Luxembourg, 29 June 2023
PRESS RELEASE No 112/23
According to Advocate General Medina, the mandatory collection and storage of fingerprints in identity cards is valid.
Regulation 2019/11571 sets out the obligation to include, as from 2 August 2021, on a highly secure storage medium, an image of the fingerprints of the holder in any identity card2 newly issued by the Member States. In November 2021, a German citizen applied to the City of Wiesbaden (Germany) for the issuance of a new identity card. In his application, he specifically asked for that card to be issued without the inclusion of a fingerprint image in its chip.
The City of Wiesbaden refused the application, on the ground, among others, that the identity card could not be issued without the holder’s fingerprint image, given that, since 2 August 2021, it had become mandatory to store a fingerprint image in the chip of new identity cards.
Seized in this context, the Administrative Court, Wiesbaden, harbours doubts as to the validity of Regulation 2019/1157 and, therefore, for the mandatory nature of the collection and storage of fingerprints in German identity cards. In particular, that Court wishes to ascertain first whether the appropriate basis for the adoption of Regulation 2019/1157 was Article 21(2) TFEU, rather than Article 77(3) of that same treaty; second, whether Regulation 2019/1157 is compatible with Articles 7 and 8 of the Charter read in conjunction with Article 52(1) thereof; and, third, whether the said regulation is in conformity with the obligation to carry out a data protection impact assessment under Article 35(10) of the General Data Protection Regulation3.
In today’s Opinion, Advocate General Laila Medina first concludes that Regulation 2019/1157 was correctly adopted on the basis of Article 21(2) TFEU with a view to facilitating the exercise of the right of EU citizens to move and reside freely within the Member States. In that regard, she points out that that right allows EU citizens to immerse themselves in the daily life of the other residents of the host Member State. National identity cards thus display the same functions as they do for those residents, which means that only a reliable and authentic proof of identity facilitates full enjoyment of free movement.
The homogenisation of the format of national identity cards and improvement of their reliability through security standards, including digital fingerprints, directly impacts the exercise of that right, by rendering those cards more trustworthy and, as such, more easily accepted by the authorities of the Member States and entities providing services. In the end, it amounts to a reduction in inconvenience, costs and administrative barriers for mobile EU citizens.
She finally considers that the competence conferred to the Council by Article 77(3) TFEU must be understood as referring only to the context of border check policy. An EU measure extending beyond that specific content, as it is the case of Regulation 2019/1157, would not fall within the scope of that provision. The Advocate General then examines whether the obligation to collect and store an image of two fingerprints in identity cards constitutes an unjustified limitation of the fundamental right to respect for private life with regard to the processing of personal data.
In her view, Regulation 2019/1157, which introduces similar measures to those examined by the Court in the judgment in Schwarz in relation to passports, constitutes a limitation of the rights guaranteed by Articles 7 and 8 of the Charter. Consequently, it is necessary to ascertain whether that processing can be justified on the basis of Article 52(1) of the Charter.
As regards whether the limitations resulting from Regulation 2019/1157 satisfy an objective of general interest, she is of the view that, given that the lack of homogeneity regarding the formats and security features of national identity cards increases the risk of falsification and document fraud, the limitations introduced by Regulation 2019/1157, which aim at preventing this risk and thus to promote the acceptance of those cards, pursue such objective.
Moreover, she considers that those limitations are appropriate, necessary and do not go beyond what is indispensable to for achieving the main objective of that regulation. In particular, an equally suitable but less intrusive method does not seem to exist, as compared to the taking and storage of fingerprints, for achieving, in a similarly effective manner, the aim of the Regulation. Also, Regulation 2019/1157 offers sufficient and appropriate measures which guarantee that the collection, storage and use of biometric identifiers is effectively protected from misuse and abuse. Those measures guarantee that biometric identifiers stored in a newly issued card remain at the sole disposal of the cardholder after the issuance of that card and that they are not publicly accessible. (103)
Furthermore, Regulation 2019/1157 does not provide a legal basis for setting up or maintaining national databases or a centralised database at EU level. Finally, regarding the question whether Regulation 2019/1157 is in conformity with the obligation to carry out a data protection impact assessment under Article 35(10) GDPR, the Advocate General points out that the GDPR and Regulation 2019/1157 are acts of secondary legislation which, in the hierarchy of sources of EU law, rank equally.
Moreover, at no point does it result from the GDPR that the obligation to carry out an impact assessment, as is provided for in Article 35(1) thereof, is binding on the EU legislature, nor does that provision establish any criterion in relation to which the validity of another secondary law norm of the European Union should be assessed.
Consequently, she is of the opinion that the European Parliament and the Council were not obliged to conduct an impact assessment during the legislative process leading to adoption of Regulation 2019/1157.
NOTE: The Advocate General’s Opinion is not binding on the Court of Justice. It is the role of the Advocates General to propose to the Court, in complete independence, a legal solution to the cases for which they are responsible. The Judges of the Court are now beginning their deliberations in this case. Judgment will be given at a later date.
NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of European Union law or the validity of a European Union act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.
Source – EU Court of Justice – Email