Welcome to the new books network. I'm Caleb Zachron, editor at the new books network. Today I'm speaking with Yulia Buenyska Ritzinska about her new book, Implications of Preemptive Data Surveillance for Fundamental Rights in the European Union. Yulia's book examines the post-9-11 world where mass surveillance for security purposes has become the norm in the EU member states.
While preventing terrorism is undeniably a good end, the means employed, run to infringe upon the fundamental rights and liberties of citizens. Yulia seeks to answer two key questions in this book. Are the data surveillance instruments that have been implemented to prevent terrorism and serious crime really effective? And do the impaired fundamental rights of EU citizens?
Yulia, thanks for joining me today on the Brill-Ny-Huff Lawcast. This is your work. Hello Eric, thank you for having me. Of course, this topic is really important.
It's interesting for me as an American citizen to learn a bit more about what's going on in the EU because obviously what happens in the EU oftentimes is it might inspire things to have in the US and vice versa. And there's just so many implications for what happens in Europe, for the rest of the world especially on a topic as important as the state of surveillance and terrorist prevention. But before jumping into the book, I was wondering if you could just tell us a little about yourself and your background. As well, in my academic background, I am associate professor at the Department of Constitutional Law at the Adamitzk University in Pozonin, Poland and the Lawyer.
My research has been focused on European and international human rights law. We focus on migrant rights, gender equality as well as business and human rights. Currently, I am especially interested in the master of surveillance of personal data, predictive policy, profiling and challenges posed by artificial intelligence. That's quite a wide range of topics but obviously all things that seem to connect with us.
I'm wondering how you came to write this particular book and what was it really that sparked your interest to investigate the topic of data surveillance? Thank you for this question. The idea of writing this book emerged when I was visiting scholars in the World Institute for International Law at the Christian Albrecht University in Germany where I was conducting my post-doctoral research on preemptive data surveillance in the European Union. Even then, in a very deep nature of this kind of surveillance, I decided to analyze its impact on fundamental rights including rights to privacy, rights to data protection, prohibition of discrimination, freedom of expression and pro-assumption of innocence.
Therefore, the aim of this book is to identify the risks of fundamental rights arising from preemptive data surveillance programs such as retention of electronic communications, metadata, passing drug name or record data and data on financial transactions, adopted by the EU legislator. The devastating impacts of acts of terrorism requires that EU and its member states need to develop every considerable means of prevention. EU member states have not only the legitimate right but also a duty, a duty I would say, to ensure national security and at the same time a duty to protect the fundamental rights of those under their jurisdiction. However, these two assumptions describe attention and attention that lies at the heart of modern democratic governance in the digital age.
The use of preemptive data surveillance programs presents one of the current dilemmas of, I would say, European constitutionalism, namely how to strike the proper balance between protecting public security and protecting the fundamental rights of EU citizens. The key question is what sort of preemptive data violence law within the EU will we have entered that is indiscriminate by the collections of data of individuals which will meet the requirements of necessity and proportionality as well as provide safeguard against abuse to protect fundamental rights or will we have a law without sufficient oversight mechanisms and transparency regarding data surveillance programs which will collect and retain our personal data simply in just in case. In the book, you look at the preemptive data surveillance that currently occurs. You cover all sorts of data that is examined from financial data to flight records of passengers on flights.
I was wondering if you could just talk about what constitutes the preemptive data surveillance that currently happens and how it works. Sure, preemptive data surveillance plays a crucial role in the European Union's counterterrorism policy. It is based on a belief that it is justified to collect and use personal data quite extensively. If such data could be used to prevent terrorist attack or serious crime, to this aim that European has adopted preemptive data surveillance programs to monitor current and exponential risks for public security and resources by collecting, retaining and sharing personal data of EU citizens.
In the digital age, everyone leaves electronic footprints on a daily basis for instance having made a phone call, booked an air ticket, all made and international bank trust. Electronic communications metadata, passenger name, recall data and data on financial transactions performed under the terrorist finance tracking program are retained and then mined and assessed in order to determine and prevent a potential serious crime which based on the analysis of the collected personal data is likely to be committed by a given individual. However, shut-back data collections mean aggregating and analyzing vast amounts of personal data of millions of law abiding EU citizens without individualized suspicion. So the key question I would say is what then makes these categories, these three categories of personal data so valuable.
