Court of Justice of the European Union: While deliberating over the validity of the European Union regulation which lays down the obligation to insert two fingerprints into the storage medium of identity cards, the Grand Chamber of the ECJ held that the obligation to insert two complete fingerprints into the storage medium of identity cards constitutes a limitation of the fundamental rights to respect for private life and to the protection of personal data, which are guaranteed by the Charter of Fundamental Rights of the European Union. However, such insertion is justified and compatible by the objectives of general interest of combatting the production of false identity cards and identity theft and to ensure the interoperability of verification systems.
However, since Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20-06-2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement, was adopted on an incorrect legal basis, hence the same was held to invalid.
The Court directed that the effects of Regulation 2019/1157 are to be maintained until the entry into force, within a reasonable period which may not exceed two years from 1 January of the year following the date of delivery of the present judgment, of a new regulation based on Article 77(3) TFEU (Treaty on Functioning of the European Union) and intended to replace it.
Background: On 30-11-2021, the applicant in the main proceedings applied to the City of Wiesbaden for a new identity card to be issued, on the ground that the electronic chip in his old card was defective. The applicant requested, however, that the new card should not contain his fingerprints.
The City of Wiesbaden rejected that application on two grounds- firstly, the applicant in the main proceedings was not entitled to have a new identity card issued, since he was already in possession of a valid identity document and secondly, since August 2021, the inclusion of two fingerprints in the storage medium of identity cards had been mandatory under Paragraph 5(9) of the Gesetz über Personalausweise und den elektronischen Identitätsnachweis (Law on identity cards and electronic proof of identity) which transposes Article 3(5) of TEU Regulation 2019/1157.
In December 2021, the applicant in the main proceedings brought an action before the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany, which is the referring court), seeking an order requiring the City of Wiesbaden to issue him with an identity card with no fingerprints being collected.
The referring court had doubts regarding the validity of Regulation 2019/1157 or, at least, the validity of Article 3(5) – Whether Regulation 2019/1157 is invalid, as a whole or in part, on the grounds that it was adopted on an incorrect legal basis, and whether Article 3(5) of Regulation 2019/1157 is compatible with Articles 7 and 8 of the Charter relating, respectively, to respect for private and family life and the protection of personal data. The obligation on the Member States to issue identity cards whose storage medium contains two fingerprints constitutes a limitation on the exercise of the rights recognised by those two provisions of the Charter, a limitation which can be justified only if it satisfies the conditions laid down in Article 52(1) of the Charter Fundamental Rights of the European Union.
Court’s Assessment: Perusing the matter, the Court pointed out that Article 1 of Regulation 2019/1157 states that the purpose of that regulation is to strengthen the security standards applicable, inter alia, to identity cards issued by Member States to their nationals when exercising their right to free movement.
It was pointed out that the inclusion of biometric data, including two complete fingerprints, in the storage medium of identity cards is intended to ensure the authenticity of those cards and to enable the holder of that card to be reliably identified, while contributing, in accordance with recitals 23 and 33 and Article 3(5), to the interoperability of identification document verification systems, with a view to reducing the risk of falsification and document fraud. The objective of interoperability of identification document verification systems is also of general interest since, as is apparent from recital 17 of Regulation 2019/1157, it contributes to facilitating the exercise by EU citizens of the right granted to them by Article 20 TFEU to move and reside freely within the territory of the Member States.
The Court noted that the inclusion of two complete fingerprints in the storage medium of identity cards is appropriate for attaining the general interest objectives of combating the production of false identity cards and identity theft as well as the interoperability of verification systems, put forward by the EU legislature in order to justify that measure.
Inclusion of biometric data, such as fingerprints, in identity cards is liable to make it more difficult to produce false identity cards. Furthermore, the inclusion of such biometric data is a means making it possible reliably to verify the authenticity of the identity card and the identity of the cardholder, and thereby to reduce the risk of fraud, in accordance with the Charter and recitals 18 and 19 of Regulation 2019/1157.
The choice made by the EU legislature to provide for complete fingerprints to be included also appears to be appropriate for achieving the objective of interoperability of identity card verification systems since the use of complete fingerprints makes it possible to ensure compatibility with all automated systems for the identification of fingerprints used by the Member States, even though such systems do not necessarily use the same identification mechanism.
The Court noted that fingerprints, as biometric data, are by their nature particularly sensitive and enjoy specific protection under EU law. However, it is important that collection and storage of two complete fingerprints are permitted by Regulation 2019/1157 only for the purpose of including those fingerprints in the storage medium of identity cards. Additionally, the fingerprints collected are to be stored only in the storage medium of that card, which is, in principle, in the physical possession of that person.
The Court thus found that the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter resulting from the inclusion of two fingerprints in the storage medium of identity cards does not appear to be of a seriousness which is disproportionate when compared with the significance of the various objectives pursued by that measure. Therefore, the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter is not contrary to the principle of proportionality, with the result that the third ground is not such as to result in the invalidity of Regulation 2019/1157.
However, the Court held that Regulation 2019/1157 is invalid in so far as it was adopted on the basis of Article 21(2) TFEU. Article 21(2) TFEU states that if action by the Union should prove necessary to guarantee every citizen of the European Union the right to move and reside freely within the territory of the Member States, and if the Treaties have not provided powers to that effect, the European Parliament and the Council, acting in accordance with the ordinary legislative procedure, may adopt provisions with a view to facilitating the exercise of those rights. The Court noted that the adoption of Regulation 2019/1157 could be based on Article 21(2) TFEU only if the purpose or the main or predominant component of that regulation were to fall outside the specific scope of Article 77(3) TFEU, namely the issuing of passports, identity cards, residence permits or any other such document, for the purposes of facilitating the exercise of the right referred to in Article 20(2)(a) TFEU. It was pointed out that by adopting Regulation 2019/1157 on the basis of Article 21(2) TFEU, the EU legislature infringed Article 77(3) TFEU and had recourse to an inappropriate legislative procedure.
[RL v. Landeshauptstadt Wiesbaden, C-61/22, decided on 21-03-2024]
