Migrants making the perilous journey to Europe face a high-tech border bristling with drones, cameras and satellites, and a system that collects vast data on those seeking new lives.
As Brussels intensifies its migration crackdown, digital rights campaigners want clarity on whether migrants’ privacy rights are protected, and warn that some of this tech could be rolled out to the public.
Nivo Vavoula, cybersecurity professor at the University of Luxembourg, said border surveillance technologies are completely unjustified and go far beyond what is necessary.
“They’re considered a success story from the perspective of the state, everything is proportionate … [but] the fundamental rights of asylum seekers or migrants are being completely sidelined,” Vavoula warned.
The creep-function
European police and border authorities collect personal and biometric data from asylum seekers, visa applicants, and other “alert” worthy people (including those subject to returns decisions or not entitled to stay in the Schengen area) in databases like Eurodac, the Schengen Information System and the Visa Information System.
They can be accessed by police investigating serious crimes like migrant smuggling, but Chloé Berthélémy, policy adviser at EDRi, said it in effect treats migrants as “suspects of crime.”
Berthélémy points to the fact there is no centralized database where police can consult fingerprint data for all EU citizens.
“That’s fundamentally a problem of inequality in the face of the law,” she said.
Furthermore, the controversial practice of scanning people’s phones to try and glean information about where they departed from is “almost normalized” by authorities in many EU countries, said Derya Özkul, sociology professor at the University of Warwick and author of a report on EU border tech.
Germany’s top administrative court recently ruled that phone scanning should be a last resort, and Özkul noted it wouldn’t be seen as acceptable in day-to-day policing.
Digital rights campaigners also fear databases might be used to train AI models, which could be used to profile people or make decisions about asylum claims — and potentially bake in racial biases.
From October, the EU’s repeatedly delayed Entry/Exit system will be rolled out, systematically gathering, for the first time, finger and face scans from third-country nationals visiting the bloc.
Berthélémy called this an example of the “creep-function” where “technologies are first deployed at the margins of society and then they’re expanded,” in this case to travelers who tend to hold “some privilege status” like U.S. citizens.
As immigration is seen as a national security issue, it can be tough to nail down concrete details on the kinds of surveillance tech being used, and where. These practices are developing with no debate around what data should be allowed to be collected, according to Özkul.
“It’s like, this is the population that we can use these technologies on and see how far we can go, and then we can use them on anyone later,” she added.
Europol spokesperson Claire Georges said the EU police agency does not directly gather data on migrants, and can’t legally process someone’s data just because they’re a migrant.
She added that Europol processes information shared by EU countries, “subject to a strong oversight and compliance framework,” to combat crimes such as migrant smuggling.
A Frontex spokesperson said the EU border agency provides surveillance tools to member states, but doesn’t “conduct mass biometric or phone scanning,” and uses AI for “risk analysis and situational awareness, not mass profiling.”
They said that most data gathering at EU borders is done by national authorities, although Frontex officials do so “during operational phases where [they] are directly involved.”
In January, the European Data Protection Supervisor (EDPS) reprimanded Frontex for gathering information during interviews with people crossing external borders and sharing it with Europol without assessing whether it was necessary.
In response to complaints about a lack of transparency, the Frontex spokesperson said the agency “is committed to transparency, while protecting operational security, investigations, and personal data.”
They said information is available in annual reports and operational overviews, and “EU or Schengen residents can request public access to documents.” The same right does not extend to migrants who aren’t resident in the EU or Schengen area.
Protection on paper
The EU’s General Data Protection Regulation (GDPR) protects the privacy rights of any person in the EU — but there is a sweeping carve-out for law enforcement trying to prevent or investigate crimes, or protect public security.
Europol, Frontex and their national counterparts must adhere to their own specialized data protection laws, including the Law Enforcement Directive, Europol Regulation and GDPR-equivalent for EU institutions.
Individuals can file complaints with the EDPS, which regulates EU agencies like Europol and Frontex, or national privacy watchdogs scrutinizing local police, but they often don’t do so.
Pauline Fritz, research and advocacy coordinator with the Border Violence Monitoring Network (BVMN), said making a data protection complaint is low on the list of priorities when “people are experiencing violence, they’ve lost loved ones,” and are afraid of doing something that compromises their asylum claim.
“The fact that they’re being surveilled by an AI system or that they have to give their fingerprints is secondary. The bar of basic rights is so low that you say, I can let go of my privacy if I stay alive,” she said.
Greece in hot water
But in Greece, some organizations advocating for migrant rights have had success with the courts.
Last year, the Hellenic Data Protection Authority (DPA) fined Greece’s Ministry of Migration and Asylum a record €175,000 over invasive technologies used in reception and accommodation facilities for asylum seekers. The Greek ministry has appealed the decision, which came following a complaint from digital rights group Homo Digitalis. The hearing is due to take place on Sept. 23.
Homo Digitalis co-founder and executive director, Eleftherios Chelioudakis, said while those working at the understaffed Greek authority are “doing their best” to deal with cases, investigations crawl on for years.
According to the regulator’s latest annual report, it has 50 staff members, but estimates it needs 135 to do its job. In 2024, it had a budget of just over €2.6 million.
A spokesperson for the Hellenic DPA agreed its understaffing is a known public issue, adding, “there is an actual difficulty for migrants to exercise their rights and submit a complaint.”
The regulator said it wants to wrap up two long-running investigations this September, one into the Greek police’s use of portable face and fingerprint scanning tools, and another into the Greek coast guard’s adoption of social media monitoring software.
Bulging border budget
A 2023 report by EuroMed Rights and Statewatch estimates the EU budgeted €113.3 billion to bolster its borders between 2021 and 2027, almost double the previous seven-year budget (€58.5 billion).
Brussels now has to divvy up its next €1.816 trillion budget from 2028 and has promised to triple funding for migration, border management and internal security.
The funding will help “fully digitalize border control management,” the Commission said, as well as help to roll out a new Migration Pact and Internal Security Strategy.
As for what kinds of tech could be developed and bankrolled by the EU, the Horizon Europe fund offers a glimpse: identifying people from the way they walk, scanning faces through moving car windows or detecting who is lying at border control.
But Pauline Fritz of BVNM says much of the “dystopian innovation that these research projects are talking about” never gets past the research phase.
Sarah Chander, co-founder of the Equinox Initiative for Racial Justice, said there can be “hyperbole” around the more “creepy” sounding surveillance tech, but it’s good old-fashioned databases that should be of more concern.
“A lot of the stuff [being used in practice] is databases. Which is not sexy at all, but they are fully there, completely discriminatory, and constantly expanding,” she said.
Meanwhile, the Commission unveiled its strategy to give its security forces a resource boost (including 20,000 extra Frontex agents) and a road map on how to give law enforcement more access to data. The European Parliament’s research service noted that the road map will come up against “privacy and other fundamental rights challenges.”
A Commission spokesperson wrote that collecting anyone’s personal data, including migrants, by public authorities “should only take place for clear and justified purposes, and in line with the applicable rules and data protection principles.”
They said the Commission’s internal security strategy and roadmap to expand law enforcement access to data will do so “while fully respecting the right to privacy and maintaining high levels of cybersecurity.”
The post Digital Fortress Europe: A test lab for surveillance tech? appeared first on Politico.
