Italy

Week of actions: Reclaim Your Face Italy and the need for a real EU ban on biometric mass surveillance

14 July 2022
ReclaimYourFace
No comments
Categories: On the ground

During the second week of May 2022, Reclaim Your Face Italy held a week of actions for an EU ban on biometric mass surveillance in Milan, Torino and Como. They collected signatures on the streets of the 3 cities, joined an event organised by the Greens-European Free Alliance Group and made a field visit to Italy’s city, Como, the first one to implement facial recognition technology in a public park.

Background

In 2021, the Italian Data Protection Authority (DPA) rejected the police use of Automatic Image Recognition System (SARI). SARI is a real-time facial recognition system that was acquired by the Italian Police in 2017 and being under investigation by the Authority ever since. Albeit it is assured to never been used in real-time, this system was at the center of debate after it was revealed their intention to employ it to monitor arrivals of migrants and asylum seekers on the Italian coasts.

In its decision, the DPA argued that the system lacks a legal basis and, as designed, it would constitute a form of mass surveillance. Thanks to the actions of Hermes Center, Associazione Luca Coscioni, Certi Diritti, CILD, Eumans, info.nodes, The Good Lobby, Privacy Network, Progetto Winston Smith, and StraLi, a temporary ban on facial recognition technology in public spaces was introduced later. This moratorium will be in force until December 2023.

Now our Reclaim Your Face partners Hermes Center, Privacy Network, Certi Diritti, STRALI and CILD are fiercely campaigning to Ban Biometric Mass Surveillance in the EU.

Here are some of their latest actions!

Paper signature collection

On the 10th of May 2022, Reclaim Your Face hosted paper signature collection stands in three big cities of Italy: Milan, Torino, and Rome. This paper signature collection was organized by Hermes Center and two national Reclaim Your Face partners: StraLi and CILD. The activists were in front of Universities and in the city center to talk about the risks of biometric mass surveillance, giving out stickers, booklets, Reclaim Your Face T-shirts and bags.

Event with Greens-European Free Alliance Group

Colleagues from Hermes Center, Riccardo Coluccini and Davide Del Monte, joined as speakers for the event ‘Stop Biometric Surveillance – Time for an EU ban on biometric mass surveillance in public spaces’ to explain why Italy must carry on campaigning pushing for a real ban on biometric surveillance in the EU.

Visit in Como

Como was the first city to implement facial recognition technology in their park in 2019 through an offer by Huawei . The technology included also algorithms that detected different types of behaviours. Not coincidentally, in 2016 during the migration crisis, migrants were camping in this park waiting to cross the border.

After the work of activists and a journalistic investigation by Hermes Center colleagues Laura Carrer and Riccardo Coluccini, and researcher Philip Di Salvo, Como was obliged to shut down the system 2020.

In May 2022, together with representatives from the Greens- European Free Alliance Group and journalists from the Czech Republic, the researchers visited the park where Facial Recognition cameras were installed and talked about their investigation. While the cameras are still there, the Facial Recognition and other algorithmic functions are turned off at the moment. The Greens- European Free Alliance Group and Czech journalist later met with local journalist Andrea Quadroni who talked about the migrant crisis that hit Como in 2016.

The trip to Como is part of the Greens- European Free Alliance Group’s newly released mini-documentary while articles about the actions and results of Reclaim Your Face in Italy were published on national TV and radio station in the Czech Republic.

No biometric surveillance for Italian students during exams

1 December 2021
ReclaimYourFace
No comments
Categories: On the ground

In September 2021 the Italian Data Protection Authority (DPA) fined Luigi Bocconi University €200 000 for using Respondus, a proctoring software, without sufficiently informing students of the processing of their personal data and, among other violations, for processing their biometric data without a legal basis. Bocconi is a private University based in Milan and during the COVID-19 pandemic introduced Respondus tools to monitor students during remote exams. 

Respondus offers two different modules: Lockdown browser and Respondus Monitor. The former prevents a student from using their computer as usual, meaning that the person for example cannot open other programs. Respondus Monitor checks that the person in front of the screen is the one that should be taking the exam, in order to prevent someone else from replacing the student or passing notes. To do this, the software uses algorithms that analyse the biometric data of the person’s face in order to confirm their presence and it also records keystrokes, mouse movements and the duration of the exam. After processing the data, the software sends the professor a report showing the student’s image for identification purposes and alerts of any anomalies, with details on the reason for the alert. 

The University initially tried to walk back from what they stated in their own privacy policy, claiming that no biometric data was processed given that the only identification happening was the one concerning the initial picture taken by the software and used by an operator (in this case the professor) to confirm the identity of the student. Something that didn’t match the real functioning of the system. In fact, in their decision, the DPA says that Respondus declared that their software creates a biometric template to monitor the presence of the same person in front of the screen throughout the exam. For this reason, the “software performs a specific technical processing of a physical characteristic of the persons,” says the DPA and, currently, in Italy there is no legal provision expressly authorising the processing of biometric data for the purposes of verifying the regularity of exams. The DPA highlights also that, considering that the processing was carried out by the University for the purpose of issuing degrees with legal value and the specific imbalance in the position of students with respect to the University, consent does not constitute the legal basis of the processing nor can it be considered as freely given. 

In addition, the DPA considers the functionalities of the ‘Respondus Monitor’ component as a “partially automated processing operation for the analysis of the behaviour of the data subjects, in relation to the subsequent assessment by the teacher,” and this “gives rise to the ‘profiling’ of the students.”

This processing of personal data, according to the DPA, may have an impact on the emotional and psychological sphere of the persons concerned which “may also derive from the specific functionalities of the supervision system, such as, in this case, facial recognition and behavioural profiling, with possible repercussions on the accuracy of the anomalies detected by the algorithm and therefore, indirectly, also on the overall outcome of the test.” 

Laptop and book, both open

Bocconi is not the only Italian University using proctoring software. In June 2020 in Italy there were at least ten Universities using (or planning to use) similar tools such as Proctorio, ProctorExam, and Safe Exam Browser. This Authority’s decision would prohibit other Italian Universities from using software similar to Respondus that collect and process students’ biometric data.

Despite this push back on student monitoring, this decision also reminds us that biometric surveillance is increasingly expanding into every sphere of our lives and the only solution is to call for a ban on these technologies.

Contribution by: Laura Carrer, Research and Advocacy at Digital Rights Unit, Hermes Center & Riccardo Coluccini, Reclaim Your Face national campaign contributor.