In 2002, Estonia created the e-State, which gave people in Estonia the opportunity to securely communicate with the state and each other in the electronic world using their ID card and X-Road. In 2014, we extended our e-State to the entire world, creating e-residency. This also gives the residents of other countries the opportunity to securely use e-services. In 2022, we introduced a system based on biometrics, which helps increase the security of identification and verification of identity. This provides even better assurance that a person is who he or she claims to be.
Creation of the Automated Biometric Identification System database ABIS – FAQ
ABIS is a central national database where biometric data gathered in state proceedings is stored: facial and fingerprint images and palm prints.
ABIS allows us to compare biometric data using artificial intelligence, thereby increasing the reliability of verifying personal identification and verification of identity. This gives even better assurance that a person can only have one identity in Estonia. This way, ABIS helps ensure security and combat crime more efficiently.
After ABIS was introduced, personal data has been protected even better than before. Biographical data, such as names and personal identity codes are now stored in a different database than palm prints and facial and fingerprint images. They can be linked only when the user has access to both databases.
Biometric data are physical or behavioural attributes which can be used for identifying a person, e.g. facial and fingerprint images, palm prints, DNA, the iris and the retina, voice, facial expressions, body shape, signature (handwriting), smell, hand geometry, palm vein pattern, footprint, ear print, tattoos, scars and birthmarks. As well as the printing pattern on a computer and mouse movement pattern.
In Estonia, facial and fingerprint images, palm prints, signatures and DNA data are gathered in state proceedings. Facial and fingerprint images and palm prints are entered into ABIS.
Through objectively certain identification and verification of identity, ABIS helps:
- support the fight against serious crime and terrorism;
- increase border security and prevent illegal immigration;
- prevent the use of forged documents and false or double identities;
- increase the efficiency with which civil servants fulfil their work tasks with cutting-edge technology.
The automated comparison function of ABIS makes comparing biometric data left at a crime scene with the data in the national database significantly faster, in order to promptly identify the offender. This considerably reduces the time spent on expert analyses and the processing of offences.
ABIS also helps detect illegal stays in Estonia. ABIS helps promptly identify unconscious people who have been involved in an accident and are not carrying a personal identification document.
In short, ABIS is needed to ensure security in society and to protect personal data with modern highly advanced tools.
An example from real life, where a citizen of a foreign country filed a readmission application for his readmission to Estonia.
A person presented himself as a citizen of Estonia: while in prison, he learnt the life story and identity of a prison mate with whom he was similar in appearance. As his identity could not be determined in any other way, he was sent to Estonia for identification and his transportation costs were covered. The Police and Border Guard Board sent a relative of his to meet him at the border and asked them to determine whether he was their relative. The relative was in shock and said that he was a total stranger.
With the comparison function of ABIS, an enquiry can be made to ABIS (comparing data in the Police and Border Guard Board’s database) for the purpose of identification before making a decision, saving time and money for both countries and avoiding causing trauma for a person looking for their relative.
ABIS allows comparing biometric data one-on-one and one-on-multiple.
One-on-one
One-on-one comparison is used for verifying identity, i.e. ascertaining whether a person is who he or she claims to be. For this purpose, the person’s biometric data is taken and compared to his or her earlier data entered into ABIS. The data are not compared to the data of other persons.
For instance, if the police stops someone at the border whose identity they doubt, they take the biometric data of the person and compare these with the personal identification document data entered in ABIS. The comparison shows whether the person and the identity match or not.
One-on-multiple
One-on-multiple comparison is used for identifying a person, i.e. determining who the person is. For this purpose, the biometric data of the person is taken and compared with other data in ABIS. In response, ABIS presents a specific number of similar candidate prints or facial images on the basis of which an expert makes a decision on a match. For instance, one-on-multiple comparison allows us to identify a dead person whose identity is unknown.
At first, a one-on-one comparison is performed, as this infringes less on a person’s rights. Only if that fails, one-on-multiple comparison may be used.
