Biometric personal data and their use in the investigation of criminal offences

The article is devoted to the analysis of biometric personal data, which is proposed to be considered as a source of information about a person and used during pre-trial investigation of criminal offences. The relevance of the research topic lies in the need to develop an optimal mechanism for using biometric personal data in the activities of pre-trial investigation bodies. The purpose of the research is to analyse the current international and national legislation on determining the place of biometric personal data in the criminal record system, implement their classification and provide recommendations for use by state bodies and individuals. To achieve this goal, the work used dialectical, historical-legal, formal-logical, dogmatic, structural-system and comparative-legal methods. It is proved that various types of biometric personal data accumulated in the criminal record system can be successfully used in the process of investigating criminal offences, and in some cases by individuals within the limits of their statutory powers. It was noted that along with the positive results of such activities, there are certain risks, namely, the presence of a threat of leakage and access to biometric data by unauthorized persons, as evidenced by the negative judicial practice of individual countries regarding unsatisfactory collection, processing, storage and use of biometric personal data. Taking into account the above, it is stated that the collection, processing and use of biometric personal data for the purpose of their use in the investigation of criminal offences must meet certain requirements, namely: the owner of the database of biometric personal data should only be the state represented by a special state body. Accordingly, the state should ensure the storage and protection of biometric personal data

Keywords: criminal proceedings, pre-trial investigation, fingerprints, human genetic characteristics, forensic records, forensic registration

Introduction

Respect for the rule of law and maintaining law and order in society remains one of the most important functions of a democratic state. The system of state bodies and private individuals take a wide variety of measures to prevent offences in various spheres of socio-economic and socio-political life, as well as to investigate criminal offences that have already been committed. The development of technical means and the spread of digitalisation logically leads to their use in law enforcement activities. The data about the person that is the basis for their identification - personal data - comes to the fore. However, such activities contain not only undoubted benefits, but also potential threats to human rights and freedoms. Therefore, it is necessary to develop a balanced mechanism for their use with maximum efficiency and minimisation of risks.

The relevance of the research topic is due to two aspects: first, active legislative activity in this direction in Ukraine and the world. In particular, over the past few years, amendments have been made to the Law of Ukraine “On the Unified State Demographic Register and Documents Certifying Citizenship of Ukraine, a Person's Identity or Special Status” [1] and the Law of Ukraine “On Personal Data Protection” [2]. In 2017, the Regulations on national system of biometric verification and identification of citizens of Ukraine, foreigners and stateless persons was adopted (approved by the resolution of the Cabinet of Ministers of Ukraine of 27.12.2017 No. 1073) [3], and in 2018 - Instructions on the procedure for recording biometric data (parameters) of foreigners and stateless persons by officials of the State Migration Service of Ukraine, its territorial bodies and territorial divisions (approved by the order of the Ministry of Internal Affairs of Ukraine of 23.11.2018 No. 944) [4]. At the end of 2020, draft law No. 4265 “On State Registration of Human Genomic Information” was submitted and considered [5].

In Europe, the GDPR came into effect on May 25, 2018 (The General Data Protection Regulation, 2016). The GDPR specifically identifies biometric data as a “sensitive” category of personal information, ensuring reliable protection. The GDPR defines biometric data quite broadly, including physical (physical or physiological characteristics of a person: face, fingerprints, iris scans, etc.) and behavioural characteristics of the person. An important advantage of the GDPR is that the data subject has the right to withdraw their consent to their storage and processing at any time. It is also worth noting that in April of this year, the European Parliament approved the creation of one of the world's largest biometric databases - Common Identity Repository (CIR), which will be designed to combine the records of more than 350 million people.

In the United States, the CCPA came into force on January 01, 2020 (California Consumer Privacy Act, 2018). It is impossible not to mention that the largest biometric database in the world is located in India (Unique Identification Authority of India - UIDAI), which includes more than 90% of the country's population, and biometrics are used everywhere.

Secondly, the relevance of the study is determined by a large number of offences in the field of collecting, storing and processing personal data. During 2017-2020 alone, more than 20 large-scale leaks of personal data of millions of people were recorded [6; 7]. At the same time, the owners of personal data databases were both public institutions and private companies. New, modern technologies that attackers use to their advantage also contribute to the activation of committing offences in this area. So, in 2016, Vkansee researchers unlocked an iPhone using fingerprints collected with Play-Doh. This indicates that even advanced biometric systems can still be vulnerable to forgery. Consequently, the challenge is to protect them from unauthorised use.

