Joint Committee on Justice debate - Tuesday, 13 Feb 2024

General Scheme of the Garda Síochána (Recording Devices) (Amendment) Bill: Discussion

An Cathaoirleach

I remind members and witnesses to please switch their mobile phones to silent or flight mode.

The purpose of today's meeting is to consider the general scheme of the Garda Síochána (recording devices) (amendment) Bill. We will have engagement with several stakeholders as part of our scrutiny of the general scheme. The scrutiny has been expedited as the matter was referred to the committee before Christmas. We are keen to do due diligence, so we are holding two sessions today. The first will take place now with those present and the second will convene after 6 p.m. We will be tight on time for this session, which will finish at 6 p.m., if not sooner, because we need a break before holding the second session.

Before we begin, I advise members that one of the witnesses has had to withdraw from the today's meeting due to ill health, namely, the representative from Safe Ireland. I wish that representative a speedy recovery. Safe Ireland has participated in our hearings many times in the past, and it is always a useful witness. In any event, we have noted the submission Safe Ireland has provided. It will be taken into account when we produce our report.

I welcome the following witnesses: Mr. David Murphy, deputy commissioner of the Data Protection Commission, DPC; Mr. Andrew Carroll, assistant commissioner, DPC; Mr. Simon McGarr, solicitor with Digital Rights Ireland; Ms Olga Cronin, senior policy officer at the Irish Council for Civil Liberties, ICCL; Dr. Cliona Saidléar, executive director of the Rape Council Network Ireland, RCNI; Ms Donna Parau, legal director, RCNI; Mr. Mark Garrett, director general of the Law Society of Ireland; Ms Amiee McCumiskey, member of the Law Society's criminal law committee; Mr. Drew Harris, Garda Commissioner; and Mr. Andrew O'Sullivan, chief information officer with An Garda Síochána. From the Department of Justice, we are joined by Ms Rosaleen Killian, principal officer, and Mr. Frank McNamara, legal researcher. We have a full house today on both sides of the room, which is always conducive to a good session and a useful hearing. I also welcome those in the Public Gallery and the people who are following proceedings online.

The usual procedure applies regarding parliamentary privilege. Witnesses and members are reminded of the long-standing parliamentary practice that they should not criticise or make charges against any person or entity by name or in such a way as to make him, her or it identifiable, or otherwise engage in speech that might be regarded as damaging to the good name of the person or entity. If their statements are potentially defamatory in respect of an identifiable person or entity, they may be directed to discontinue their remarks and it is imperative they comply with any such direction if given.

As regular attendees will be aware, the format of our meeting is that we will have a short opening round of three minutes per organisation. We find that works better for a wider discussion as we then have time for a further discussion with questions from members and answers from witnesses over the course of the meeting. I will invite each group to make its opening statements in three minute blocks. We will then have a six minute window per member. Members will have the floor for six minutes to put their questions and have them answered. It is up to each member to choose how to use that time, whether to get six minutes of answers or use the six minutes to make submissions.

I will start with the opening statements. Five organisations will make opening statements, beginning with Mr. Murphy from the DPC. I note for all witnesses that there are clocks in the corner to assist them with the time. If they go egregiously over the allocated time, I will call them in. There is a small amount of latitude, but it is small because we have to get through the business.

The witnesses are all welcome. I am delighted to have such a full house today and such accomplished witnesses around the table. It will be an interesting session. I call upon Mr. Murphy to deliver his opening remarks.

Mr. David Murphy

I thank the committee for the invitation to contribute to its deliberations on the general scheme of Garda Síochána (recording devices) (amendment) Bill. I am one of the deputy commissioners of the DPC and have responsibility for our function of supervision of the public sector. As the Cathaoirleach noted, I am accompanies by Mr. Carroll, who is an assistant commissioner from the DPC's supervision team and who has responsibility for matters pertaining to law enforcement.

This proposed Bill will provide the legal basis for the processing of personal data by An Garda Síochána for the purpose of biometric identification by way of facial recognition. The DPC acknowledges the potential for facial recognition technology to benefit the work of An Garda Síochána. However, as the use of this technology presents serious risks to an individual's right to data protection, the legislation must implement the necessary restrictions, limitations and safeguards to ensure that any deployment of facial recognition technology by An Garda Síochána is strictly necessary and proportionate and respects the requirements of data protection law and the fundamental rights of individuals.

EU Directive 2016/680, the law enforcement directive, sets out that legislation should be clear and precise, its application should be foreseeable to those subject to it and it should specify the objectives of data processing, the personal data to be processed and the purposes of the processing. The statutory code of practice envisaged in the general scheme will be an essential element in meeting these requirements of EU law by setting out the specific details of how biometric identification and facial recognition technology may be used by An Garda Síochána.

Head 4 specifically links compliance with the code of practice to the strict necessity for proportionality in the use of biometric identification, highlighting its importance in this context. Head 4 further provides that An Garda Síochána can use any image or video to which it lawfully has access. This currently offers little clarity as to what is intended. A concern is that large existing public databases of facial images could be brought within the scope of biometric identification without specific safeguards to prevent this. The inclusion of such databases would represent a serious and disproportionate intrusion on the rights and freedoms of affected persons. Facial recognition technology does not provide definitive results but relies on probability through comparison of facial images with an inherent underlying margin of error and risk of in-built bias. These factors can significantly impact on the reliability and accuracy of the technology and indicate a high level of risk for affected data subjects. Consequently, it will be necessary for a data protection impact assessment to be carried out prior to the introduction of the technology. The DPC recommends publication of such an impact assessment in the interests of transparency.

Biometric identification also constitutes a form of automated individual decision-making permitted under the directive only subject to the right to obtain human intervention. The general scheme provides that the results of biometric identification must be verified by a member of Garda personnel. The efficacy of this safeguard will depend on the expertise of relevant Garda personnel in the operation of the system and their ability to effectively challenge its results. The code of practice should provide detail on this key safeguard, as well as on all oversight mechanisms governing the use of biometric identification.

I hope these comments will be of assistance to the committee and I am happy to answer any questions members may have and speak about any of the issues raised in my written submission.

An Cathaoirleach

I call Mr. McGarr solicitor with Digital Rights Ireland. He is also speaking on behalf of the ICCL in his opening remarks. Is that right?

Mr. Simon McGarr

Yes. Both ICCL and Digital Rights Ireland thank the committee for the opportunity to discuss this proposed legislative scheme.

The use of facial recognition technology, FRT, by police engages many fundamental human rights, including but not limited to the rights to human dignity, privacy, protection of personal data, non-discrimination, protest and freedom of expression, all of which are enshrined in the EU Charter of Fundamental Rights. We call on the committee to urge the Government to reconsider the proposal, as currently presented, to introduce FRT into Irish policing as we believe the risks to these fundamental rights are too high in the legislation before us at the moment. We make this call for several reasons.

We endorse the statement by the Data Protection Commission. The results of FRT are unreliable. It is not a silver bullet solution. FRT involves comparing a biometric template created from a face detected in an image or video against a reference database of biometric templates in an attempt to identify a person. However, even when there are optimal conditions with respect to image quality, facial recognition technology is not designed to give police a singular positive identification or 100% match for a person. Instead, at best it gives a person running an FRT search a guess list of who the person could be. It provides a list of potential candidates accompanied by similarity scores. A threshold value is fixed to determine when the software will indicate that a probable match has been found. Should this value be fixed too low or too high, it can create a high false-positive rate or high false-negative rate. There is no single threshold setting which eliminates all errors.

Facial recognition technology is also inherently discriminatory. As the technology stands at the moment, the discriminatory effects of FRT are well documented. While error rates vary depending on the multiple factors that can affect the performance of an FRT system, these errors do not affect all individuals equally. Studies have clearly demonstrated deeply inherent racial and gender biases in FRT, meaning women and people of colour would be more likely to be misidentified and brought to the attention of An Garda Síochána than white men. FRT can enable powerful, mass, indiscriminate and pervasive surveillance. The implications for police use of this highly invasive technology can vary depending on the purpose and scope of its use.

