Living Under the Digital Eye: How a dual citizen of Greece and the United Kingdom (the "UK") can resist becoming a biometric data source

-- By ValeriaVouterakou - 02 Dec 2024

As a dual citizen of Greece and the UK, I often found myself constantly perplexed by the surveillance landscape that underpinned those two societies. I spent the better half of my life in Greece where surveillance was never a prominent topic of public discourse. After having spent a decade in the UK and having then experienced the phenomenon of hyper-surveillance, I realised that the British public was willing to discuss this topic because they were aware of the surveillance issue hanging over like a pendulum threatening their privacy. This paper explores the hidden ways biometric surveillance operates in everyday life in these societies and outlines the legal and practical strategies for resisting the transformation of one’s own self into a data commodity.

The phenomenon of the hyper-surveilled UK

It may not come as a surprise that surveillance is a major concern for British citizens, as the UK has an estimated 6 million CCTV cameras in operation which amounts to the average Londoner being caught on camera over 300 times per day (n1). The Metropolitan Police is undertaking AI-driven real-time facial recognition trials at heavily trafficked public places. The implication of this trial for the day-to-day life of a resident in London is that a mere walk through Picadilly Circus will result in him being unknowingly scanned and compared against police watchlists. The UK National DNA Database holds over 5 million profiles, including of people with no prior criminal record. Fingerprint and DNA retention policies mean that biometric samples will not be deleted unless expressly requested. The reality for a citizen in London is that if he were to be arrested for a minor protest action with no further consequences or charges, the National DNA Database will still keep his DNA indefinitely.

The illusion of less surveillance in Greece

As a stark contrast to the UK, Greece has significantly far fewer CCTV surveillance and there is generally no large-scale public discussion on biometric tracking, but lack of visible surveillance does not equate to true privacy. For instance, the Greek government is rolling out mandatory biometric ID cards that will replace older forms of identification. So, a Greek citizen must now provide fingerprints which are stored in a centralised EU database in order to apply for a Greek passport. Greece is also part of Eurodac, the EU’s centralised fingerprint database, initially established to track asylum seekers but has seen increasingly wider data collection. Under the Schengen Information System, biometric records are shared across EU law enforcement agencies which means that it is possible that that Greek citizens’ data may be used beyond what was originally anticipated upon their collection. There is a sort of opaqueness when it comes to knowing how these data will be processed across the EU borders and in most cases EU citizens are unaware of these practices. In practical terms, this means that a Greek citizen applying for a visa or crossing the EU border is unknowingly checked against various biometric databases.

The art of unnoticed surveillance

To craft a vivid portrayal of this invisible surveillance, picture a 30-year-old journalist in London. She wakes up to her smart alarm and as she asks Alexa about the weather, her voice command is processed and stored by AI to refine her consumer profile. She then taps her contactless card at the Tube with her journey data logged by TFL. When she is at the office, Microsoft Teams analytics tracks her screen activity. As she steps out to get lunch, Apple Pay tracks her activity and links it to previous purchases to assess spending habits, all while the coffee shop's WIFI collects device data and potentially shares anonymised location trends with third party advertisers. When she is back at home after a long day at work, she scrolls through social media and the algorithm tracks her activity, searches and location history to refine personalised ad targeting. Finally, as she is about to put the lights out, she checks her fitness tracker which continuously stores her heart rate and sleep cycle, anonymised health data which then will be sold (absent her express consent) to insurers and research institutions to build health risk models.

In both Greece and the UK, surveillance operates subtly, embedding itself into every-day activities that go unnoticed by the public. This seamless integration takes shape in the form of constant monitoring and tracking. For instance, if an individual lists his property for renting on Facebook Marketplace, he will likely be monitored by local authorities for potential tax obligations. Unbeknownst to them, individuals put out information on social media that is monitored by authorities in an effort to detect unauthorised activities. Many social media platforms utilise AI-powered facial recognition technology to identify individuals in photos even if they are not explicitly tagged. This practice raises serious red flags and people are often unaware of those practices and the opt-out features for facial data automatic tagging. Even though the facial data is allegedly not collected for the purpose of individual identifications, the practice still raises many concerns on the extent to which surveillance is used on social media platforms. This suggests that the Met police could deploy live facial recognition to develop a database of protestors in the UK.

Surveillance has infiltrated the retail space as biometric tracking is now used to collect data on customers. It is often the case that shopping centres and transport hubs make use of facial recognition to track customer movements and companies often use biometric data such as facial recognition systems linking a customer’s history of past visits to predictive purchasing behaviour. While Greece appears, prima facie, less evasive in the biometric tracking practice, the recent transition to cashless transactions has helped institutions create a detailed behavioural profile linking financial patterns to specific locations and activities. When an unsuspected citizen makes a contactless payment in a market in Athens, the technology combined with other data sources can be potentially used to build a more comprehensive picture of an individual's movements. Our digital footprint is so big that a combination of information can reveal so much about our activities and predispositions and it seems like this simple fact falls out of the ambit of matters that preoccupy the Greek public.

A Guide to Digital Anonymity

Whilst the surveillance picture painted looks grim, reducing one’s digital footprint is still feasible and it can be achieved by resisting biometric data collection, following technological strategies for increased anonymity and minimising social media presence.

Under the Protection of Freedoms Act 2012, individuals can request the deletion of their DNA and fingerprints absent a past criminal record. In 2020, the English Courts deemed the automated facial recognition technology used by South Wales Police unlawful and a violation of privacy rights in the case of Ed Bridges v South Wales Police (n2). Another way to protect someone’s identity is by using infrared-blocking glasses and opting for accessories that distort AI-based face recognition in highly surveilled areas of London to avoid facial recognition and tracking. The use of de-Googled phones can also prevent passive location tracking. In a similar manner disabling WIFI and Bluetooth in public spaces can reduce digital footprint. To prevent cross-border tracking in the EU, a traveller can use burner SIM cards.

The General Data Protection Regulation provides a stronger legal protection because it gives individuals the option to request access and deletion of their biometric data. Greek citizens can take advantage of this option and also delay the adoption the new biometric ID cards that the Greek government is in the process of implementing. Both residents in Greece and the UK should opt for encrypted messaging apps, use privacy-focused search engines like Startpage and opt-out of all data collection. To achieve secure internet usage, they can use VPNs to prevent ISP tracking and a Tor Browser. The use of burner emails such as ProtonMail? and Temp Mail as well as the use of block trackers can also add to digital anonymity. To ensure location privacy, individuals are advised to turn off location services and opt for privacy focused phones while removing any smart assistants like Alexa and Siri. Opting for privacy-friendly payment methods and cash payments can also ensure transaction privacy.

Conclusion

While the road to full anonymity seems utopic for the UK given the heightened surveillance landscape, residents still have the option to implement changes in their day-to-day life to minimise surveillance. Notwithstanding that Greece is less surveilled, it has adopted EU-wide biometric control measures. Greek residents must become increasingly aware of the surveillance force that looms over, unseen, yet inescapable. The surveillance elephant is not merely in the room, it is expanding exponentially, shaping the very space we navigate and it is about time Greeks acknowledged the weight it carries into their lives.

Endnotes:

N1 - https://www.nytimes.com/2018/08/13/lens/surveillance-camera-photography.html

N2- https://www.hunton.com/privacy-and-information-security-law/uk-court-of-appeal-finds-automated-facial-recognition-technology-unlawful-in-bridges-v-south-wales-police

---

You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, ValeriaVouterakou
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.