Data watchdog raps EU asylum body for snooping

The asylum agency, based in Malta, says its reports have helped to detect migrants on their way to Europe, but the monitoring activity has raised concern from data protection authorities.

EASO lacks a legal basis for collecting personal data on social media, the EU's data protection supervisor Wojciech Wiewiórowski said in a recent letter.

He imposed a temporary ban on the project.

EASO has monitored social media since January 2017. It took over a project and two employees from the UN refugee agency UNHCR, it announced then in its newsletter.

Refugees use groups on Facebook and YouTube channels to exchange news on routes and conditions in transit countries, the UNHCR's final report said.

According to their findings, migrants trust information from peers on social networking sites more than conventional media.

Social media is also used by smugglers and traffickers to advertise their services, the UN experts said. Their project ran from March to December 2016. Its initial focus was on fighting disinformation among refugees and migrants.

"It soon transpired, however, that the social media findings were useful to an extraordinary large number of different stakeholders in Europe", the report says.

EASO specialists in Malta on the project searched groups and channels on social media using keywords in languages such as Arabic, Pashtu, Kurdish, Edo and Amharic.

"Through the activity, EASO alerted national asylum and migration authorities on changes in migration routes, smuggling offers being made to migrants and potential asylum seekers, offers for the sale of fake documents which could be used to attempt to trick asylum authorities, as well as the reactions of asylum seekers and migrants to developments in countries of origin, transit and destination", a spokesperson for the EU agency told netzpolitik.org.

"The goal of the activities was to inform member states and prevent the abuse of vulnerable people", EASO spokesperson Anis Cassar said.

He declined to provide samples of the reports sent to EU member states and other agencies, citing their confidentiality.

Asked for a "success" due to their social media monitoring, the asylum office mentioned the "convoy of hope" in Greece.

Earlier this year, a group of several hundred people mainly from Iran, Afghanistan and Pakistan tried to cross the border from Greece to Bulgaria. Border forces stopped them by firing teargas.

The spokesperson said social media monitoring had made the "very early detection" of the "convoy of hope" possible.

The hard-line response of EU countries to refugees and migrants seeking to enter Europe has sparked outrage from human rights groups.

A focus point is Libya, were migrants are frequently mistreated by local militia.

German diplomats have warned of "concentration camp-like" conditions in detention camps on the Libyan coast. New reports on the treatment of migrants in Libya frequently surface on social media.

EASO's spokesperson said he could not say whether reports ever included possible human rights violations against refugees, or if such violations were a priority for the monitoring team.

He noted "the reports certainly contributed to enabling national authorities to target smugglers, and to lives being saved". However, the agencies work was "different from law enforcement, border guard actions or anti-trafficking efforts."

The European data protection supervisor (EDPS) levelled harsh criticism at EASO in the letter from November 17.

Breach of GDPR

EU institutions are bound by new, stricter rules of data protection that were adopted last year in the wake of the General Data Protection Regulation.

The watchdog said the asylum agency had collected sensitive personal data about migrants, including their religious affiliation, without informing the data subjects.

EASO's spokesperson said that they did not agree with the interpretation of the law by the EDPS, but would nevertheless respect it.

The data protection authority warned that the filtering of information by language and keyword may "lead to assumptions of group behaviour that are inaccurate and may enhance risks of discrimination."

The watchdog also complained that a sample weekly report provided by EASO contained email addresses and a telephone number of migrants.

The asylum agency stressed that it took "excess measures to ensure that no personal data was ever stored".

EASO's spokesperson said there were no plans to re-start social media monitoring, however the agency regretted the "negative consequences" of not being able to inform member states.

The agency also warned of the "potential harmful impact on the safety of migrants and asylum seekers due to the restricted ability to be aware of their exploitation."

EASO has been in trouble with EU watchdogs before.

Last year, Politico reported that the anti-corruption agency OLAF was investigating misconduct at EASO in procurement, human resources and data protection as well as on accusations of bullying and "a culture of irresponsibility".

OLAF confirmed to netzpolitik.org that it had conducted an investigation and found irregularities, but declined to provide further details.

Meanwhile, the EU border agency Frontex recently halted its own social media monitoring project after severe criticism from campaign groups.

Frontex had published a tender worth €400,000 in September for social media services "concerning irregular migration trends and forecasts".

The EU agency was quizzed about the project by campaign group Statewatch and journalists at Mediapart.

It finally cancelled the tender after data protections concerns were raised by the NGO Privacy International.