Obtaining biometric personal data as samples for comparative research in criminal proceedings in Russia and some foreign countries

Full Text

llegal trafficking of various types of biometric personal data needs effective legal protection. This is being talked about both in Russia and abroad. One of such legal sources in the Russian Federation is Federal Law No. 149-FZ of July 27, 2006 "On Information, Information Technologies and Information Protection", which establishes the legal basis for handling information, including biometric personal data, and ensures their protection from illegal trafficking. In Canada, such a legal source is the Personal Data and Electronic Documents Protection Act (PIPEDA), which sets out rules for the collection, use and storage of personal data, including biometric data. Currently, modern technologies and scientific discoveries often require the collection and analysis of biomaterials for the development of medicine, genetics, pharmacology and other fields.
All over the world, biometrics is used in such diverse areas as the security of enterprises, schools, government agencies, borders, airports; identification of patients in hospitals and blood banks; voice control of electronic devices. Biometric personal data has a special place in the process of disclosure and investigation of crimes. In this regard, the right of citizens to the inadmissibility of the forced collection of biomaterials is of great importance, which is an important aspect of the legal protection of personality and privacy.
Biometric data in various databases of countries are becoming increasingly important for the identification of criminals and their victims. To take a well-known case as an example, in the United States, 7 of the 19 terrorists of the September 11, 2001 attacks on the twin Towers were known to the authorities, but they used fake documents to enter the country. If there had been a biometric counteraction system then, the terrorists could have been identified and stopped. At the same time, it is important to take into account that biometric personal data also includes biomaterials — from a medical point of view. Thus, it becomes important to develop ethical standards and norms in the field of biomedical research, since the collection of biomaterials is also carried out by force, which causes ethical dilemmas related to the violation of personal life, privacy and human dignity.
With the introduction of new information and telecommunication technologies, criminals are looking for innovative ways to commit crimes, for example, to steal personal data, hack personal and corporate computers to steal confidential information, cybercrime, etc. In this regard, it is necessary to adapt legislation to new technologies, that is, the rapid development of technologies for the collection, storage and analysis of biomaterials requires appropriate legislative regulation to ensure data security and confidentiality.
When referring to the term biometric characteristic given in the interstate standard GOST ISO/IEC 2382-37-2016 "Information technology. Dictionary. Part 37. Biometrics. Information technologies. Vocabulary. Part 37. Biometrics" these are the biological and behavioral characteristics of an individual that can be recorded and used as distinctive, repetitive biometric features for automatic recognition of individuals. Examples of biometric characteristics are: Galton papillary structure, facial topography, facial skin texture, hand topography, finger topography, iris structure, hand vascular structure, palm papillary structure, retinal image, handwritten signature dynamics and voice. For comparison, let's try to consider regulatory regulation in different countries, for example, such as Russia, Canada and Norway, issues related to the collection of biomaterials.
The most common ways of identifying a person are currently the following: fingerprinting, palm scanning, iris scanning, DNA data, etc.
In turn, the current legislation, explanations of state bodies and judicial practice of Russia and a number of other countries on this issue vary significantly.
Thus, in the legislation of the Russian Federation, biometric personal data includes information that characterizes the physiological and biological characteristics of a person (paragraph 1 of Article 11 of the Federal Law "On Personal Data" dated 07/27/2006 No. 152-FZ).
Decree of the Government of the Russian Federation No. 772 dated June 30, 2018 refers to biometric personal data placed in a single biometric system only the image of a person's face obtained using photo and video devices and human voice data obtained using sound recording devices.