The use of FRT by gardaí, as proposed in this scheme - to use any images or recorded footage that An Garda Síochána legally retains, or can legally access, to locate, identify and track people in respect of certain crimes - would result in a seismic shift in the surveillance capabilities of Irish policing. This brings us to our fourth point.

The general scheme is unlawful under EU law. The committee must consider: the EU law enforcement directive, as transposed in our Data Protection Act 2018; the forthcoming artificial intelligence Act; case law from the Court of Justice of the European Union; and recent guidelines published by the European Data Protection Board, EDPB, on FRT. With those in mind, it is our position that this general scheme is not in step with those frameworks. For example, the use of FRT, as provided for, is not clear, precise or foreseeable. It creates a model of indiscriminate surveillance of people in Ireland. It fails to limit the use of facial data to when it is strictly necessary. It fails to ensure that any FRT use would be targeted in terms of the individuals to be identified. It fails to ensure that anyone whose biometric data is processed by FRT is directly linked to a specific crime, as required under the EU law principles of necessity and proportionality.

In conclusion, we urge the committee to urge the Government to reconsider introducing the FRT proposals before us at the moment. We warn that to do so on foot of ill-defined methods and purposes is to invite not only breaches of innocent people’s rights but also to see otherwise secure convictions at risk on subsequent appeal if the underlying legislation is found to be unlawful.

Ms Donna Parau

I thank the Chairman, and members of the committee for the invitation to this meeting. From a crime investigation perspective, we support the appropriate use of this technology for the detection of perpetrators and for the collection of evidence in support of charges against them. We have two specific points which we would like to address further.

The first is how data will be collected, processed and protected, specifically, data that contains information on or about survivors of sexual violence. This legislation and the code of practice in the Act must state what procedures and protections will be put in place to ensure that survivors are not subjected to humiliating, degrading and dangerous breaches of their privacy. The protection of privacy for survivors must be prioritised and severe criminal penalties applied to those who access or distribute any information outside of the strict parameters allowed for the processing of this data and in any way that could adversely affect survivors.

The second point is on the schedule of offences. As an investigative tool, we strongly support the use of biometrics in all sexual offences and do not agree with any limitation or privileging of some offences over others. The value of being able to use this technology, not only in the detection of perpetrators in public spaces but also in the online space, is invaluable. Technology which is already being used to combat online harms such as child sexual abuse, trafficking and other forms of exploitation, must continue to be available to the An Garda Síochána so its members can do their job effectively.

As stated, we support the use of this technology in collecting evidence but having this evidence stand up in court is of concern. Ensuring that the use of this technology is not left open to challenge on both its efficacy and accuracy is highly important. We have not addressed the merits of the technology from a technical standpoint and have approached our submission from the position of trusting that the very suggestion of the use of such technology carries with it assurances that extensive and robust research and testing into its use and application for this and any other purpose has been done.

I again thank the committee for the opportunity to contribute to this discussion.

Mr. Mark Garrett

I thank the Chair and members of the committee for the invitation to speak to them this afternoon. I am joined by my colleague Ms Amiee McCumiskey, a member of the Law Society criminal law committee and a partner at MacGuill and Company Solicitors.

The Law Society is keenly aware of strong feelings in support of, and in opposition to, the Bill. Working on the front line of the justice system, solicitors know the needs of law enforcement to have at its disposal the necessary tools and technology to deter and detect crime. We are also very much attuned to the need to respect, protect and enforce the rights and civil liberties of individuals.

As explained in the Law Society submission, we have identified a number of possible weaknesses in the published general scheme of the Bill. These weaknesses give rise to concern that this legislation will be challenged on several grounds including through the lens of privacy rights, data protection, the right to non-discrimination and the right to a fair trial. For these reasons, the Law Society believes that the necessity and proportionality required for the introduction of biometric identification in the Irish context merit further examination. Furthermore, we believe the Bill could provide more safeguards and oversight relating to when biometric identification may be used by An Garda Síochána and the external monitoring of its use.

While time does not permit me to go through all of the specific issues we have raised about the Bill, I would like to raise four of them briefly. Much has been made of the intention of this Bill to allow for the use of FRT by the Garda. The general scheme says that biometric data, as it is phrased, will not extend to such physical features as a person’s height or build - presumably because reliance on such information would not lead to a definite identification of a suspect. If it is the intention that the Bill will only apply to facial images and not other physical characteristics of individuals, such as their height, it would be preferable that this is set out more explicitly in the legislation.

The scheme permits the Garda to process and store “images which have been legally provided by other national or international organisations”. The draft does not specify what national or international organisations it refers to and we believe it should do so.

Further, the Bill should place an onus on the Garda only to use images which have been legally obtained by outside organisations. For example, the Department of Social Protection has been implicated in the past for illegally processing biometric data. If such data is subsequently transferred to An Garda Síochána then the whole chain could be tainted and attempts to secure convictions could fail.

Finally, for now, it is not explained how, or against what criteria, a chief superintendent is to assess whether the use of biometric identification is both necessary and proportionate. As we say in our submission, it is assumed that such technology will only be required for complex investigations and where there is a threat to the public security, concern for a person’s safety or the protection of life. The objectives of the proposed Bill could be set out in clearer detail so that the test as to what is necessary and proportionate can be better assessed and reviewed. We also recommend that judicial oversight might be more appropriate here, namely an application to a District Court judge.

In conclusion, the Law Society is mindful that this is complex legislation that deserves close scrutiny. I am very happy to assist the committee with any further elements of its work.

Mr. Drew Harris

I thank the committee for inviting me and my colleague the Garda chief information officer, Andrew O’Sullivan, to present today.

Every major criminal investigation now involves processing digital evidence. This evidence can take the form of images or footage obtained through warrant from seized devices or CCTV. Two separate judgments from the Court of Appeal recently confirm that the Garda has a duty to process available footage to identify or exclude suspects.

Digitalisation in society has led to an explosion in the volume of digital footage as evidence. For instance, the footage from the 23 November riots runs to 22,000 hours or a total of 916 days of footage. Individual murder investigations have had upwards of 50,000 hours of footage. Seized devices can have over 1 million images of child sexual abuse material.

The key to these cases may just be in a few frames out of millions. A child’s school uniform crest can help to identify the victim. The importance of brief footage in a murder investigation or an arson investigation cannot be overemphasised in making a detection for serious crime.

Digital evidence that the Garda has a duty to process is now at big data scale in terms of its massive volume, complexity of formats and the rate at which it is generated. Digital crime and evidence can only be investigated with digital tools. Manual processing by Garda personnel sitting at screens is unfeasible and ineffective. In the case of child sexual abuse material, which is the rape of children and every form of sexual depravity that can be visited on a defenceless victim, there is the traumatic impact on Garda members who view the material.

To be effective at fulfilling our mandate to protect victims, investigate crime and vindicate the human rights of citizens in a digital society, An Garda Síochána must have access to modern digital image analysis and recognition tools.

There is understandable public concern, and perhaps some confusion, about AI technology and how An Garda Síochána intends to use it as an investigative tool. I wish to clarify that digitalisation in An Garda Síochána means that electronic tools act only in support of decisions taken by gardaí. There is never a question of autonomous machine decision-making. All decisions that can impact on a person are only taken by identifiable and accountable personnel. This decision support approach is already used. People make the final decision in many areas within An Garda Síochána, including for driver penalty notices that are initiated by Go Safe vans, the 600,000 vetting applications that we process annually, the use of technology to flag uninsured vehicles and the existing use of biometric processing in online abuse cases. Most of these cases involve searching or sifting massive amounts of evidence for the material relevant to the decision-maker’s decision.

An Garda Síochána has invested significantly in digital policing, including the in-house expert professionals required to build and manage the underlying technology and data. This has directly contributed to our effectiveness in major investigations. The reliability of biometric decision support tools is demonstrated by the success of the Garda National Cyber Crime Bureau in detecting and prosecuting online abuse cases, often as part of transnational investigations. The accuracy of more modern biometric identification systems is clearly demonstrated by the biannual review by the US National Institute of Standards and Technology, NIST. We intend to follow the practice of European law enforcement partners in using these ratings to select the best available technology. There must be safeguards but these should be proportionate to the risks involved in the specific use cases.

