EDPS Opinion 21/2024 on the Proposal for a Council Regulation on strengthening the security of identity cards

13 September 2024

Opinion 21/2024

on Proposal for a Council Regulation on strengthening the security of identity cards

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to Proposal for a Council Regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposals and the future Agreement that are relevant from a data protection perspective.

Executive Summary

On 23 July 2024, the European Commission issued a Proposal for a Council Regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement.

The objective of the Proposal is to replace Regulation (EU) 2019/1157 on strengthening the security of identity cards of Union citizens and of residence documents, which was invalidated by the Court of Justice of the EU because it was adopted on an incorrect legal basis. On substance, the Proposal essentially reproduces the text of the current Regulation with several limited adaptations of the original text.

The EDPS has already had the opportunity to comment on the initial proposal for Regulation (EU) 2019/1157 in his Opinion 7/2018. In this regard, the EDPS notes that the CJEU in its judgment has found that the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter resulting from the inclusion of two fingerprints in the storage medium of identity cards does not appear disproportionate when compared with the significance of the various objectives pursued, thus addressing the main concern of the EDPS as regard the legal act in question.

In this Opinion, the EDPS welcomes Recital 19 of the current Proposal, which clarifies that the Regulation does not provide a legal basis for setting up or maintaining databases at national level for the storage of biometric data in Member States, nor for setting up or maintaining a centralised database at Union level. At the same time, he is concerned that the proposed Regulation does not exclude the legal possibility of such databases under the national law. Therefore, the EDPS recommends further strengthening of the language of the Proposal by eliminating entirely the possibility to set up or maintain databases for the storage of biometric data collected under Regulation 2019/1157 and the current Proposal under national law, or, alternatively, by restricting it substantially. In addition, the EDPS invites the Commission to pay specific attention to this issue during the monitoring and evaluation of the Regulation under Articles 12 and 13 of the Proposal, and, if necessary, to intervene in accordance with its powers under the Treaties.

2

Contents

3. Setting up or maintaining databases of biometric data at

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement has been in application since 2 August 2021.

2. In March 2024, Regulation (EU) 2019/1157 was invalidated by the CJEU because it was adopted erroneously on the basis of Article 21(2) TFEU and under the ordinary legislative procedure. According to the Court, Regulation (EU) 2019/1157 falls within the specific scope of Article 77(3) TFEU, which provides for a special legislative procedure and, in particular, for unanimity in the Council. The Court decided, however, to maintain the effects of the regulation until the entry into force of a new regulation with the correct legal basis, within a reasonable time and by 31 December 2026 at the latest.

3. On 23 July 2024, the Commission adopted a Proposal for a Council Regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement.

4. The objective of the Proposal is to replace the invalidated Regulation (EU) 2019/1157 on the basis of the correct legal basis. On substance, the Proposal essentially reproduces the text of Regulation (EU) 2019/1157 with several limited adaptations of the original text .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 23 July 2024, pursuant to Article 42(1) of EUDPR. The EDPS positively notes that he was already previously informally consulted pursuant to Recital 60 of EUDPR. The EDPS also welcomes the reference to this consultation in Recital 48 of the Proposal.

2. General remarks

6. The EDPS issued Opinion 7/2018 on the initial proposal for Regulation (EU) 2019/1157. In this Opinion, the EDPS supported the objective of the European Commission to enhance the security standards applicable to identity cards and residence documents, thus contributing to security of the Union as a whole. At the same time, the EDPS considered that the Proposal did not sufficiently justify the need to process two types of biometric data (facial image and fingerprints).

7. The EDPS duly notes that the CJEU in its Landeshauptstadt Wiesbaden judgment has found that the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter resulting from the inclusion of two fingerprints in the storage medium of identity cards does not appear to be disproportionate when compared with the significance of the various objectives pursued by that measure, and, accordingly, such a measure must be regarded as being based on a fair balance between, on the one hand, those objectives and, on the other, the fundamental rights involved .

8. The EDPS Opinion from 2018 contained several additional recommendations aimed at enhancing the safeguards for biometric data processing, in particular as regards deletion of biometric identifiers after their inclusion in the secure storage medium as well as the setting of age limit for collecting children's fingerprints. The EDPS positively notes that these recommendations have been addressed, even if not in their entirety, by the Union legislator in Regulation 2019/1157, and have been retained by the Commission in the current Proposal .

9. At the same time, as explained in the following section, the EDPS remains concerned about the potential risks stemming from the possibility to set up or maintaining databases at national level for the storage of biometric data as well as to use such data for other purposes.

3. Setting up or maintaining databases of biometric data at national level

10. The EDPS notes that the Proposal would have a wide-ranging impact on a very big proportion of EU population by subjecting them to mandatory processing of biometric data . This wide scope, combined with the sensitive data processed (facial images in combination with fingerprints) calls for strict purpose limitation of the processing of the collected data.

11. The EDPS recalls the clear position of the CJEU in this regard, according to which the provision of Article 10(3) of Regulation 2019/1157, which remains unchanged in the current Proposal, does not permit Member States to process biometric data for purposes other than those laid down in that Regulation and precludes centralised storage of fingerprints which goes beyond the temporary storage of those fingerprints for the purpose of personalising identity cards .

12. In the same vein, the EDPS welcomes Recital 19 of the current Proposal, which clarifies that the Regulation does not provide a legal basis for setting up or maintaining databases at national level for the storage of biometric data in Member States, nor for setting up or maintaining a centralised database at Union level.

13. At the same time, the EDPS is concerned that the proposed Regulation nevertheless does not entirely exclude the legal possibility of such databases under the national law. In particular, Article 10(3) of the Proposal refers to instances “where required for the purpose of processing in accordance with Union and national law [...]” and Recital 19 clarifies that this remains “a matter of national law”.

14. The EDPS would like to stress that setting up or maintaining databases at national level for storing biometric data in Member States, or similarly, setting up or maintaining a centralised database at Union level, along with the potential use of such data for other purposes, would need to meet a strict necessity and proportionality test under the Charter, as interpreted by the relevant case law of the Court. Moreover, it should be borne in mind that such biometric database(s), irrespective of the fact whether centralised or decentralised, could create not only the risk of potential misuse or even abuse, but also a very significant vulnerability in case of data breach, e.g. due to a cyberattack.

15. The EDPS therefore recommends further strengthening the language of Article 10(3) and recital 19 of the Proposal by either prohibiting the possibility to set up or maintain databases for the storage of biometric data collected under Regulation 2019/1157 and the current Proposal under national law, or by restricting it substantially. In addition, the EDPS invites the Commission to pay specific attention to this issue during the monitoring and evaluation of the Regulation under Articles 12 and 13 of the Proposal, and, if necessary, to intervene in accordance with its powers under the Treaties.

4. Conclusions

16. In light of the above, the EDPS recommends: (1) to further strengthen the language of Article 10(3) and recital 19 of the Proposal by eliminating entirely the legal possibility to set up or maintain databases for the storage of biometric data collected under Regulation 2019/1157 and the current Proposal under national law, or, alternatively, by restricting it substantially; (2) the Commission to pay specific attention to this element during the monitoring and evaluation of the Regulation under Articles 12 and 13 of the Proposal, and, if necessary, to intervene in accordance with its powers under the Treaties. Brussels, 13 September 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6