EUROPEAN COMMISSION
Brussels, 23.7.2024
COM(2024) 316 final
2024/0187(CNS)
Proposal for a
COUNCIL REGULATION
on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement
(Text with EEA relevance)
EXPLANATORY MEMORANDUM
1.CONTEXT OF THE PROPOSAL
•Reasons for and objectives of the proposal
On 17 April 2018, the Commission adopted a proposal for a Regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement 1 . The Commission proposed that the Parliament and the Council base the regulation on Article 21(2) of the Treaty on the Functioning of the European Union (TFEU). On the basis of that proposal, the Parliament and the Council adopted, on 20 June 2019, Regulation (EU) 2019/1157 2 , which has been in application since 2 August 2021.
In case Landeshauptstadt Wiesbaden 3 , the Court of Justice ruled that Regulation (EU) 2019/1157 is invalid due to it having been adopted erroneously on the basis of Article 21(2) TFEU and under the ordinary legislative procedure. According to the Court, Regulation (EU) 2019/1157 is one of the measures that falls within the specific scope of Article 77(3) TFEU, which provides for a special legislative procedure and, in particular, for unanimity in the Council.
While declaring Regulation (EU) 2019/1157 invalid, the Court ruled that the “effects of Regulation 2019/1157 are to be maintained until the entry into force, within a reasonable period which may not exceed two years from 1 January of the year following the date of delivery of the present judgment, of a new regulation based on Article 77(3) TFEU and intended to replace it”.
The purpose of this proposal is to set in motion the procedure for a new regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement being adopted on the appropriate legal basis, namely Article 77(3) TFEU.
This proposal essentially reproduces the text of Regulation (EU) 2019/1157 as adopted by the Parliament and the Council. In particular, the Court ruled that the limitations of the right to respect for private life and of the right to the protection of personal data, enshrined in Articles 7 and 8 of the Charter respectively, flowing from the obligation to include two fingerprints in the storage medium of identity cards are not contrary to the principle of proportionality 4 .
Nevertheless, the Commission considers that it is appropriate to adapt the text in certain minor aspects. These adaptations are explained in the section on ‘Detailed explanation of the specific provisions of the proposal’.
•Consistency with existing policy provisions in the policy area
The Union offers its citizens an area of freedom, security and justice without internal borders, in which the free movement of persons is ensured in conjunction with appropriate measures regarding external border management, asylum, immigration and the prevention and combating of crime and terrorism. Many of the Union’s security measures rely upon secure travel and residence documents – such as the systematic checks established by the Schengen Borders Code 5 in the Schengen Information System.
According to Article 77(1) TFEU, and as noted by the Court in Landeshauptstadt Wiesbaden 6 , the Union is to develop a policy with a view to ensuring the absence of any controls on persons, whatever their nationality, when crossing internal borders, to carrying out checks on persons and efficient monitoring of the crossing of external borders, and to the gradual introduction of an integrated management system for such borders. The provisions concerning passports, identity cards, residence permits or any other such document referred form an integral part of any such Union policy. As regards Union citizens, the documents covered by the proposed regulation enable them, among other things, to certify that they benefit from the right to move and reside freely within the territory of the Member States referred to in Article 20(2)(a) TFEU and therefore to exercise that right.
Directive 2004/38/EC of the European Parliament and of the Council 7 sets out the conditions for the exercise of the right of free movement and residence (both temporary and permanent) in the Union for Union citizens and their family members. That Directive provides that, in conjunction with a valid identity card or passport, Union citizens and their family members may enter and live in another Member State and apply for the appropriate residence documentation. Directive 2004/38/EC, however, does not regulate the format and standards of identity cards to be used to enter or leave Member States. Similarly, it does not provide for specific standards for residence documents issued to Union citizens and their family members apart from their title.
By maintaining the security standards introduced by Regulation (EU) 2019/1157 applicable to identity cards issued by Member States to their nationals and to residence documents issued by Member States to Union citizens and their family members when exercising their right to free movement, this proposal is fully consistent with the existing policy measures outlined above.
2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
•Legal basis
As stated by the Court in Landeshauptstadt Wiesbaden 8 , Article 77(3) TFEU confers on the Union a competence to adopt provisions on passports, identity cards, residence permits or any other such document intended to facilitate the exercise of the right to move and reside freely within the territory of the Member States guaranteed in Article 20(2)(a) TFEU. The Court ruled that it follows from the purpose and main components of Regulation (EU) 2019/1157 – to strengthen the security standards applicable to identity cards and residence documents and to set out the requirements, notably in terms of security, with which such documents must comply – that it is one of the measures that falls within the specific scope of Article 77(3) TFEU 9 . The same applies to this proposal, which replicates Regulation (EU) 2019/1157 with the exception of limited adjustments that do not affect its purpose and main components.
Article 77(3) TFEU provides for a special legislative procedure. When adopting measures pursuant to Article 77(3) TFEU, the Council is to act unanimously after consulting the Parliament.