In summary, extending the already accurate, reliable and safe usage of image analysis and biometric identification technology beyond abuse cases to other serious criminal investigations is essential for An Garda Síochána in our mission to keep people safe in a rapidly changing digital society, to counter emerging threats and to meet our obligations to work with European law enforcement partners to counter transnational organised crime.

An Cathaoirleach

I thank all of the witnesses for their opening remarks. I invite members to put their questions and have their engagement. As I said, there are six and a half minutes per member and interactions will flow within that. I call Senator Ruane.

Deputy Aodhán Ó Ríordáin

I thank everyone for their presentations. I will make some general comments and then invite the witnesses to respond. We all want to arm gardaí with as much weaponry as possible to enable them to target and effectively prosecute those engaged in very serious crimes. We are all on the same page in that regard. I am reminded of a television miniseries that I watched recently about postmasters in the UK who were told that new technology would solve lots of problems but many of them were criminalised over a period of years. I make that point because sometimes technology can be presented to us as something that will solve a lot of problems but due diligence is not done. I have learned a bit more than I knew before I sat down today, particularly from Mr. Carroll, in terms of how this technology has advanced over recent years.

The context in which we are deliberating is that this technology was effectively banned in many parts of America, including San Francisco, Somerville, Massachusetts, Oakland, California, and Boston, Massachusetts in 2019 and 2020. There is also a list of other large population centres with their own police jurisdictions that have had difficulties with this technology and have banned it. Senator Ruane referenced the 2019 study conducted by Peter Fussey and Daragh Murray into the London Metropolitan Police, which found that 81% of suspects flagged by mass FRT were innocent. That study put the technology in the dock, so to speak. Only last June the European Parliament voted in favour of a total ban on live facial recognition in public spaces.

That is correct. The example of the destruction of public transport vehicles might be better. The individuals who engaged in that may, in fact, have engaged in earlier disorder and disruption at the scene and in other subsequent attacks. There is a hierarchy of offences committed and that is how we order our investigation. There is no question of asking who we recognise in the footage and what we can get them for. We are purposively pursuing the more serious offences and working our way through the full culpability of those individuals by, as the Cathaoirleach said, tagging them, seeing where they turn up next and what else they do. We hope then to arrive at a point where we can identify them.

An Cathaoirleach

That is very helpful. I thank Mr. Harris.

Deputy Alan Farrell

I wish our witnesses a good evening and thank them for their opening statements and for answering questions. I will be running into the Dáil shortly to make a contribution on another matter but I will return.

I have a couple of questions that arise from questions that have been asked. I will start with the representatives of the Data Protection Commission, DPC. Do they have concerns about how the Bill is drafted in the context of the sharing of data across jurisdictions, if it comes to that? For instance, if an individual is identified using this technology, would they have a concern about the sharing of that data? Digital Rights Ireland might also have a view on that.

Mr. David Murphy

I would not say that we have an overarching concern on that point. The Bill makes reference to the obtaining of images by the Garda. The sharing of personal data between jurisdictions for law enforcement purposes is already subject to substantial oversight and governance mechanisms, and we would expect that any information derived from this source would fall under the same governance and oversight rule set.

In our submission, we make reference to the code of practice that will need to be developed to provide substantial detail on how the system will work. We expect the code of practice will speak to that and the safeguards that may be in place.

Deputy Alan Farrell

There is no doubt that the code of practice will be key. Without a completed Bill or Act before us, it is fairly easy to see which is the more important of the documents.

I will turn to Commissioner Harris. Thanks to the Cathaoirleach, this point has been filled out a little, but, as a matter of interest, for the 22,000 hours of footage the Garda is assessing with respect to the Dublin riot, how many officers are assigned to that work and how many hours have they spent assessing that information?

Mr. Drew Harris

There is presently a viewing team of eight people and they have been working solidly on this since 24 November. There has been a considerable effort involving dozens of Garda members to secure CCTV evidence, mobile phone footage, dashcam footage, etc. There have been several public appeals. Those Garda personnel analyse the CCTV and produce packages of evidence. It is for others then to go out and do the interview, search and arrest portion of the work.

Deputy Alan Farrell

How would the implementation of this Bill impact that specific example? How would it reduce the man hours required?

Mr. Drew Harris

Ms Olga Cronin

A data protection impact assessment would be necessary by law. However, it is important that we are not just concerned about data protection rights. There are privacy rights, and rights to non-discrimination, freedom to protest, freedom of assembly, and to be anonymous and be a face in the crowd. I understand that we have been told the purpose of the Bill is not for identification but, as it stands, the Bill provides for identification. Serious clarity needs to be introduced.

An Cathaoirleach

I will indicate the next three members who are due to speak so they can prepare. Deputy Costello will be followed by Deputy Daly and Senator Gallagher.

Ms Olga Cronin

On the accuracy point, as I said earlier, the methodologies NIST uses are fully published on its website. I encourage members to read those in detail because we do not really have time to go through them here. As I said, we have already taken hundreds of cases, on our existing basis of biometric identification, through the courts. Where this has been challenged we have had defence solicitors come in to the Garda National Cyber Crime Bureau to examine our methodologies and there has never been a single case where the accuracy of this technology has been disputed. That is just another comment on the accuracy figure.

Deputy Pa Daly

I thank everyone for their submissions and opening statements. I thank especially the secretariat for providing a very good overview as usual. I also thank Mr. O'Sullivan for the presentation he gave me and another member of my party at the digital innovation centre, as I think it is called, in the Phoenix Park a few months ago. It was of great assistance prior to this meeting.

It is a good thing this Bill was not rushed, as was intended last summer, when it was to be tacked on to the end of another Bill. There are clearly discrepancies in what some people are saying about the data. On the initial list mentioned last summer were child abductions and very important and serious cases, and then we have an expanded list provided today with the heads of the Bill. It seems strange that some of the cases are in there. It is obvious the riot-type cases have been included subsequently, but this seems to be dealt with on an ad hoc basis. Murder and manslaughter are in there but attempted murder does not seem to be there. Sexual assault is not included and section 3 assault, which was so serious the sentence was increased last year to five years' imprisonment, is not on the list whereas section 4 assault is. As such, it is an unusual list. There does not seem to be any great consistency in it. It seems to be evolving, like the legislation. The code of practice also seems a bit strange. It would be much better to have it in the Bill. Leaving it to the Minister is not a good idea. It should include record-keeping, how to conduct identifications and review processes, etc. It is also important there be a pilot scheme to see how well this technology works given that it is, as I saw in the Phoenix Park, evolving all the time.

Yes, in exceptional circumstances, it should be set out.

An Cathaoirleach

Thank you. We are going to move on because we have spent a lot of time on the opening statement. Senator Gallagher is up next, followed by Senator Ward and Deputy Pringle.

Senator Robbie Gallagher

I thank the Chair and I thank the witnesses for coming here this afternoon. It has been very useful, albeit somewhat confusing, from my perspective. I am assuming that the starting point for us all here is that we would like to give gardaí every assistance possible in the investigation of crime. I think we are all on the same page in that regard.

That said, we want to do it in a way that is lawful and completely above board. It is somewhat concerning that we have got to where we are today with legislation that the data protection people have concerns with. Mr. McGarr and Ms Cronin have raised issues here that go as far as to say that it is not compatible with EU law. That is very concerning. Following on from the previous speaker in talking about the merits of pre-legislative scrutiny, this afternoon proves that there is always a strong need for it. When I have finished, will someone from the Department make a comment? From a lay person's perspective, I would take it as a given that whatever legislation is drawn up would have the imprimatur from the data protection people at stage 1, so to speak. It concerns me that this is not the case.

There seems to be a bit of confusion, or perhaps a difference of opinion, regarding whatever data is currently out there and the merits or otherwise, of it. I do not know who has the overriding voice in relation to it and who determines who is right and who is wrong regarding the information we have been given this afternoon. From our perspective, we are trying to get a complete handle on it from the Garda Commissioner, Drew Harris, and from Mr. O'Sullivan's perspective. He talked about the 22,000 hours of footage that would equate to 916 days for individuals to go through. lf the legislation we are discussing was invoked could we get a very rough estimate as to how many person hours would be involved in going through that 22,000 hours of footage? How beneficial would it be from a manpower perspective?

