this Bill back in line with the protections and the safeguards outlined in the EU AI Act. As we described on Committee Stage, the Government is using a novel term it has made up, namely, the term "biometric analysis". It is preparing codes of practice and regulations around the use of this brand new term and category of thing. However, when we look at it, the activities being planned for require biometric identification systems which are categorised as high risk AI systems under the AI Act.
Biometric analysis is not a term used in the European legislation. It is not captured by the regulations within that Act. I do not believe there was an attempt to create a separate category called biometric analysis at that time, unless Ireland attempted to create a separate category of biometric analysis when the Act was being drafted. The Minister might clarify that point. Effectively, it seems the Minister is trying to use this term to distinguish the use of biometric technologies under this Bill from the use of biometric technologies as outlined in the AI Act and use that renaming of the activity as a way to sidestep the obligations, safeguards and guardrails that are outlined in that European legislation.
Subsequent sections of the Bill, for example, allow for flexible use of the technology and of biometric analysis without adequate safeguards and the necessary judicial approval for use. Under the EU AI Act, when biometric identification is being conducted, there are requirements in terms of judicial approval and other safeguards. However, those do not apply when it comes to what is being described by the Government as biometric analysis. The definition of biometric analysis that is in this Bill is so close to the activity of biometric identification under the EU AI Act that a line had to be inserted stating that we have just described something that sounds very like biometric identification but we are just going to put a line in at the end that says this is not biometric identification. Truly, if a line must be inserted to state "This is not biometric identification" at the end of the definition, that is to acknowledge that all the signs point to it being biometric identification, because what was repeatedly described by the Minister on Committee Stage as identifying unidentified persons is a process of identifying. If it is a matter of comparing biometric information with other biometric information and concluding that that seems to be the same person, then that is biometric identification.
The Minister then referenced that if we were trying to correct the definition of biometric analysis to make it clear that it encompasses and reflects biometric identification as understood by the AI Act then really we should be challenging the definition of biometric identification that is also in the Bill. That is why we have done that in this amendment. I hope that will be supported.
In regard to amendment No. 3, biometric identification as the Minister defines it in the Bill, is basically something inserted which was not in the AI Act. For biometric identification, the Minister is now saying that biometric identification is when you compare data with a database of named individuals. That is not what the AI Act describes as biometric identification. Recital 17 of the EU Act clarifies that
The notion of 'remote biometric identification system' referred to in this Regulation should be defined functionally, as an AI system intended for the identification of natural persons without their active involvement, typically at a distance, through the comparison of a person’s biometric data with the biometric data contained in a reference database, irrespectively of the particular technology, processes or types of biometric data used.
That does not say biometric identification is comparison with a database with a list of names in it. That is not what it says. It refers to a "reference database". It is worth noting that elsewhere in the Act, which we will come to shortly, the same examples as the Minister used are clarified, such as somebody breaks a window and is caught on CCTV and then gets on a bus, and it is noted that it seems to be the same person. That is what the Minister described as biometric analysis. However, that is biometric identification. That is comparing the biometric information of somebody, their appearance and such factors, and comparing it with other biometric identification. That is biometric identification. Having it be a named database is not what the AI Act at EU level talks about or looks for because names are not biometric. They are relevant information. They are not biometric information. It is interesting to note there is one area where a little bit of a differentiation is allowed between things that you are doing immediately and things that you are doing at a slight time delay. What is made clear in the examples used about that is the examples used are of CCTV footage, of video footage. The video and CCTV footage the Minister seems to think are somehow not the databases that are meant by the AI Act, are very clearly anticipated and understood to be relevant databases. It is a database if it is a bank of recordings of persons on a bus that have been taken that day. It is a database if it is footage captured on CCTV. If those two are being compared then you are comparing biometric data with biometric data in another database.
Looking to the examples again, the Minister stated that biometric analysis could involve a garda looking at CCTV footage and comparing a person with one who committed an assault and considers it to be the same person who gets off the bus. This fits the definition of a post-remote biometric identification system as outlined in Recital 17 of the AI Act which refers to:
material, such as pictures or video footage generated by closed circuit television cameras or private devices, which has been generated before the use of the system in respect of the natural persons concerned.
The exact example the Minister gave us is explicitly described as an example of a post-remote biometric system under the recital to the EU Act, namely, CCTV footage compared with the footage of those on a bus, pictures of video footage generated by closed circuit television cameras or private devices that are being generated not with the purpose of seeking out a particular individual but that are being generated and then are being compared. As such, amendment No. 1 clearly outlines and makes clear that biometric analysis involves the use of biometric identification systems.
Amendment No. 2 is consequential on amendment No. 1 and removes the line which states that biometric analysis "does not include biometric identification". You cannot make international law go away by literally stating in a Bill that it does not apply in this country.
Amendment No. 3 replaces the definition of "biometric identification" proposed by the Minister with the wording on biometric identification that is used in the EU AI Act, which at no point refers to databases of named individuals. That is just a concoction that has been created to try to make a narrower and different version of biometric identification and to state that we will apply all the rules and safeguards - the things that were weighed up very carefully over a long period at European level - but only in the much narrower set of circumstances we have chosen. Again, the definition in the Bill is very narrow and is not in line with the AI Act. A reference database is not required to contain the names of particular individuals. Recital 17 of the AI Act outlines that as long as there is a comparison of biometric data with other source material containing biometric data, it is considered a process of biometric identification regardless of the technology, processes or types of data used.