•Subsidiarity (for non-exclusive competence)
The Union is committed to ensuring the free movement of persons within an area of freedom, security and justice. Secure identity cards and residence documents are essential elements to ensure the trust needed for free movement within that area.
Without a common standard at Union level, it is likely that the obstacles to free movement resulting from the problems in the acceptance of certain documents observed prior to the adoption of Regulation (EU) 2019/1157 re-emerge 10 . The same would apply to the previously experienced security gaps resulting from insufficiently secure documents. The absence of action at Union level would also result in more practical problems for Union citizens, national authorities and businesses in a context where citizens live and travel within the Union. Addressing such systemic problems by maintaining a high level of security for national identity cards and residence documents clearly requires continued action on a Union scale.
The objectives of any initiative seeking to prevent the re-emergence of such problems cannot be achieved at a national level. The documents covered by this proposal have an intrinsic European dimension because of their connection with the exercise of the right to free movement in an area of freedom, security and justice. Member States already confirmed the necessity to act at Union level by adopting Regulation (EU) 2019/1157.
The regulation would not require Member States to issue documents that are not currently being issued.
•Proportionality
Union action can continue to add considerable value in addressing the challenges outlined above. Union citizens face obstacles in the exercise of their rights if they cannot be sure that their documents will reliably be accepted outside their Member State(s) of issuance.
Ongoing security challenges demonstrate the inextricable link between free movement of persons inside the Union and robust external border management. Insofar as identity cards may be used to cross external borders, measures to improve security and external border management, such as the systematic checks against databases on all persons, including Union citizens, crossing the external borders would be weakened if security standards for identity cards were to deteriorate. Overall, the minimum standards for the information to be provided on the documents covered by this proposal and for security features common to all Member States that issue them will facilitate the exercise of free movement and improve security within the Union and at its borders.
Complete harmonisation of the design of identity cards is not warranted and a proportionate measure ensuring minimum document standards is proposed. This includes the mandatory use of fingerprints, which are a reliable and effective means of establishing, with certainty, the identity of a person, and a proportionate measure in light of the objectives to facilitate the exercise of the right to free movement and residence, to combat the production of fraudulent identity cards and identity theft, and to ensure the interoperability of identification document verification systems 11 .
For residence cards issued to third-country family members, it is suggested to continue to use the same format as already agreed at Union level in respect of residence permits of third-country nationals.
•Choice of the instrument
A regulation is the only legal instrument ensuring the direct and common application of Union law in all Member States. In a field where divergences have previously proved detrimental to free movement and security, a regulation will ensure that the desired commonality is maintained.
3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS
•Impact assessment
No impact assessment was carried out in the preparation of this proposal as it essentially reproduces the text of Regulation (EU) 2019/1157, which itself was based on a proposal 12 that had been accompanied by an impact assessment 13 . Thus, this proposal is not expected to lead to new impacts. Moreover, this proposal considers the lessons learned from the implementation report adopted on 20 September 2023 14 . Since not even three years have passed since the entry into application of Regulation (EU) 2019/1157, no evaluation was undertaken.
•Fundamental rights
This proposal has a positive impact on Union citizens’ fundamental right to free movement and residence under Article 45 of the Charter of Fundamental Rights of the European Union (Charter) by addressing difficulties in recognition and insufficient security of both identity cards and residence documents.
This proposal implies processing of personal data, including biometric data, namely a facial image and two fingerprints. Processing the personal data of individuals, including collection, access and use of personal data, affects the right to privacy and the right to protection of personal data enshrined in Articles 7 and 8 of the Charter.
In particular, the obligation to include two fingerprints in the storage medium of identity cards and residence cards, as well as the obligations to collect and temporarily store such biometric data for the purposes of producing the documents, constitutes a limitation to both the right to respect for private life and the right to the protection of personal data 15 .
Limitations on those rights must be provided for by law and respect the essence of those rights. In addition, in compliance with the principle of proportionality, such limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights of others 16 .
The limitations, as well as the conditions for application and scope of those limitations, will be defined in the regulation. The Court held that the limitation entailed by the obligation to include two fingerprints in the storage medium does not adversely affect the essence of the fundamental rights enshrined in Articles 7 and 8 of the Charter, as the information provided by fingerprints does not, in itself, make it possible to have an overview of the private and family life of data subjects 17 .
As noted by the Court, the specific objectives pursued by the regulation, namely combating document fraud and the interoperability of identification document verification systems, constitute objectives of general interest recognised by the Union. In addition, the Court found that the inclusion of two complete fingerprints is appropriate for attaining those general interest objectives 18 . As far as the necessity of the inclusion of fingerprints is concerned, the Court considered that the limitations placed on fundamental rights guaranteed in Articles 7 and 8 of the Charter arising from the obligation to include two complete fingerprints in the storage medium appear to comply with what is strictly necessary 19 .
