WRITTEN QUESTION E-1723/02

by Bart Staes (Verts/ALE) to the Commission

(13 June 2002)

Subject: The protection of privacy and electronic data processing

As part of the e-government programme in autumn 2000 the Federal authorities decided that by 2005 every Belgian would be required to carry an electronic identity card. An article which appeared in the 21 May 2002 issue of De Morgen, entitled New identity card brings Big Brother to your doorstep, claims that so-called super databases are being developed which will store tax, medical and police data. Alongside this information, biometric data will also be stored by means of which the authenticity of facial characteristics can be checked. Using the secret code from the identity card, this highly personal data can be accessed via a web portal all that is needed is a combination of four figures. In addition, according to the article these databases are to be interlinked, so that access to them would offer very lucrative prospects.

As things stand, there is virtually no supervision of stores of data of this kind. The monitoring authority (the Commission on the Protection of Privacy) is not subject to parliamentary scrutiny and does not have enough staff to carry out proper supervision. Moreover, one member of that Commission is also the head of the body responsible for coordinating the electronic identity card project.

What view does the European Commission take of the interlinking of police, medical and tax databases?

Is simultaneous membership of the Commission on the Protection of Privacy and responsibility for the electronic identity card project consistent with European law and how can the Commission explain this?

Is the protection of data solely by means of a pin code not technically and organisationally inadequate in order to provide full guarantees of the protection of privacy, and on what arguments is the Commission basing its position?

Joint answerto Written Questions E-1723/02 and E-1724/02given by Mr Bolkestein on behalf of the Commission

(26 September 2002)

The Commission was apprised of the proposals for Belgian regulations introducing a digital identity card through a notification pursuant to Directive 98/34/EC(1) (directive imposing notification of proposals for national regulations relating in particular to information society services). Belgium notified the proposed legislation (Ref. No 2001/474/B) and asked for the texts to be treated in confidence pursuant to Article 8(4) of the aforementioned Directive. Subsequent to an analysis of the proposed legislation, the Commission issued a reasoned opinion and observations. The reasoned opinion related essentially to the technical annexes with a view to ensuring that they complied with Council Directive 73/23/EEC of 19 February 1973 on the harmonisation of the laws of Member States relating to electrical equipment designed for use within certain voltage limits(2) and Council Directive 89/336/EEC of 3 May 1989 on the approximation of the laws of the Member States relating to electromagnetic compatibility(3). The observations, for their part, concerned the data protection aspects.

The Commission would point out that, as things currently stand, although there are plans to simplify certain existing procedures governing access or the communication of personal data, the proposed legislation does not specifically provide for the interconnection of medical or tax databanks.

The Commission nevertheless recognises the importance of the concerns raised by the honourable Member and will bear them in mind when assessing the implementation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(4). That assessment should be completed by the end of 2002.

At all events, the processing of personal data, including interconnections, to be implemented in connection with the electronic identity card must comply with Directive 95/46/EC. That Directive, whose scope is limited to Community law, sets out the principles and conditions governing the processing of personal data. In particular, it imposes the obligation to process the data fairly and lawfully and not to process them subsequently in a way incompatible with the purposes for which they were compiled. Directive 95/46/EC also contains a principle forbidding the processing of data relating to health, while providing for various exceptions. Moreover, it lays down that the conditions for the use of unique identifiers must be determined.

In addition, Directive 95/46/EC lays down the obligation to ensure that data are protected against accidental or unlawful destruction, accidental loss, modification, dissemination or unauthorised access, as well as against any other form of unlawful processing. Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector, which will be replaced as from 31 October 2003 by Directive 2002/58/EC(5), also contains specific security obligations concerning public telecommunications networks and telecommunications services accessible to the public.

The Commission is following with particular attention technological developments relating to the security of data exchanges. It would point out in this context that the level of security provided by using a public key infrastructure depends not only on the level of security offered by

the technical components of the infrastructure, but also on the quality of the security procedures, and above all on how strictly they are implemented (smart card, key generation, authority issuing the certificates, validity of the certificates, etc.).

The Commission is devoting particular attention to the security technologies used for transferring personal data. It would stress, however, that there is no such thing as an absolute level of security and that, pursuant to Directive 95/46/EC, the appropriate level of security having regard to the risks posed by the processing of personal data and the nature of the personal data to be protected must be assessed in the light of the state of the art and the costs involved in implementing the security measures.

As regards the composition of the supervisory authorities entrusted with monitoring the application of the provisions adopted by the Member States, Directive 95/46/EC lays down that those authorities shall perform their tasks in complete independence. However, the Directive does not provide any further indication on the manner in which that independence must be ensured. The Commission would point out in this context that, pursuant to the Belgian Law of 8 December 1992 on the protection of privacy with regard to the processing of personal data, the Belgian authority responsible for data protection issues is a collegiate body whose members are appointed by Parliament. That Law also lays down that the members must offer every guarantee that they can perform their tasks independently. Various measures are provided for to that end, including the ban on members being present when matters are discussed in which they have a personal interest.

The Commission would also reiterate that it is supporting research projects in the field of smart card security. Researchers Ross Anderson and Sergei Skorobogatov are involved in the G3CARD project (IST-1999-26328). This project has two objectives. In the first place, it is aimed at identifying all the attacks that can be made against a card (the flash attack is one example of the kind of attack addressed by this project). The second objective of the project is to develop a new generation of smart cards capable of resisting such new attacks.

The smart card has the advantage of greatly increasing the level of security of systems by making attacks both technically complex and cumbersome, and hence inaccessible to criminals for a certain length of time. It is, however, clear that new attacks will be discovered which will require the development of new generations of chips.

The level of GSM security was suited to the applications planned by the devisers of the standard some fifteen years ago, those applications relating essentially to telephony. The new standards for third-generation wireless telephones call for increased security with a view to allowing sensitive applications. Moreover, the security of wireless transactions will be one of the priority topics in the Community's 6th framework programme for research and technological development. At present, one of the objectives of the Embedded Finread research project (IST-2000-30091) is to transpose payment terminal security to wireless telephony, including the current GSM.

Other projects such as PKI Challenge (IST-2000-25012) and Digisec (IST-1999-20981) are working on developing the electronic signature and its corollary PKI infrastructure. The Nessie project (IST-1999-12324) is defining new cryptographic algorithms, while Verificard (IST-2000-26328) is concentrating on verifying the security of the software loaded on the card. Projects such as UFACE (IST-1999-11587) or BANCA (IST-1999-11159), for their part, are concentrating on the technical aspects of biometrics.

The Smartcities project (IST-1999-12252) is devoted to a city card. However, it has the advantage of inventing mechanisms to ensure data security. Smartcities considers that data protection will become a commercial argument, and its mechanisms could then be used by other projects.

(1) Directive 98/34/EC of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations, OJ L 204, 21.7.1998.

(2) OJ L 77, 26.3.1973.

(3) OJ L 139, 23.5.1989.

(4) OJ L 281, 23.11.1995.

(5) OJ L 24, 30.1.1998 and OJ L 201, 31.7.2002.