The Minister might clarify why he does not want to go with the definition of "biometric identification" contained in the AI Act. Is it because it is far too close to the definition being applied to the made-up concept of biometric analysis? I said this when I engaged with the Minister on Committee Stage. I had a very long journey in respect of a previous process with the former Minister, Regina Doherty, in relation to biometrics and attempts to create fantasies about what is and is not biometric data. Ms Doherty simply stated that we had different opinions. It was not that she and I had different definitions of biometric; it was the fact that there is a definition of biometric in the GDPR and that she, her Department and the Government seemed to believe that if they avoided referring to it, the definition in question would not apply.
The Minister will recall that I referred to the difference between hiring Biometric Card Services to produce social services cards and hiring Security Card Concepts Limited to do it. We are dealing with law, particularly European law, and its application here to issues crucial to effective democracy and the accountability of our institutions, as well as the delivery of justice in the round and the balancing that was attempted in the creation of the definition of "biometric identification" at EU level and of the appropriate safeguards. Diluting it in this way is really damaging, not just in the context of the collective challenge we have in properly addressing the uses of AI in an ethical fashion internationally but also with regard to the public's confidence that they are seeing justice in the round at work.
The Minister and I may disagree on biometric identification and its uses, as well as some of the other aspects of the law and all that, but let us begin the conversation from point at which we are using language in a way that is meaningful, accurate and comes with understood ramifications and safeguards. I urge the Minister to accept these changes to the definition in order to allow us proceed to have a real conversation about biometric identification rather than sidestep into a conversation about biometric analysis, which is apparently fine and does not need safeguards to the same degree at all.
I thank Senator Higgins for tabling this amendment and for her contribution. I often look for areas where we have agreement. There is agreement between us to the effect that there is a difference between biometric analysis and biometric identification. That is why in this legislation there is in the first instance a definition of "biometric analysis". the legislation then states that this "does not include biometric identification". The legislation proceeds to define biometric identification. The Senator's criticism is that the definition of "biometric identification" is not on all fours with the definition of "biometric identification" in the AI Act. Maybe I am being harsh on her in respect of this, but the political charge is that in some respects I am trying to get biometric identification in through the back door via this legislation, when, in fact, I am stating that this deals with biometric analysis.
I have two things to say in response to the Senator. The first is that the AI Act is a regulation that is directly effective and no matter what I do or what the Oireachtas does, we are bound by the AI Act. The second is that I have repeatedly stated that although this legislation seeks to deal with biometric analysis, I intend to bring forward legislation to permit biometric identification. The real difference between biometric analysis and biometric identification - in fairness, this is what Senator Higgins read out when she recited the definition of biometric identification - is that biometric identification involves referencing biometric information against a database of such information. The example I gave on the previous occasion is that the biometric information of an individual is taken and is checked against a database of facial images or other biometric information, including the gait or other strong characteristics of an individual, that can be available that is contained in a separate database. That is different from what biometric analysis. The latter is a means of filtering or sorting information to facilitate An Garda Síochána in speeding up a process of investigation.
Amendments Nos. 1 to 3, inclusive, proposed by Senators Higgins and Ruane would amend the definition of "biometric analysis" to include reference to biometric identification systems and to remove the exclusion of biometric identification from the existing definition.
Amendment No. 3 would also substitute the definition of "biometric identification" for that which is set out in Article 3(35) of the AI Act. The fundamental purpose of this Bill, which, as I say, is the biometric analysis Bill, is to provide the Garda with the power to analyse information by utilising biometrics on a retrospective basis. In the context of this Bill, biometric analysis is the preliminary step in the sphere of biometric processing. This is about analysis, not identification. The current definition of "biometric analysis" will allow the Garda, subject to the requirements under Part 6A, to search for general characteristics for a particular unknown or known individual. The types of person that can be searched are set out in the proposed new section 43C(6). The definition of "biometric analysis" excludes biometric identification. As Senator Higgins will be aware I will be providing for biometric identification and its limitations in another Bill, as I have said previously. I am hoping to publish the general scheme of that Bill this year. For the avoidance of doubt, biometric identification should be considered as searching against databases to establish the identity of an individual. To illustrate this point, gardaí may have a photograph of a person. In the normal course, such a photograph may be circulated to other gardaí to find out if the person's identity is known.
It would be useful in certain situations if gardaí could use a facial image to search against a database to see if that person is a convicted criminal, for example, but this particular use of biometrics is not what the Bill is providing for, which is why it must be clear that it has been excluded from the definition of biometric analysis.
Respectfully, to insert the amendments suggested by Senator Higgins would be to miss the purpose of the Bill. This is a standard drafting approach to define a concept in terms of what it is and what it is not. The amendments proposed by Senator Higgins may, in fact, broaden out what may be permitted under this Bill beyond what is intended. To insert the amendments is to miss the key distinction between analysis and identification. I am not accepting the amendments.
Digital evidence is part of almost every Garda investigation. This Bill is allowing for the sorting and filtering of information where necessary and proportionate to do so for serious crime. Gardaí gather data during investigation. That data will invariably, depending on the crime, contain large swathes of video or imagery. What this Bill is doing is giving the Garda the power to sort through data quickly while ensuring that there is a human reviewer who is making decisions throughout an investigative cycle. Any instances found of a person in footage gathered from a crime scene are to aid gardaí in ruling people in or out as potential persons of interest.
I understand Senator Higgins's comments about biometric analysis not being referred to in the AI Act but to be clear, what we are proposing to allow the Garda to do with this Bill is analyse documents, such as video or images, gathered in the course of an investigation and utilise biometrics subject to certain safeguards, including that of necessity and proportionality. The term makes it clear what the Garda can do. I am satisfied that there is no inconsistency between what is in this legislation and what is in the AI Act. When it comes to our responsibilities and obligations under data protection legislation, the Bill is compatible there, too. For those reasons, I am afraid I cannot accept Senator Higgins's amendments.