Metadata include information about them, IP address, the time, the duration, and location of course or messages, the device use and the identity of the contact. Therefore, metadata are diverse source of personal information obtained in the aggregate which reveals private details about people's everyday lives that they have no intention or expectation of sharing. In turn, the passenger name record is flight information provided by passengers while booking or buying of an AOTK, PNR data, express a behavior of the passenger since they allow to detect choices made by passengers such as travelling only with hand baggage, for instance painting cash, making the reservation in the last 24 hours from departure. It is to recognize that within PNR data there is information not found in any other type of data collection.
In turn, data on financial transactions within the TFPP data is a final tracking program contained records of completed financial transactions including inter-aliyah, passport information, phone numbers, local address, also critical identifying information about standards and recipients, the purpose of the transaction, the currency and the amount of the transaction. These three categories of data adequately combined by algorithms may provide very detailed, proven, intimate information about each of us and negatively affect a wide range of our fundamental rights. Communications metadata for instance may be used to create a detailed profile of an individual as life embracing, for example, medical conditions, political and religious use, associations, interactions, preferences and activities. In turn, PNR data allows comprehensive conclusions to be drawn about the private and professional lines of a travel act, but they also enable creating detailed and personalized profiles, particularly of frequent flights.
The preemptive data surveillance raises serious concerns about its ramifications and intrusions into fundamental rights of EU citizens shifting the focus of risk from suspect individuals and individual groups to a suspect population. How does preemptive data surveillance threaten fundamental rights? You've given some great background on how it actually works, but what is the risk to law abiding citizens? Thank you for this question, as well as the many risks and I would say sometimes it sounds really creepy when we are undergoing surveillance.
I would say that the recognition of electronic communications metadata, as well as the BNR system and then terrorist finance tracking program constitute a surveillance system which is not targeted and discriminated and propped. Legislative measures adopted by the EU legislator feature the collection, retention and analysis of a huge amount of the personal data of innocent EU citizens in order to prevent and preempt rather than to prosecute a potential serious crime or act of terrorism. The European legal framework for preemptive data surveillance programs assumes that everyone is potentially suspicious. What is striking is that the PNR program and the terrorist finance tracking program focus on mining large commercial data sets by using algorithms which make predictions about emerging risks threatening national security.
This means that such programs are used and analyzed personal data not related to crime, but collected foreign commercial purposes. When a passenger named Riko Dada are used, the individual is profiled in terms of degrees of risk. The transfer of such a special data of AR passengers as well as their retention aims at allowing the collected data to be compared against so-called predetermined criteria or databases in order to identify persons previously known to law enforcement authorities. However, the analysis of huge amounts of personal data may easily lead to the entry into the system of incorrect or inaccurate data which are then hard to erect a time bearing in mind that personal information can be inaccurate, insufficient or out of date in different databases.
The risks stemming from their indiscriminate processing by law enforcement authorities or intelligence and services affect both people individually and society as a whole. Moreover, inaccurate PNR data can produce a false identification leading, for example, to a situation in which we may be forbidden to enter a given EU member state because we share a line with an individual on a terrorist watch list or because as a result of an erroneous processing of our PNR data, the computer said simply false positive. A false positive refers to an innocent individual that is strongly identified by the algorithm which means in practice that we might have been misidentified as a terrorist threat. There is a little doubt that then interpretative strategy adopted by the court of justice of the EU attempts to shape the complex balance between fundamental rights and national security in the digital age, keeping in mind the urgent need for security, the effort of the court of justice of the EU to reconcile those diverging interests seems to be the most rational and pragmatic solution.