I would like the point about the range of offences which Ms Parau raised to be expanded upon. I certainly agree with that. What are the Commissioner's thoughts on the matter? I will pose those questions for starters.

Mr. David Murphy

I will address the matter of the legislation passing without reference to us. I should state that there is statutory consultation under section 84 of the Data Protection Act 2018. The Department is obliged to consult us on the legislation and I can confirm that this has commenced. We are in dialogue with the Department. Following this process, we will continue to engage with the Department on the progress of the legislation.

Regarding concerns about the lawfulness of the measure and its compatibility with EU law, recital 33 of the law enforcement directive does not necessarily require that the clarity, precision and foreseeability are provided for in a printable Act passed by the parliament. This is where we see the code of practice as a statutory, mandated code stepping in to provide - if that is the way the legislation progresses - substantial detail on how this is implemented in practice. This will cover those assessments of necessity and proportionality, on a case-by-case basis, on each deployment of the technology being made by An Garda Síochána. It will also cover the oversight mechanism and the expertise of Garda personnel to effectively challenge through the verification process.

As a suite of measures, the Bill and the code of practice will need to meet those thresholds of clarity, precision and foreseeability for persons affected. That is why we see the code of practice, in essence, doing a lot of the heavy lifting in that regard.

Senator Robbie Gallagher

Is Mr. Murphy confident that by the end of the discussion with the Department, that point will be arrived at?

Mr. David Murphy

As written into the Bill, there is a requirement for consultation with our office on the code of practice. We await developments on that. The making of the code of practice will also rely on a positive resolution of the committee and the Houses of the Oireachtas as an additional safeguard on that. We would see this as an ongoing, iterative process of establishing the substantive detail of how this will actually work in practice.

Mr. Drew Harris

Rather than use the example of the disorder on 23 November, the example we can talk more authoritatively about is the examination of child abuse material. In a very recent example I looked at last week, in a two-month period, one phone gathered some 650,000 images. In effect, this individual grooms children and then through threat and intimidation, exploits them but also encourages them and demands them to produce other victims as well.

From that, we identified 54 children as victims, of whom 51 were actually identified. All of them were beyond this jurisdiction, so it required considerable international co-operation. One can imagine how impossible it would be to try to do that manually with a phone with 650,000 images. It is in this context that we talk about sifting through images quickly to look for groups or identifiable characteristics. That goes beyond the individual. It can be the room, the language on the spines of books in the background, school identification and simple things like light switches, electrical sockets and furniture. These are the details we look for. The specialist software for this purpose speeds up that process immeasurably. What is the work of a number of weeks in identifying 54 individuals would literally take months if we were to try to work our way through 650,000 images manually. We would not be able to identify 54 separate victims. In the meantime, the months would be rolling on and the abuse would be continuing. The software makes a considerable difference. That is well accepted.

Public disorder is a fast-moving and raw situation and there will need to be a great deal of manual examination, but we would look for individuals with clear characteristics as to their clothing. We would search for those electronically. Even if we just got the clues, the space-time continuum means they must travel down a certain route to get from A to B. We would look for the other footage manually to show us what was happening in between, which premises they were in or what actions they engaged in, hopefully leading to their identification.

Senator Barry Ward

I will first say that I appear in court on behalf of the Garda Commissioner and I am a member of the ICCL. I do not believe that either circumstance conflicts me, but I wanted to declare it at the outset.

The questions I wish to ask relate to false positives and the concerns in that regard. I have listened to what the Garda has said about this essentially being a data-processing tool that works in the same way as Ctrl+F in a PDF does. It finds a particular data set, but a human is ultimately responsible for deciding whether that data set is what he or she is looking for. Comment has been made about the number of hours of footage that might have to be looked through and what might be sought out in same. Depending on the quality of the algorithm, it can make mistakes based on the flaws of the person who designed it. In Ireland, for example, that is more likely to be a white person than someone of a different ethnicity. Is there any data or study to support the idea that an individual garda who sits down and watches eight hours of footage, fast forwards through it and finds what he or she believes is Barry Ward is more or less accurate than technology doing the same job?

Mr. Andrew O'Sullivan

It is accepted best practice that the best results are obtained where there is a true digital approach to the processing, with a trained facial examiner working in conjunction with the technology. If someone is sitting in front of a screen for eight hours, there is a chance that he or she will get tired or develop tunnel vision and start to make mistakes. A machine does not get tired. It is a question of the two working in conjunction.

This is complicated from a technical perspective, so I can give another example of where we apply digital techniques. It is exactly the same approach, but it is perhaps an easier one to explain. The Senator may have seen from press coverage last September or thereabouts that we now have access to a list of uninsured vehicles from the Motor Insurers Bureau of Ireland. That is known to contain inaccuracies. It is highly accurate for private vehicles, but it is not particularly accurate yet for fleet vehicles. It will be once fleet managers provide information on which vehicles are covered by their policies. We had deployed the technology to just 150 gardaí, but we deployed it to all 700 members of our roads policing units last week. In the next month or so, we will deploy it to all gardaí through their mobile phone apps. In practice, this means that, if gardaí get a flag from the app or the in-car ANPR about a vehicle being uninsured, they will stop it. That will be at a checkpoint or, in some cases, on the open road, but they make no assumptions. All they have is an indication that an offence may have been committed under the Road Traffic Acts. They will not take the car off the road or even accuse the person of having no insurance. It is an opportunity to have a discussion and use other information at their disposal, including discussing it with the motorist, who may be able to produce an insurance certificate. Of course, that certificate may not be correct, so the gardaí can ring the insurance company. There are other steps they can take to verify it.

I will move on quickly because we are running out of time. There is to be a second round. Some of those witnesses are in different time zones, but I hope everyone will be able to contribute.

Deputy Thomas Pringle

I thank the witnesses for their evidence. My question has been evolving as the proceedings have moved on. It is on the code of practice and consultation the Minister would have with the DPC. Is there a requirement on him to report whether the Minister takes on board his concerns, or is there a requirement on him to report what has happened in the consultation that takes place?

Mr. David Murphy

My understanding is that the Garda Commissioner must develop the code of practice, which must then be approved by the Minister. The Garda Commissioner is obliged to consult with us. That consultation is a closed loop.

Deputy Thomas Pringle

Is there no requirement on the DPC to report?

Mr. David Murphy

Not that I am aware of. I do not think there is any requirement to report. With the development of any measures like this, we would encourage transparency, and that as much information as possible be put into the public domain about the development of these matters.

Deputy Thomas Pringle

The Oireachtas will also have to approve the code of practice. Through history that has been a 50-minute debate in the Dáil, and that is it - end of story. The committee should recommend that the code comes before it for full and rigorous interpretation as well before it is adopted.

Okay, I think that is clear.

Deputy Niamh Smyth

I thank all of our witnesses. It has been an interesting debate. It is important that the Data Protection Commission is truly onboard and feels that this legislation is airtight. My concern is that if we continued with things as they are, there would be huge problems when it comes to prosecution if data protection was to be broken. There is a lot of work to do at the Department's end to make this more airtight. Ms Cronin spoke earlier about privacy and how people's privacy is broken. My honest opinion, which comes from being chair of the committee where we did the Online Safety and Media Regulation Bill, is that the horse has bolted regarding people's data and their images. If I walk down O'Connell Street, there are people taking video footage of the street and the buildings. Kids are using their phones all of the time. To a certain extent that is impossible to roll back. I feel incredibly sorry for An Garda Síochána, which has a real job trying to fight crime with two hands tied behind its back while the world and its mother can use whatever data they like. Yet and all, so many Garda resources are being encumbered and burdened by something that technology could help and assist in the fight against crime. That is the most important thing. Everybody around this table is in favour of trying to assist that fight against crime. One example is those who were involved in what we saw in the riots in Dublin.

