BRAVE NEW BORDERS Lecture 3: “Smart” Borders

1. BRAVE NEW BORDERSLecture 3: “Smart” Borders Jorrit Rijpma EUI Summer Academy 2013

2. EUROSUR: surveilling the external borders • The entry-exit system • The Registered Traveller Programme

4. 1. EUROSUR: surveilling the external borders Article 12 SBC on surveillance 4. Surveillance shall be carried out by stationary or mobile units which perform their duties by patrolling or stationing themselves at places known or perceived to be sensitive, the aim of such surveillance being to apprehend individuals crossing the border illegally. Surveillance may also be carried out by technical means, includingelectronicmeans.

5. Schengen Borders Code Parliament v. Council (C-355/10) ECJ does not define “surveillance”, but seems to implicitly agree with AG Mengozzi: surveillance authorises interventions which go beyond simply monitoring the border. Including preventive or deterrent measures (para. 58)

6. Frontex Article 7(1) of Regulation 2007/2004: The Agency may acquire, itself or in co-ownership with a Member State, or lease technical equipment for external border control to be deployed during joint operations, pilot projects, rapid interventions, joint return operations or technical assistance projects in accordance with the financial rules applicable to the Agency

7. EUROSUR Feasibility studies by Council (2003) and Frontex: MEDSEA (2006) and BORTEC (2007) Frontex’s European Patrol’s Network EUROSUR Roadmap: COM(2008) 68 final Legislative Proposal: COM(2012) 873 final Agreement in First Reading: Council doc. 11367/13, 13 June

8. EUROSUR Roadmap PHASE 1: Upgrade and extend national border surveillance systems and interlinking national infrastructures PHASE 2: Develop and implement common tools and applications for border surveillance at EU level (including “examination of the need for legislation”) PHASE 3: Create a common monitoring and information sharing environment for the EU maritime domain

9. EUROSUR proposal Article 1: Subject- matter This Regulation establishes a common framework for the exchange of information and cooperation between Member States and the Agency in order to improve the situational awareness and to increase the reaction capability at the external borders of the Member States of the European Union, hereinafter referred to as "EUROSUR", for the purpose of detecting, preventing and combating illegal immigration and cross-border crime and contributing to ensuring the protection and saving the lives of migrants.

10. EUROSUR proposal Article 5: National Coordination Centre • Each Member State shall designate, operate and maintain a national coordination centre, which shall coordinate and exchange information between all authorities with a responsibility for external border surveillance at national level as well as with the other national coordination centres and the Agency. (…) Technical Regulation with enormous transformative potential.

11. EUROSUR proposal Article 12: Common application of surveillance tools • The Agency shall coordinate the common application of surveillance tools (…) to supply the [NCC] surveillance information on the external borders and on the pre-frontier area (…)

12. EUROSUR proposal • The Agency shall provide the information referred to in paragraph 1 by combining and analysing data which may be collected from the following systems, sensors and platforms: a) ship reporting systems in accordance with their respective legal bases; b) satellite imagery; c) sensors mounted on any vehicles, vessels or other craft (EARLIER VERSION: c) sensors mounted on any platforms, including manned and unmanned aerial vehicles)

13. EUROSUR Proposal Article 10 Situational pictures consist of 3 layers: 1) Events 2) Operational 3) Analysis Article 9: National Situational Picture Article 10: European Situational Picture Article 11: Common Pre-Frontier Intelligence Picture

14. ECHR on Surveillance Peck v the United Kingdom “the monitoring of the actions of an individual in a public place by the use of photographic equipment which does not record the visual data does not, as such, give rise to an interference with the individual’s private life” (para. 132)

15. Common Pre-Frontier Intelligence Picture

16. Frontex Regulation: data processing Recital 19 and Article 11a: Regulation (EC) No 45/2001 applies Art. 11b Limited power to collect and process personal data for joint return operations Art. 11c Limited power to collect personal data during joint operations: Persons suspected of cross border crime, including human trafficking and smuggling Risk analysis and onward transmission to Europol and other EU law enforcement agencies

17. EUROSUR Proposal Recital 7 Directive 95/46/EC, Regulation (EC) No 45/2001 and FD 2008/977/JHA apply, in case more specific instruments such as Regulation (EC) No 2007/2004 do not provide for a full data protection regime

18. Cooperation with neighbouring countries Art. 18 • Exchange of information on the basis of bilateral or multilateralagreements is allowed on the condition of: a) Compliance withfundamentalrights b) Purpose limitation + compliancewith EU data protectionrules • Information thatcanbeusedtoidentify TCN in need of internationalprotectionshallnotbeexchanged • Onward transmission of the information is prohibited

19. Cooperation with Third Countries Art. 14 Frontex Regulation Cooperation with third countries Cooperation shall serve to promote European border management standards, including respect for fundamental rights Agency may launch and finance technical assistance projects in third countries Art. 11c (6): onward transmission to third countries or third parties prohibited