General theoretical issues of using personal data are considered by S. Dobrianskiy [8], M. Rizak [9], V. Shvydenko [10] and et al. Certain issues of using biometric personal data in the process of investigating criminal offences were covered by scientists V. Bondar [11], R. Melnyk [12], O. Petryshyn [13], V. Prykhodko [14], M. Shepitko [15; 16], V. Shepitko [17] and other scientists. However, there are no comprehensive studies on this issue in Ukrainian legal Science, which makes it difficult to develop a balanced mechanism for using biometric personal data, in particular in the process of investigating criminal offences, taking into account national and international legislation.

Consequently, the need to develop an optimal mechanism for using biometric personal data in the activities of pre-trial investigation bodies is an urgent need of modern forensic science. Considering the above, the purpose of the article is a development and provision of recommendations for the implementation of optimal mechanisms for collecting, processing, storing, and using biometric personal data. Tasks of the author's team are to analyse international legal acts and the current legislation of individual states on regulating the use of biometric personal data in conducting forensic records, classify personal data, develop, and provide recommendations on the work of state bodies and individuals with biometric personal data.

Materials and methods

In particular in supermarket chains Morrisons (Ј10,500 fine), British Airways (Ј183 million fine), data leak of 500 million Marriott users in November 2018, Nova Poshta (in the spring of 2018, screenshots of the customer passport data database were leaked, an unscheduled inspection found no evidence), Uber in December 2017 (the company paid a ransom of $ 100,000 for non-disclosure of data) [21]. In 2017, a personal data leak occurred in the largest bank in Ukraine, and in 2018 - in the world's most popular social network, the most common taxi service and the largest delivery service in Ukraine [10]. In 2019, access to the Chinese Smart city database could be obtained from a web browser without a password. This database contained gigabytes of information, including facial recognition data from hundreds of people. The data was hosted on the cloud platform of the Chinese tech giant Alibaba [22]. The FBI has arrested 33-year-old programmer Paige Thompson. She is suspected of stealing the data of 106 million users of the American bank Capital One, mainly citizens of the United States and Canada [6].

Well-known companies from various sectors of the economy also become targets of hacker attacks with theft of personal data, such as FacebookInc (there are already many cases, in one of which the fine is $5 billion). It contained data from 133 million Facebook users from the United States, 18 million from the United Kingdom, and 50 million from Vietnam [7]. There were also leaks of personal data in Toyota and Lexus (hackers stole information about car owners in March 2019), Suprema Biostar (August 2019), Mastercard (August 2019), Habr.com (August 2019), Yves Rocher (September 2019), Darimax (Russian Federation, September 2019), Novaestrat (data leak on almost all residents of Ecuador, September 2019) and many others [21]. Therefore, the issue of storing and processing biometric personal data is particularly relevant.

In most cases, users of digital technology and the Internet protect personal information individually, using a variety of technologies [13, p. 19; 23]. However, the security of using biometric personal data in the process of investigating criminal offences should be ensured by the state, since such activities are one of the main tasks of the state. Judicial practice in cases of misuse of biometric personal data by private individuals confirms the need for the state to guarantee the security of storage and use of such data. In 2019, the owner of a fitness club in Kazan (Russian Federation) challenged in court the decision of Roskomnadzor to impose a fine of 10,000 RUB for using the PACS system to identify visitors from a photo when passing through a turnstile without their written consent. The court did not satisfy the complaint, referring to the fact that the photo is biometric personal data, and their use requires the written consent of the owner [24].

Decision of the Supreme Court of Illinois (USA) of 25.01.2019 in the case of the corporation Rosenbach v. Six Flags Entertainment Corporation confirmed the need for written consent to the collection and processing of biometric personal data [21]. In this case the parents of a minor child filed a lawsuit against the amusement park Six Flags Great America. They claimed that their child's biometric data was collected without consent and violated BIPA (performing biometric scanning at the turnstile to prevent fraud and provide access in case of ticket loss). The Illinois Supreme Court ruled that Six Flags Entertainment Corporation violated BIPA. The court's decision concluded that it is not necessary to prove the damage and it is enough that the collection was incorrect.

Biometric personal data is now widely used in the banking sector, in the field of providing financial services and making payments for services rendered. Thus, from 2015 to 2020, the Ladoshki project (Russian Federation) collected data on the structure of palm veins of tens of thousands of Russian children for use in the school food payment system [25]. Despite the 5-year period of the project's existence, there is still no consensus even among representatives of state bodies on the legality of all aspects of its activities. There are the first attempts to use fingerprints to register an employee's working hours in private companies. Thus, they try to maintain work discipline, because the fingerprint is not a card, it is impossible to transfer it to another person to register.