I will go back to the initial point about the use of technology. We can get the concerns of the DPC and everybody around the table, and do more work teasing that out with the Department. We could be prepared and in the best possible position to give An Garda Síochána the strength to do that because it is unhelpful. The other side is that the criminal world is using AI to its advantage. There are then the law-abiding citizens and those who are there to protect the State. It must feel like the most futile job in the world trying to do that against those who are using it for negative purposes, and who have a free hand in it. That is more of an observation than a question.

Having heard all of the observations and concerns, does the Department feel that it can do more work to strengthen the legislation to answer most of the concerns around the table, not break any EU law, have the support of the DPC and give An Garda the strength and support and use of AI it needs to do its job? We also have a shortage of gardaí, which feeds into all of that.

Ms Rosaleen Killian

We thank the Chair, the other witnesses and the committee for taking the time to listen to and observe the pre-legislative scrutiny. We appreciate all of the effort that has gone in, and the discussion is informative.

Senator McDowell is next and then our final member to come in on this strand will be Deputy Ward. I mention for the information of all members and witnesses that this session must conclude sharply at 6 p.m. because we have a second session commencing at 6.15 p.m. with some international witnesses in various time zones. It is a bit of an effort to get them all lined up online so I do not want to jeopardise things by running over.

Senator Michael McDowell

I want to re-echo what has been said here about the value of this session. It is very important that the Oireachtas has the opportunity to have sessions of this kind. I want to make a few points. It seems, as has been pointed out by some of the contributors, that the sourcing of data material is not adequately dealt with in this legislation. Is a public service card available? Are passport photographs available? Is there a duty on the people who have those databases to make them available and in what circumstances? I would like to see that developed when the Bill comes before us again.

The second issue is the code of practice. I appreciate that the Minister is going to generate that but we should have some kind of regular review built into the statute so that the code of practice does not fossilise.

Third, with regard to the number of offences that are covered in the Schedule, I notice that apart from the security of the State, they are all personal injury-type offences. Maybe it is a bit topical, but arson is one thing which, at the moment, carries a life sentence. Organised crime is something at which we should also look. It seems to be that some of the offences covered could be minor compared with some of those.

Deputy Mark Ward

I thank the Chair. I apologise to all the witnesses; I stayed for the opening statements but I had to leave because I was speaking in the Dáil Chamber. I may, therefore, ask a question that was already asked but if I do, I would like to hear the answer. In fairness, however, what I have gotten out of this session today is the absolute value and need for pre-legislative scrutiny when we come to really important issues like this. I am hearing many conflicting opinions across the board. Everybody's opinion really needs to be heard on this. One of the conflicting opinions I heard in the opening statements was, for example, when Mr. Garrett mentioned concerns that height could be used as a metric to identify a person. Commissioner Harris used a really good example of the use of technology to identify, say, a school crest on a young person who is a victim of sexual abuse. There are conflicting opinions and concerns on that.

My understanding is that we are discussing FRT and this debate today is specifically on that. This is kind of a simple question and I do not know whether it has been asked. Can FRT or this legislation be used to identify a person by height, clothes or other distinguishing identifiers apart from his or her face? A representative from the Law Society of Ireland might answer that question.

Dr. David Murphy

I will come in because it might be helpful to address a question that was also raised by Deputy Pringle. Under EU law enforcement directive, which is the overarching legislation, biometric data is any data derived from a person's physical characteristics that can uniquely identify him or her. Therefore, yes, a person's height, body shape or face or fingerprint are considered biometric data because it is data derived from his or her unique physical characteristics. In that case, therefore, we would deem that tracking somebody by his or her height or body shape would be processing biometric data.

Deputy Mark Ward

What about, as I said, a school crest or hoodie or certain clothes?

Dr. David Murphy

Those would not be biometric because they would not be derived from the unique physical characteristics of the person. However, they would be personal data for the purposes of data protection law, if an individual can be identified from that, and that would need to be processed accordingly. However, they would not meet the threshold of biometric data, which is a special category of data and requires additional safeguarding.

Mr. Mark Garrett

What the Deputy is raising is the issue around clarity and providing clarity around what is meant in different sections. I raised the point under head 2, which refers to how biometric data has the same meaning attached to it in section 69 of the Data Protection Act 2018, but does not include "DNA, fingerprints or any other data 'except for facial images.'" Therefore, the confusion probably arises at this stage of the development of the legislation whereby those sorts of clarities will have to be teased out as it is drafted. That is the assumption we were making in our submission. As the Deputy can see from that particular quote from the heads, there is a clear view of biometric data except for these data, and we are talking about facial, or are we? That is some of the clarity we require in terms of the procedures that should be clearer, the oversight that should be clearer and exactly what people have talked about in terms of the procedures and guidelines.

Mr. Simon McGarr

Mr. Drew Harris

Yes.

An Cathaoirleach

We have just about concluded this session on time. I remind members that we are back in 15 minutes for part two. I thank all the witnesses across the spectrum who contributed. It was a very valuable hearing. I thank them all for their time, contributions and inputs. They were very valuable.

Is it agreed that we publish the opening statements to the committee website? Agreed. We will suspend until 6.15 p.m. I am sure we will speak to our witnesses again in due course on other matters.

Sitting suspended at 6.02 p.m. and resumed at 6.16 p.m.

An Cathaoirleach

We are resuming our engagement on the general scheme of the An Garda Síochána (recording devices) (amendment) Bill. We invite those witnesses joining us online to log in. They may take a minute to do whatever they need to do. If the witnesses are online, we are trying to get them connected. They might be able to hear us but not see us. We are working on it. I welcome our online witnesses. I think I can see everybody. I can see six faces and hopefully they can all see us. Will they raise their hands if they can hear me? Super. I think everybody is good.

I thank everyone for joining us. We are about to commence the second part of a session we are holding on the An Garda Síochána (recording devices) (amendment) Bill. I thank this round of witnesses, who are appearing remotely. I will introduce them all now. I formally welcome Dr. Abeba Birhane. I cannot quite see the names on the board, so I ask the witnesses to put their hands up when I call them so I know who is who. Dr. Birhane is a senior adviser in AI accountability at the Mozilla Foundation and an adjunct assistant professor at the school of computer science and statistics at Trinity College. She is very welcome. I welcome Dr. Daragh Murray, senior lecturer and IHSS fellow at the school of law at Queen Mary University of London and UKRI future leaders fellow. I welcome Dr. Nessa Lynch, who I think I can see in the top left corner. She is the Matheson lecturer in law, technology and innovation at University College Cork and a research fellow at the faculty of law at Victoria University of Wellington, New Zealand. I welcome Professor David Kaye from UC Irvine school of law and Ms Hinako Sugiyama, digital rights fellow and lecturer in UC Irvine school of law. I see them in the top right and bottom middle on my screen. I welcome Dr. Ciara Bracken-Roche, who is on the bottom left of my screen, if I am correct. She is assistant professor and director of internationalisation at the school of law and criminology at Maynooth University.

From the Department of Justice, we are joined by Ms Rosaleen Killian, principal officer, and Mr. Frank McNamara, legal researcher.

When witnesses are speaking, they should ensure their microphones are not on mute. They should ensure that they are on mute when not speaking in order to avoid interference. Everybody is used to this now ,but we still trip ourselves up every so often.

Members have already been served with a warning on parliamentary privilege but witnesses joining the session should note the long-standing parliamentary practice to the effect that they should not criticise or make charges against any person or entity by name or in such a way as him, her or it identifiable, or otherwise engage in speech that might be regarded as damaging to the good name of any person or entity. If witnesses are directed to discontinue their remarks on the grounds that they are potentially defamatory or otherwise in breach of the Houses' rules, it is imperative that they comply with any such direction. Therefore, if statements are potentially defamatory in relation to an identifiable person or entity, they will be directed to discontinue their remarks, and any such direction must be complied with.

For witnesses attending remotely outside the Leinster House campus, there are some limitations to parliamentary privilege. They may not benefit from the same level of immunity as a witness physically present does. That is the age we are in, and we are used to it at this stage; it is just a question of mentioning the housekeeping note at the outset. Witnesses participating in this committee session from a jurisdiction outside the State are advised that they should also be mindful that domestic law could be applied to the evidence they give.