Finally, the Court considered that the limitations resulting from the inclusion of two fingerprints do not appear to be – having regard to the nature of the data at issue, the nature of the processing operations, the manner in which they are carried out and the safeguards laid down – of a seriousness that is disproportionate when compared with the significance of the various objectives pursued by the regulation. Accordingly, such a measure must be regarded as being based on a fair balance between, on the one hand, those objectives and, on the other, the fundamental rights involved. As a result, the Court concluded, in Landeshauptstadt Wiesbaden, that the limitations on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter are not contrary to the principle of proportionality 20 .
4.BUDGETARY IMPLICATIONS
The proposal has no implications for the Union budget.
5.OTHER ELEMENTS
•Implementation plans and monitoring, evaluation and reporting arrangements
To ensure an effective implementation of the measures foreseen, and to monitor their results, the Commission will continue to work closely with relevant stakeholders from national authorities and Union agencies, such as the European Border and Coast Guard Agency.
The Commission will adopt a monitoring programme to monitor the outputs, results and impacts of the regulation based on the monitoring programme adopted pursuant to Regulation (EU) 2019/1157 21 .
The Commission will evaluate the effectiveness, efficiency, relevance, coherence and Union added value of the resulting legal framework 6 years after the date of application of the regulation. This will ensure that sufficient data is available for the evaluation.
•Detailed explanation of the specific provisions of the proposal
In essence, the attached proposal reproduces Regulation (EU) 2019/1157 as adopted by the Parliament and the Council. However, the Commission considers that the text of that Regulation should be adapted in the following respects:
–In order to take account of the ruling in Landeshauptstadt Wiesbaden, the legal basis for the regulation is Article 77(3) TFEU.
–In the recitals of the regulation, references to policy documents adopted several years ago are removed.
–The explicit reference in the recitals to the passport card issued by Ireland is removed, given that Ireland is not taking part in the adoption of the regulation unless it notifies that it wishes to take part in its adoption and application. In such case, while the passport card issued by Ireland is a travel document compliant with International Civil Aviation Organization Document 9303 on Machine Readable Travel Documents, it does not serve identification purposes in Ireland, and therefore should not be considered as falling within the scope of the regulation.
–In the recitals of the regulation, a reference is added to the fact that the Court of Justice has ruled that the mandatory inclusion of fingerprints on the storage medium is compatible with the fundamental rights to respect for private life and to protection of personal data as guaranteed in Articles 7 and 8 of the Charter.
–The recital on the phasing-out of documents not complying with the requirements of the regulation is adapted to reflect the fact that the deadlines established by Regulation (EU) 2019/1157 should continue to apply.
–Recitals are added to reflect the respective opt-outs of Ireland and Denmark.
–A new consultation of the European Data Protection Supervisor will be carried out.
–Since the Commission has not received a notification pursuant to Article 5(3), point (b), of Regulation EU 2019/1157, the references to such notifications are removed.
–Pursuant to Article 8(2) of Regulation (EU) 2019/1157, certain residence cards of family members of Union citizens who are not nationals of a Member State ceased to be valid at their expiry or by 3 August 2023, whichever was earlier. As this date is in the past, the regulation merely states that such residence cards are no longer valid.
–Pursuant to Article 11(6) of Regulation (EU) 2019/1157, biometric data stored in the storage medium of identity cards and residence documents, namely the facial image and two fingerprints of the holder, is only to be used by the duly authorised staff of competent national authorities and Union agencies. Given the electronic signature on the storage medium of identity cards, identifying the holder by checking the data in the storage medium is more reliable than a visual check of the document, in particular in situations of remote identification. Union citizens may therefore wish to use the data in the storage medium of their identity card, including the facial image, to identify themselves towards private entities, such as banks or air carriers. The wording of the provision is thus adapted to state that only fingerprints can be accessed exclusively by duly authorised staff of competent national authorities and Union agencies. In any event, cryptographic protection prevents unauthorised persons from accessing the fingerprints on the storage medium.
–To reduce reporting obligations for Member State authorities, the obligation to maintain, and communicate annually to the Commission, a list of the competent authorities with access to the biometric data stored on the storage medium is removed.
–To reduce reporting obligations for Member State authorities, the rules on reporting and evaluation are streamlined. Article 13 of the regulation provides that instead of evaluating the regulation every six years, a single evaluation will be carried out by the Commission six years after the regulation enters into force, specifically focusing on a number of elements falling within the scope of the regulation.
–Given that Member States are already applying Regulation (EU) 2019/1157, it is not necessary to delay the entry into application of this regulation. The regulation should thus start to apply with its entry into force.
2024/0187 (CNS)
Proposal for a
COUNCIL REGULATION
on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement
(Text with EEA relevance)
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 77(3) thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Having regard to the opinion of the European Parliament 22 ,
Acting in accordance with a special legislative procedure,
Whereas:
(1)The Treaty on the European Union (TEU) resolved to facilitate the free movement of persons while ensuring the safety and security of the peoples of Europe, by establishing an area of freedom, security and justice, in accordance with the provisions of the TEU and of the Treaty on the Functioning of the European Union (TFEU).