In its assumptions and deliberations, the court of justice focused on the proportionality of the interference which must be limited to what is strictly necessary. That means that on the one hand, Luxembourg judges clearly stressed the importance of the fundamental rights of privacy and protection of personal data, but on the other hand, they did not reject the metadata retention or the PNR data collection and transfer per se, recognizing these two collections and potential of personal data as suitable and necessary tools to prevent serious crime and terrorism. Moreover, the court of justice clearly stated that it would not allow for any abandonment or a lowering of the standards of the protection of privacy and personal data in the EU's external relations, including its bilateral agreements with said countries. Then indiscriminate retention of a metadata collected on all EU citizens resulted in the loss of their rights to privacy as they had been deprived of the tools and the consent on how and when their personal information would be used and most importantly to whom that information would be revealed.
Individuals who want to protect information that makes them vulnerable or that can be used by others to help them emotionally or financially. This does not make people clew in us. The Court of Justice of the EU presented the view that general and indiscriminate retention of electronic communications metadata is precluded under EU law except in the event of a serious threat to national security. The Court of Justice detailed and simultaneously strict conditions and safeguards needed to be met by the EU member states in order to hold such measures consistent with the charter of fundamental rights on them EU.
The Court of Justice specified that data the country must be subject to effective review either by court or by independent administrative body whose decision will be binding. In particular, the aim of this independent review is to verify whether such a serious threat to national security exists as very often human-based states have a tendency to abuse this clause of national security risks. In other words, human-based states cannot merrily invoke a threat to national security as a ground for general and indiscriminate data retention measures since such measures are only permissible if there is a real specific earth at the verified. Once it no longer exists, the obligation to data retention needs to be seized as the Court of Justice explicitly recognized that it cannot be systematic in in nature.
What is more, it was made clear that metadata retention for the purpose of serious crime prevention had to constitute an exception. It must also be pointed out that in its approach to a serious interference with the fundamental rights arising from the regulations on the collection and the retention of metadata and PNR data, the Court of Justice focused above all on the fundamental rights to privacy and protection of personal data. However, taking into consideration the intrusive nature of pre-empty data surveillance programs, it must be said that they do not only undermine our privacy and data protection, but also undermine and approach the pre-stention of prohibition of discrimination and freedom of expression. The logic of pre-empty data violence implies that everyone may have a criminal intent.
It's treats with suspicion individuals who have done nothing in particular to arise such a suspicion. There is, I would say, little doubt that then data violence programs adopted by the U-legislator have changed them, established paradigm of a criminal law in democratic societies whereby any interference with suspects fundamental rights has to be authorized by a judge or prosecutor on the basis of a reasonable suspicion. Re-empty surveillance measures use sophisticated algorithms to mine bulk personal data of all U-citizens regardless of the links to serious crime or terrorism in order to detect terrorists or other serious criminals. Furthermore, the Court of Justice reasoning fails to examine the risk inherent in the automated profiling system such as biases.
There is no transparency at the EU law how the profiles are being created. Biases may be established at each stage of the process of algorithmic profiling, even if the profiles are not based on sensitive data, prejudices against minorities and other vulnerable groups may particularly influence the decisions of the person designing algorithms and may consequently decide which parameters will be used and how they will be used. Inaccurate profiling may lead to an innocent person, in particular a passenger being blacklisted, investigated, humiliated or even detained. Even though law abiding citizens are aware of the fact that the behaviors are subject to systematic monitoring by law enforcement authorities, they may overly restrain themselves from participating in the democratic process or contributing fully to the social and cultural life of the communities.
For instance, we may decide not to take part in the public demonstration against the government, fearing that our location may be tracked through our mobile phone. Likewise, we may choose not to call for instance to call the mental health hotline for fear that the public authorities will reveal our secret benefit. Those are many great arguments or great examples of how it infringes on the rights of people that are innocent or not, you know, planning any kind of terrorist act, which is obviously what one of these surveillance programs are initially designed for. So, you know, in the book, you also talk about sugar pyramids that you advocate for, things that you think should be implemented in order to safeguard against these potential infringement on fundamental rights.
Could you discuss these, please? Yes, of course. As a preemptive data, surveillance is an inherent element of the reality in our modern digital world. Concrete checks and balances are required.