Roskomnadzor has previously expressed its position on the issue of which personal data is biometric. Thus, according to the agency, biometric personal data includes physiological data (fingerprint data, iris, DNA tests, height, weight, and others), as well as other physiological or biological characteristics of a person, including an image of a person (photograph and video recording), which allow to establish his identity and are used by the operator for identification of the subject (Explanations of the Federal Service for Supervision of Communications, Information Technology and Mass Communications dated August 30, 2013 "Clarifications on the issues of attribution of photo, video, fingerprint data and other information to biometric personal data and the specifics of their processing"). They also include photos and other information used to ensure access to the protected area and establish the identity of a citizen. At the same time, he repeated the provisions of Article 11 of Law No. 152-FZ that the processing of personal data, as a general rule, is allowed only with the written consent of the subject of personal data, i.e. the person from whom this data is received.
At the same time, law enforcement practice in terms of legal regulation of the turnover and use of biometric personal data varies. The photos on the pass are regarded by the courts of the Russian Federation as biometric personal data. So, in one case, the Arbitration Court of the North-Western District explicitly stated that such photographs characterize the physiological and biological characteristics of a person, on the basis of which it is possible to establish his identity by comparing the photo and the surname, first name and patronymic contained on the document (pass) with the person of the bearer of the pass (the Decision of the Arbitration Court of the North-Western District of 21 November 2017 N F07-11732/17 in case no. A42-342/2017). The Supreme Court of the Russian Federation subsequently confirmed the position of the lower court, noting that the company had not received the consent of the subjects to process biometric personal data (Ruling of the Supreme Court of the Russian Federation dated March 5, 2018 No. 307-KG18-101 in case No. A42-342/2017). Other courts come to similar arguments – persons providing a photo for a pass in order to be used by an enterprise to identify a subject must give written consent to the processing of biometric personal data (Resolution of the Thirteenth Arbitration Court of Appeal dated August 16, 2018 No. 13AP-15087/18).
In another case, citizen S. complained about Citizen M., who, without consent, was videotaping on a mobile phone camera with the participation of the first. The territorial department of Roskomnadzor refused to initiate a case, finding that the video does not contain information that allows the identification of citizen S. as a specific subject of personal data, which indicates that there are no violations of the provisions of the law on personal data, in connection with which the arguments of the complaint were refuted by the district and regional courts (Decision of the Fourth Cassation Court of General Jurisdiction dated October 16, 2020 in case No. 16-894/2020).
The main difficulty in using the processing of biometric personal data is the mandatory written consent (Part 1 of Article 11 of Law No. 152-FZ). Moreover, when using information technologies for identification purposes, a form approved by the Government of the Russian Federation is used (in accordance with Part 5 of Article 14.1 of Federal Law No. 149-FZ dated July 27, 2006 "On Information, Information Technologies and Information Protection"). Consent to the processing of personal data may be given by the personal data subject or his representative in any form that allows confirming the fact of its receipt, unless otherwise provided by law (paragraph 1 of Article 9 of Law No. 152-FZ).
The processing of biometric personal data is possible without the consent of the subject in some cases defined by law. It seems that for the purposes of processing personal data during identification, the following cases may be valid (Part 2 of Article 11 of Law No. 152-FZ):
• in connection with the administration of justice and the execution of judicial acts;
• in connection with the mandatory state fingerprint registration;
• in cases provided for by the legislation on defense, on security, on countering terrorism, on transport security.