I fully recognise that there is a difference between biometric analysis and biometric identification. I am expressly providing in this legislation that we are not dealing with biometric identification. I will be coming back to the House in due course with other legislation that will deal with biometric identification and I very much look forward to hearing Senator Higgins's comments in respect of that as well.
I hate to say that the Minister and I are not in agreement. I do not believe there is a difference, or any substantial difference, between biometric analysis, as the Minister defines it in this Bill, and biometric identification, as it is defined in the EU law. They are actually almost exactly the same. What the Minister describes under biometric analysis and what is described under biometric identification in the EU law are the same. Where there is a difference is between the Minister's definition of biometric identification in this legislation and the EU definition of biometric identification. The Minister is defining biometric identification differently to the EU AI Act. That is quite an extraordinary thing to do.
The Minister did not address in his response this newly invented narrowing of the frame to "a database of one or more named individuals". A database of named individuals being one half of the comparison is not biometric identification under the EU law. The EU law is comparing biometric information with biometric information and what the Minister has just described is this different activity. It may be a worthy activity. Maybe the Minister could take this activity of comparing biometric information with a database of named individuals and give that a name. Maybe we could give that a new name. Maybe we could call that "biometric name alignment checking" or whatever we want, but that is a different and very specific, narrower activity.
It is extremely important that the Minister start getting this right. The Minister says he has new legislation coming, but will his new biometric identification legislation be narrowed to when biometric information is compared to databases of names that are made up of letters and not biometric information? Named individuals is not the category.
Let us talk about things that are biometric. Some of the things that are biometric are "physical, physiological or behavioural human features". Those are biometric pieces of information. That is what the Minister is proposing to compare under biometric analysis through "automated recognition and categorising of instances of physical, physiological or behavioural human features", and that they would be compared in respect of other instances of the particular unidentified individual. There is identified and unidentified. That is only a matter of if you know their name, but the key point is the Minister is comparing the "physical, physiological or behavioural human features" with the goal of, as the Minister said, ruling persons in or out. Therefore, this is around saying that you think this person whom you see on the bus and this person whom you see in this photograph is the same person. That is part of that process of biometric identification. You are not looking at a searching or a gathering of the pure databases. You are looking for where you seek to find physiological, physical or behavioural feature A matching up with the same feature in database B.
There is another point that I made that the Minister did not respond to, I am afraid. The Minister went back to the suggestion of us comparing the photograph with our Interpol most wanted list or whatever we might want to do, but that would be comparing biometric information with relevant other information, which may include biometric but also includes names. It is a particular category. What is described in recital 17 to the Act and the example given is not that. This is an example described by the drafters of the EU AI Act as to what post-remote biometric identification might look like. They describe pictures, such as the photograph the Minister just mentioned, or video footage generated by closed circuit television cameras or private devices like a phone, and comparing the biometric information in one with the biometric information in the other. That is biometric identification. That is how it is described by the drafters of the EU AI Act and that is exactly what the Minister has described under his biometric analysis, which is, in respect of an unidentified individual, the automated recognition and categorising of physical, physiological or behavioural human features by processing different documents in respect of other instances of "the particular" unidentified individual. The Minister is saying that we have identified this particular individual and now we will go and identify them in other instances in other forms of databases and other forms of footage. However this is flipped and spun, what the Minister is describing there - the particular individual appearing in different footage - is exactly what is being described as the comparison between footage generated by private devices, pictures and footage, and the language generated and looked at in terms of a natural person. The EU drafters are very explicit that that is irrespective of the technology processes or types of biometric data used.
It is a concern that the safeguards that should be attached to the kinds of activity proposed in relation to biometric analysis are not being attached because of the renaming of it as biometric analysis.
There is an even greater concern that this Bill seeks to narrow the scope and change the important definition of biometric identification set out in the EU AI Act, again, set out, because it is identified as a high-risk AI system. It is categorised as high risk. For a security conscious Minister and a Minister concerned with justice, when something is categorised as high risk, surely we should not be trying to narrow and dilute its application. When something is categorised as high risk, we should not accept it is high risk but only use the safety net in this one instance of it, if it is comparing with the database of named individuals, even though safety nets are recommended across the board for the kinds of activity comparing biometric with biometric.
I would like clarity on why the Minister is choosing to narrow biometric identification to only where it is being compared with databases of named individuals in absolute difference of approach to anything in the AI Act. Why is that choice being made? We can continue to use different terms in terms of biometric analysis, but I would like an answer in terms of that. Will the Minister accept that where biometric analysis is being compared, the databases can include CCTV and footage from a Garda recording device, for example? That is what I would like to clarify, that is, it is not narrowed to solely that category and it is quite serious.
I move amendment No. 2:
In page 5, to delete line 33.
I second the amendment.
I move amendment No. 3:
In page 6, to delete lines 1 to 5 and substitute the following:
“ ‘biometric identification’ means the automated recognition of physical, physiological, behavioural, or psychological human features for the purpose of establishing the identity of a natural person by comparing biometric data of that individual to biometric data of individuals stored in a database;”.
I second the amendment.
Amendments Nos. 4 to 6, inclusive, and 10 are related, and may be discussed together, by agreement. Is that agreed? Agreed.