Enemies of preventing a serious crime and act of terrorism must take into account the demands of the rule of law and fundamental rights in a democratic society. Otherwise, there will be a risk, a risk that the legitimacy of such means will be lost and then the democratic society will be destroyed. The European legislature often fails to recognize, thoroughly, the risks for fundamental rights arising from pre-empty data surveillance measures and in fact, no balancing takes place. Therefore, independent oversight bodies are crucial to determine what is proportional and necessary in pre-empty data surveillance and independent ex-ante oversight of their collection, storage analysis and access of personal data carried by a judge or by an independent administrative body is perceived as a crucial safeguard against abuse.
And I would say in each particular case, the independent body, whether it is a judge or administrative body, it should be case by case approach applied based on the principle of a proper nationality. So this balancing, the striking a proper balance, I would say, is a core and a crucial element of pro-sederate side gaps as approach based on proportionality. I would say is the essential and the most effective mechanism in this contemporary dilemma of European constitution, I don't know how to strike a proper balance between protecting fundamental rights of citizens and at the same time, protecting national security in particular in a current geopolitical situation in Europe. Obviously, when it comes to these sorts of mass surveillance programs, it's difficult to measure their efficiency and effectiveness because the ultimate measure of whether or not they succeeded is something not taking place.
So there's no, obviously, you can see if certain attacks were thwarted, but it's hard to know truly the full extent about the effectiveness. But how would you assess based on what we know, the overall effectiveness and efficiency of the current data surveillance programs in the EU? And do you see the ends just fine, the means? Thank you for this question.
As this is to be honest, a very complex question. And I try to find the proper answer, but many, many EU member states and EU institutions are, first of all, are, they should initiate comprehensive, there is a, I would say, a necessity to initiate a comprehensive debate within the EU to answer the question whether reducing the collection and processing of huge amounts of personal data would result in a loss of efficiency of pre-emptive programs, doubts regarding the effectiveness of these programs still remain. The European Commission and the Council of the European Union who too often tried to trade off the fundamental rights for security generally have little evidence of them, of the overall effect of pre-emptive data surveillance programs. At the same time, these EU institutions do not indicate other measures that might better protect these rights and security.
And I would say it is still an open question whether instead of mass and continuous data surveillance of almost entire population, it would not be better to use available resources, or of course, appropriate for protected surveillance of persons, flights, financial transactions or countries with regard to them pending cases, concerning metadata retention and the PNR data. In the code of justice, I would say Luxembourg judges have not yet said that they find a word in these methods. With this project completed, obviously there's still, you know, this is a very light issue. This isn't like you are doing a report of some event that occurred 300 years ago.
This is still very much tip of the mind for many people. I'm sure for you too. What do you see moving forward? What are some things that maybe have you optimistic for change or things that are giving you caution?
The change is always possible when I try to be an optimist. However, when I observe the current, I would say ongoing discussion within the EU and some very narrow approach of EU member state in particular France who wants to grow then, they are a margin of appreciation in deciding independently. Now, broadly, they can interfere in fundamental rights, applying mass and indiscriminate retention of electronic communication metadata. It's difficult to predict the final decision within the EU institutions, as some EU member states have, I would say, changed data proud.
And we will see if we can expect, I would say, a turning point, which in fact aims at striking the proper balance. As this is striking this proper balance, I would say it's a golden mean. So, so far, after six years, there's no consensus among EU member states about the new EU regulations concerning privacy, which, which, otherwise, address the issue of electronic communication metadata retention. So, we are living, I would say, in a very interesting but in a very complex time.
And there are so many threats, so many threats that style of this mechanism of surveillance are necessary, provided that they are respecting human rights and then, and then requirements of the rule of law. But on the other hand, we as a civil society, as citizens, we should remember that democracy is not taken for granted. So, we will see, but I think that the new challenges posed by AI, and as I mentioned, the current very complex European situation regarding security was in the EU. We can expect that there will be the general approach to narrow our fundamental rights.
Well, you, thank you so much for being guest on the liberal Nihof Lockast and on the new books network. The book was Implications of Primitive Data Surveillance for Fundamental Rights in the European Union. Thanks so much. Thank you, thank you for your time and for having this great opportunity to discuss my book.
Thank you so much.