The final decision on a data match in both one-on-one comparison and one-on-multiple comparison is always made by a person, not artificial intelligence.
Yes, ABIS is a modern artificial intelligence solution, which in the interest of everyone's security ensures the improved implementation of a law that has already been in effect for more than ten years.". The new solution modernises technological information security measures and creates better legal certainty. Thus, our personal data are even more securely protected.
The rapid development of technology and the modern data processing possibilities require a clear, transparent and unambiguous formulation of the principles of data processing. This is necessary to establish an even clearer understanding of which state institution processes which personal data and for what purpose.
Data are processed in compliance with all the data protection principles and requirements, ensuring the lawful and transparent use of data. All the procedures which civil servants perform in databases – such as accessing, altering, adding and erasing data – are logged and the justification for the enquiries is systematically checked with measures developed for that purpose.
According to personal data protection requirements, persons themselves are the owners of their data and they always have the right to check who has accessed, used or erased or otherwise processed their data and for what purpose.
Yes, the applicable law permitted taking and comparing biometric data. For instance, this has been used for a long time in solving crimes.
The obligation to capture fingerprints derives from international and European Union law and is nationally regulated. Pursuant to the Code of Criminal Procedure, biometric data gathered for other purposes have been allowed to be used for detecting offences for more than ten years. Biometric passports were also introduced as far back as 2009 and fingerprints gathered in the procedure of issuing personal identification documents are since then stored in the personal identification documents database.
Yes, ABIS is in conformity with the applicable international and European Union law, including the Charter of Fundamental Rights of the European Union, the General Data Protection Regulation (GDPR), the Law Enforcement Directive and other relevant EU legal acts and the restrictions arising therefrom.
The legitimacy requirements of the GDPR says that there must always be a legal basis for processing personal data. Biometric data are classified as a special category of personal data and the legal bases for processing these are provided in Article 9 (2) of the GDPR. A legal basis for gathering biometric data is provided in paragraph (g) of Article 9 (2), pursuant to which processing is allowed when processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respects the principals of the right to data protection and provides for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The Government allocated 14.8 million euros for the development of ABIS in 2017. In addition, 1.7 million euros have been allocated from the European Union structural funds.
The budget of ABIS is distributed as follows in 2019–2025:
- personnel-related management expenses – approximately 4.3 million euros
- development and implementation expenses of ABIS – approximately 6.4 million euros
- maintenance and operation costs of ABIS – approximately 2 million euros
On 8 June 2021, the obsolete fingerprint comparison system AFIS of the Estonian Forensic Science Institute was transferred to a new technical solution. This gave the Institute’s fingerprint experts a modern tool with which to compare fingerprints in criminal proceedings.
Biometric data stored in other national databases were transferred to ABIS on 30 June 2022.
No, the creation of ABIS does not grant the state additional rights to process data.
The circle of civil servants who process biometric data is not extended. Every civil servant still has access only to the data to which they had access before ABIS was taken into use. For instance, a civil servant who is conducting visa proceedings has access to data that concern the visa proceedings, while a civil servant who is conducting criminal or misdemeanour proceedings has access to data needed in criminal or misdemeanour proceedings.
After the introduction of ABIS, people’s data are even better protected than before. A person’s name and personal identity code are stored in another database than his or her biometric data. The data can be linked only when access to both databases is granted for conducting proceedings.
Yes. Pursuant to international and European Union law, it is mandatory to use biometric data in various proceedings.
The aim of this is to better ensure public order and security through a more reliable identification of persons. Biometric data are taken and compared in all the European Union countries as well as in third countries, primarily in proceedings where the precise identification of persons is of critical importance, such as offence proceedings, migration related proceedings, in border control, proceedings for issuing travel documents and personal identification documents, and visa proceedings.