Amendments Nos. 4 to 6, inclusive, and 10, are my amendments. I am proposing to make them to section 43C to include international co-operation as a purpose under the Bill. This is to ensure that there is clarity that the Garda may use biometric analysis where it is necessary and proportionate to do so, in the context of its co-operation with other international law enforcement authorities such as those in other member states. The provisions of the Bill will therefore apply to such co-operation. The amendments to subsection (6), on the data subjects that may be searched, and subsection (11), which provides definitions for the section, are consequential amendments to the insertion of a new purpose under subsection (2). I believe this amendment to ensure that there is permission for use of biometric analysis, where it is necessary and proportionate to do so for international co-operation, is appropriate, considering that this type of technology will be of considerable assistance in trying to investigate child sexual abuse on the Internet, which, regrettably, is now so common in terms of Garda investigations. It is essential, because of that international nature of this heinous criminal act, that there is an ability for An Garda Síochána to co-operate with their international police partners in other countries.
The Minister might clarify. While I am of course in favour of international co-operation on these important issues, I am concerned because the Minister did not answer my question. Other countries may use different definitions of biometric identification. For example, other countries could use the definition that is in the EU AI Act, and other countries do not have a bespoke biometric analysis definition. This is what I mean by being quite serious. We talked about a thing that is of high risk in terms of how it is done, but that is not about not doing it, it is about doing it properly. If we have made up our own definition of biometric analysis and other countries do not have that because they have biometric identification under the EU AI Act, how is that going to affect our co-operation? How is that going to affect a like-with-like comparison when we are working with others across Europe on this? Will the Minister have his biometric analysis material brought into comparison with the biometric identification? Will he be expecting them to narrow their definition of biometric identification to only include comparison with named databases? This is what I mean when I say it is quite serious if we are not taking on a common definition when, as the Minister has rightly pointed out, these are areas where co-operation is needed. I would like an answer as to why the Minister is choosing to narrow biometric identification to only situations where it is with a database of named individuals. I would also like to know how the Minister envisages co-operating when we have put our own definition of biometric analysis, and many other countries will probably have biometric identification. In that context, it is hard to see how the co-operation is to be effective. I would appreciate answers on these. It is important.
I thank Senator Higgins-----
Even for prosecution, I should say.
The reason I did not stand up the last time was because I was only allowed to speak once. However, now I am allowed to speak twice because I am the mover of the amendment. The mover of an amendment is entitled to speak twice on Report Stage, but I am not. That was the reason I did not stand up in response to the Senator's previous contribution.
That is why I wish to give the Minister the opportunity.
I also believe that the answer I provided was sufficient to answer the queries that she raised. The Senator talked about the proposed amendments to section 43C. As she will be aware, the primary amendment I am putting forward here is to include a new paragraph in section 43C(2). It provides that a member of Garda personnel shall not carry out biometric analysis other than for one of the following purposes, and the new purpose I am putting in is where it is necessary for co-operation with one or more other law enforcement agencies in relation to the prevention, investigation, detection or prosecution of criminal offences. In that instance, a query may come from another international law enforcement agency in respect of a missing person or perhaps a child who has perhaps has been criminally assaulted in terms of child sexual abuse material on the Internet. That is one context in terms of how it may arise. In the alternative, there may be a desire on the part of An Garda Síochána to find out information in respect of a child victim in terms of child sexual abuse material or a missing person in Ireland or both. There has to be international co-operation between the police force in Ireland and international police forces.
When it comes to the purpose of biometric analysis, the new purpose I want to put in is to facilitate that co-operation. It does not necessitate or require that the other country or police force that is requesting co-operation specifies whether they are coming to us pursuant to biometric identification or seeking other information derived from a database. This would be a query arising from another international police force or a query made by the Garda to that police force in respect of an individual whose image is on a piece of video footage. The Garda is using the analysis power that it has under this legislation to try to filter, sort out or rule out individuals in terms of the persons, whether or not it is a missing person, information for which has been provided by another police force, or whether or not it is a person who has been the subject of sexual abuse online and there is co-operation in that regard. There has to be an ability for the Garda exercising these powers to do so for the purpose of ensuring that it is providing co-operation to or seeking co-operation from other international agencies.
Amendments Nos. 7 and 8 are related and may be discussed together by agreement. Is that agreed? Agreed.
I move amendment No. 7:
In page 7, between lines 16 and 17, to insert the following:
“(7A) Where biometric analysis is carried out in accordance with section 43C(2), such use shall be subject to a data protection impact assessment.”.
I second the amendment.
I begin by noting that the Minister has sadly again declined to answer my repeated question as to why he is choosing to narrow the definition of biometric identification to only include situations where it is being compared with a database of named individuals when that is not what the EU AI Act defines it as or applies it to. If the Minister recalls my previous intervention, I was clear on the importance of international co-operation. That is why it is important we co-operate with regard to international definitions. We should expect Ireland to seek to be aligned with other countries that are also engaging in biometric identification in order for us to be able to work and co-operate with them. I have asked the Minister this again and again. It is quite an anomaly. Frankly, the narrowing of the definition of biometric identification to say it only applies when it is compared with a database of named individuals, when that is not how it is understood in the EU context or by others, is a big red flag. I will continue to say it. We still have not had a rationale for it.
I know there has been certain grace given to Ireland within the EU AI Act because of Northern Ireland. There is this idea that Ireland will have flexibility when it comes to certain measures. That flexibility has been somewhat misused in this legislation, however.
One area where we do not have flexibility is GDPR. There are clear requirements under GDPR. Ireland does not have a special carve-out, opt-out or anything else when it comes to data protection. Those same issues the Minister mentioned about proportionality, necessity and all of the other safeguards of GDPR still apply. That is why I suggest in amendment No. 7 that where biometric analysis is carried out in accordance with section 43C(2), it should be subject to a data protection impact assessment. Amendment No. 8 would also make biometric analysis carried out in accordance with section 43C(2)(a) subject to a data protection impact assessment.