(2)Citizenship of the Union confers on every citizen of the Union the right of free movement, subject to certain limitations and conditions. Directive 2004/38/EC of the European Parliament and of the Council 23 gives effect to that right. Article 45 of the Charter of Fundamental Rights of the European Union (the Charter) also provides for freedom of movement and residence. Freedom of movement entails the right to exit and enter Member States with a valid identity card or passport.
(3)Pursuant to Directive 2004/38/EC, Member States are to issue and renew identity cards or passports to their nationals in accordance with national laws. Furthermore, that Directive provides that Member States may require Union citizens and their family members to register with the relevant authorities. Member States are required to issue registration certificates to Union citizens under the conditions set out therein. Pursuant to that Directive, Member States are also required to issue residence cards to family members who are not nationals of a Member State and, on application, to issue documents certifying permanent residence and to issue permanent residence cards.
(4)Directive 2004/38/EC provides that Member States may adopt the necessary measures to refuse, terminate or withdraw any right conferred by that Directive in the case of abuse of rights or fraud. Document forgery or false presentation of a material fact concerning the conditions attached to the right of residence have been identified as typical cases of fraud under that Directive.
(5)Prior to the adoption of rules at Union level, considerable differences existed between the security levels of national identity cards and residence documents for Union citizens and their family members residing in another Member State. Such differences increase the risk of falsification and document fraud and also give rise to practical difficulties for citizens when they wish to exercise their right of free movement.
(6)Secure travel and identity documents are crucial whenever it is necessary to establish without doubt a person’s identity. A high level of document security is important to prevent abuses and threats to internal security, in particular related to terrorism and cross-border crime. Insufficiently secure national identity cards have in the past been among the most frequently detected false documents used for travel within the Union.
(7)In order to deter identity fraud, Member States should ensure that the falsification and counterfeiting of identification documents and the use of such falsified or counterfeit documents are adequately penalised by their national law.
(8)Issuing authentic and secure identity cards requires a reliable identity registration process and secure ‘breeder’ documents to support the application process. The Commission, the Member States and the relevant Union agencies should continue to work together to make breeder documents less vulnerable to fraud, given the increased use of false breeder documents.
(9)This Regulation does not require Member States to introduce identity cards or residence documents where they are not provided for under national law, nor does it affect the competence of the Member States to issue, under national law, other residence documents which fall outside the scope of Union law, for example residence cards issued to all residents on the territory regardless of their nationality. Furthermore, this Regulation does not affect the principle, resulting from the case-law of the Court of Justice, that the entitlement to the right of free movement and residence can be attested by any means of proof.
(10)This Regulation does not prevent Member States from accepting, in a non-discriminatory manner, documents other than travel documents for identification purposes, such as driving licences.
(11)Identification documents issued to citizens whose right of free movement has been restricted in accordance with Union or national law, and which expressly indicate that they cannot be used as travel documents, should not be considered as falling within the scope of this Regulation.
(12)Travel documents compliant with International Civil Aviation Organization (ICAO) Document 9303 on Machine Readable Travel Documents (‘ICAO Document 9303’) that do not serve identification purposes in the issuing Member States should not be considered as falling within the scope of this Regulation.
(13)This Regulation does not affect the use of identity cards and residence documents with eID function by Member States for other purposes, nor does it affect the rules laid down in Regulation (EU) No 910/2014 of the European Parliament and of the Council 24 , which provides for Union-wide mutual recognition of electronic identifications in access to public services and which helps citizens who are moving to another Member State by requiring mutual recognition of electronic identification means subject to certain conditions. Improved identity cards should ensure easier identification and contribute to better access to services.
(14)Proper verification of identity cards and residence documents requires that Member States use the correct title for each type of document covered by this Regulation. In order to facilitate the checking of documents covered by this Regulation in other Member States, the document title should also appear in at least one additional official language of the Union. Where Member States already use, for identity cards, well-established designations other than the title ‘identity card’, they should be able to continue to do so in their official language or languages. However, no new designations should be introduced in the future.
(15)Security features are necessary to verify if a document is authentic and to establish the identity of a person. The establishment of minimum security standards and the integration of biometric data in identity cards and in residence cards of family members who are not nationals of a Member State are important steps in rendering their use in the Union more secure. The inclusion of such biometric identifiers should allow Union citizens to fully benefit from their right of free movement.
(16)The storage of a facial image and two fingerprints (‘biometric data’) on identity and residence cards, as already provided for in respect of biometric passports for Union citizens and residence permits for third-country nationals, represents an appropriate combination of reliable identification and authentication with a reduced risk of fraud, for the purpose of strengthening the security of identity and residence cards. As the Court of Justice confirmed, the mandatory inclusion of fingerprints on the storage medium is compatible with the fundamental rights to respect for private life and to protection of personal data as guaranteed in Articles 7 and 8 of the Charter.
(17)As a general practice, Member States should, for the verification of the authenticity of the document and the identity of the holder, primarily verify the facial image and, where necessary to confirm without doubt the authenticity of the document and the identity of the holder, Member States should also verify the fingerprints.