I invite the representatives to give a short opening statement on behalf of their organisations. Three minutes is the norm for such statements. After three minutes, I may have to interrupt and move on to the next speaker. Once the opening statements are completed, we will have a rota system whereby members will each have a six-minute slot in which to engage with the witnesses and ask questions. I will move from member to member in the order in which they have indicated.

We have a relatively short window for the meeting tonight because there are several meetings today. Therefore, I ask everybody to remain focused. I will move things on if I need to have the appropriate times.

I am delighted to have such professional and esteemed witnesses with such expertise in this area. We are very lucky to have this expertise available to us in our deliberations. I call on Dr. Birhane, who has three minutes in which to make her opening remarks.

Dr. Abeba Birhane

I am very grateful for this opportunity. I really appreciate the opportunity to appear before the Joint Committee on Justice.

In seeking policing FRT legislation a second time, Ireland runs the risk of inadvertently imposing a technology that is ineffective, inherently flawed, opaque and proven to be discriminatory. A robust body of scientific evidence over the past year has demonstrated flaws and inaccuracies arise time and again. Although often presented as a cost- and resource-effective aid to policing, FRT has proven to be ineffective and intrusive. For example, in a recent survey by Big Brother Watch in the UK that reviewed police use across Wales of FRT that scanned over 508,542 faces, it was found that over 3,000 people were wrongfully identified. An inaccuracy rate of 88% was recorded in the period 2016 to 2023. In all this time, only three arrests were made. I point to this research to show the ineffectiveness of the technology.

In an audit carried out by Cambridge researchers only last year, which evaluated the ethics and legality of police use of FRT in the UK, the researchers complied ethical and legal standards for governing facial recognition based on extensive literature, feedback from academia, government, civil society and policing organisations. They then applied the resulting audit tool to evaluate three facial recognition deployments by police forces in England and Wales and found that all three technologies failed to meet the stated criteria or standards.

Although computer vision, the basic technology for FRT, has come a long way since the misidentification of black people as gorillas in 2015 by the app Google Photos and huge error rates in identifying black-skinned faces, as confirmed in the 2018 study by Buolamwini and Gebru study that found error rates of 34.7% for black women by comparison with 0.8% for white men, the technology remains deeply flawed. In a recent study carried out by me and my colleagues, which evaluated the latest state-of-the-art computer-vision models on classification tasks, we found that black people are still labelled and misclassified as "criminal" and "suspicious person" at a much higher rate. So far in the US alone, we know of six people who have wrongfully been arrested and convicted due to errors in FRT, five of whom are black men and one of whom is a black woman. Again, the discrimination tends to be against minoritised identities.

I cannot emphasise enough the importance of independence when it comes to evaluations and audits of the technology. Although the technology is deployed to track, monitor and surveil the public, it operates in the dark without clear oversight, transparency and accountability. This is partly due to the proprietary rights that come with technology. For example, there is no access to training data, model architecture and other critical information necessary for model performance. For the most part, all the information remains hidden from the public and independent auditors, essentially making independent audits and evaluations impossible.

If Ireland goes ahead with this technology, it is just a matter of time before it becomes another cautionary international headline. I thank the committee.

Dr. Daragh Murray

I thank the committee for the invitation to participate in this session.

In my opening remarks, I would like to address first, in general terms, the surveillance capability made possible by facial recognition and highlight the chilling effects this surveillance may give rise to. I will then flag three concerns regarding the human rights law compliance of the general scheme.

Facial recognition represents a step change in police surveillance capability. It is an oversimplification to think of facial recognition as a technology that merely allows police to examine an image and identify those present. The use of retrospective facial recognition allows police to look back in time and determine where an individual was, who they were with and what they were doing. Both live and retrospective facial recognition make possible the ability to monitor, track and profile large segments of the population, with significant private-life implications. Linked to this surveillance capability is the possibility that chilling effects will emerge. Chilling effects arise when individuals modify their behaviour because they are afraid of the consequences that might follow if that behaviour is observed. These chilling effects are most likely to be felt by those outside the mainstream or in opposition to the status quo. In concrete terms, they can undermine the right to protest and the ability to mobilise or organise for political change.

Chilling effects are most likely to be felt when police are granted broad powers, as is the case regarding the draft Bill, which allows police to use facial recognition for a wide variety of offences and a wide variety of purposes on the basis of subjective interpretation. The European Court of Human Rights has classified facial recognition as "highly intrusive", requiring a "high level" of justification to be considered "necessary in a democratic society". It is difficult to see how new section 43 satisfies this criterion.

Two additional issues, linked to the authorisation and oversight process, can be highlighted that again raise concerns regarding human rights compliance. The authorisation process runs the risk of being reduced to a tick-box exercise by failing to take into account the context of each use of facial recognition, thereby undermining the ability to evaluate necessity. Equally, a tool this powerful should appropriately be subject to independent oversight.

To summarise, the surveillance capability made possible by facial recognition is unprecedented. We should be cautious about authorising the use of this tool and should first fully understand both the benefit to policing and the potential harm, including to human rights.

Discussion surrounding police uses of facial recognition is characterised by unsubstantiated claims and this is why I have suggested a moratorium for the time being.

Dr. Nessa Lynch

Good morning from New Zealand where it is already Wednesday. I thank the committee for the opportunity to speak. It was great to listen to the expertise of others appearing today. I would like to highlight three overarching points from my written submission. This draws on my expertise in biometrics and biometrics regulation from an academic perspective in various regulatory and ethics roles in the public sector and in police leadership. Regarding human rights compliance, the risks of biometric technologies in policing have rightly been highlighted in the scholarly and advocacy literature and by my expert friends here today. Facial recognition technology involves the collection, analysis and retention of sensitive personal data. As we heard, it poses significant risks to collective and individual rights such as privacy and freedom from discrimination. I agree strongly with this analysis and have made those points in my own work. I also invite the committee to reflect on the wider human rights framework.

The State has a duty to protect the human rights of all. I argue that assessing the use of FRT can be very context-specific. There are situations in which it may be possible to use the technology in a human rights-compliant way or to deter or prevent significant human rights abuses. As an example, I come from a disciplinary background in children's human rights. I found in my work that children and young people from ethnic and social minorities may be disproportionately impacted by the use of biometric technologies due to their use of public space and existing inequities in the impact of policing. I also know that in the growing area of online child exploitation, these types of tools can be used to identify alleged victims and alleged perpetrators, thus fulfilling Articles 19 and 36 of the Convention on the Rights of the Child. These two things can be true at the same time. It is vital to look at those contexts. While perceived social licence, political expediency or public opinion cannot in any way override fundamental human rights, we have to reflect on situations in which technology such as this can be used in a human rights-complaint way where there is a legitimate law enforcement objective.

Moving to the particular use case contemplated in the draft legislation, which is retrospective, which means that analysis will occur on already collected imagery. It will depend on the system and vendor contracted, were these proposals to go ahead. There is a spectrum within retrospective use ranging from the kind of speed and scale improvements where a single image is compared against footage to use cases that are very close to live automated, where there is only a small time lag and the reference database is large. That needs to be considered as well in terms of that spectrum. Previous work I have done on FRT in the policing context has categorised retrospective FRT as medium risk. This is dependent on the existence of a significant system of controls. I encourage the consideration, which will be compulsory, of the European Union AI regulations, which I think aligns with that scheme. As we heard in previous submissions, accuracy and bias remain significant concerns. It is important to reflect that humans are not a gold standard for visual identification. It is important not to fall into that trap for comparisons.

To echo what Professor Kaye said, I welcome the production of this draft Bill and amendment to bring facial recognition technology under the rule of law to help safeguard the Irish public. However, I am concerned that the adoption of FRT could do more harm than good in this context and that it could be counterproductive for An Garda Síochána’s operational goals. The development and consistent review of Garda practices, resources and technologies should occur in tandem with the adoption of new technologies, which need to be assessed on their own merit, but also in the context of broader organisational operations.

In this statement, I will highlight three key points relating to effectiveness and the proprietary nature of FRT for the committee but I am happy to discuss other things later on. First, with regard to public order policing or surveillance of public spaces, everyday garments can often render FRT useless because these simple physical barriers stop FRT from seeing the face clearly. Thinking of the riots, baseball caps, face coverings, face masks, glasses, hoods and umbrellas can all potentially obstruct FRT. Notwithstanding this issue, the chilling effects at play should prohibit the use of FRT in public spaces in the first instance.

