Mandatory fingerprints on IDs will be up for re-negotiation

The clock is ticking for the EU regulation on fingerprint IDs

According to the European Court of Justice (ECJ) judgment in case C-61/22, the EU regulation (2019/1157) enacting mandatory fingerprints on ID cards has been adopted on an incorrect legal basis and is therefore invalid.

This is a small victory for EDRi member Digitalcourage, who had taken legal action against the regulation. A disappointing aspect of the ruling is that the mandatory insertion of fingerprints in ID cards as a principle was found to be compliant with European fundamental rights. Via the ECJ’s decision, the effects of the regulation will stay in place until 31 December 2026 or until a new regulation comes into force. European citizens applying for a new ID card are therefore still obliged to have prints of both their index fingers stored on the chip contained in the ID card.

But the clock is ticking for mandatory fingerprints: If no new regulation is passed by the end of 2026, the current regulation will expire. Adopting such a new regulation will be more difficult, as the legislative procedure that will now have to be followed requires unanimity in the Council. If this procedure had been used for the original regulation in 2019, it would not have passed, because there were two no-votes in the Council at the time.

Court failed to close dangerous backdoors

Regrettably, several important objections by Digitalcourage were not reflected in the ECJ’s judgment. The current regulation that created the obligation for fingerprints has severe flaws. The fingerprints are not deleted as soon as the ID card has been produced. The local authorities that registered the fingerprints are allowed to store these data for up to 90 days. These data are therefore exposed to the risk of theft through hacking or leaks. Also, the regulation allows for the fingerprints to be used for purposes other than ID cards – if, for example, national law provides for it. In effect, the EU created a backdoor and left it wide open, but does not want to be responsible for any of the consequences. Unfortunately, the ECJ did not step in to close this backdoor.

Mandatory fingerprinting is an attack on our dignity

In Digitalcourage’s opinion, mandatory fingerprints on ID cards do not achieve their stated purpose and are also unnecessary. It is not proven that storing fingerprints on ID cards increases their security from falsification. Biometric data may make it harder to produce a fake, but that alone does not justify this severe incursion.

At the same time, there are less invasive tools against falsification of identity documents, such as more complex printing procedures. Biometric data must not be treated as a security measure. For very good reasons they need to be strongly protected – biometric data can identify us permanently. A data leak would therefore affect us for the rest of our lives. Whether this will happen solely relies on the security of the technology used to transmit and encrypt the data on the RFID chip in ID documents.

An obligation for all citizens to submit biometric data without a specific reason is not in line with democratic values. Instead, it is an attack on our dignity if we are all being treated as if we were criminals.

That is why Digitalcourage took legal action as soon as the German law implementing the EU regulation had entered into force. A member of the Digitalcourage team and activist applied for a new ID card in his home city of Wiesbaden (Hesse, Germany). He refused to submit his fingerprints and when his application was consequently rejected, he went to court. The administrative court of Wiesbaden directly submitted the case to the European Court of Justice for a preliminary ruling.

The future of mandatory fingerprints now hangs in the balance

The decision on fingerprints in ID cards is now back on the table. If we can find political support for our position on fundamental rights and our concerns about the security risks of fingerprint collections, there will be no new EU regulation. We could then celebrate the end of the fingerprint obligation for ID cards on New Year’s Eve 2026.

Digitalcourage welcomes support on this issue. Interested individuals or organisations are invited to contact julia [dot] witte [at] digitalcourage [dot] de.

Contribution by: EDRi member, Digitalcourage