Banks are increasingly investing in new technologies: machine learning; real-time fraud reporting; voice, face, and fingerprint recognition (biometric data), as well as so-called behavioural biometrics, which include customer interaction profiles with their devices and online banking tools. Since 2018, the Central Bank (Russian Federation) has started collecting biometric personal data to identify individuals when providing financial services. This data is entered in a single biometric system and collected by many banking institutions. Since 2019, PrivatBank (Ukraine) has launched FacePay24 payment technology [26]. To counteract this, cybercriminals have created a digital fingerprint market, and fraudsters have learned to record and reproduce customer voices using new technologies [27, p. 174].

Only a few states are gradually beginning to fill in large-scale regulatory gaps in regulating the use of biometric personal data by digital banks. It is very likely that in the near future, innovative technologies will radically change the structure of the economy, the labour market and the construction of society as a whole [28, p. 159]. Currently, the analysis of the current legislation of Ukraine suggests that the Ukrainian legislation protects the rights of Ukrainians much more closely than the CCPA, BIPA and GDPR, resulting in possible abuses. Violation of the Ukrainian national legislation on the rules for handling biometric personal data entails administrative and criminal liability. At the same time, an important achievement of the GDPR is the consolidation of the “right to erasure”. According to it, the subject of biometric personal data has the right to withdraw their consent at any time. The consequence of revoking such consent under national law may be the “archiving” of such data without the possibility of further use, or deletion from the database. In April 2020, the European Parliament approved the creation of one of the world's largest biometric databases. It will be called the Common Identity Repository (CIR) and will contain records of more than 350 million people. The largest biometric database in the world is currently created in India (it includes data on more than 90% of the country's population, and biometrics are used everywhere) - UIDAI (Unique Identification Authority of India). Each person is assigned a unique personal number - AADHHAAR.

Biometric personal data is widely used in criminal proceedings. One of the most important and effective ways to achieve forensic tasks is forensic registration in general and maintaining forensic records in particular. Forensic registration (in the scientific literature, the term “criminal registration” is also often used) is a system of material objects (file cabinets, databases, collections and other information repositories) and a practical registration activity [12, p. 186]. It was the materialistic understanding of the world around us, the laws of dialectics and the theory of knowledge that became the basis for the development of the doctrine of forensic registration. Its development is closely connected with the teachings on the mechanism of trace formation and methods of committing criminal offences, on recording evidentiary information, and directly with the theory of forensic identification. Forensic registration also occupies a prominent place in the activities of Interpol. V. Shepitko emphasises the importance of creating and using judicial (international) records of Interpol as the most effective means of countering international crime [17, p. 184]. The doctrine of forensic registration is a scientific theoretical basis for a whole criminal record system, its development and designing of organisational forms and technical support. Biometric personal data is used to achieve the goals of forensic registration, namely:

1) accumulation of data that can be used to investigate and prevent criminal offences;

2) providing conditions for identifying objects whose attributes are accumulated in the credentials;

3) assistance in finding objects whose attributes are accumulated in their credentials;

4) providing reference and orientation information to operational-search and investigative units of law enforcement agencies and judicial bodies.

Accounting as a subsystem of forensic registration tools differs in record data, methods and forms of their concentration and systematisation. Accounting is both a system of recorded data and a procedure for collecting, registering, organising, storing and searching such data. According to incomplete information of R. Melnik, the modern system of forensic registration unites more than 30 types of objects of different origin and features [12, p. 185]. Forensic registration is conducted not only in Ukraine, but also in foreign countries. Thus, the model legislation establishing effective control over persons who have committed sexual offences is the legislation of the United Kingdom. The law on sexual offences, adopted in 2003, provides that persons who have committed sexual crimes are registered in a special database [15, p. 6], which contains, among other things, biometric personal data.

