EDPS Opinion 23/2024 on the Proposal for a Regulation on the issuance of and technical standards for digital travel credentials based on identity cards

4 December 2024

Opinion 23/2024

on the Proposal for a Regulation on the issuance of and technical standards for digital travel credentials based on identity cards

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Regulation on the issuance of and technical standards for digital travel credentials based on identity cards . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 11 October 2024, the European Commission issued the Proposal for a Council Regulation on the issuance of and technical standards for digital travel credentials based on identity cards (‘the Proposal’).

The objective of the Proposal is to make it easier for Union citizens to exercise their right to free movement, by enabling them to use digital travel credentials based on identity cards that would allow them to pass through border controls more quickly and more smoothly. For this purpose, the Proposal is accompanied by another Proposal for a regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations (EU) 2016/399 and (EU) 2018/1726 of the European Parliament and of the Council and Council Regulation (EC) No 2252/2004, as regards the use of digital travel credentials. That Proposal will be subject to a separate Opinion.

The present Opinion is limited to the rules for issuing digital travel credentials based on identity cards. The EDPS considers that the Proposal does not raise any specific concerns from a data protection perspective and makes one recommendation to better clarify the relationship between the digital travel credentials and the data categories stored in the European Digital Identity Wallet, in particular person identification data.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 11 October 2024, the European Commission issued the Proposal for a Council Regulation on the issuance of and technical standards for digital travel credentials based on identity cards (‘the Proposal’).

2. The objective of the Proposal is to make it easier for Union citizens to exercise their right to free movement, by enabling them to use digital travel credentials based on identity cards that would allow them to pass through border controls more quickly and more smoothly .

3. For this purpose, this initiative goes side-by-side with a Proposal for a regulation of the European Parliament and of the Council establishing an application for the electronic submission of travel data (“EU Digital Travel application”) and amending Regulations (EU) 2016/399 and (EU) 2018/1726 of the European Parliament and of the Council and Council Regulation (EC) No 2252/2004, as regards the use of digital travel credentials . Among other things, that Proposal introduces a digital travel credential based on passports and sets out specifications for the ‘EU Digital Travel application’, a mobile phone application for the issuance and submission of digital travel credentials for advance check ahead of travel. Adopting both Proposals at the same time ensures consistency in the developments for identity cards and passports, taking into account that both types of travel documents can be used to exercise the right to free movement . As a result, Union citizens holding an identity card should be able to use the ‘EU Digital Travel application’ to create and submit identity card-based digital travel credentials just like when using passports .

4. In addition, according to the explanatory memorandum to the Proposal, digital travel credentials could also be used to facilitate other aspects of free movement, such as registering with national authorities when taking up residence in another Member State, which has the potential to reduce administrative burden. At a later stage, it may also become possible to exercise free movement based on a digital travel credential only, that is, without the need for a physical identity card or passport.

5. Lastly, an authentic digital travel credential could facilitate access to electronic identification schemes, and to services that require reliable identification. This has the potential to simplify the daily life of Union citizens, including those that reside in a Member State other than that of which they are a national . The Proposal would lay down a uniform standard for digital travel credentials, avoiding fragmentation, ensuring compliance with Union values, and guaranteeing that all Union citizens can benefit from digital travel credentials . Furthermore, the Proposal pursues the objective of global interoperability, by basing the technical specifications on the ICAO’s digital travel credential standard .

6. The 2023 Commission work programme envisaged a Proposal on digitalisation of travel documents and facilitation of travel in Chapter 3.5 ‘Promoting our European Way of Life’.

7. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 11 October 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 22 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

8. The EDPS recalls that Member States have developed and deployed automated border control gates based on biometric passports for the last 20 years. When it came to the technical implementation of the automatic border control gates, the data protection supervisory authorities were particularly instrumental in ensuring that the risks typically associated with such systems, such as misuse of biometric data, long-term data storage and tracking, discriminatory refusal of entry based solely on an inaccuracy in biometric matching, did not materialise in the EU. The EDPS is of the opinion that efficiency in border controls, enhanced security and a more seamless travel experiences when crossing a border are without a doubt advantages of such systems. However, remaining algorithmic biases or other forms of inaccuracies still require human intervention by a border guard, just as travellers with disabilities, technological barriers, or language limitations denying them access to or use of automated systems require continued access to conventional border control checks by border guards.