(18)Members States should ensure that, in cases where a verification of biometric data does not confirm the authenticity of the document or the identity of its holder, a compulsory manual check is carried out by qualified staff.
(19)This Regulation does not provide a legal basis for setting up or maintaining databases at national level for the storage of biometric data in Member States, which is a matter of national law that needs to comply with Union law regarding data protection, including its necessity and proportionality requirements. Moreover, this Regulation does not provide a legal basis for setting up or maintaining a centralised database at Union level.
(20)Biometric identifiers should be collected and stored in the storage medium of identity cards and residence documents for the purposes of verifying the authenticity of the document and the identity of the holder. Given the electronic signature on the storage medium of identity cards, identifying the holder by means of the storage medium, which contains the same biographic data as printed on the document, is more reliable than a visual check of the document. Union citizens should thus be allowed to use the data stored in the storage medium of their identity card to identify themselves towards private entities. However, the verification of the fingerprints stored on the storage medium should only be carried out by duly authorised staff and only when the document is required to be produced by law.
(21)Biometric data stored for the purpose of the personalisation of identity cards or residence documents should be kept in a highly secure manner and only until the date of collection of the document and, in any case, no longer than 90 days from the date of issue of the document. After that period, those biometric data should be immediately erased or destroyed. This should be without prejudice to any other processing of these data in accordance with Union and national law regarding data protection.
(22)The specifications of ICAO Document 9303, which ensure global interoperability including in relation to machine readability and use of visual inspection, should be taken into account for the purpose of this Regulation.
(23)Member States should be able to decide whether to include a person’s gender on a document covered by this Regulation. Where a Member State includes a person’s gender on such a document, the specifications of ICAO Document 9303 ‘F’, ‘M’ or ‘X’ or the corresponding single initial used in the language or languages of that Member State should be used, as appropriate.
(24)Implementing powers should be conferred on the Commission in order to ensure that future security standards and technical specifications adopted pursuant to Council Regulation (EC) No 1030/2002 25 are duly taken into account, where appropriate, for identity cards and residence cards. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council 26 . To that end, the Commission should be assisted by the Committee established by Article 6 of Council Regulation (EC) No 1683/95 27 . Where necessary, it should be possible for the implementing acts adopted to remain secret in order to prevent the risk of counterfeiting and falsifications.
(25)Member States should ensure that appropriate and effective procedures for the collection of biometric identifiers are in place and that such procedures comply with the rights and principles set out in the Charter, the Convention for the Protection of Human Rights and Fundamental Freedoms of the Council of Europe and the United Nations Convention on the Rights of the Child. Member States should ensure that the best interest of the child is a primary consideration throughout the collection procedure. To that end, qualified staff should receive appropriate training on child-friendly practices for the collecting of biometric identifiers.
(26)Where difficulties are encountered in the collection of biometric identifiers, Member States should ensure that appropriate procedures are in place to respect the dignity of the person concerned. Therefore, specific considerations relating to gender and to the specific needs of children and of vulnerable persons should be taken into account.
(27)The introduction of minimum security and format standards for identity cards should allow Member States to rely on the authenticity of those documents when Union citizens exercise their right of free movement. The introduction of reinforced security standards should provide sufficient guarantees to public authorities and private entities to enable them to rely on the authenticity of identity cards when used by Union citizens for identification purposes.
(28)A distinguishing sign in the form of the two-letter country code of the Member State issuing the document, printed in negative in a blue rectangle and encircled by 12 yellow stars, facilitates the visual inspection of the document, in particular when the holder is exercising the right of free movement.
(29)While the option to provide for additional national features is maintained, Member States should ensure that those features do not diminish the efficiency of the common security features or negatively affect the cross-border compatibility of the identity cards, such as the capability that the identity cards can be read by machines used by Member States other than those which issue the identity cards.
(30)The introduction of security standards in identity cards and in residence cards of family members who are not nationals of a Member State should not result in a disproportionate increase in fees for Union citizens or third-country nationals. Member States should take this principle into consideration when issuing calls for tender.
(31)Member States should take all necessary steps to ensure that biometric data correctly identify the person to whom an identity card is issued. To this end, Member States could consider collecting biometric identifiers, particularly the facial image, by means of live enrolment by the national authorities issuing identity cards.
(32)Member States should exchange with each other such information as is necessary to access, authenticate and verify the information contained on the secure storage medium. The formats used for the secure storage medium should be interoperable, including in respect of automated border crossing points.
(33)Directive 2004/38/EC addresses the situation where Union citizens, or family members of Union citizens who are not nationals of a Member State, who do not have the necessary travel documents are to be given every reasonable opportunity to prove by other means that they are covered by the right of free movement. Such means can include identification documents used on a provisional basis and residence cards issued to such family members.
(34)This Regulation respects the obligations set out in the Charter and in the United Nations Convention on the Rights of Persons with Disabilities. Therefore, Member States are encouraged to work with the Commission to integrate additional features that render identity cards more accessible and user-friendly to people with disabilities, such as visually impaired persons. Member States are to explore the use of solutions, such as mobile registration devices, for the issuance of identity cards to persons incapable of visiting the authorities responsible for issuing identity cards.
