Aengus Ó Snodaigh (Dublin South Central, Sinn Fein)

I move amendment No. 19:

In page 9, line 39, to delete ", including biometric data," and substitute the following:

", including data comprising of information relating to facial structure,".

Molaim an leasú seo. An fáth atá leis an leasú ná go bhfuil an iomarca cumhachtaí ag an Aire sa chás seo.

I apologise for not being present earlier; it took longer than I anticipated to walk from Harcourt Road. This amendment deals with the biometric data and the powers of the Minister to change what is currently on a passport and the security and protection of that data. I dealt with this in detail on Committee Stage. I noted the insecure nature of this data and how it might be broken down.

Biometric data consists of fingerprints, retinal patterns, facial structures, iris imaging as well as voice and hand geometry, signature, ear and DNA.

This Bill empowers the Minister at any stage in the future to change the biometric data which is required for passports without recourse to this House. My amendment seeks to limit the data to that which is already contained in passports and that if the Minister wishes to add or subtract in the future, he or she must come back to the House with an amendment to the Passports Act, as it would be. Given the change in data protection, the encryption that can be allowed, the security of the data retained and the international circumstances whereby most countries are using this method and refuse to admit Irish passport-holders, at that stage, the Minister should come back to the House and inform the House of his or her intention to include data such as fingerprints, retinal scan or whatever. This House could then debate whether such a change would be proportional. If somebody steals one's biometric data, it is the same as stealing one's identity and it is very difficult to retrieve it. I refer to the significant issues of data protection and data security.

The human rights commission raised concerns about this and referred the Minister to points it had made previously about the retention of data and the need for the Data Protection Commissioner to be informed of what data is being retained by the State. In response to the debacle in England when a significant amount of personal data was lost in transit, not once but twice, by the British equivalent of the Department of Social and Family Affairs, the Data Protection Commissioner said that public information is safe. When the Data Protection Commissioner stated that public information will be safe, he admitted a number of leaks from different Departments.

At international level there is a move towards the maximum amount of data being on passports or on national identity cards and in terms of Big Brother security, there is a logic to it; the more information gathered in, the more can patterns of human behaviour be predicted and people who are a danger to the common good can be tracked. The down side is the danger that those who are intent on putting public safety at risk, those intent on being a challenge to the common good, can access that material and subvert all the data being held by the State.

The European Commission is proposing that all children over the age of six years should be fingerprinted for EU passports and national identity cards. The only reason for not fingerprinting those younger than six years is a technical one; the fingerprints of children younger than six years seem not to be of sufficient quality for a one to one verification of identity.

We should state implicitly that we want to include fingerprints or whatever. I can give the Minister of State recent examples of those who are involved in the research of cryptography which has exposed major flaws in the retention of biometric data and how that data, despite all the guarantees, can be reconverted to allow identity theft. In Belgium a team of cryptography researchers discovered that approximately 750,000 Belgian passports issued between 2004 and 2006 were not even encrypted and that the sensitive material they contained, including people's signatures and photographs, could be easily read using a commercial chip reader. It did not even need to run the data through the machine. It could be held a short distance away. The team then looked at passports issued after 2006 following the change Belgium introduced, which it was claimed protected the chip in the future. This is the same technology the Government and other governments are considering to retain information on a passport RFID chip. The researchers were easily able to lower the possible combinations for a serial number to 24,000 and using the lowered figure it only took them half an hour to reconvert the identity data.

On Committee Stage I gave the example of the Japanese mathematician who, at a cost of only £20, was able to take a finger, make a cast with a moulding plastic sold in hobby shops, pour some ordinary liquid gelatine, used in food preparation, into the mould and let it harden. If this is stuck over a person's finger pad, it fools fingerprint detectors approximately 80% of the time. The joy is that once the person has fooled the machine, because the fake fingerprints are made of the same substance as fruit pastilles, they can be eaten. I gave another example of mathematicians who showed they could reconstruct a fingerprint solely from data contained in systems such as that we are proposing to introduce on passports. They printed out the images they made and used them to fool the fingerprint readers thereafter.

There is a danger of identity theft and we need to consider carefully where we are going with this. If the Minister wishes to go down the fingerprint road or even consider it for the future, he should be clear that is where he is going. The Bill allows him to do it by regulation, which is not good enough. It should be limited to what we have at the moment. If at a stage in the future the Minister so wishes then he should introduce it by way of amendment.

Considerable work has been done on this matter in the EU. A working party was established which proposed the EU protection directive. They considered the matter in depth. That needs to be taken on board by the Members of the House when giving the Minister the powers in the future. As currently drafted the Minister would have discretion to extend biometric information to include fingerprints, DNA, retina scans etc. without the scrutiny of the House. We should delete the term "including biometric data" as proposed in my amendment and replace it with "including data comprising information relating to a facial structure", which is what is there at the moment — a picture. We should limit it to that.

See this speech in context