Composition of data and storage of data in ABIS – FAQ
ABIS contains facial and fingerprint images and palm prints which were transferred to ABIS from the following databases:
- National Fingerprint Database
- Identity Documents Database
- Database of Aliens Staying or Having Stayed in Estonia Illegally
- National Database of Prohibitions on Entry
- Database for Registering Short-term Employment of Aliens in Estonia
- National Register of Granting International Protection
- Register of Residence and Work Permits
- Visa Register
- Database of Persons Who Have Acquired or Lost Estonian Citizenship, or to Whom Estonian Citizenship Has Been Restored
- Database of Professional Acts of Consular Officers and Database of Diplomatic Passports
In ABIS, people’s data are even better protected than before, as biometric data are stored separately from names and personal identity codes.
No, the term ‘facial image’ is not new in Estonian law. It was defined in 2006 and it was established already back then that the image of an iris is not a facial image. The Estonian state does not currently have the possibility of capturing irises and it has not been created with the creation of ABIS.
The technology for capturing and comparing facial images is entirely different from the technology for identifying people on the basis of their irises. The latter is not used in Estonia and ABIS does not contain iris data. ABIS only contains facial and fingerprint images and palm prints.
Biometric data are delicate personal data, which is why to be able to capture and compare any additional data a public discussion would first have to be initiated in society and Estonian law changed. Law amendments must be approved by ministries as well as the Data Protection Inspectorate.
No, DNA data are engaged in offence proceedings and for exclusion purposes from police officers and the employees of the Estonian Forensic Science Institute. Exclusion is required, for instance, so as to promptly exclude bomb disposal experts who have worked on a bomb scene from amongst the suspects by comparing fingerprints.
DNA data are stored in the DNA Register of the Estonian Forensic Science Institute and are not stored in ABIS.
No, in order to ensure better protection of personal data, biometric data is not stored in ABIS together with biographic data, i.e. names, identity codes, citizenship, etc.
Biographic data are still stored in the current databases – such as the Identity Documents Database and the Visa Register. All data are stored separately and a person’s data set can only be assembled when a civil servant has access to both databases. This reduces potential data security risks, as it is impossible to obtain entire data sets in the case of an incident.
For instance, similarly to the recent leak of photos of personal identification documents from the Information System Authority, a leak from ABIS would also only let perpetrators obtain photos or fingerprints and it would be impossible to link these to a person’s name or identity code.
No, a person cannot request the erasure of his or her data from ABIS.
For instance, the Identity Documents Act stipulates that when a person submits a document application, he or she attaches his or her photo to it and his or her fingerprints are taken, which allow his or her unmistakable identification. The person applying for a document must therefore give his or her biometric data and allow the processing and storage of such data for producing and using the document. This is why people cannot request the erasure of their data from ABIS. However, you can always check who has accessed, used or erased your data and for what purpose by contacting the owner of the database, i.e. the Police and Border Guard Board.
Storage terms have been established by the legislator and they differ depending on the type of proceedings, as data need to be stored for the use of different purposes. Access to data is level-based. After a certain period of time has passed, data are transferred to the archive of the database, access to which is more restricted. For instance, biometric data gathered in visa proceedings are archived five years, biometric data gathered in citizenship proceedings 20 years and biometric data gathered in offence proceedings 40 years after entry into the database. Different terms have also been established for the storage of data in the archive section, for example, biometric data gathered in visa proceedings are stored in the archive section for 75 years, biometric data collected in criminal proceedings for 35 years, after which the data are deleted, and biometric data collected in citizenship proceedings are permanently stored in the archive section.
The terms have been established for the purpose of ensuring security and public order. It is important to ensure objectively certain identification and verification of identity, in order to uncover potential identity fraud in state proceedings. It is important to store the data in ABIS for a long time, as ABIS allows making enquiries for the verification of identity and identification of persons in nationally vital services, such as electronic identification of persons, digital signing, and payment services.
The data in ABIS are also relied upon by other state institutions and databases (e.g. the Population Register), notaries and other representatives of free professions and the representatives of the private sector (e.g. banks). Personal identification data need to be used throughout a person’s life cycle and in certain cases also after the person’s death, e.g. in matters related to descendance and citizenship. Data concerning obtaining Estonian citizenship and status determination are data of national archival value.