(35)Residence documents issued to citizens of the Union should include specific information to ensure that they are identified as such in all Member States. This should facilitate the recognition of the Union citizen’s use of the right of free movement and of the rights inherent to this use, but harmonisation should not go beyond what is appropriate to address the weaknesses of current documents. Member States are free to select the format in which these documents are issued and could issue them in a format complying with the specifications of ICAO Document 9303.
(36)As regards residence documents issued to family members who are not nationals of a Member State, it is appropriate to make use of the same format and security features as those provided for in Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954 of the European Parliament and of the Council 28 . In addition to proving the right of residence, those documents also exempt their holders who are otherwise subject to a visa obligation from the requirement to obtain a visa when accompanying or joining the Union citizen within the Union territory.
(37)Directive 2004/38/EC provides that documents issued to family members who are not nationals of a Member State are to be called ‘Residence card of a family member of a Union citizen’. In order to facilitate their identification, residence cards of a family member of a Union citizen should bear a standardised title and code.
(38)Taking into account both the security risk and the costs incurred by Member States, identity cards as well as residence cards of family members of Union citizens that do not meet the requirements of this Regulation should be phased out. For documents that are missing important security features, or are not machine readable, a shorter phasing-out period is necessary on security grounds.
(39)Regulation (EU) 2016/679 of the European Parliament and of the Council 29 applies with regard to the personal data to be processed in the context of the application of this Regulation. It is necessary to further specify safeguards applicable to the processed personal data and in particular to sensitive data such as biometric identifiers. Data subjects should be made aware of the existence in their documents of the storage medium containing their biometric data including its accessibility in contactless form as well as of all instances where the data contained in their identity cards and residence documents are used. In any case, data subjects should have access to personal data processed in their identity cards and residence documents and should have the right to have them rectified by way of issuance of a new document where such data is erroneous or incomplete. The storage medium should be highly secure and effectively protect personal data stored on it from unauthorised access.
(40)Member States should be responsible for the proper processing of biometric data, from collection to integration of the data on the highly secure storage medium, in accordance with Regulation (EU) 2016/679.
(41)Member States should exercise particular caution when cooperating with an external service provider. Such cooperation should not exclude any liability of the Member States arising under Union or national law for breaches of obligations with regard to personal data.
(42)It is necessary to specify in this Regulation the basis for the collection and storage of data on the storage medium of identity cards and residence documents. In accordance with Union or national law and respecting the principles of necessity and proportionality, Member States should be able to store other data on a storage medium for electronic services or for other purposes relating to the identity card or residence document. The processing of such other data including their collection and the purposes for which they can be used should be authorised by Union or national law. All national data should be physically or logically separated from biometric data referred to in this Regulation and should be processed in accordance with Regulation (EU) 2016/679.
(43)In accordance with the Interinstitutional Agreement of 13 April 2016 on Better Law-Making 30 , the Commission should, no sooner than six years after the date of application of this Regulation carry out an evaluation of this Regulation, including on the basis of information gathered through specific monitoring arrangements, in order to assess the actual effects of this Regulation and the need for any further action. For the purpose of monitoring, Member States should collect statistics on the number of identity cards and residence documents which they issued.
(44)Since the objectives of this Regulation, namely to enhance security and to facilitate the exercise of the right of free movement by Union citizens and their family members, cannot be sufficiently achieved by the Member States but can rather, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 TEU. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.
(45)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application.
(46)In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the TEU and to the TFEU, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Regulation and is not bound by it or subject to its application.
(47)This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter including human dignity, the right to the integrity of the person, the prohibition of inhuman or degrading treatment, the right to equality before the law and non-discrimination, the rights of children, the rights of the elderly, respect for private and family life, the right to the protection of personal data, the right of free movement and the right to an effective remedy. Member States should comply with the Charter when implementing this Regulation.
(48)The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council 31 and delivered an opinion on XXXX 32 ,
HAS ADOPTED THIS REGULATION:
Chapter I
Subject matter, scope and definitions
Article 1
Subject matter
This Regulation strengthens the security standards applicable to identity cards issued by Member States to their nationals and to residence documents issued by Member States to Union citizens and their family members when exercising their right to free movement.
Article 2
Scope
This Regulation applies to:
(a)identity cards issued by Member States to their own nationals as referred to in Article 4(3) of Directive 2004/38/EC;
(b)registration certificates issued in accordance with Article 8 of Directive 2004/38/EC to Union citizens residing for more than three months in a host Member State and documents certifying permanent residence issued in accordance with Article 19 of Directive 2004/38/EC to Union citizens upon application;
(c)residence cards issued in accordance with Article 10 of Directive 2004/38/EC to family members of Union citizens who are not nationals of a Member State and permanent residence cards issued in accordance with Article 20 of Directive 2004/38/EC to family members of Union citizens who are not nationals of a Member State.
This Regulation shall not apply to identification documents issued on a provisional basis with a period of validity of less than six months.