We discussed this issue on Committee Stage, but the Minister did not have the opportunity to come back in. Perhaps he will now. The European Data Protection Board has issued guidelines on the use of facial recognition technology. When we talk about AI and computer-enabled processing of footage, photographs, videos, CCTV footage and the use of body cameras, we are talking about facial recognition. That is the kind of software and technology being used. The data protection board was asked to provide guidelines on the use of facial recognition technology in the area of law enforcement. It was asked to specify how those guidelines outline specific scenarios, examining the remote processing of biometric data in public spaces for identification purposes. Let us use the same exact scenario where the window gets broken and someone gets on a bus. That person may be seen later at a railway station or on another piece of CCTV. Maybe someone takes a photograph, but is it the same person? Is it the same particular individual as is described under the Minister’s definition? The European Data Protection Board was asked whether facial recognition technology could be used to examine biometric data in public spaces for identification purposes and it found that such use would constitute a disproportionate interference in the data subject’s rights under Articles 7 and 8 of the Charter of Fundamental Rights of the EU.
Article 26.10 of the AI Act, which we will be discussing further when we come to amendment No. 9, is quite clear in this regard. It outlines that, "Deployers shall submit annual reports to the relevant market surveillance and national data protection authorities on their use of post-remote biometric identification systems". Post-remote identification systems use material, such as pictures or video footage, generated by CCTV or private devices in respect of natural persons. There is a clear requirement to ensure a line of communication between the deployers of high-risk AI systems, like those employed for biometric analysis or identification, and the data protection authorities. That is outlined by the expectation of an annual report. If the Minister does not want to accept our amendments, which look for specific data impact assessments, will he outline the processes by which he will be ensuring, in an ongoing way, that the use of biometric analysis by authorities is continually and regularly - at least annually as outlined in the AI Act – in compliance with GDPR, given the scenarios the Minister used and those the data protection board described as being in breach of the data protection Act are very similar?
Under the AI Act, Article 27 states that deployers "shall perform an assessment of the impact on fundamental rights that the use of such systems may produce". Can the Minister tell us definitely that there has been, or will be, an impact assessment regarding the use of these systems?
I thank Senator Higgins for her amendments. We are discussing amendments Nos. 7 and 8. Before getting into the substance of the amendments, I wish to address the question Senator Higgins raised at the outset. She again said that I failed to identify the distinction between biometric analysis, which is provided for in this legislation, and biometric identification, which she rightly says is covered in the AI Act. While I do not want to go back over old ground, the biggest distinction between the two is the fact that biometric identification involves identification against a database of biometric information. I will provide an example of the use of biometric identification, were it to be introduced. The way it would operate is that the Garda on its systems would have photographs and images of tens of thousands of people. If the Garda identified an individual committing an offence or a suspect it was interested in identifying coming out of a nightclub in Dublin last night, if gardaí got his image, they would play and reference it against the database of those tens of thousands of individuals. If the system identified the individual as, say, Mark Daly, that is an example of biometric identification. It identifies the individual against a database.
Biometric analysis is different. It does not have a database. The name of the individual is not known after the process, but it provides the Garda with an opportunity to filter, sort or seek to know whether the person in the image is the same as a person in a subsequent image. We do not have a database.
The amendments proposed here are to include a new subsection in section 43C providing for data protection impact assessments where biometric analysis is carried out in the context of both sections 43C(2) and 43C(2)(a). Section 47A, which I will refer to presently, is to be inserted by section 10 of this Bill. I want Senator Higgins and other Senators to know that this already provides for data protection and human rights impact assessments to be conducted prior to the use of biometric analysis as part of the development of a code of practice.
The GDPR that Senator Higgins referred to is a regulation that is directly effective in Ireland. In terms of its transposition, the Data Protection Act is also operating in Ireland. This legislation cannot ignore other legislation. Even if that other legislation was not there, I would be very satisfied because of what is being proposed under Part 8A of the Bill and the codes of practice for Part 6A that the concerns the Senator has will be met in the legislation and the codes of practice.
Section 10 of the Bill inserts a new section 47A that will provide for a code of practice for biometric analysis. What the House will notice in subsection (2)(c) is that the draft code of practice shall include provisions relating to "the confidentiality, security, storage, access, retention, erasure and destruction of data obtained as a result of the operation of Part 6A", which is biometric analysis. There is a clear statutory imperative that the code of practice must deal with all those data issues, whether confidentiality, security, storage, access, retention, erasure or destruction. If that is not sufficient, the Garda Commissioner, who is responsible for preparing a code of practice, must, in accordance with section 47A(4), consult with a number of other statutory entities. One of those entities is the Data Protection Commission. Another is the Irish Human Rights and Equality Commission, IHREC. In terms of the requirements for the code of practice, there is a requirement on the Garda Commissioner to engage with the Data Protection Commission and IHREC in respect of how the code of practice operates, particularly in light of the statutory obligation on him to ensure that the code of practice respects the data requirements that I just spoke about a few moments ago. Even if that was not sufficient, the draft code of practice must then be presented to me so that I get an opportunity to appraise it. Then, it is set before the Houses of the Oireachtas and Members of this House and the Lower House shall have an opportunity to assess it. It will not come into force until such time as there is a vote of both Houses of the Oireachtas to approve the code of practice.
