WRITTEN QUESTION E-1723/02 by Bart Staes (Verts/ALE) to the Commission. The protection of privacy and electronic data processing.
Date: 2002-06-13
Institutions: European Parliament, Provisional data
Subjects: Belgium, EU programme, biometrics, computer crime, data processing, data protection, database, identity document, mobile phone, personal data, protection of privacy

6.3.2003

EN

Official Journal of the European Union

C 52 E/97

(2003/C 52 E/109)

WRITTEN QUESTION E-1723/02

by Bart Staes (Verts/ALE) to the Commission

(13 June 2002)

Subject: The protection of privacy and electronic data processing

As part of the e-government programme in autumn 2000 the Federal authorities decided that by 2005
every Belgian would be required to carry an electronic identity card. An article which appeared in the
21 May 2002 issue of ‘De Morgen’, entitled ‘New identity card brings Big Brother to your doorstep’, claims
that so-called super databases are being developed which will store tax, medical and police data. Alongside
this information, biometric data will also be stored by means of which the authenticity of
facial
characteristics can be checked. Using the secret code from the identity card, this highly personal data can
be accessed via a web portal (cid:1) all that is needed is a combination of four figures. In addition, according to
the article these databases are to be interlinked, so that access to them would offer very lucrative prospects.

As things stand, there is virtually no supervision of stores of data of this kind. The monitoring authority
(the Commission on the Protection of Privacy) is not subject to parliamentary scrutiny and does not have
enough staff to carry out proper supervision. Moreover, one member of that Commission is also the head
of the body responsible for coordinating the electronic identity card project.

What view does the European Commission take of the interlinking of police, medical and tax databases?

Is simultaneous membership of the Commission on the Protection of Privacy and responsibility for the
electronic identity card project consistent with European law and how can the Commission explain this?

Is the protection of data solely by means of a pin code not technically and organisationally inadequate in
order to provide full guarantees of the protection of privacy, and on what arguments is the Commission
basing its position?

(2003/C 52 E/110)

WRITTEN QUESTION E-1724/02

by Bart Staes (Verts/ALE) to the Commission

(13 June 2002)

Subject: Electronic identity cards and the protection of personal data

As part of the e-government programme in autumn 2000 the Belgian authorities decided that by 2005
every Belgian would be required to carry an electronic identity card. In order to make the exchange of data
between individual authorities and between the authorities and their customers as secure as possible, the
Fedict
launched the Public Key
Infrastructure (PKI), also referred to as the certification services rule. The card containing the private key
should preferably be kept on a chip secured by means of a pin code.

(Federal Agency for Information and Communication Technology)

An article which appeared in the 12 May 2002 issue of the New York Times claims that this chip
technology can be copied. Two computer security researchers, Sergei Skorobogatov and Ross Anderson, of
the University of Cambridge have demonstrated that information can be extracted from the chips with the
aid of a simple camera flash-bulb and a microscope. In this way, criminals would have no problem
whatsoever in obtaining personal information. In addition to electronic identity cards, this technology is
also used in a number of other applications, e.g. in credit and charge cards and the GSM SIM cards in
widespread use today. An IBM paper entitled ‘Partitioning attacks: or how to rapidly clone some GSM
cards’ has confirmed the vulnerability of this technology. The researchers demonstrated that they could
extract information from the SIM cards much more quickly.

Can the Commission confirm that these worrying reports are correct?