Chapter II
National identity cards
Article 3
Security standards/format/specifications
1.Identity cards issued by Member States shall be produced in ID-1 format and shall contain a machine-readable zone (MRZ). Such identity cards shall be based on the specifications and minimum security standards set out in ICAO Document 9303 and shall comply with the requirements set out in points (c), (d), (f) and (g) of the Annex to Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954.
2.The data elements included on identity cards shall comply with the specifications set out in part 5 of ICAO document 9303.
By way of derogation from the first subparagraph, the document number may be inserted in zone I and the designation of a person’s gender shall be optional.
3.The document shall bear the title ‘Identity card’ or another well-established national designation in the official language or languages of the issuing Member State, and the words ‘Identity card’ in at least one other official language of the Union.
4.The identity card shall contain, on the front side, the two-letter country code of the Member State issuing the card, printed in negative in a blue rectangle and encircled by 12 yellow stars.
5.Identity cards shall include a highly secure storage medium which shall contain a facial image of the holder of the card and two fingerprints in interoperable digital formats. For the capture of biometric identifiers, Member States shall apply the technical specifications as established by Commission Implementing Decision C(2018) 7767 33 as amended by Commission Implementing Decision C(2021) 3726 34 .
6.The storage medium shall have sufficient capacity and capability to guarantee the integrity, the authenticity and the confidentiality of the data. The data stored shall be accessible in contactless form and secured as provided for in Implementing Decision C(2018) 7767 as amended by Implementing Decision C(2021) 3726. Member States shall exchange the information necessary to authenticate the storage medium and to access and verify the biometric data referred to in paragraph 5.
7.Children under the age of 12 years may be exempt from the requirement to give fingerprints.
Children under the age of 6 years shall be exempt from the requirement to give fingerprints.
Persons in respect of whom fingerprinting is physically impossible shall be exempt from the requirement to give fingerprints.
8.When necessary and proportionate to the aim to be achieved, Member States may enter such details and observations for national use as may be required in accordance with national law. The efficiency of minimum security standards and the cross-border compatibility of identity cards shall not be diminished as a result.
9.Where Member States incorporate a dual interface or a separate storage medium in the identity card, the additional storage medium shall comply with the relevant ISO standards and shall not interfere with the storage medium referred to in paragraph 5.
10.Where Member States store data for electronic services such as e-government and e-business in the identity cards, such national data shall be physically or logically separated from the biometric data referred to in paragraph 5.
11.Where Member States add additional security features to identity cards, the cross-border compatibility of such identity cards and the efficiency of the minimum security standards shall not be diminished as a result.
Article 4
Period of validity
1.Identity cards shall have a minimum period of validity of five years and a maximum period of validity of ten years.
2.By way of derogation from paragraph 1, Member States may provide for a period of validity of:
(a)less than five years, for identity cards issued to minors;
(b)in exceptional cases, less than five years, for identity cards issued to persons in special and limited circumstances and where their period of validity is limited in compliance with Union and national law;
(c)more than 10 years, for identity cards issued to persons aged 70 and above.
3.Member States shall issue an identity card having a validity of 12 months or less where it is temporarily physically impossible to take fingerprints of any of the fingers of the applicant.
Article 5
Phasing out
1.Identity cards which do not meet the requirements set out in Article 3 shall cease to be valid at their expiry or by 3 August 2031, whichever is earlier.
2.By way of derogation from paragraph 1:
(a)identity cards which do not meet the minimum security standards set out in part 2 of ICAO document 9303 or which do not include a functional MRZ, as defined in paragraph 3, shall cease to be valid at their expiry or by 3 August 2026, whichever is earlier;
(b)identity cards of persons aged 70 and above at 2 August 2021, which meet the minimum security standards set out in part 2 of ICAO document 9303 and which have a functional MRZ, as defined in paragraph 3, shall cease to be valid at their expiry.
3.For the purpose of paragraph 2, a functional MRZ shall mean any of the following:
(a)a machine-readable zone compliant with ICAO document 9303;
(b)any other machine-readable zone for which the issuing Member State notifies the rules required for reading and displaying the information contained therein.
Chapter III
Residence documents for Union citizens
Article 6
Minimum information to be indicated
Residence documents, when issued by Member States to Union citizens, shall indicate at a minimum the following:
(a)the title of the document in the official language or languages of the Member State concerned and in at least one other official language of the Union;
(b)a clear reference that the document is issued to a Union citizen in accordance with Directive 2004/38/EC;
(c)the document number;
(d)the name (surname and forename(s)) of the holder;
(e)the date of birth of the holder;
(f)the information to be included on registration certificates and documents certifying permanent residence, issued in accordance with Articles 8 and 19 of Directive 2004/38/EC, respectively;
(g)the issuing authority;
(h)on the front-side, the two-letter country code of the Member State issuing the document, printed in negative in a blue rectangle and encircled by twelve yellow stars.
If a Member State decides to take fingerprints, Article 3(7) shall apply accordingly.
