Biometric IDs and health passports in Europe: The end of personal autonomy

Fingerprints and facial images stored on a chip have been obligatory for EU ID cards since June 2019, yet biometrics for matters such as payments, entry to public venues and workplaces, and travel – which link to form a far more intrusive and centralized identity system – are now being promoted as the only way to return to normal amid COVID-19.

Governments and companies, while claiming that digital health IDs will be optional, are threatening those who opt out with exclusion from the most fundamental of freedoms, which equates to outright coercion into a system that gravely threatens privacy and personal autonomy.

EU invests big in biometrics

The EU’s Horizon 2020 program has been boosting the biometric industry since long before the coronavirus, particularly for security products for police and border control agencies, providing €1.7 billion in funding between 2014 and 2020 which involves wide ranging surveillance technologies such as facial and iris recognition, and a further €1.3 billion will be provided for the next seven years.

Figures compiled by the Guardian show that Horizon 2020 has given out €1.15 billion to private companies since 2007, which equates to 42 percent of the total €2.7 billion in funding from the security research program, while it has also been the lead partner in almost half of the 714 funded projects.

Among its beneficiaries is Idemia, a French tech company, which received a total of €2.91 million from Horizon 2020 between 2017 and 2019. Idemia recently won a contract for the delivery of a new shared Biometric Matching System which will integrate a database of over 400 million third-country nationals by 2022 with fingerprint verification and facial recognition for entering and exiting the Schengen area.

Signs of this growing shift become more evident as numerous European countries make steps towards biometric innovations which could then be integrated into a central ID. Lithuanian ID verification company iDenfy closed two partnership deals in December which bring biometric verification to the parcel delivery industry and a democratic participation platform. Croatian digital identity provider Identyum, also in December, announced it had reached a milestone of 10,000 users in the country. PayByFace, which allows one to do exactly as its name suggests, is expanding its biometric offering to over 65 partner store locations in Romania, and Swedish challenger bank Rocker has selected Idemia’s F.CODE biometric payment card which will be put to the test in the first quarter of 2021.

Public-private collaboration

The World Economic Forum’s January 2020 White Paper on ‘Reimagining Digital Identity’ talked up the need for cooperation between the public and private sectors, and collaboration across industries on such IDs, including healthcare, travel and financial services.

Mastercard and Microsoft joined forces in 2018 to work on a global digital identity system, which includes access to health, financial and social services with various governments. Emblematic of the public-private merge on digital ID, France became the first European country to form a “Partnership for the digital economy” with Mastercard in January 2020 for four years.

It is based on several strategic pillars which correspond to the strategic public policies of the French government on digitisation and economic growth, namely for tourism, FinTech, AI, digital identity and cyber security and the future of work. North Macedonia also sealed a similar agreement with Mastercard.

Beyond just a more simplified identification process, concern is growing over visible steps towards such IDs encapsulating the most crucial aspects of citizens’ lives which could then determine access to facilities and services. The likes of Mastercard and Microsoft, among others, are already doing exactly that in other parts of the world.

Mastercard has begun trials in West Africa – as part of a partnership with Gavi the Vaccine Alliance and Trust Stamp, an AI-powered ‘identity authentication’ company – that will combine a biometric digital identity system, vaccination records, and biometric payment system into a single platform.

Launched in 2018, the initiative has received $3.8 million in Gavi donor funds in addition to a matched donation of the same amount by Microsoft co-founder Bill Gates through his foundation. In early June 2020, Gavi reported that Mastercard’s Wellness Pass program would be adapted in response to COVID-19 which would include “vaccination verification”.

Mastercard was also the company which developed the payment solution for transactions on Aadhaar, India’s nationwide biometric ID system, using UID numbers with biometric authentication which requires fingerprint and iris scans.

Aadhaar was launched in 2009 with the purpose of efficiently delivering welfare services, but it has divided the country as it has grown to cover just about every facet of daily life. Despite being marketed as voluntary, blocking basic services to those who refuse to get one essentially makes it mandatory. Today, an estimated 1.22 billion Indians are enrolled in Aadhaar, some 90 percent of the population.

The EU and health passports

The European Commission outlined a ‘Roadmap on Vaccination’ linked to a digital health passport before the virus outbreak, last updated in Q3 of 2019.

It details a plan spanning from 2018 to 2022 to “examine the feasibility of developing a common vaccination card/passport for EU citizens” and “develop EU guidance for establishing comprehensive electronic immunisation information systems”.

Also among the aims listed is to “overcome the legal and technical barriers impeding the interoperability of national immunization information systems” and mentions its need to strengthen partnerships with the World Health Organization (WHO), the Strategic Advisory Group of Experts on Immunisation (SAGE) and Gavi among others, and continue to support research and innovation projects through Horizon 2020.

The idea of needing a vaccination verified by an application to access cinemas and restaurants, or to travel by air, was regarded a conspiracy theory at the start of the coronavirus outbreak, yet such digital health passports are now in the process of being rolled out and hailed as the only way to return to normality.

The UN has already launched a digital wallet for employees containing travel, financial and pension data, in addition to allergy and vaccination history, while the EU parliament is testing a biometric time and attendance system at its Brussels facilities.

The International Air Transport Association (IATA) announced in December its Travel Pass, an app through which travellers will have to show proof of coronavirus test or vaccination in order to travel. Accenture, Microsoft, Mastercard, Idemia, IBM and Google, are all strategic partners of the IATA.

Similarly, The Common Trust Network – a partnership between airlines, the World Economic Forum and the non-profit The Commons Project – recently introduced the CommonPass App which will allow users to upload medical data such as COVID-19 test results or proof of vaccination.

In the UK, the recently appointed minister in charge of COVID-19 vaccine rollout, Nadhim Zahawi, talked up the idea of digital immunity passports to enter bars, restaurants, cinemas, sporting venues and even workplaces, before backtracking.

Estonia and the United Nations health agency in October 2020 started a pilot project for a digital vaccine certificate.

Several other EU nations have talked up vaccine passports in recent months. Greece has called on the European Commission to introduce a coronavirus vaccination certificate for travel within the bloc, an initiative that EC president Ursula von der Leyen has welcomed, describing it as a “medical requirement”. Poland will hand vaccine passports to citizens after their second shot, Belgium stated it was in favor of a vaccine certificate on both an EU and global level, while Denmark’s government is developing its own.

Spain is taking things a step further, with health minister Salvador Illa stating that those who refuse the vaccine will be put on a list that will be shared with other EU countries.

France’s prime minister Jean Castex recently submitted a bill on establishing a long-term health emergency management system which includes a ‘vaccine passport’. This came on the back of the UDI party’s proposal of a ‘green passport’ with UDI chief Jean-Christophe Lagarde defending the idea by saying that those “who are vaccinated, have the right to live normally”.

These troubling words merely confirm what many had long feared, that many in power hope to make compliance to digital IDs intertwined with vaccination, if not by force then through coercion. This threatens to alienate those who hold valid weariness over the wider threats of a digital ecosystem at the mercy of private entities that seem to be above the law. Yet blanket labels like ‘anti-vaxxers’ and ‘COVID-deniers’ are being deployed to belittle rational debate that is not limited to health concerns.

Such systems, which have been receiving billions in funding since long before the pandemic, do not appear to be temporary nor to specifically counter the virus, yet sensible discussion and public concern on the matter is being brushed aside to facilitate the fast-tracking of highly contentious tools which bypass unprecedented threats to privacy and personal freedom, and threaten to create a two-tier society.