Second, FRT relies on vast databases of images to operate, using algorithms to find details about one face to assess its similarity to others. Instead of positively identifying an unknown person, some systems will calculate a probability match score between the unknown person and specific face match templates in a database. This means that, instead of a single match, the system offers up several matches ranked by probability score. This puts privacy at risk as individuals who have nothing to do with an event might still be brought into the investigation if their probability score is high enough.

Lastly, the proprietary nature of FRT means the algorithms and processes inside the system are black-boxed. They are often unexplainable to government institutions and the public alike. The practices employed by FRT companies are questionable at best with one of the largest international providers, Clearview AI, being fined and sanctioned for the inappropriate collection, use and disclosure of personal information, creating risks of significant harm to individuals who have never been engaged in a crime and collecting images in an unreasonable manner.

An Cathaoirleach

We are over time. Dr. Bracken-Roche was finishing anyway. I thank her for the contribution. I thank all our distinguished guests. I will move to the members. All members present are offering. I will call on Senator Ruane first, followed by Deputy Daly and Deputy Pringle. Deputy Alan Farrell and some others may wish to come in at that point.

Senator Lynn Ruane

I thank everyone for their presentations. I do not know if anybody watched the last session. It is probably unfair to the witnesses that some of the last session's witnesses' contributions are still ringing in my head. Today's witnesses may be able to clarify some of my concerns from that last session by virtue of their expertise. Facial recognition technology is about facial recognition. As Dr. Bracken-Roche said, that facial image can be obscured in many different ways. In speaking on the heads of Bill, An Garda Síochána has pointed out that there are measures already in place. People can be identified by clothing and then followed from point to point until they are identified. Its representatives seem to be completely avoiding speaking to the fact that this is facial recognition. It is in the name. It has to involve recognition against something. In its contribution, An Garda Síochána has not acknowledged that a database has to be used. Faces are identified and then run through a system to measure them against lots of other faces but An Garda Síochána seems to be saying that no reference point is going to be used for facial recognition technology. That does not make very much sense. If anybody has watched the last session, will they use their expertise to clarify whether there is some sort of misunderstanding in those contributions as regards what the technology is built for and intended to do under the heads of Bill?

I have another question, which is about Garda verification of those matches. Having a human involved seems to be put forward as the answer and solution but, as was highlighted by the ACLU in the US, evidence has shown people being misidentified and that misidentification being held up by the police overseeing the process. The police officers involved were apprehensive of questioning the machine. Will the witnesses speak to the importance of judicial oversight in the granting of access and the importance of independent oversight and the human who makes a decision based on the data that comes through?

I will ask a group of questions and people can indicate as we go back through them. On the codes of practice, to be transparent, I do not feel that it is enough to regulate FRT through regulations or guidelines as it is ever-growing and ever-expanding. Legislation should obviously be sufficiently flexible but guidelines may not be enough to fulfil obligations in respect of human rights, privacy and civil liberties.

How does a person who is misidentified by FRT get access to justice under this Bill? In other legislation, such as the Freedom of Information Act and the GDPR, An Garda Síochána already has rights carved out, allowing it to access data. Does anybody have recourse to justice in light of existing carve-outs?

We know that the method by which that 99% accuracy rate is calculated is problematic. Who is calculating those rates? Is it the vendors, who have decided what accuracy looks like? Obviously, it is their intention to sell a product so it is in their interests to create an accuracy rate based on the number of people a system did not misidentify rather than the number it did. We should speak to some of those vendors. The procurement process in Ireland is an issue. How do we know who those vendors, who are setting the accuracy rates, are? Has a reliable vendor been found in this area?

An Cathaoirleach

I see a few hands raised on the screen. I will call on Dr. Bracken-Roche first, Dr. Birhane second and Dr. Lynch third.

Dr. Ciara Bracken-Roche

I thank the Senator for those great questions. I will give a general response because I know some of my colleagues will have more technical expertise. Many of the questions the Senator has raised are concerns we had in reading this draft amendment Bill. There is a lot of information missing as to the technology, how it will operate and what the protocols around it will be. Trying to incorporate this as an amendment to another Act when the technology is changing so quickly and when there is such a lack of clarity as to how it will operate is of concern. Where has the biometric data come from? There is discussion of biometric data but we are not sure where An Garda Síochána will access data from. On verification, head 7 of the Bill talks about the result being verified by an investigation team but at no point in the draft amendment does it say who this investigation team will be or what kind of training they will have. Who is the facial examiner? How would that operate? All of those specifics need to be brought into the conversation in order for this amendment to proceed. Legislation on this topic could be ad hoc because the technology develops so quickly and because we need to be really specific about how it operates. I will leave my comments there and pass on to Dr. Birhane.

Dr. Abeba Birhane

I thank the Senator for the questions.

I thank Deputy Daly. This may not be particularly helpful but it is quite an unusual thing to begin to legislate for facial recognition technology in this way. There is probably not a large amount of experience internationally to draw on. Certainly in New Zealand where there is some use of retrospective facial recognition technology the police do have an independent panel on emerging technology with community members who look at cases before they begin but there is no legislative oversight. The Irish experience is probably quite novel. Other jurisdictions are relying on a combination of common law and statute to empower it. It is more unusual to begin to legislate. I apologise as this is not particularly helpful but it does show the international context.

Dr. Daragh Murray

Deputy Thomas Pringle

I thank our witnesses. It is very interesting. We probably should have had this session before the previous session because it is far more informative and leading up to questions we could be asking. When the Garda Commissioner was giving his evidence, he said that the 99% plus accuracy of modern biometric identification systems is clearly demonstrated by the biannual review by the US National Institute of Standards and Technology. Are the witnesses familiar with that and whether that example was quoted extensively by An Garda Síochána in terms of how robust this new system is going to be even though it was pointed out that a number of police forces in the US have refused FRT?

Dr. Birhane said that it was a matter of time before it becomes another cautionary international headline. I would agree with that. Regarding the databases that will be used, the database we will use will be the custody records of An Garda Síochána so there is an inherent bias in there in that it is somebody who has been arrested and more than likely will be charged. Does that mean that facial recognition technology will be inherently biased anyway?

I endorse everything Dr. Murray has said on the non-convicted information and I add to that ensuring that it operates on a principled basis in line with the rules for collection and retention of other biometrics such as DNA and fingerprints as the same ideas apply. When someone has been convicted, there is obviously an understanding in international human rights law that that places some restrictions on a person but that does not apply to suspects, victims of crime, voluntary sources and open source intelligence.

I know from various reviews I have done with police and the creakiness of police information technology systems that I would not be overly worried at this stage about the ability to do a broad-based search but technology will improve. It is important, therefore, to lay down those rules now.

I agree with the points made about the passport and driving licence databases because people have given over that data for a particular purpose. I contemplate, as might the European regulation, that this for very extreme circumstances such as a significant threat of terrorism or national security where there could be some sort of exception but, certainly, broad-based searches of other national databases should be explicitly ruled out.

Ms Hinako Sugiyama

I just want to quickly build on the points made by Dr. Murray and Dr.Lynch on the database because international human rights law clearly requires in respect of the legality test not only that it is prescribed in law but that it should be transparent, in that it gives prior notice to the public the sort of consequences which would be caused to humans.

I am not sure I have many questions but I have a couple of points which I want to make so that I can put them on the record for the report. I ask that our witnesses respond to them. I am conscious of the European Court of Human Rights impact which was briefly mentioned in the previous session, particularly around judicial warrants or approval. I believe that question may already have been asked but I would ask for information around the international experience which would be useful.

I found the chilling effect points made by several of the witnesses very interesting in that this was not necessarilyy mentioned in the earlier session.

On the reference databases, we absolutely need that clear legislation as to what it can and cannot be used for, particularly in the international context which brings me to a question for our friends from the Department of Justice. Does this legislation require and EU Technical Regulation Information System, TRIS, referral and has such a referral been done, particularly if we are going to be trying to access international and European databases?

