The Biometric Passport

Does it protect or compromise individual privacy?

Mukisa Joshua William

THE AFRICAN PASSPORT
What is it? Features? Who uses it?
Quick Definition

• Privacy: Free from intrusion, capable to reserve matters as private.

• Data protection: Safeguard important info from corruption, loss or compromise.
• Biometric Data: Palm, Finger prints, iris, odour, face, ear.
• Biometric Passport: Machine readable with biometrics and RFID Chip.
• MRZ: Particular area in ID encloses holders personal data.
• International Biometric Symbol: Bottom of Passport
The African (Biometric) Passport Framework

• African Union, Decision on free movement of persons and the African passport, Assembly/au/dec.607 Revised
Draft, AU Guidelines for the Design, Production and Issuance of the African Passport, Africa Free Trade
Agreement.
• ICAO, ISO Standards: Machine Readable, 14443,
• EAC Joint Communique 17th Ordinary Summit by Heads of State, Common Market Protocol,
• The Immigration Sub-Sub Committee & other Experts Consultative Meeting on Free Movement of Persons &
implementation of the African Passport (The SADC Protocol on Facilitation of the Movement of Persons of
2005)
• CEMAC/ECCAS, 10th Summit of Heads of State 2010, ECCAS Protocol on Freedom of Movement
• ECOWAS/979 Protocol A/P.1/5/79 relating to Free Movement of Persons, Residence and Establishment
• Arab Maghreb Union Free of Movement Protocol, The Arab Maghreb Union Treaty,
• Muhochi v Attorney General of Uganda;
Data Protection in Africa

• AU Data Convention (Malabo Convention)

• The African Data Convention states in Article 10(4) that: “The following actions shall be undertaken after authorization by the national
protection authority: (d) Processing of personal data involving biometric data.
• Article 11: Independence of DPA’s.
• African Internet Rights Declaration: Article 12 (2) (m) of the African Internet Rights Declaration provides for the cooperation between
African Data Protection Authorities.
• The SADC Model Law on Data Protection: Article 16 SADC Model law provides a specific legal regime for the process of genetic,
biometric and health related data. [HIPSSA Project
• ECOWAS: Supplementary Act A1SA.1F01F10 On Personal Data Protection Within Ecowas,
• EAC: Human and People’s Rights Bill, now Act, Article 19.
• ECCAS: Economic Community of Central African States. [Data Protection similar to EU/ITU Model SADC] ECCAS
• ‐
Model Law CEMAC Directives on Cybersecurity (Data protection, e-­transactions, cybercrime)
• The Arab Magreb Union (AMU), founded in 1989, and involving 5 states (Mauritania, Morocco, Algeria, Tunisia and Libya), Community of Sahel-- ‐Saharan States (CEN-
SAD): Lack data privacy regimes except Tunisia and Morocco.
THREATS TO INDIVIDUAL PRIVACY

• Cloning
• Brute force attacks
• Skimming
• Eavesdropping
• Clandestine Scaning and Tracking
• Data Leakage
• Identity Theft, Jans Krissler made biometrics using public figures photographs. Nigerian passport culprits in the US.
• Weaknesses in the ICAO Standard (Passive authentication and Active Authentication can be breached.)
• Calderoni, Luca & Maio, Dario. (2014). Cloning and tampering threats in e-Passports
EU DEVELOPMENT, CASE LAW.

• EU/ITU involvement in developing Model Laws.

• General Data Protection Regulation [Independent DPAs, Consent, Subject rights]
more than OESCD Guidelines.
• Case law:
• Huber v Germany (deletion of passport records, right to be forgotten.)
• In Commission v Germany, (Independence of DPA, states cannot transpose laws)
• In Schwarz v Bochum, (Passport applicant not deemed to have consented.)
• In Commission v Luxembourg, (Luxembourg was charged for delayed transposition
of a directive. Cited national law, court rejected it. Found in violation.)
The Biometric Passport

• Does it protect or compromise individual privacy?

• It is not a matter of “YES” and “NO”
• Non biometric passports have their failures which are numerous.
• When used in environments with robust protection mechanisms, they
prevent identical theft, illegal immigration, authentication spoofing. [Its
sustainability requires constant update and states should pursue more
protective measures while fulfilling the required minimum standards.]
RECOMMENDATIONS

• Harmonisation
• Cryptography, invest more in technology. (Independent cryptographic
research)
• Independence of DPAs’.
• Demand reciprocity and interoperability from European states.
• Design and manufacture passports within the continent.
END

End…