9. In the same vein, the EDPS recalls that the requirement for air carriers to provide Advance Passenger Information (API) prior to the landing of an aircraft has also been established 20 years ago . In this regard, the EDPS recalls that he has issued an Opinion on two Proposals for Regulations on the collection and transfer of advance passenger information (API), where he has focused in particular on the processing of API data from EU internal flights .

10. The EDPS takes note that the introduction of digital travel credentials based on identity cards, as provided for in the Proposal, would have the potential to support both aforementioned business processes as well as a direct submission of the traveller’s data to border authorities based for advance checking. At the same time, the Proposal focuses on the issuance and technical standards of the digital travel credentials based on identity cards and not on their use case scenarios. Therefore, the focus of this opinion will be equally narrow.

11. The EDPS underlines that the separation of travel credentials from a physical identification document puts data security at the forefront. In this context, the security of the technical solution is crucial where identity data is processed in a digital format and on a mobile device. For this reason, Regulation (EU) 2024/1183 points out in recital 15 that technologies used for the European Digital Identity Wallets should be developed aiming towards the highest level of, among others, security and privacy.

12. Consequently, the EDPS stresses that, even if digital travel credentials are not stored in the European Digital Identity Wallet, they equally need to be protected according to the highest standards against any unauthorised access, altercation, or loss of data. The same applies to the process of their issuance and access.

13. Other than that, the Proposal does not raise any specific concerns from a data protection perspective, as the following specific comments demonstrate.

3. Voluntary nature of the issuance of digital travel credentials based on identity cards

14. According to Article 2 of the Proposal, digital travel credentials based on identity cards are issued upon request from the person having applied for an identity card, or from the holder of an existing identity card, if applicable.

15. The EDPS welcomes that issuance of the credentials is voluntary on the side of the user. In this regard, the EDPS calls on Union and Member State bodies that would process the digital travel credentials to ensure that the possible choice not to request or use the credentials would not entail in practice any discriminatory or other negative consequences for the individual. 6

4. Relationship with the European Digital Identity Wallet

16. Article 2(4)(b) of the Proposal requires that the digital travel credentials based on identity cards be in a format that enables their storage in European Digital Identity Wallets issued in accordance with Regulation (EU) No 910/2014 .

17. The EDPS notes that according to Article 2(4)(d) of the Proposal, the digital travel credentials based on identity cards will contain the same personal data, including facial image and excluding the fingerprints, as the identity card based on which they are issued or created. Conversely, according to Article 3, point 3 of Regulation (EU) No 910/2014, ‘person identification data’ that can be stored in the European Digital Identity Wallet means a set of data that is issued in accordance with Union or national law and that enables the establishment of the identity of a natural or legal person, or of a natural person representing another natural person or a legal person.

18. However, the Proposal lacks further details about the relationship of the digital travel credentials with the European Digital Identity Wallet and, in particular, with the ‘person identification data’ stored in the latter. For instance, one may assume that digital travel credentials would be stored in the form of attestations of attributes rather than person identification data. Therefore, the EDPS recommends further clarifying the relationship between the digital travel credentials and the European Digital Identity Wallet, e.g. by adding an explanatory recital to the Proposal.

5. Specific rules on data protection

19. The EDPS notes that, in addition to the general reference in recital 15 of the Proposal to Regulation (EU) 2016/679 (GDPR) with regard to the processing of personal data in the context of the application of the future Regulation, Article 4 thereof, under the headline ‘protection of personal data’, refers to Article 11 of a proposed Council Regulation on strengthening the security of identity cards of Union citizens . The latter legal act contains attributions of controllership and responsibility, clarifications on supervisory rights of the supervisory authorities under the GDPR, and processing limitations for machine-readable data and biometric data. The EDPS has already issued an Opinion on that legislative Proposal and its predecessor, so he considers that no further comments are warranted.

20. In addition, according to Article 2(4) subparagraph 2 of the Proposal, the digital travel credentials issued or created pursuant to this Article should not include the fingerprints of the holder. The EDPS welcomes this important restriction of the biometric data included in the credentials, which is in line with the principles of data minimisation and proportionality.

6. Conclusion

21. In light of the above, the EDPS makes the following recommendation: - to clarify the relationship between the digital travel credentials and the European Digital Identity Wallet, and in particular with the ‘person identification data’ stored in the Wallet. Brussels, 4 December 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8