Biometric Data Sharing Expansion among Five Eyes Raises Concerns

A network for sharing biometrics, demographics, and other data about visitors, migrants, and other travelers has ballooned in scope and amount of data shared, but mostly out of the watchful eye of the public, journalists, and even national regulatory authorities. The 'Migration 5' arrangement allows data sharing among New Zealand, Australia, Canada, the United States, and the UK.

Independent research by a Fulbright scholar at Georgetown University shows that since New Zealand began sharing data with its partners in 2011, the volume of data exchanged has exploded. The original agreement mainly dealt with fingerprint biometrics, and limited checks against other partners' databases to 3,000 each per year. However, the number of checks allowed rose to 30,000, and now 400,000 for each combination of countries. This means the Migration 5 could be checking 8 million travelers per year, in total.

The original deal included a ten-year time limit for data retention, but the U.S. now stores data for 75 years, and New Zealand holds migrants' biometric data for 50 years. New Zealand also shares biometrics and other data with Japan, and biographic data with the Cook Islands.

A pair of strategy documents for Migration 5 were reportedly published by the partners in 2022, but not released to the public. New Zealand Privacy Commissioner Michael Webster says his office has seen privacy impact assessments from the Migration 5 arrangement, but is otherwise not involved.

The lack of transparency and robust oversight raises concerns about risks related to false matches and data breaches. A human rights lawyer recounts how a face biometrics match appears to have been the sole factor in determining that an individual had attempted to obtain a visa under an assumed identity.

An official for Immigration New Zealand says that Refugee Protection Officers have rules to follow when handling travelers' information, and discretion about sharing it, while individuals have the option to refuse to provide biometrics. However, it is unclear whether they can do so without affecting their visa application.

Information 

Georgetown University is a private research university in Washington, D.C. The National Institute of Standards and Technology (NIST) is a non-regulatory agency of the United States Department of Commerce. The Center for Democracy and Technology (CDT) is a non-profit organization that advocates for digital rights and freedoms.

Immigration New Zealand is the government agency responsible for managing immigration to New Zealand. The New Zealand Privacy Commissioner is an independent officer responsible for promoting and enforcing privacy in New Zealand."

Q: What is the Migration 5 arrangement?

A: The Migration 5 arrangement allows data sharing among New Zealand, Australia, Canada, the United States, and the UK.

Q: How much data is being shared?

A: The volume of data exchanged has exploded since New Zealand began sharing data with its partners in 2011.

Q: What kind of data is being shared?

A: The data shared includes biometrics, demographics, and other information about visitors, migrants, and other travelers.

Q: How long is the data retained?

A: The U.S. stores data for 75 years, and New Zealand holds migrants' biometric data for 50 years.

Q: What are the risks associated with biometric data sharing?

A: Risks include false matches and data breaches, which can have serious consequences for individuals.