EUROPEAN COMMISSION
Brussels, 20.9.2023
COM(2023) 538 final
REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE
pursuant to Article 13(1) of Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement
1.Introduction
On 20 June 2019, the European Parliament and the Council adopted Regulation (EU) 2019/1157 on strengthening the security of identity cards of EU citizens and of residence documents issued to EU citizens and their family members exercising their right of free movement (the ‘Regulation’). The Regulation entered into force on 1 August 2019 and applies as of 2 August 2021.
The Regulation covers documents referred to in or established by Directive 2004/38/EC (the ‘Free Movement Directive’): identity cards, residence documents for EU citizens, and residence cards for family members who are not nationals of a Member State.
Pursuant to the Free Movement Directive, Member States are to issue and renew identity cards to their nationals when exercising their right to free movement in accordance with national laws. This covers, in particular, their use to exit and enter the territory of a Member State or for the registration of residence with the relevant authorities. Identity cards can be used by EU citizens when travelling from another Member State or from a third country. They may thus also be used to cross the external borders of the Schengen area. At the same time, it is important to note that neither the Regulation nor the Free Movement Directive require Member States to introduce identity cards where they are not provided for under national law
.
Furthermore, Member States may require EU citizens and their family members to register with the relevant authorities, in which case Member States are required to issue registration certificates to EU citizens. Member States are also required to issue residence cards to family members who are not EU citizens and, on application, to issue documents certifying permanent residence and to issue permanent residence cards. While these residence documents are not travel documents, possession of a residence card or permanent residence card exempts family members who are not EU citizens from visa requirements.
The Regulation facilitates the exercise of the right to free movement of EU citizens by providing for more secure identity cards and residence documents. Before the adoption of the Regulation, considerable differences existed between the security levels of identity cards issued by Member States and residence documents for EU citizens residing in another Member State and their family members. Those differences increased the risk of falsification and document fraud, as well as giving rise to practical difficulties for citizens when exercising their right of free movement.
Pursuant to Article 13 of the Regulation, the Commission is to report to the European Parliament, to the Council and to the European Economic and Social Committee on the implementation of the Regulation, in particular on the protection of fundamental rights and personal data, two years, and 11 years, respectively, after its date of application. In addition, the Commission is to carry out an evaluation of the Regulation six years after its date of application, and every subsequent six years, and to present a report on the main findings to the European Parliament, to the Council and to the European Economic and Social Committee.
Member States and relevant EU agencies are to provide the Commission with the information necessary for the preparation of the reports mentioned in that provision. For this purpose, the Commission sent a questionnaire to the Member States. In addition, Frontex carried out an analysis of the security features of the identity card specimens provided to the Commission by the Member States.
2.Implementation of the Regulation
2.1.Technical implementation
2.1.1.Technical assessment of the identity cards issued
The purpose of the technical assessment carried out by Frontex was to the verify the compliance of Member States’ identity cards with the format, minimum security standards and specifications of Article 3 of the Regulation. This included checking the compliance of the identity cards with the specifications and minimum security standards set out in the International Civil Aviation Organisation (ICAO) Document 9303 ‘Machine Readable Travel Documents’ and the requirements set out in points (d), (f) and (g) of the Annex to Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954, with certain limitations due to Frontex technical capabilities. Frontex examined the latest models of identity cards issued by Member States.
Except for the Greek identity card (see Section 2.4.2), all identity cards analysed were found to be compliant with the Regulation for those parts that Frontex was able to check. Nevertheless, Frontex identified the following issues regarding some other identity cards:
·some of the examined identity cards did not meet minimum portrait size requirements;
·some of the examined identity cards did not contain all security features to protect against photo substitution;
·some of the examined identity cards contain deviations from the general layout specifications established by ICAO (e.g. information is indicated in a different zone).
The Commission is in contact with the Member States whose identity cards are concerned by Frontex’ findings.
Based on its analyses, Frontex made the following operational remarks:
·“Rainbow printing, being a special printing method, increases robustness of offset printing and facilitates checks at the front line. The gradual merge of the colours should be identifiable and distinguishable.”
·“[The] requirement for the size for the portrait is relevant for facilitating identity checks and detecting document frauds such as impostor fraud and portrait overprinting, two types of fraud have that have been among the most common types of document/identity fraud in recent years. Therefore, a larger size of the holder portrait is crucial to identity and document authenticity checks. In cases where the portrait is the only biographical identifiers available to support an identity check, the portrait size becomes even more significant.”