A further point which has been made by many of the witnesses which was not made in the previous session was around the proprietary and black box nature of many of these software systems. The point was made about transparency being essential but how can an accused challenge with ease in court without having that level of transparency?

We have had codes of practice for other technology. They need to be dealt with as much as possible in the primary legislation. We talk a great deal about policing by consent, so surely any code of practice should involve an extensive review and extensive public consultation. That public consultation should be baked into the legislation.

I thank Deputy Costello for the point about oversight. Experts such as ourselves are all very well, but it is important to ensure that community members, in particular those who would probably be disproportionately affected by this, are properly consulted and are in partnership on some of the oversight mechanisms.

One point that has not come up today and that I am particularly interested in is how the proposed legislation would deal with children and young people. Obviously, children and young people have a particular human rights framework, which has a higher level of consideration around privacy, stigmatisation, vested interests, etc., so I think that is an important thing for the committee and the framers of the legislation to reflect on and whether children and young people would be entirely excluded or that there would be a very limited power. The UN Convention on the Rights of the Child does contemplate some situations where public safety may be the primary concern, but there does need to be a different lens on the data of children and young people. I think that is a very important point.

An Cathaoirleach

I thank Dr. Lynch. I think Dr. Murray's hand was up.

Dr. Daragh Murray

I will make just two points very quickly. On the black box, in the UK there is a public sector equality duty, and I am not sure if there is an equivalent piece of legislation in Ireland. Essentially, in the only case that went to court about the police use of facial recognition, they said that the black box was not sufficient to discharge the police's duty, so even though there might have been a proprietary interest in the algorithm, the police still had an obligation under the equality Act to ensure that there was no discrimination. The fact of a black box was not sufficient of itself. That raises a whole other scope of issues, but in terms of the police's obligations to prevent discrimination, it may be a relevant point.

The second one is about the chilling effect. I think the chilling effects are a significant concern because of their potential to undermine democratic processes and have a significant impact on human rights. The difficulty with the chilling effect is that we do not know what the precise impact of facial recognition is going to be, and that should be a cause for concern. The issue is that we might have very negligible effects in the short term but that the impact may be profound in the long term. That is why we do not want to sleepwalk into a very dystopian future. The risk of chilling effects are compounded by the broadness of this proposed legislation. As it stands, it is an enabling mechanism that allows for facial recognition to be used in a wide variety of contexts. As a simple example, the range of activities that can be considered important or relevant to the investigation of a crime is huge. Reasonable people can have a very different interpretation of it so what it comes down to is that facial recognition as it stands could nearly be used for any activity and related to one of the offences, which in themselves are very broad. As it stands, the open-ended nature of the authority that is given to the Garda is a problem.

An Cathaoirleach

Before I go to Ms Sugiyama, who I think has her hand up, I want to make an observation on the point Dr. Murray made. He mentioned the black box. I think he means the magic computer that has the technology within it. It is a black box in the sense that we cannot access the algorithms within. I am reminded that in this jurisdiction there is a plethora of challenges to the technology used to detect motoring offences. It could be a speed van or a Breathalyser for drink-driving offences, and so forth. A cottage industry has sprung up around criminal defence in terms of challenging those devices. I am interested in the views of the expert witnesses. In those type of prosecutions, or certainly within the area of drink-driving or speed capture, it is submitted that the machine is determinative of the offence in the sense that the machine said the person was going past the speed limit or was over the drink-driving limit. As I understand it, what has been put forward today by the Commissioner and others who are advocating for the technology, it is not determinative, rather this is an aid to evidence-gathering and that another process, be it the court or an officer reviewing the outputs, etc. would make the next step. In other words, it is of assistance but not determinative. Does that make any difference in the opinion of the witnesses?

Ms Sugiyama is up next to speak. She will say something anyway but I might just come back to the witnesses on the question I have asked. I would like to hear what they have to say on that. I know Ms Sugiyama has a point to make anyway, and she can answer my question if she likes. Then I will hear from witnesses across the board on the question I have asked, if that is in order.

Ms Hinako Sugiyama

I am more interested in addressing the original question but I will also address the black box issue.

In terms of the prior notification to the public, it is pretty important to make the public disclosure to the public in a way that a layperson can understand how the technology works and how it impacts people's lives. Professor Kaye also mentioned that in the United States there are attempts at state and municipal level to restrain the use of facial identification and other technologies. Some of the legislation includes items to be disclosed to the public and the manner in how this information should be disclosed in San Francisco, for example, or New York city. The American Civil Liberties Union, ACLU, published model legislation to guarantee these points, so that source might be informative in this context.

An Cathaoirleach

I thank Ms Fugiyama. That is very good. I will go back around the table to get responses to the point I raised about the black box.

Dr. Ciara Bracken-Roche

When we are talking about FRT, it can be applied to almost any imagery - video and photographic - so in terms of the scale and scope, it is an entirely different level. When we are comparing it to other technologies, I think we need to keep that in mind. Thinking about things like the chilling effect, function creep, net widening and, as Dr. Murray said, the stigmatisation that can impact already marginalised communities is key. We need to know what the referent database is, and a lot of particulars from the vendors would need to be under consideration as well.

Dr. Nessa Lynch

On the point about the difference between an intelligence match and evidence in court, I think it is probably worth comparing this again to other types of biometrics such as DNA and fingerprints. A motoring offence is maybe a little bit different because that is probably intrinsic to the proof of the offence. However, for a serious criminal offence, obviously DNA and other biometrics will go to prove that the person was there at the particular time, or the identification. Certainly, like DNA evidence, it is not going to help with proving mens rea or other elements of the criminal offence. There is the idea that the normal rules of evidence for a serious criminal offence, and the standard of proof, are still going to have to be met. However, I definitely agree with the points made about accuracy.

Dr. Abeba Birhane

I just want to clarify what we mean by black box technology or black box algorithms. It generally refers to the fact that, for example, for a computer vision system or a face recognition system you save up your parameters, you gather up thousands and even millions and billions of images of faces, and you train your algorithm to differentiate what is a face from what is not a face. After sufficient training, then the algorithm has learned what a face is like. However, you do not know how. That is what is generally referred to as a black box algorithm. This at the heart of machine learning. It is a problem not only with face recognition systems or computer vision but AI in general.

However, it is still possible to have as much information about a given algorithm to be able to assess error rates, performance and so on. For example, training data is a critical element that determines how a certain algorithm performs. Things such as training data and the model architecture are what I refer to when I talk about the public or independent auditors - not even the public, as they do not have to give access to the public. This is information that is available which independent auditors could have access to and could do independent evaluations of such given models. This is the kind of information that is hidden by proprietary rights that nobody outside the vendors and probably An Garda Síochána - I am not sure about the arrangements - may have access to. I just wanted to clarify what we mean by a black box algorithm.

An Cathaoirleach

I thank Dr. Birhane for those further remarks, and all of the speakers who have contributed. That concludes our engagement with the members this evening. We have had a long couple of sessions where there has been quite a degree of detail and engagement. This was a very worthwhile panel and I also note the submissions that have been made, which are before the committee and will be considered when we go to prepare our report in due course. That has been very helpful.

We are privileged to have such an array of expertise before us, and it is one of the benefits of these Oireachtas committees that we can draw upon both national and international expertise, as we have done this evening, to better inform. I hope that it will, as has been suggested, make the legislation that is finally produced here an exemplar of international best practice. That would be a worthy goal, and we would certainly strive to do that on this committee.

I thank the witnesses for all of their assistance. I propose that we publish all of the opening statements on the committee's website. Is that agreed? Agreed.

That concludes our business and I will adjourn until the next sitting. I thank all of the participants who should feel free to follow this process. I am sure they will anyway but I ask that they feel free to remain in touch with us, officially or unofficially. I am sure they will be watching this with interest as they have a significant interest in these matters.

The meeting of the joint committee stands adjourned until Tuesday, 20 February at 4 p.m., which is this day next week, if I am not mistaken. We will then consider a number of reports, including this one.

The joint committee adjourned at 7.35 p.m. until 4 p.m. on Tuesday, 20 February 2024.