Fingerprint biometrics on ID cards legally invalid, but EU top court declines change

The European Union’s top court has ruled that governments that mandate handing over fingerprint biometrics for identity cards are not breaking European privacy laws. They are, however, doing it illegally.

In its ruling, published on Thursday, the European Court of Justice explains that the mandatory insertion of fingerprint data in ID cards is compatible with fundamental privacy rights. The court also argues that obtaining biometrics is justified because of the need to combat identity theft and to ensure the interoperability of verification systems.

The court, however, has also declared that the EU regulation on mandatory fingerprinting of ID cards is invalid.

“The regulation in question was adopted on an incorrect legal basis and, therefore, in accordance with the wrong legislative procedure, namely the ordinary legislative procedure, rather than a special legislative procedure requiring, in particular, unanimity in the Council. The Court therefore declares the regulation to be invalid,” the ruling states.

Luckily for European governments, the legal decision states that declaring the fingerprinting regulation invalid would have “serious negative consequences” and that the regulation should stay in force until new rules are in place. The deadline for this is December 31, 2026.

The case dates to 2021 when a German citizen filed a case against Wiesbaden city authorities for denying him a new ID card without handing over biometric fingerprint records. The lawsuit was brought by campaign group Digitalcourage.

The European Court of Justice was tasked with deciding whether taking fingerprint biometrics and storing them in ID cards is in accordance with other EU laws, including the bloc’s Charter of Fundamental Rights and its data privacy law, the General Data Protection Regulation (GDPR).

Despite the European top court’s decision, some European digital rights campaigners are declaring a win.

“Even though the Court of Justice unfortunately did not dismiss the fingerprinting of the entire population on the merits, mandatory fingerprinting only has a future if all EU governments are unanimous and in agreement. I appeal on national governments to phase out this blanket collection of biometrics!” Patrick Breyer, German Pirate Party politician and member of the European Parliament, wrote on X.

Article Topics

biometric identification  |  data privacy  |  EU  |  fingerprint biometrics  |  GDPR  |  identity document