20. 2. Entry-Exit System EUROSUR part of the “EU border package” (COM(2008) 67-69 final) COM(2008) 69 final: “Preparing the next steps” • Entry-exit system • Registered Traveler Programme • European ESTA (Electronic System for Travel Authorisation) COM(2013) 295 final

21. 2. Entry-Exit System According to the European Commission, yearly 109 million TCN without a visa and 73 million TCNs with a visa cross the EU borders. At the same time this is only a small percentage of the overall flow across borders (consisting mainly of EU citizens) Costs of the Smart Borders proposals estimated by the Commission at 1.1. billion euro

22. Article 4: Purpose Improving external border management by providing information on entry and exit of TCNs • enhance checks and combat irregular immigration; • calculate and monitor duration of authorised stay; • assist in the identification of any person who do not fulfill conditions for entry and stay; • identify overstayers and take appropriate measures; • gather statistics.

23. Article 11 and 12: Data collected • Name • Date of birth, place of birth, country of birth, nationality or nationalities and sex; • Data relating to travel document(s); • Visa sticker number and data relating to visa • at the first entry on the basis of the visa, the number of entries and the authorised period of stay as indicated on the visa sticker; • RTP status • 10 fingerprints (if over 12yo)

24. Article 11 and 12: Data collected Upon entry: • date and time of the entry; • MS of entry, border crossing point and authority that authorised the entry; • the calculation of the number of days of the authorised stay(s) and the date of the last day of authorised stay Upon exit: • date and time of the exit; • MS and the border crossing point of the exit

25. Individual Rights and Supervision Article 21: Deletion of data in case of an “unforeseeable and serious event” Article 29: Liability for unlawful processing Article 30: Keeping of records of access Article 32: Penalties for misuse

26. Individual Rights and Supervision: Chapter VI Very similar to the other data bases we have seen: Article 33: Right of Information Article 34: Right of access, correction and deletion Article 35: Assistance by DPA Article 36: Judicial Review Articles 37-39: Joint supervision by DPA and EDPS

27. Article 46(5): Access to Law Enforcement Staff The first evaluation shall specifically examine the contribution the entry-exit system could make in the fight against terrorist offences and other serious criminal offences and will deal with the issue of access for law enforcement purposes to the information stored in the system, whether, and if so, under which conditions such access could be allowed, whether the data retention period shall be modified and whether access to authorities of third countries shall be granted, taking into account the operation of the EES and the results of the implementation of the VIS.

28. Impact assessment Civil society (academia, think tanks and NGOs) and the private sector participated actively in the debate and organised several relevant conferences. Civil society provided input in various conferences and academic papers published on the subject. Most were critical of the setting up of an EES, considered that the added value was not proven and that it would not be proportionate to collect such amounts of personal data in relation to the aims pursued.

29. Criticism 1) Costs and technical feasibility (Cf. US Entry-Exit System) 2) Necessity and proportionality • No clear figures on the extent of the problem to be solved • Only identifies overstayers as such: limited contribution to return policy • Mere statistical purpose alone cannot justify EES • Assessment should be made as regards the purpose of border management, not law enforcement.

30. Criticism • Relation with other legislation insufficiently clear: - Other data bases (SISII, VIS) - Return Directive - Visa Regulation - Schengen Borders Code - EU free movement rights • First wait for overhaul of data protection legislation • Concerns as regards the capacity of the DPAs and EDPS • First wait for evaluation of exiting systems • Reliability of the data

31. Criticism • Specific concerns as regards the data protection rights Article 20: Retention period of 181 days (entry-exit record), 91 days after last exit if no entry for 90 days (individual file) or 5 years in case of overstay Article 21: Right to have data corrected and/or deleted Article 27: Transfer of data to third countries Practical possibilities to enforce rights when no longer on EU territory, remedies left to national law

32. Registered Traveler Programme COM(2013) 97 final Fee based RTP for pre-vetted and prescreened frequent TCN with the data (biometrics, alphanumeric data and unique identifier number) stored in a Central Repository and the unique identifier (application number) stored in a token Token in the form of a machine-readable card containing only a unique identifier (i.e. application number), which is swiped on arrival and departure at the border using an automated gate.

33. 3. Registered Traveler Programme • Consequences of refusal of RTP status • De facto discrimination on the basis of wealth or origin • Biometric data (defined as “fingerprints”) • Questionable whether capable of off-setting the delays caused by the entry-exit system • Interest of private security industry

34. Final Remarks • Integrated border management and the e-border create a multi-level entry system; • Migration and security issues are conflated at the border and lead to a risk-based, automated approach towards travelers; • There is a hunger for (biometric) data and a firm belief in the possibilities of new technologies; • New technologies tested on a group that is often more vulnerable and has less easy access to legal remedies; • Technical solutions are not as a-political as sometimes represented; • Lack of clear legal drafting and consist rule-making.

35. Thank you for your participation and… Good luck to those taking the exam!