When the Senator looks at the concerns she has in terms of whether there will vigilance in respect of data, there is a whole myriad and series of layers there to ensure that data is protected in accordance with the laws that exist at present. First, there is the operation of GDPR, which is directly effective. Second, there are the provisions of the Data Protection Act. Third, there is an express statutory requirement on the Garda Commissioner to ensure that the code of practice covers issues in respect of the confidentiality, storage and destruction of data. Fourth, there is a requirement on the Garda Commissioner in terms of preparing that code of practice, which has those statutory obligations contained in it, to consult with the Data Protection Commission and IHREC. Finally, it has to go past me. Even if I am asleep at the wheel, there is the requirement that it be presented to both Houses of the Oireachtas to ensure that it only comes into force if there is a vote of both Houses of the Oireachtas. I have no doubt that, if there were any defects or flaws in the area of data retention and protection, they would be readily identified by Members in this House and the Lower House during that process.
I thank the Minister. He again sought to clarify between biometric analysis and biometric identification. That was one question we had, but the actual question I have been asking repeatedly is why he is choosing to narrow the definition of biometric identification that he proposed in this legislation. When the Minister spoke, he compared biometric information with a biometric database. That is not what the legislation states. The legislation states it is of named individuals. The Minister is proposing that biometric identification will only be deemed to be happening when the biometric information is compared with a specific database that contains names. That is a radically different and narrower definition of biometric identification than what we have in the EU AI Act. I will read recital 17 of the Act again for clarity. It states:
... 'remote biometric identification system’ ... should be defined functionally, as an AI system intended for the identification of natural persons [which sounds very like the particular persons mentioned in the Minister's definition] without their active involvement, typically at a distance, through the comparison of a person’s biometric data with the biometric data contained in a reference database, irrespectively of the particular technology, processes or types of biometric data used.
Even if the Minister were to argue that names are somehow biometric data, which they are not, is he willing to say that these names with photographs contain biometric data, too? The point is, recital 17 explicitly stated that it should not be narrowed. The document goes on to clarify further and gives the example of the kinds of databases where material is being compared, such as pictures or video footage generated by CCTV or private devices, and where those are generated before the use of the systems. This language of a reference database containing named individuals is an extraordinary narrowing of what is meant to be a comparator of biometric information with a biometric database or databases. The EU drafters make the greatest of efforts to be clear that they wish to be technology neutral in this regard. The Minister is saying it is only going to apply to databases of named individuals. That is an extraordinary choice. Why has the Minister narrowed it to named individuals versus a comparison of biometric data with a database of other biometric data? Why is he choosing to introduce an extra layer of requirement that it will only be biometric identification when it is compared with the persons who we not only have pictures of but have their names? That is a choice. It is a choice that is at odds with the EU AI Act. That is why I have concerns about how it is going to be applied and what its implications will be for the necessary international co-operation we might need in all of the instances outlined.
Returning to amendments Nos. 7 and 8, it is good that there will be a code of conduct. The problem is the idea that a data protection impact assessment is done at the very beginning, it inspires or influences the writing of the code of conduct, there is engagement on that and then it is left. The AI Act's drafters envisage that deployers - those who are doing this work - would be submitting annual reports to the relevant national data protection authorities on their use of these identification systems.
They are not saying to consult with them when you set out the code of conduct at the beginning. I worry that so much has been placed on the Garda Commissioner. Ministerial accountability is important and of ongoing relevance as well. We know in other situations that individually you cannot just make a general rule. You either have to apply your data protection assessment individually as came up on the information and tracing Bill, or you have to look at creating clear regulations that meet necessity and proportionality. I guess the code of conduct is a proxy for regulations here because the Minister is placing it before the Houses of the Oireachtas. That is a good step, and I welcome it. However, I am concerned as to whether it is the Garda Commissioner's code of conduct, the State's code of conduct or the Minister's code of conduct. What happens if that code of conduct proves to be poorly drafted and not appropriate for the facts, challenges or issues that are arising? What is the mechanism for the annual reporting required and suggested under Article 26.10 of the AI Act? What does it look like after the code of conduct gets voted through by the Oireachtas? What happens next in terms of a data impact assessment and data protection? Also, where does the accountability ultimately sit? Is it with the Garda Commissioner or with the Minister? I would also like that clarified.
I move amendment No. 8:
In page 7, between lines 16 and 17, to insert the following:
“(7A) Where biometric analysis is carried out in accordance with section 43C(2)(a), such use shall be subject to a data protection impact assessment.”.
I second the amendment.
I move amendment No. 9:
In page 7, lines 18 to 20, to delete all words from and including “a principal” in line 18 down to and including line 20 and substitute the following:
“the principal purposes outlined in section 43C(2)(a) and (b) unless the use of such results has been approved by a decision of the Circuit Court.”.
I second the amendment.
The Minister stated on Committee Stage that we had opted into the policing sections of the AI Act. However, it is difficult to see how that is going to work given legislation before us because the safeguards in the AI Act are detailed and extensive. Our amendments have consistently sought to better align this Bill with the protections and practices in the AI Act. Again, if we opt in to Article 26.10 we should be mindful of what that contains. It states:
In the framework of an investigation for the targeted search of a person ... convicted of ... a criminal offence, the deployer of a high-risk AI system for post-remote biometric identification shall request an authorisation ... without undue delay and no later than 48 hours, by a judicial authority or an administrative authority whose decision is binding and subject to judicial review, for the use of that system.