Access to ABIS – FAQ
ABIS is used by institutions who already have to process biometric data in their proceedings. ABIS does not change or extend these authorisations.
ABIS and its data are the responsibility of and can be accessed by the Police and Border Guard Board, the Estonian Forensic Science Institute and the Ministry of Foreign Affairs for the fulfilment of their tasks arising from law.
For instance, the Police and Border Guard Board handles crimes and asylum requests, expels foreigners illegally staying in Estonia, and issues personal identification documents. Eight databases of the Police and Border Guard Board are interfaced to ABIS and every civil servant is only able to access the data they could access before. ABIS does not create new legal bases for processing personal data.
Strict rules have been established for using databases and processing data across the country and in institutions.
The use of databases is restricted with legal, organisational and technical measures. Civil servants have access to data that are necessary for the fulfilment of their tasks. They do not have access to other data. For instance, a civil servant who is conducting visa proceedings has access only to databases necessary for visa proceedings, while a civil servant who is conducting criminal or misdemeanour proceedings has access only to databases necessary for criminal or misdemeanour proceedings.
Data gathered in other proceedings may still be processed in criminal proceedings only with the permission of the prosecutor for solving serious crimes.
Yes, private sector institutions where personal identification is very important gain access to the data in ABIS via other databases interfaced to ABIS in order to check that the person wishing to use their services is who he or she claims to be. In other words, private sector institutions can only make one-on-one enquiries and only via another database interfaced to ABIS.
For instance, subsection 5 of § 31 of the Money Laundering and Terrorist Financing Prevention Act stipulates that credit and financing institutions have the right to use personal identification data entered in the Identity Documents Database for identifying an e-resident and verifying data. Banks can thus use the data exchange platform X-Road to make an enquiry to the Identity Documents Database which in turn requests the biometric data from ABIS and forwards the information to the bank. Banks already receive biometric data from the Identity Documents Database and the introduction of ABIS has not changed anything for them.
Data are issued from national databases to competent authorities of foreign countries only on the basis of law, international agreements or other international legal acts binding for Estonia.
Since 2008, for instance, fingerprint data enquiries can be made in the European Union in the fight against terrorism, cross-border crime and illegal migration on the basis of the treaty on stepping up cross-border cooperation, or the Prüm Convention.
Supervision over ABIS procedures – FAQ
No, the applicable law does not allow the use of public cameras for comparing people’s biometric data automatically to ABIS data in real time. That would be a very intensive infringement of fundamental rights and would require a clear authorisation.
Pursuant to § 34 of the Law Enforcement Act, the police or, in the cases established by law, another law enforcement agency may use monitoring equipment for monitoring in a public place for ascertaining or countering a threat or for eliminating a disturbance. A person may only be identified with his or her knowledge.
The identification of persons with public cameras is therefore not allowed.
No, only the civil servants of pre-defined institutions have access to ABIS. Their roles, rights and obligations are clearly defined in legal acts. Data cannot be processed without authorisation – it is prohibited and punishable.
Access to ABIS does not mean that civil servants have access to all the data. Every civil servant who is tasked with conducting proceedings can process biometric data only via the database to which he or she has access. No one can presume that they can escape punishment for unauthorised processing.
Yes, the Police and Border Guard Board has the right to check who has accessed data and made entries and when. The use of the data in ABIS can be monitored and checked in the case of every civil servant with access rights.
All the personal data processing procedures are logged in ABIS. The log shows the gathering, altering, reading, disclosing, transmitting, linking and erasing of data. The log must make it possible to determine who and why and when data has been processed and the log is encrypted in order to ensure the reliability of the log data. The log data are stored for ten years from an enquiry or entry having been made. This is necessary in order to comply with internal control measures in performing supervision over the database.
Upon receiving an access request, the Police and Border Guard Board assesses whether the person requesting access has the legal basis and the competence needed for access to ABIS data.
