4.4.8. Privacy and data protection in first instance asylum procedures

Digitalisation can make the first instance asylum procedure more efficient and flexible, but its implementation also requires adequate safeguards to protect fundamental rights. Issues related to data protection and the right to privacy were raised in several countries during first instance procedures, where applicants challenged the seizure of their mobile phones and the use of the data to establish their identity and nationality. Furthermore, new legislative provisions concerning the use of mobile data in the asylum procedure came into force or were reviewed in several EU+ countries.

In Belgium, the Constitutional Court reviewed the Act of 21 November 2017 amending the Residence Act and the Reception Act by interpreting Article 48/6, according to which the CGRS may request information from an asylum applicant’s electronic device. The court stated that the decision for such a request must be communicated in writing or orally to the applicant or the lawyer and that the authorities are not authorised to carry out unlimited searches themselves on the electronic device but may only consult the elements shown by the applicant from his/her phone.

The Belgian Constitutional Court also annulled Article 57/7(3) insofar as it does not limit the possibility for the CGRS to keep certain elements confidential to cases where "disclosure of information or sources would endanger national security, the security of the organisations or persons who provided the information or the security of the person(s) to whom the information relates, or where the interests of the investigation would be harmed in connection with the processing of applications for international protection by the competent authorities of the Member States or in the international relations of Member States". 

In a judgment that was not final, the Regional Administrative Court of Berlin held that BAMF’s evaluation of data from the applicant’s mobile phone to determine her identity and nationality constitutes an interference with the fundamental right to guarantee the confidentiality and integrity of IT systems. The measure, which is suitable to obtain indications of identity and nationality, is disproportionate due to the encroachment on fundamental rights. The court also noted that measures, such as the evaluation of submitted documents, the implementation of register comparisons, inquiries from other authorities or checking with the interpreter for language issues, constitute milder means that should be used by the authorities.
 
The court also held that, in this particular case, the Federal Office was not entitled to read the applicant’s data from the mobile phone and to evaluate it using software, to save the report generated from the evaluation of the applicant’s mobile phone, to release the report for the applicant’s asylum procedure and to take a decision on the asylum application based on the respective report. The court did not rule that the evaluation of data from applicants’ mobile phones was generally unlawful. The lawfulness of the relevant provision (Asylum Act, Section 15a) was not doubted by the court. The unlawfulness of the measures in the specific case was determined, as the court concluded that milder means could have been applied. BAMF lodged an appeal against the decision on points of law. The proceeding was pending at the Federal Administrative Court for a decision on the legal aspects of the case (BVerwG 1 C 19.21).

Similarly, the Civil Court of Milan in Italy held that the confiscation of the mobile phone of an asylum applicant who is in detention had no basis in the Italian Constitution and was a limitation of the applicant’s rights. The court noted that the limitation of communication with the outside world, which results from the impossibility of accessing the mobile phone, also constitutes a violation of the detainee’s right to access legal safeguards. The court ordered the authorities to allow the applicant to use the mobile phone for a sufficient time (at least 2 hours daily).

In January 2021, the Federal Council in Switzerland adopted a parliamentary initiative on the obligation to cooperate in the asylum procedure, which includes the possibility of checking an applicant’s mobile phone.565  This legislative proposal was criticised by the Swiss Refugee Council, arguing that such measures would lead to a disproportionate violation of the right to privacy, and the proposal is disconcerting for data protection as it lacks an independent control of the data collected, and the procedures for accessing, using and saving data are not clearly defined.566  Similar concerns were raised by UNHCR in April 2021.567
 
Subsequently, on 12 October 2021, the Swiss Federal Assembly adopted amendments to the Asylum Act (LASi) which would add a legal obligation on the asylum applicant to cooperate with the authorities by temporarily handing over any electronic devices when the identity cannot be established based on documents, or the itinerary could not be established by other means.568  The Swiss Refugee Council and UNHCR criticised the measure as disproportionate and a violation of privacy rights.569