This is an example of the nuance in the actual AI Act. If there are times when you have to engage in biometric identification at short notice, you have to move forward in identification of a person where there is clear risk but you make sure that within 48 hours, you get appropriate judicial approval. It recognises the urgency and the accountability. That is the balancing act and that is the piece missing from this legislation. The system outlined in the Bill allows for the results of biometric analysis to be used subject simply to approval from a second garda. If you have a garda and then you have any other garda, you are ready to go. It does not require senior gardaí or higher authorities. It does not require, either before the fact or after the fact, appropriate judicial permissions to be given. It is simply a second garda. Considering that the AI Act calls for judicial approval normally before a biometric identification system is used, or post facto in certain circumstances, this is a wildly out-of-step approach being proposed here. Our amendment would ensure that the results of biometric analysis would not be used without the court approval in instances relating to the investigations of offence. It would allow for the expedited use of biometric analysis in the case of searches for missing persons. We identify, as the Minister has, that those are issues where time is of the essence. It suggests there may be differing procedural protocols with regard to those uses. Article 26.10 of the AI Act goes on to state that, "If the authorisation requested pursuant to the first subparagraph is rejected, the use of the post-remote biometric identification system linked to that ... authorisation shall be stopped" and the personal data would then be deleted.
There are other obligations in Articles 26 and 27 that are just not present in this Bill. It is again notable from the code of conduct that Article 26.10 states "Each use shall be limited to what is strictly necessary for the investigation of a specific criminal offence." It goes on to state that "In no case shall such high-risk AI system [again, these are categorised as high-risk AI systems] for post-remote biometric identification be used for law enforcement purposes in an untargeted way". It should ensure, "that no decision that produces an adverse legal effect on a person may be taken by the law enforcement authorities based solely on the output of such post-remote biometric identification systems". Article 26.8 also suggests that public authorities using high-risk AI systems will comply with registration obligations under Article 49 and only use systems that are registered within an EU database. Perhaps the Minister will clarify if the systems the Garda will be using will be registered on the database referenced in Article 71 of the EU AI Act. Or does the novel term "biometric analysis" mean that we will not be registering under that either?
On Committee Stage we talked about the second pair of eyes, and sadly there was strong rejection of amendments others had put forward to ensure the misuse would have particular offences attached to it. With absolute respect to the Minister, simply having the four eyes of two gardaí of any level on this and signing off on the use of a high-risk AI system without proper previous or after-the-fact systems in place comprised of the safeguards sought elsewhere is a serious concern. He might also answer the question about Article 71. Given that it will be his last opportunity to reply at this point, he may wish to address the issue of why he is only including databases of named individuals as biometric identification, when the AI Act is clear that it is biometric information. Why is the Minister introducing an extra hurdle for biometric identification to take place, and that it is only taking place when it is compared with a database of named individuals, given that names are not biometric? It will be his last opportunity to address that question if he wishes to.
I will take up Senator Higgins's offer before I deal with the substance of amendment No. 9. The Senator mentioned a number of issues of concern at the outset. In substance, I think her criticism is that I am not introducing the biometric identification that is defined within the AI Act. She is correct in that respect. I am not introducing biometric identification. Through this legislation I am introducing biometric analysis.
And a definition for biometric identification.
The Minister without interruption.
It is unusual because had I come here with legislation saying I am introducing the biometric identification provided for in the AI Act, I suspect Senator Higgins would have been vigorously opposed to that and would be asking me why I was introducing this excessive and disproportionate measure. I suspect that is what she will say when I bring forward legislation seeking to introduce biometric identification, hopefully later this year or next year.
Senator Higgins also correctly said that names are not biometric. That is correct. However, the difference between biometric analysis and biometric identification is that the latter, as I have repeatedly stated, is a process whereby an image is compared against a database of named individuals but the database contains biometric information.
Why are names-----
It contains photographs and other biometric information.
The Senator asked whether the database will be registered under the provision contained in the AI Act. Obviously, once this legislation is enacted, it is not the case that the Garda will be able to engage in biometric identification against a database so there will not be any necessity or requirement to introduce the registration of such a database.
Senator Higgins also raised the issue of the code of conduct and whose code of conduct it is. It is the code of conduct that is prepared by the Garda Commissioner in consultation with, in the instance of what we are discussing here, the Data Protection Commission and the Irish Human Rights and Equality Commission. It also must be prepared in consultation with me and with the Policing Authority and the Office of the Police Ombudsman, Fiosrú. This clearly is a code of conduct into which there will be inputs from many significant stakeholders, including me. It will come to me and ultimately be approved by the Houses of the Oireachtas. Although it is a code of conduct prepared by the Garda Commissioner, if it subsequently comes into effect, it is a code that has had the sanction and that has been consulted on with many important stakeholders in the sphere.
I will turn to amendment No. 9 being put forward by Senator Higgins. Senator Higgins wants to change subsection (8) of section 43C so that it reads the results of biometric analysis shall not be used by An Garda Síochána, except with there being an order of the Circuit Court, "unless the use of such results has been approved by a decision of the Circuit Court". What I propose and what is there at present is that the results shall not be used "unless such results have been reviewed by a member of Garda personnel and have been ascertained by him or her to be of sufficient reliability to be so used".
It is extremely important that we emphasise that the use of biometric analysis is an investigative tool to assist the Garda in very serious criminal investigations, as I have outlined previously, in respect of child sexual abuse. It is a tool. No one is suggesting that somebody is going to be convicted exclusively on foot of the use of this tool. However, it is an important tool. If we were to put in place the amendment suggested by Senator Higgins, it would lead to extraordinary consequences where a member of An Garda Síochána conducting an investigation using biometric analysis would not be able to act on foot of the results of biometric analysis unless he or she got an order from a Circuit Court judge to say they are permitted to use this investigative tool for the purpose of the serious investigation. It would have a chilling impact on investigative work done by An Garda Síochána. For example, with child sexual abuse material investigations, which I have raised repeatedly, a garda could be looking at hundreds if not thousands of victims or suspects within a single device and if an authorisation process is imposed it would mean not only would gardaí be spending time making applications to the Circuit Court but court services would be inundated with authorisation requests. This would not free up resources or speed up investigations. Rather, it would have the opposite effect and pose significant operational difficulties, particularly in the context of these types of investigations. What we can all agree on in child sexual abuse material investigations is that gardaí must be able to sort through the volumes of material they find as quickly and efficiently as possible to remove victims from harm and bring perpetrators to justice.