·“The introduction of an additional portrait of a holder is a measure to increase ID cards’ robustness against photo substitution and make it more resistant to portrait manipulations. The additional portrait shall be of sufficient quality to ensure comparison with the main portrait and shall be easily verifiable at the front line.”
2.1.2.Other aspects linked to the technical implementation regarding identity cards
As allowed by Article 3(3) of the Regulation, two Member States use, instead of ‘identity card’, another well-established national designation in the official language. Five Member States include braille text on the card.
13 Member States currently make use of the possibility provided by Article 3(9) of the Regulation to incorporate a dual interface or a separate storage medium. In accordance with Article 3(10) of the Regulation, 14 Member States store data for electronic services such as e-government and e-business in their identity cards, in a way that is physically or logically separated from the biometric data stored in the chip of the card.
2.1.3.Collection of biometric identifiers
Pursuant to the first subparagraph of Article 3(7) of the Regulation, Member States may decide to exempt children between the age of 6 to 12 years from the requirement to give fingerprints when issuing their identity cards. Currently, 19 Member States make use of this possibility. Member States have also put in place various measures for the collection of biometric identifiers in relation to the specific needs of children and of vulnerable persons, such as dedicated handbooks or opening hours.
In their answers to the Commission’s questionnaire, only few Member States reported difficulties with the collection of biometric identifiers, mainly linked to the quality of the facial image or the fingerprints captured. 22 Member States use or are exploring the use of mobile registration devices for the issuance of identity cards to persons incapable of visiting the authorities responsible for issuing such cards. 12 Member States collect the facial image by means of live enrolment, although some of those also accept that the applicant provides a photograph instead.
2.1.4.Document fraud
Most Member States report that they continue being confronted with cases of fraudulent identity cards and residence documents issued in accordance with the Regulation. However, it is not possible to provide a detailed overview of the situation relevant to the Regulation, as Member States do not specifically monitor the number of reported imposters (both lookalike fraud and fraudsters in general) using identity cards or residence documents issued in accordance with the requirements of the Regulation, or the number of people who self-report being victims of identity theft. In the five Member States that provided the number of reported imposters since the entry into application of the Regulation, numbers varied between 22 and 57 reported fraudulent documents.
2.1.5.Reporting obligation under the Regulation
The sections below summarise different reporting obligations provided for by the Regulation. The Commission continue its contacts with the Member States that have not yet provided information pursuant to the different provisions.
2.1.5.1.Reporting pursuant to Article 9
Pursuant to Article 9 of the Regulation, Member States are to designate at least one central authority as a contact point for the implementation of the Regulation and to communicate the name of that authority to the Commission and other Member States.
By June 2023, 19 Member States communicated that name to the Commission.
2.1.5.2.Reporting pursuant to Article 11(7)
Pursuant to Article 11(7) of the Regulation, Member States are to maintain a list of the competent authorities with access to the biometric data stored on the storage medium in identity cards and to communicate such lists to the Commission once a year. The Commission is to publish online a compilation of such national lists.
By June 2023, 22 Member States communicated the list of their competent authorities to the Commission, which the Commission has made publicly available.
2.1.5.3.Reporting pursuant to Article 14(3)
Pursuant to Article 14(3) of the Regulation, Member States are to designate responsible bodies for printing identity cards and residence cards of family members of EU citizens and to communicate the names of such bodies to the Commission and other Member States.
By June 2023, 22 Member States communicated the responsible bodies for printing the documents under the Regulation to the Commission.
2.1.6.Number of documents issued in a format compliant with the Regulation
By April 2023, Member States reported having issued more than 53 million identity cards, almost 900 000 residence documents for EU citizens and more than 950 000 residence cards for third-country nationals who are family members of EU citizens in a format compliant with the Regulation.
2.2.Phasing-out periods for identity cards and residence cards for family members who are not nationals of a Member State
2.2.1.Identity cards
Article 5 of the Regulation provides that identity cards that do not meet the requirements set out in the Regulation cease to be valid at their expiry or by 3 August 2031, whichever is earlier. Identity cards that do not meet certain minimum security standards or which do not include a functional machine-readable zone cease to be valid at their expiry or by 3 August 2026.