In addition to the requirement of mandatory written consent to the processing of personal data, the operator is required to comply with the provision on non-disclosure of personal data without the consent of the subject.
But there are cases of forced receipt of biometric personal data, as stated in Part 2 of art. 11 No. 152-FZ "Processing of biometric personal data may be carried out without the consent of the personal data subject in connection with the implementation of international treaties of the Russian Federation on readmission, in connection with the administration of justice and the execution of judicial acts, in connection with mandatory state fingerprint registration, mandatory state genomic registration, as well as in cases provided for by the legislation of the Russian Federation on on defense, on security, on countering terrorism, on transport security, on combating corruption, on operational investigative activities, on public service, the penal enforcement legislation of the Russian Federation, the legislation of the Russian Federation on the procedure for leaving the Russian Federation and entering the Russian Federation, on citizenship of the Russian Federation, the legislation of the Russian Federation on the notary. That is, it can be concluded that this applies to different cases, including in the framework of criminal proceedings.
Criminal proceedings are regulated by a special code and the provisions of 152-FZ are not applicable to it. Thus, Article 202 of the Code of Criminal Procedure of the Russian Federation provides for obtaining various samples for comparative research, including biometric personal data of a person. Such samples can be obtained even before a criminal case is initiated. At the same time, methods that are dangerous to human life and health or humiliate his honor and dignity should not be used. It is not completely clear from the text of the law whether it is possible to forcibly obtain biometric personal data as samples for comparative research in the framework of criminal proceedings. At the same time, for comparison, we can cite the provisions of Articles 179 and 196 of the Code of Criminal Procedure of the Russian Federation, prohibiting, as a general rule, the compulsory production of forensic examination and examination in relation to a witness[1].
The positions of the Constitutional Court of the Russian Federation (hereinafter referred to as the Constitutional Court of the Russian Federation) on the possibility of compulsory receipt of biometric personal data in accordance with Article 202 of the Code of Criminal Procedure of the Russian Federation are that compulsory receipt of biometric personal data may affect a citizen's right to privacy and personal secrecy. At the same time, the Constitutional Court of the Russian Federation in its Definition No. 1297-O dated 09/24/2013. He noted that the Constitution of the Russian Federation, while guaranteeing everyone the right to defend their rights and freedoms in all ways not prohibited by law and the right not to testify against themselves, does not exclude the possibility of conducting various procedural actions involving a suspect or accused, as well as using documents, garments, biological tissue samples, etc. in order to obtain evidence. The Code of Criminal Procedure of the Russian Federation provides for the possibility of procedural actions (including obtaining samples for comparative research) and the use of coercive measures related to the restriction of citizens' right to personal integrity in order to protect the rights and legitimate interests of persons and organizations victims of crimes, ensuring the validity and proportionality of restrictions on this right, as well as It requires judicial control over the production of these actions, granting interested parties the right to judicial protection of their rights and freedoms. The compulsory receipt of biometric personal data must be carried out in compliance with the requirements of the law and in proportion to the goals for which this is being done. In other words, the Constitutional Court of the Russian Federation actually permits the compulsory receipt of samples for comparative research in cases where a person refuses to provide them voluntarily. That is, he, guided by the principle of expediency,[2] designed and approved a legal norm that allows obtaining biometric personal data forcibly.
For comparison, we can refer to the regulatory regulation of this issue in a number of foreign countries. Thus, in Canada, the procedure for obtaining biometric personal data by force in criminal proceedings is also regulated by law — Criminal Code www.laws-lois.justice.gc.ca and the principles of human rights. Canadian law strictly regulates the collection and use of biometric personal data, protecting individual rights and data privacy. According to subsection 487.055(1), taking into account that a police officer has reviewed the offender's criminal record, the nature of the offense, the circumstances surrounding its commission, and the impact that this permission will have on the offender's privacy and personal safety, he has the right to forcibly withdraw samples from him for comparative research.
The Norwegian Code of Criminal Procedure - The Criminal Procedure Act does not mention the legislative framework governing the procedure for obtaining biometric personal data by force. Norwegian legislation protects the rights of the individual and the confidentiality of data when collecting and using biometric personal data. Violations of the law can lead to serious consequences for responsible persons and organizations.
In Germany, the receipt of biometric personal data is forcibly regulated by law and is subject to strict rules. The Personal Data Protection Act (Bundesdatenschutzgesetz/BSG) and the General Data Protection Regulation (GDPR) of the European Union establish the framework and requirements for the collection, processing and use of biometric data.
In Germany, it is prohibited to obtain biomaterials by force without human consent. The collection of biometric data is possible only if there is a legitimate reason, such as the fulfillment of a contract, compliance with a legal obligation or the consent of the data subject. In the case of forced collection of biomaterials without consent, this may be considered a violation of the law and subject to punishment.
At the same time, in some cases, there are exceptions by law when the collection of biometric data can be carried out without the explicit consent of the data subject. For example, this may be necessary for national security purposes, crime prevention, or public safety. This is explicitly stated in §81a of the Criminal Procedure Code of Germany - Strafprozessordnung (StPO) - In order to establish facts relevant to criminal proceedings, it is allowed to take blood and use other invasive medical methods that are used by a doctor according to the rules of medical art for research, without the consent of the accused, if there is no danger of harm to his health. These measures are appointed by the judge, and if there is a danger to the results of the study due to delay, also by the prosecutor's office and persons conducting an investigation on behalf of the prosecutor's Office (section 152 of the Law on the Judicial System), in section81b, photographs, fingerprints, measurements can be taken for the purpose of preventing the commission of criminal acts or for the purposes of the criminal registration service and other similar measures have been applied against the accused also against his will, as well as in section 81c against persons who are not accused, but may be witnesses, an examination and a forensic medical examination may be carried out without their consent, only if, in order to investigate the true circumstances of the case, the presence of certain traces or consequences of a criminal act on their body must be established.
In Russia, as mentioned earlier, the procedure for obtaining biometric personal data by force became possible due to the position of the Constitutional Court of the Russian Federation, expressed in a number of definitions mentioned earlier.

Conclusion
In general, in all four countries, the procedure for obtaining biometric personal data by force is strictly regulated by law.
However, there may be cases of violations of legislation in this field of application, therefore it is important to improve the mechanisms of control and supervision over the collection and use of biometric personal data.
At the same time, it can be seen in Russian legislation that the Constitutional Court of the Russian Federation has actually created a legal norm that allows obtaining biometric personal data forcibly. A similar rule is contained in German legislation, where there are also a number of exceptions under which it is possible to forcibly obtain biometric personal data.
To improve the system, it is recommended to clarify in more detail the pro

About the authors

Alyona Nurmatova

Author for correspondence.
Email: nurmatova145@mail.ru
Russian Federation, 443086, Russia, Samara, Moskovskoye Shosse, 34

References

Supplementary files