The European Court of Justice (ECJ) recently delivered a landmark decision on the legality of mandating fingerprints on national identification cards across the European Union. The court found the 2019 EU regulation, which required EU citizens to include fingerprints in their national ID cards, to be based on incorrect legal grounds, rendering the law invalid. However, the court also acknowledged that while the requirement impacts fundamental rights, it is justified, maintaining the regulation’s effectiveness until a new one is introduced or until December 2026 at the latest.
This ruling emerged from a case brought forward by Digitalcourage, a German organization dedicated to defending fundamental rights and privacy. They contested the EU’s fingerprint mandate, arguing it disproportionately infringes on the right to privacy and data protection as outlined in the European Charter of Fundamental Rights. The organization emphasized the irreversible nature of biometric data, contrasting it with more easily changeable identifiers like passwords.
Despite the ruling’s complexity, the ECJ’s decision opens a window until December 2026 for EU legislators to formulate a new regulation, this time requiring a unanimous agreement in the Council, as opposed to the ordinary legislative procedure previously used. This adjustment comes after the initial regulation faced opposition from several member states, highlighting the contentious nature of integrating biometrics into identification processes.
The implications of this ruling are significant. Should member states fail to reach a consensus on a new regulation, the current mandate for fingerprint collection and storage could be nullified. This outcome would obligate national authorities to issue ID cards without fingerprints, and individuals could request the deletion of any fingerprints already stored.
The backdrop to the ECJ’s decision includes a rigorous legal challenge spearheaded by Digitalcourage, beginning with a lawsuit in 2021 against the mandatory fingerprinting for ID cards. This legal battle underscores the broader concerns regarding privacy, data security, and the proportionality of using biometric data for identification purposes.
Critics of the fingerprint requirement, including Digitalcourage, have highlighted the risks associated with storing such sensitive information. Concerns range from the potential for identity theft in the event of data breaches to the misuse of biometric data for purposes beyond identification, such as law enforcement activities. This situation has sparked a debate on the balance between enhancing document security and protecting individuals’ privacy and data rights, a debate that will undoubtedly continue as the EU works to redefine its stance on biometric data in ID cards.