Living Under the Digital Eye: How a dual citizen of Greece and the United Kingdom can resist becoming a biometric data source

-- By ValeriaVouterakou - 02 Dec 2024

As a dual citizen of Greece and the United Kingdom, I often found myself constantly perplexed by the surveillance landscape that underpinned those two societies. I spent the better half of my life in a country where surveillance was not a significant concern for the Greek society and has never been a prominent topic of public discourse. After having spent a decade in the United Kingdom and having experienced the phenomenon of hyper-surveillance in that society, I realised that citizens are more willing to talk about it because they know that there is an elephant in the room. This paper explores the hidden ways biometric surveillance operates in everyday life in these societies and outlines the legal and practical strategies for resisting the transformation of one’s own self into a data commodity.

The phenomenon of a hyper-surveilled United Kindgom

It may not be a surprise that surveillance is a major concern for British citizens, as the United Kindgom has strikingly an estimated 6 million CCTV cameras in operation which amounts to the average Londoner being caught on camera over 300 times per day. The Metropolitan Police is undertaking AI-driven real-time facial recognition trials at heavily trafficked public places. The implication of this trial for the day-to-day life of a resident in London is that a mere walk through Picadilly Circus will result in him being unknowingly scanned and compared against police watchlists. The UK National DNA Database holds over 5 million profiles, surprisingly even of people with no prior criminal record. Fingerprint and DNA retention policies mean that biometric samples will not be deleted unless expressly requested. The reality for a citizen in London is that if he were to be arrested for a minor protest action with no further consequences or charges, the National DNA Database will still keep his DNA indefinitely.

.---++++ Subsub 1

The illusion of less surveillance in Greece

As a stark contrast to the UK, Greece has significantly far fewer CCTV surveillance and there is generally no large-scale public discussion on biometric tracking but lack of visible surveillance does not equate to true privacy. For instance, the Greek government is rolling out mandatory biometric ID cards that will replace older forms of identification. So, a Greek citizen must now provide fingerprints which are stored in a centralised EU database in order to apply for a Greek passport. Greece is also part of Eurodac, the EU’s centralised fingerprint database, initially established to track asylum seekers but has seen increasingly wider data collection. Under the Schengen Information System, biometric records are shared across EU law enforcement agencies which means that it is possible that that Greek citizen’s data may be used beyond what was originally anticipated upon its collection. There is a sort of opaqueness when it comes to knowing with certainty how these data will be processed across the EU borders and in most cases EU citizens are unaware of these practices. In practical terms, this means that a Greek citizen applying for a visa or crossing the EU border is unknowingly checked against various biometric databases.

The art of unnoticed surveillance

To paint a picture of this unseen surveillance, picture a 30-year-old journalist in London. She wakes up to her smart alarm and as she asks Alexa about the weather, her voice command is processed and stored by Amazon AI to refine her consumer profile. She then taps her contactless card at the Tube with her journey data logged by TFL. When she is at the office, Microsoft Teams analytics tracks her screen activity and message frequency. As she steps out to grab lunch, Apple Pay tracks her activity and links it to previous purchases to assess spending habits all while the café’s WIFI collects device data and potentially shares anonymised location trends with third party advertisers. When she is back at home after a long day at work, she scrolls through Instagram and the algorithm tracks her activity, searches and location history to refine personalised ad targeting. Finally, as she is about to put the lights out, she checks her fitness tracker which continuously stores her heart rate and sleep cycle, anonymised health data which then will be sold (absent her express consent) to insurers and research institutions to build health risk models. In both Greece and the United Kingdom, surveillance operates subtly, embedding itself into every-day activities that go unnoticed by the public. This seamless integration takes shape in the form of constant monitoring and tracking. For instance, if an individual lists his property for renting on Facebook Marketplace, he will likely be monitored by local authorities for potential tax evasion. Unbeknownst to them, individuals put out information on social media that is monitored by authorities in an effort to detect unauthorised activities. Many social media platforms utilise AI-powered facial recognition technology to identify individuals in photos even if they are not explicitly tagged. This practice raises serious red flags and people are often unaware of those practices, let alone that there are opt-out features for facial data automatic tagging. Even though the facial data is allegedly not collected for the purpose of individual identifications the practice still raises many concerns on the extent to which surveillance is practised on social media platforms. This means that potentially Met police could deploy live facial recognition to develop a database of protestors in the UK.

Surveillance has infiltrated the retail space as biometric tracking is now used to collect data on customers. It is often the case that shopping centres and transport hubs make use of facial recognition to track customer movements and absent a customer’s express consent, companies often use biometric data such as facial recognition systems linking a customer’s history of past visits to predictive purchasing behaviour. While Greece appears, prima facie, less evasive in the biometric tracking practice, the recent transition to cashless transactions has helped institutions create a detailed behavioural profile linking financial patterns to specific locations and activities. When an unsuspected citizen makes a contactless payment in a market in Athens, the technology combined with other data sources can be potentially used to build a more comprehensive picture of an individual movements. Our digital footprint is so big that a combination of information can reveal so much about our activities and predispositions and it seems like this simple fact falls out of the ambit of matters that preoccupy the Greek public.

A Guide to Digital Anonymity

Whilst the surveillance picture painted looks grim, reducing one’s digital footprint is still feasible and it can be achieved by resisting biometric data collection, following technological strategies for increased anonymity and minimising social media presence.

Under the Protection of Freedoms Act 2012, individuals can request the deletion of their DNA and fingerprints absent a past criminal record. In 2020, the English Courts deemed that automated facial recognition technology used by South Wales Police was unlawful and a violation of privacy rights in the case of Ed Bridges v South Wales Police. Another way to protect someone’s identity is by using infrared-blocking glasses and opting for accessories that distort AI-based face recognition in highly surveilled areas of London to avoid facial recognition and tracking. The use of de-Googled phones such as CalyxOS? can also prevent passive location tracking. In a similar manner disabling WIFI and Bluetooth in public can reduce digital footprint. To prevent cross-border tracking in the EU, a traveller can use burner SIM cards.

The GDPR provides a stronger legal protection because it gives individuals the option to request access and deletion of their biometric data. Greek citizens can take advantage of this option and also delay the adoption the new biometric ID cards that the Greek government is in the process of implementing. Both residents in Greece and the UK should opt for encrypted messaging apps, use privacy- focused search engines like Startpage instead of Google and opt out of all data collection. To achieve secure internet usage, they can use VPNs to prevent ISP tracking and Tor Browsers. The use of burner emails such as protonmail and tempmail as well as the use of block trackers can also add to digital anonymity.

To ensure location privacy, individuals are advised to turn off location services and opt for privacy focused phones such as CalyxOS? instead of Android and iOS while removing any smart assistants like Alexa and Siri. Opting for privacy-friendly payment methods and cash payments can ensure a better transaction privacy.

While the road to full anonymity seems unfeasible for the UK given the heightened surveillance landscape, residents still have the option to implement changes in their day-to-day life to minimise surveillance. Notwithstanding that Greece is less surveilled, it is adopting EU-wide biometric control measures. Greek residents must become increasingly aware of the surveillance force that looms over, unseen yet inescapable. The surveillance elephant is not merely in the room, it is expanding exponentially, shaping the very space we navigate and it is about time Greeks acknowledged the weight it carries into our lives.

---

You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, ValeriaVouterakou
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.