In the replies to the questionnaire, ten Member States indicated that the 10-year phasing-out period applies to their previously issued identity cards, five Member States indicated that the 5-year phasing-out period applies to their previously issued identity cards and seven Member States indicated the applicability of both periods due to different formats currently in circulation.
2.2.2.Residence cards for family members who are not nationals of a Member State
Article 8 of the Regulation provides that residence cards that do not meet the requirements set out in the Regulation will cease to be valid at their expiry or by 3 August 2026 (5-year phasing-out period), whichever is earlier. Residence cards that do not meet certain minimum security standards or which do not include a functional machine-readable zone will cease to be valid at their expiry or by 3 August 2023 (2-year phasing-out period), whichever is earlier.
In their replies to the questionnaire, 11 Member States indicated that the 5-year phasing-out period applies to their previously issued residence cards, six Member States indicated that the 2-year phasing-out period applies to their previously issued residence cards and six Member States indicated the applicability of both periods due to different formats currently in circulation.
2.3.Protection of fundamental rights and personal data
2.3.1.Freedom of movement and of residence
The Regulation positively affects the fundamental right of freedom of movement and of residence under Article 45 of the Charter of Fundamental Rights of the European Union (the ‘Charter’) by addressing difficulties of security and recognition of both identity cards and residence documents. Through the inclusion of biometric data (facial image and two fingerprints), documents issued in accordance with the Regulation allow for a more reliable verification of the document and a better identification of individuals.
Since the start of the issuance of identity cards in a format that complies with the requirements of the Regulation, Member States have not reported on any issues that their nationals would experience with the acceptance of such documents in other Member States.
In most Member States, the fees for the issuance of the documents covered by the Regulation did not increase following its entry into application. Where the fees did increase, the increase was reported to be minor and in line with the costs of the improved security features of the documents.
2.3.2.Respect for private life and protection of personal data
Limitations to the right to privacy and personal data (Articles 7 and 8 of the Charter) must be provided for by law, respect the essence of those rights and be proportionate to the attainment of a legitimate objective
. In this context, the Regulation provides for processing of personal data of the holder of the document, including biometric data. The storage of a facial image and two fingerprints on identity and residence cards, as already provided for in respect of biometric passports
and residence permits for third-country nationals
, represents an appropriate combination of reliable identification and authentication with a reduced risk of fraud, for the purpose of strengthening the security of identity and residence cards.
Amendments to the Commission proposal introduced by the European Parliament and the Council during the legislative process added the possibility to store such biometric data on residence documents issued to EU citizens. According to the information provided by Member States in the questionnaire, 13 Member States currently include a secure storage medium with the biometric identifiers of the holder (facial image and possibly two fingerprints) in residence documents issued to EU citizens.
As far as the justification of the processing of the biometric data is concerned, it must be noted that it is provided for by law, namely Article 3(5) of the Regulation. That limitation to the right to privacy and personal data satisfies an objective of general interest, namely the prevention of falsification and document fraud, which is increased by a lack of homogeneity regarding the formats and security features of national identity cards prior to the entry into application of the Regulation. Preventing falsification and fraud promotes the acceptance of identity cards in Member States other than the one issuing them, facilitating the right of free movement of EU citizens. The risk of fraud must be taken seriously, in particular by means of falsified identity cards or abuse of rights.
Article 3(5) is the subject of two ongoing preliminary reference procedures (see Section 2.4.3). As regards the suitability of the storage of biometric data in identity cards, the Court has already recognised that the storage of fingerprints on a highly secure storage medium could reduce the risk of counterfeiting of passports and facilitate the work of the authorities responsible for verifying the authenticity of such documents
. According to Advocate General Medina, this also applies to the use of identity cards in connection with the exercise of free movement.
The Court has already examined the proportionality of the acceptance and storage of fingerprints. It found that this process is neither intimate in nature, since the two fingerprints are characteristics that can be seen by others, nor does it cause particular physical or mental inconvenience to the person concerned. In addition, the Court found no indication that the recording of fingerprints and the taking of the facial image would result in a more serious interference with those rights because they were carried out at the same time. It further concluded that there does not exist an equally suitable but less intrusive method, as compared to the taking and storage of fingerprints, for achieving, in a similarly effective manner, the aim of the Regulation.