The users of ABIS data have to ensure with internal control measures that the data are processed lawfully. The duty of the internal control function of the Police and Border Guard Board is to analyse data processing logs in order to check the data enquiries of the Police and Border Guard Board and other institutions. For this purpose, requirements for the security and storage of data processing logs have been established in legal acts.
Technical monitoring solutions are used for detecting possible security incidents and anomalies, or data processing that differs from the usual. Monetary sanctions for violations are established for private sector institutions in contracts. In the event of a material violation by a civil servant, control or disciplinary proceedings are initiated in order to determine the circumstances.
No, the police is obligated to ascertain before commencing a procedure or proceeding that the procedure or proceeding is conducted with regard to the right person. Without ascertaining the identity of the person, the police may infringe upon the rights of the person by performing erroneous procedures or wrong data processing. Ascertaining the identity of persons is therefore mandatory in procedural procedures and no consent is required for it.
Depending on the proceedings, the relevant administrative act will not be issued in the case of refusal, e.g. a visa or travel document cannot be issued, or the proceedings will be conducted with coercion by, for instance, detaining the person for 48 hours for identifying him or her (law enforcement proceedings).
The mechanisms for acting in a critical situation are established by a three-level baseline security system class.
In the case of a possible security incident, ABIS will be switched to back-up servers that ensure the functioning of a nationally important database and exclude any data losses.
The processing of personal data in the area of government of the Ministry of the Interior
The Ministry of the Interior is tasked with ensuring public order and national security. Public order and security are influenced by a number of closely related areas, such as the fight against terrorism and organised crime, efficient border control, and the detection of identity fraud.
In order to ensure public order and security, a number of national databases have been created according to the law for the fulfilment of public tasks in the area of government of the ministry of the Interior. The following are entered into the databases:
- personal data gathered in state proceedings (e.g. data gathered in personal identification document or residence permit proceedings)
- procedural data (e.g. data gathered in processing a visa application)
Access to databases
The use of databases is restricted using legal, organisational and technical measures. Civil servants can only access data for the purpose of fulfilling their work tasks and only to a limited extent. They have no access to other data. For instance, a civil servant who is conducting visa proceedings only has access to databases necessary for visa proceedings, while a civil servant who is conducting criminal or misdemeanour proceedings only has access to databases necessary for criminal or misdemeanour proceedings.
Ensuring the lawfulness of data processing
The legal bases of data processing have been established by law in accordance with the Charter of Fundamental Rights of the European Union and the legal acts regulating the protection of personal data. Data can only be processed on the terms and conditions established in legal acts. There are no additional rights for processing data. Data are processed in compliance with all the data protection principles and requirements, ensuring the lawful and transparent use of data.
In Estonia, everyone is the owner of their data. Pursuant to legal acts that regulate the protection of personal data, every person always has the right to check which institution has accessed, used or otherwise processed his or her data and on which legal basis and for what purpose.
In order to prevent and detect the abuse of personal data, the Ministry of the Interior has developed a comprehensive system of measures which is based on technology and supervision.
Databases in the area of government of the Ministry of the Interior
Databases of the Ministry of the Interior:
- Population Register
- Database of Border Crossing Queue
Databases of the Rescue Board:
- Rescue Information System
Databases of the Emergency Response Centre:
- Database of Emergency Notifications
Databases of the Police and Border Guard Board:
- Police Database
- Border Control Database
- National Register of Granting International Protection
- Register of Residence and Work Permits
- Identity Documents Database
- Database of Persons Who Have Acquired or Lost Estonian Citizenship, or to Whom Estonian Citizenship Has Been Restored
- Database for Registering Short-term Employment of Aliens in Estonia
- National Database of Prohibitions on Entry
- Database of Aliens Staying or Having Stayed in Estonia Illegally
- Visa Register
- Register of Service and Civilian Weapons
- Database for Organisation of Guarding State Border
- ABIS
- State Register of Schengen Information System
- Passenger Name Record Database
Last updated: 11.09.2023
