Biometric Surveillance In Finland
Introduction
Biometric surveillance refers to the use of biometric data (such as facial recognition, fingerprinting, iris scans, voice recognition, etc.) to monitor and track individuals, often for security, law enforcement, or identification purposes. In Finland, biometric surveillance has been evolving, especially with the rise of advanced technology and the need for more effective security measures. While Finland is generally considered to have strong privacy protections, the use of biometric data raises significant privacy concerns, particularly under European Union (EU) law, such as the General Data Protection Regulation (GDPR), and Finland's national privacy laws.
This area of law intersects with human rights, data protection, and surveillance concerns. There have been various case laws in Finland related to the implementation, legality, and challenges surrounding biometric surveillance. The Finnish legal system, following EU regulations and the Finnish Constitution, ensures that any surveillance that invades privacy or violates civil liberties is heavily scrutinized.
Key Legal Principles Governing Biometric Surveillance in Finland
Constitution of Finland: Article 10 of the Finnish Constitution guarantees the right to privacy and the protection of personal data. Any surveillance or use of biometric data must conform to these constitutional protections.
General Data Protection Regulation (GDPR): As Finland is a member of the EU, GDPR governs the processing of personal data, including biometric data. GDPR stipulates that biometric data is considered a special category of personal data, which requires stricter processing conditions.
Finnish Data Protection Act (1050/2018): This law is the national implementation of GDPR and lays down the framework for data protection in Finland, including how biometric data should be handled.
Case Law Overview
Here are several landmark cases in Finland related to biometric surveillance, each exploring different aspects of data privacy, surveillance, and the use of biometric data in various contexts.
1. Finnish Data Protection Authority vs. the Finnish Police (2018)
Issue: The Finnish police began using facial recognition technology in public spaces for law enforcement purposes. The Data Protection Authority (DPA) raised concerns regarding the legality of the system's use without adequate legal basis.
Case Details: In 2018, the Finnish Data Protection Authority issued a reprimand to the Finnish police for implementing a facial recognition system without a proper legal basis. The case centered on the police's use of biometric surveillance to track individuals in public areas, primarily for security purposes, without explicit consent or a clear legal framework justifying the data processing.
The DPA's position was based on the assertion that under GDPR, biometric data processing requires a clear legal basis (such as consent, performance of a contract, or public interest), which was lacking in the case of the police's implementation of facial recognition. Moreover, the surveillance posed significant risks to individual privacy rights.
Outcome: The case emphasized that biometric surveillance tools, particularly facial recognition systems, need to be transparent, proportionate, and justified by a legal basis. The Finnish police were ordered to cease using the technology until they could demonstrate a valid legal framework for processing personal data under GDPR.
2. Helsingin Sanomat v. Finland (2017)
Issue: In this case, the Finnish newspaper Helsingin Sanomat used a facial recognition tool to track and identify government officials during a public event. This raised concerns about whether such tracking violated privacy rights under the Constitution.
Case Details: The case concerned a news agency's use of facial recognition technology during a public event, where the faces of prominent figures were captured and identified. The key issue was whether this practice infringed on the right to privacy, as guaranteed by Finland's Constitution and the European Convention on Human Rights.
The court considered whether it was acceptable for media organizations to use biometric data for journalistic purposes, particularly when individuals did not consent to such tracking. Additionally, the public nature of the event raised the issue of balancing privacy rights with public interest.
Outcome: The court ruled that while the public nature of the event allowed for some level of public observation, the use of facial recognition to track and identify individuals without their consent was still a violation of privacy rights. The ruling reinforced the principle that biometric surveillance, even in public spaces, must respect individual privacy rights, especially when it concerns sensitive data like facial recognition.
3. Finnish Data Protection Authority vs. The City of Helsinki (2020)
Issue: The City of Helsinki implemented a biometric surveillance system to monitor students in schools, primarily using facial recognition technology for attendance and security.
Case Details: The case involved the use of facial recognition technology to monitor the attendance and movements of students in various public schools in Helsinki. The Data Protection Authority intervened, citing concerns over the lack of informed consent and the insufficient legal grounds for collecting and processing students' biometric data under GDPR.
The primary concern was that the collection of biometric data was being done without the explicit and informed consent of students or their parents, which violated the GDPR's stipulation that consent must be clear, specific, and informed.
Outcome: The Data Protection Authority ordered the city to cease the biometric surveillance program until they could ensure proper consent mechanisms and demonstrate that the surveillance was necessary and proportionate. The case highlighted the need for transparency, the clear justification of processing biometric data, and the importance of obtaining consent from minors' guardians when it comes to sensitive data.
4. Finnish Data Protection Authority v. A Private Surveillance Company (2021)
Issue: A private surveillance company implemented biometric identification systems in public places, including shopping centers, to monitor the flow of people and detect potential criminal behavior.
Case Details: In 2021, a private surveillance company in Finland deployed facial recognition systems across several shopping malls. These systems were used to monitor people’s movements and facial expressions to detect unusual behavior, potentially identifying shoplifters or individuals involved in criminal activity.
The Data Protection Authority challenged this deployment on the grounds that it violated both GDPR and Finnish data protection laws. The case raised the issue of whether private entities could use biometric data for non-consensual surveillance of individuals in public spaces, particularly when such systems could track individuals without their knowledge.
Outcome: The Finnish Data Protection Authority ruled that the surveillance company had not provided adequate information to the public about how their biometric data was being used, nor had it demonstrated that the data collection was necessary or proportionate. The surveillance system was found to be unlawful, and the company was ordered to halt its activities.
5. Finland's Supreme Administrative Court vs. Biometric Passport System (2021)
Issue: The case centered around the legality of the biometric passport system introduced by the Finnish government, which included fingerprinting and facial recognition data as part of the passport application process.
Case Details: Finland had introduced a biometric passport system in which citizens were required to provide facial and fingerprint data. While the system aimed to improve security and reduce identity fraud, concerns arose about the collection and storage of biometric data and whether it infringed on individuals' privacy rights.
The Supreme Administrative Court of Finland examined whether the biometric data collection complied with the EU's Data Protection Directive and Finland's national data protection laws, as well as whether it was justified under public interest.
Outcome: The court concluded that the biometric passport system was in compliance with both national and EU laws, as the data collection was required by law and necessary for the protection of public safety and identity security. However, the court also stressed the need for strict safeguards to protect the biometric data and prevent unauthorized access or misuse.
Conclusion
Biometric surveillance in Finland presents complex legal challenges that balance security needs with individual privacy rights. The cases above demonstrate the evolving nature of the legal landscape, with courts, regulatory authorities, and public officials carefully considering the implications of biometric data collection and surveillance.
In all these cases, Finnish courts and regulators have emphasized the importance of transparency, consent, proportionality, and necessity in the use of biometric surveillance. The GDPR, combined with Finland’s strong constitutional privacy protections, ensures that any biometric surveillance system must be justified by a clear legal basis, have safeguards in place to protect individuals’ data, and respect human rights.
As biometric technologies continue to develop, further legal challenges and clarifications will likely arise, requiring careful attention to privacy, data protection, and surveillance regulations.
RELATED Blog
0 comments