Finally, the Regulation provides for enhanced guarantees for the collection and storage of fingerprints. Regulation (EU) 2016/679 of the European Parliament and of the Council applies with regard to processing of personal data, including biometric data, in the context of the application of the Regulation. As a rule, Member States must check the facial image, and fingerprints may only be checked in case of doubt. Fingerprints may only be taken by qualified and duly authorised personnel and checked by duly authorised staff and only where required by law. In addition, biometric data stored for the purpose of personalising identity cards or residence documents must be kept in a highly secure manner and only until the document is collected. Moreover, Recital 21 states explicitly that the Regulation cannot constitute a legal basis for the establishment or maintenance of databases of biometric data at national or European level.
Since the date of application of the Regulation, the Commission has not been made aware of any successful attacks or breaches of the secured storage medium included in the documents covered.
In Landeshauptstadt Wiesbaden, Advocate General Medina concluded that the Regulation and in particular Article 3(5) thereof does not constitute an unjustified limitation of Articles 7 and 8 of the Charter.
2.4.Other information on the implementation of the Regulation
2.4.1.Impact of the COVID-19 pandemic
The date of application of the Regulation, 2 August 2021, took place during the COVID-19 pandemic. In view of that fact, the Commission had sought feedback from the Member States as to the impact of the pandemic on the relevant preparations of the Member States in March 2021. In their replies, seven Member States proposed to consider postponing the date of application of the Regulation.
Based on the feedback received, the Commission informed the Member States in July 2021 that it had decided not to propose to postpone the entry into application of the Regulation in order not to jeopardise the planned rollout of Member States that were ready to issue documents compliant with the requirements of the Regulation by 2 August 2021.
The Commission suggested that those Member States that had indicated potential delays take mitigating measures to make sure that the validity period indicated on the document duly corresponds to the phasing-out periods established by Articles 5 and 8 of the Regulation (see Section 2.2).
This would mean, for example, that non-compliant identity cards issued after 2 August 2021 and covered by the longer phasing-out period should indicate 3 August 2031 at the latest as their validity end date, even if a Member State normally issues such identity cards with a validity period of 10 years. Otherwise, the identity cards concerned would cease to be valid by operation of Article 5 of the Regulation while still appearing to be valid due to a later date indicated on the document. Similarly, non-compliant identity cards issued after 2 August 2021 and covered by the shorter phasing-out period should indicate 3 August 2026 at the latest, as their validity end date.
At the same time, the Commission strongly encouraged all Member States to ensure that they issued documents compliant with the Regulation as of its entry into application.
In terms of mitigating measures, the Member States concerned indicated that they had limited the validity of the documents concerned and/or notified the holders accordingly.
2.4.2.Infringement procedures opened by the Commission
On 14 July 2023, the Commission opened infringement procedures against Bulgaria, Greece and Portugal for failing to implement the Regulation. The infringement procedures concern failures by those Member States to issue documents covered by the scope of the Regulation in a format that complies with its requirements.
In the case of Bulgaria, this concerns the failure to issue compliant identity cards, residence documents of EU citizens and residence cards for family members of EU citizens who are not nationals of a Member State.
In the case of Greece, this concerns the failure to issue compliant identity cards.
In the case of Portugal, this concerns the failure to issue compliant identity cards and residence documents of EU citizens.
2.4.3.Court cases with relevance for the Regulation
Since its entry into application, there have been two requests for preliminary rulings concerning the Regulation, and in particular the legality of the inclusion of fingerprints in the identity cards. Both cases are currently pending.
The first pending request for a preliminary ruling, Landeshauptstadt Wiesbaden, concerns the validity of Article 3(5) of the Regulation, which provides that identity cards issued by Member States are to be equipped with a highly secure storage medium with the holder’s facial image and two fingerprints in interoperable formats.
The referring national court asked whether Article 21(2) TFEU is the correct legal basis for the Regulation, whether the obligation to take fingerprints complies with the fundamental rights to respect private life and data protection, and whether the alleged lack of a data protection impact assessment can have an impact on the validity of Article 3(5) of the Regulation.