Biometric personal data contained in forensic records is used in the investigation of all types of criminal offences. Thus, M. Shepitko notes that during the investigation of judicial errors, investigators should search for and seize case materials and documents relevant to the case, namely recordings of the court session, audio and video recordings of the court session, a document confirming payment of the court fee, etc. [16, p. 136]. It is impossible to identify individuals on video and audio recordings of court sessions without using biometric personal data, in particular voice, speech and facial images. In 2016, the creation of a Unified Information System (hereinafter, UIS) of the Ministry of Internal Affairs began in the system of bodies subordinate to the MIA. During 2016-2020, implementing the concept of informatisation of the Ministry of Internal Affairs of Ukraine and central executive authorities, the implemented UIs was improved in order to ensure a high level of its reliability and trouble-free operation. One of the most important areas of such activity was the development of automated public data banks based on the existing unified software and hardware complexes of the DIT divisions and the Expert Service of the Ministry of Internal Affairs of Ukraine. The integration of these information resources was supposed to create prospects for automating the information and search engine for identifying a person based on a face image. Also, since 2016, the provisions of the Law of Ukraine “On the Unified State Demographic Register and Documents Certifying Citizenship of Ukraine, a Person's Identity or Special Status” have been implemented, in particular, the registration of a passport of a citizen of Ukraine in the form of a card containing an electronic contactless chip with simultaneous fingerprint registration. Another element of the integrated automated system was the automated identification systems used by the Expert service of the Ministry of Internal Affairs of Ukraine (fingerprinting, signs of appearance).

Taking into account the capabilities of modern algorithms for recognising a wide variety of biometric indicators of a person, it is possible in the future to introduce interrelated fingerprint and portrait identification, the identification features for which are taken into account in various automated identification systems. According to V. Bondar, the functioning of such a system provides for a qualitatively new level - information- analytical processing of information arrays [11, p. 30]. Agreeing with him, we believe that the collection and processing of experimental data and computational forensic methods, as well as image analysis in forensic research, occupy a special place in analytical processing. Therefore, the essence of information and analytical support can be expressed by the formula “source information - the subject of forensic science - technology and technique of forensic science - the necessary information”, which can be understood as the process of movement of forensic information from its receipt to processing by special subjects with the use of special knowledge and scientific and technical means and technologies in order to solve forensic problems [11, p. 31].

The provisions of the Law of Ukraine “On Personal Data Protection” apply to maintaining forensic records of biometric personal data. They provide for the processing of personal data, which is carried out using both automated and non-automated means, which are contained in the file cabinet, or will be entered in the file cabinet. Also, today there are instructions for regulating the procedure for the formation and functioning of certain types of forensic records, in particular instructions for organising the functioning of forensic records of the expert service of the Ministry of Internal Affairs [29], instructions on the procedure for the functioning of fingerprint records of the expert service of the Ministry of Internal Affairs of Ukraine [30], instructions on the procedure for the formation and use of automated accounting of human genetic traits [31]. The operation of these instructions provides legal regulation of each of the links of activities for conducting forensic records, which, for its part, creates conditions for relativity, reliability, and the possibility of verifying the information contained in this record [14, p. 92].

It is worth considering forensic records containing biometric personal data in more detail. According to paragraph 1.5. of the Instruction on the organisation of the functioning of criminal records of the Expert Service of the [29], among the criminal records that include biometric personal data, the following can be distinguished:

1) Dactyloscopic records;

2) records of persons on the basis of their physical appearance;

3) records of genetic traits of a person;

4) records of voices and speech records of persons.

Dactyloscopic record is leading among other types of criminal records, due to a large number of traces of human hands that remain during the commission of criminal offences. This type of record is one of the first record-keeping activities in the history of the development and refinement of state authorities in the investigation of crime. Dactyloscopic record is used to search for people who are missing; to establish the identity of a person behind an unidentified corpse; to confirm the identity of a previously fingerprinted person; to identify persons who left handprints at the scene; to establish the facts of leaving handprints by one person during the commission of various criminal offences. Elements of the dactyloscopic record subsystem are the handprint card index and the fingerprint card index. Both elements of the subsystem are interrelated, complement each other, and are used in four areas of verification: fingerprint card index-print, print-fingerprint card index, print-print, and fingerprint card index-fingerprint card index. Modern automated dactyloscopic information systems (ADIS) facilitate and speed up the processing of dactyloscopic information, as well as the search for necessary data about specific accounting objects and individuals among a large number of similar data. The structural divisions of the State Scientific Research Forensic Centre (SSRFC) of the Ministry of Internal Affairs of Ukraine use ADIS software and hardware complexes: “Sonda” and “Dakto 2000”. Also, for the purpose of registering dactyloscopic objects, ADIS software and hardware complexes are used, which are equipped with colourless image input scanners, which scan fingerprints, fingerprints index card or a photograph of a footprint and display them on a monitor screen. Having entered fingerprint information into the computer, such systems are used to check and establish the coincidence or discrepancy of certain objects [32, p. 282].