If we look at the types of searches gardaí may perform, a facial image will not always be used. It could be searches for a particular hair colour, height or distinctive facial feature. Is it an effective or efficient use of Garda time or resources for gardaí to have to make an application every time they wish to search for the height or age range in this type of data in order that they can filter out relevant images? If we were to proceed on the basis of this amendment we would increase the risk that suspects may flee the jurisdiction, as can be the case in current manual systems. In a serious crime investigation sometimes speed is of the essence to ensure that those who perpetrate serious offences are not permitted to remove themselves from the reach of the investigation. Any search will only provide investigative leads. As I say, it is an investigative tool. It is grouping relevant images together or finding relevant frames in CCTV footage gathered in an investigation into serious crime so that a person can review the relevant footage or have a starting point for their review.
The purpose of the current subsection (8) is to ensure that there is not an over-reliance on the technology and that trained gardaí are interrogating results. It is much more appropriate that that be the method by which human involvement is here, that members of the Garda themselves review this investigative tool as they review all the investigative tools that they use at present. It would be completely inappropriate to put in a requirement that when members of the Garda are engaged in an investigation, before they act on foot of some lead obtained in an investigation they have to get approval from the Circuit Court for the purpose of continuing with that lead.
It also begs the question of who is going to be the respondent in such an application? Under Senator Higgins's application, the Garda Commissioner has to go to the Circuit Court. Who is on the other side? Who will be the person who is the legitimate contradictor saying this should not happen? Obviously, we cannot put on notice of the suspect or indeed the victim. We will have this bizarre system whereby the Circuit Court is not going to be determining an adversarial dispute. Instead, under this proposed amendment, it will be asked to second-guess and to review the work of An Garda Síochána to see whether it should be permitted to continue with the fruits of its investigation. That would not just undermine An Garda Síochána terribly but would also have a significant negative impact on the work of the Judiciary.
There are search warrants and arrest warrants, there are safeguards. The Minister's picture of the police at work suggests that any delay, anything that gets in the way or any check and balance is intolerable. Let us have everybody into every house they wish to go into. This is what the Minister is describing. What the Minister has described is that a check and balance would be extraordinarily onerous, whether or not he likes this check and balance. He could say "I do not like the Circuit Court". Let us bear in mind that on Committee Stage he also rejected moderate requests that at least a senior officer would be reviewing it and signing off. At the moment, it requires two members of the Garda at any level. The Minister specifies trained individuals. Are all gardaí in Ireland going to become experts in the appropriate uses of all AI technology? The Minister is not talking about designated gardaí or designated decision-making or a safety net within An Garda Síochána against which these decisions should be checked. It is literally one garda and any other garda.
The Minister does not like the requirement around the Circuit Court, but in adversarial cases people look for search warrants all the time and get them quickly. They look for search warrants and arrest warrants and this is a similar mechanism.
There is an individual on the other side who is a respondent.
Nonetheless, there is a property or an individual, either way. What the Minister is talking about here refers to the searching and the mechanisms. This relates to that definition. It is disingenuous to say this Bill has nothing to do with biometric identification, which is coming later, because he put the definition of biometric identification into this Bill.
If the Minister claims it has no relevance to what is in the Bill, why insert a definition that is at odds with what is happening elsewhere and that includes names? If the Minister does not like the Circuit Court idea, why reject the concept of having sign-off from a senior garda? He may think the bar I am suggesting is too high. The bar as he has it right now is extraordinarily low and highly at odds with what is envisaged under the use of - I will say it because this is the last time I will get an opportunity to do so - high-risk AI systems that are categorised as such. Very few areas of AI usage are categorised as high risk. We are talking about high-risk tools being used on the say-so of any two gardaí. The Minister rejected the idea of the courts. Previously, he rejected the idea of senior officers. He has not proposed any other mechanism regarding how sign-off will be achieved.
The Minister used examples. We all want to see these examples. That is why I referenced the idea of doing it post facto. The latter is something I would be open to. It is what is in the AI Act in the context of biometric identification. The AI Act refers to authorisation being requested within 48 hours. That would be satisfactory. I would be very happy with a different version of my amendment which did that in the case of missing persons and identifying those kinds of things. It is not simply the same to say that we are fighting crime and that crime is serious. We do not live in a world where it is only Batman and his sidekick involved, and if they both think it is worth doing, they can go ahead and do it. That is what the Bill sets out. We need to have safeguards. We have them in here because of the risks involved, including in the context of abuse, which the Minister rejected, as he did some of the safeguards around penalties put forward previously in relation to abuse.
The Minister and I disagree on this. I reiterate that the bar as set out in this Bill is too low, does not provide adequate safeguards and falls very short of what is envisaged in the AI Act. The Minister may speculate about how I would have liked that to be and say that I am giving out. Of course, I have strong opinions about the AI Act and about the omnibus that will seek to dilute that Act during Ireland's EU Presidency. I have strong views on these things, but I also recognise that a process is at play. I am concerned that said process is being somewhat disregarded in the context of this domestic legislation, which seems to plough its own furrow.
Is the Senator pressing the amendment?
When is it proposed to take the next Stage?
Is that agreed? Agreed.