In her Opinion of 29 June 2023, Advocate General Medina concluded that the Regulation had been correctly adopted on the basis of Article 21(2) TFEU with a view to facilitating the exercise of the right of EU citizens to move and reside freely within the Member States. In that regard, the Advocate General pointed out that that right allows EU citizens to immerse themselves in the daily life of the other residents of the host Member State. National identity cards thus display the same functions as they do for those residents, which entails that only a reliable and authentic proof of identity facilitates full enjoyment of free movement.
Advocate General Medina also considered that Article 3(5) does not constitute an unjustified limitation of Articles 7 and 8 of the Charter (see also Section 2.3.2). Finally, the Advocate General took the view that the European Parliament and the Council had not been obliged to conduct an impact assessment during the legislative process leading to adoption of the Regulation.
The second pending request for a preliminary ruling, Kinderrechtencoalitie Vlaanderen and Liga voor Mensenrechten, concerns Article 3(5) and (6) and Article 14 of the Regulation, and their compatibility with, among others, the right to privacy and personal data and the right to free movement. No Opinion has been published in this case yet.
2.4.4.Information received from citizens
Since the entry into application of the Regulation, the Commission has received a number of complaints and letters from citizens concerning the documents covered by the Regulation. Most of that correspondence concerned issues unrelated to the implementation the Regulation, notably national administrative procedures linked to the issuance of identity cards and residence documents in the Member States and delays in these procedures. The letters and complaints concerning the implementation of the Regulation mainly concerned the mandatory inclusion of fingerprints (in this context, see Section 2.3.2).
2.5.Other relevant developments
2.5.1.Digitalisation of travel documents and travel facilitation
On 2 June 2021, the Commission adopted a Communication on a strategy towards a fully functioning and resilient Schengen area. The strategy noted that once global travel recovers from the COVID-19 pandemic, strong increases in passenger flows can be expected. This will give a new impetus to the digitalisation process that already started before the pandemic and will require innovative ways to facilitate and accelerate border controls at international ports of entry. Digital documentation is both more efficient and secure. The Commission announced that, following an in-depth assessment and the necessary consultations, it intends to present a proposal for a Regulation on digitalisation of travel documents and facilitation of travel.
By introducing digital travel documents for EU citizens, the Commission aims to facilitate travel across external borders, to relieve pressure and bottlenecks at border-crossing points and to shorten waiting times as well as increase the security and efficiency of border checks. It also aims to facilitate the exercise of free movement for EU citizens and their family members.
A standard for digital travel documents (so-called Digital Travel Credentials) has been established by ICAO, as done historically for the physical ePassport document and the electronic data contained in its chip. Digital Travel Credentials can be derived from an existing passport or identity card. Travellers would have a copy of the data stored on the storage medium of the physical travel document replicated into an application hosted on a device, such as a mobile phone (fingerprints not included). Travellers would be able to send travel information up-front, giving authorities the time to filter the information and speed up any applicable border checks.
The Commission is currently carrying out the evidence-gathering and assessments necessary for the preparation of such a proposal.
2.5.2.European Digital Identity
On 3 June 2021, the Commission proposed a framework for a European Digital Identity, which will be available to EU citizens, residents, and businesses to identify themselves online and offline for public and private services. The proposed Regulation seeks to establish a secure framework where citizens can link their national digital identities with digital attributes and credentials that will enable them to replace a variety of physical cards and passes thus simplifying their everyday lives.
The proposal for a European Digital Identity, currently under negotiations, is aligned with the objectives of the Regulation. Identity cards issued in accordance with the requirements of the Regulation contain secure information in a storage medium that can be used by Member States to securely identify a person, allowing it to be used to create a European Digital Identity. Member States can also make use of the secure storage medium of the identity cards issued under the Regulation to equip the cards with eID functionality.
On 29 June 2023, the European Parliament and the Council reached a provisional political agreement on the key elements of the proposal.
3.Conclusion
The right to free movement is an EU citizenship right particularly cherished by EU citizens, and secure and reliable identity cards and residence documents play a crucial role in avoiding obstacles to the exercise of this right. The possibility for EU citizens to travel within the EU without a passport and using only an identity card is one of the concrete benefits of the right of free movement. In addition, the visa-exempting nature of residence cards issued to family members who are not nationals of a Member State facilitates family life with the EU citizen they accompany. To ensure that these benefits are not abused by malign actors, a high level of security for such documents remains necessary.
The Commission will continue monitoring the implementation of the Regulation in line with its role as guardian of the treaties.