Chapter IV
Residence cards for family members who are not nationals of a Member State
Article 7
Uniform format
1.When issuing residence cards to family members of Union citizens who are not nationals of a Member State, Member States shall use the same format as established by Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954, and as implemented by Implementing Decision C(2018) 7767 as amended by Implementing Decision C(2021) 3726.
2.By way of derogation from paragraph 1, a card shall bear the title ‘Residence card’ or ‘Permanent residence card’. Member States shall indicate that these documents are issued to a family member of a Union citizen in accordance with Directive 2004/38/EC. For this purpose, Member States shall use the standardised code ‘Family Member EU Art 10 DIR 2004/38/EC’ or ‘Family Member EU Art 20 DIR 2004/38/EC’, in data field [10], as referred to in the Annex to Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954.
3.Member States may enter data for national use in accordance with national law. When entering and storing such data, Member States shall respect the requirements set out in Article 4, second paragraph, of Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954.
Article 8
Phasing out of existing residence cards
1.Residence cards of family members of Union citizens who are not nationals of a Member State which do not meet the requirements of Article 7 shall cease to be valid at their expiry or by 3 August 2026, whichever is earlier.
2.By way of derogation from paragraph 1, residence cards of family members of Union citizens who are not nationals of a Member State which do not meet the minimum security standards set out in part 2 of ICAO document 9303 or which do not include a functional MRZ compliant with part 3 of ICAO document 9303 shall be invalid.
Chapter V
Common provisions
Article 9
Contact point
1.Each Member State shall designate at least one central authority as a contact point for the implementation of this Regulation. Where a Member State has designated more than one central authority, it shall designate which of those authorities will be the contact point for the implementation of this Regulation. It shall communicate the name of that authority to the Commission and the other Member States. If a Member State changes its designated authority, it shall inform the Commission and the other Member States accordingly.
2.Member States shall ensure that the contact points are aware of relevant information and assistance services at Union level included in the Single Digital Gateway set out in Regulation (EU) 2018/1724 of the European Parliament and of the Council 35 and that they are able to cooperate with such services.
Article 10
Collection of biometric identifiers
1.The biometric identifiers shall be collected solely by qualified and duly authorised staff designated by the authorities responsible for issuing identity cards or residence cards, for the purpose of being integrated into the highly secure storage medium provided for in Article 3(5) for identity cards and in Article 7(1) for residence cards. By way of derogation from the first sentence, fingerprints shall be collected solely by qualified and duly authorised staff of such authorities, except in the case of applications submitted to the diplomatic and consular authorities of the Member State.
With a view to ensuring the consistency of biometric identifiers with the identity of the applicant, the applicant shall appear in person at least once during the issuance process for each application.
2.Member States shall ensure that appropriate and effective procedures for the collection of biometric identifiers are in place and that those procedures comply with the rights and principles set out in the Charter, the Convention for the Protection of Human Rights and Fundamental Freedoms and the United Nations Convention on the Rights of the Child.
Where difficulties are encountered in the collection of biometric identifiers, Member States shall ensure that appropriate procedures are in place to respect the dignity of the person concerned.
3.Other than where required for the purpose of processing in accordance with Union and national law, biometric identifiers stored for the purpose of personalisation of identity cards or residence documents shall be kept in a highly secure manner and only until the date of collection of the document and, in any case, no longer than 90 days from the date of issue. After this period, these biometric identifiers shall be immediately erased or destroyed.
Article 11
Protection of personal data and liability
1.Without prejudice to Regulation (EU) 2016/679, Member States shall ensure the security, integrity, authenticity and confidentiality of the data collected and stored for the purpose of this Regulation.
2.For the purpose of this Regulation, the authorities responsible for issuing identity cards and residence documents shall be considered as the controller referred to in Article 4(7) of Regulation (EU) 2016/679 and shall have responsibility for the processing of personal data.
3.Member States shall ensure that supervisory authorities can fully exercise their tasks as referred to in Regulation (EU) 2016/679, including access to all personal data and all necessary information as well as access to any premises or data processing equipment of the competent authorities.
4.Cooperation with external service providers shall not exclude any liability on the part of a Member State which may arise under Union or national law in respect of breaches of obligations with regard to personal data.
5.Information in machine-readable form shall only be included in an identity card or residence document in accordance with this Regulation and the national law of the issuing Member State.
6.Biometric data stored in the storage medium of identity cards and residence documents shall only be used in accordance with Union and national law for the purpose of verifying:
(a)the authenticity of the identity card or residence document;
(b)the identity of the holder by means of directly available comparable features where the identity card or residence document is required to be produced by law.
The two fingerprints stored in the storage medium shall only be accessed by duly authorised staff of competent national authorities and Union agencies.
Article 12
Monitoring
1.By [one year after the entry into force of this Regulation], the Commission shall establish a detailed programme for monitoring the outputs, results and impact of this Regulation, including its impact on fundamental rights.
2.The monitoring programme shall set out the means by which and the intervals at which the data and other necessary evidence are to be collected. It shall specify the action to be taken by the Commission and by Member States in collecting and analysing the data and other evidence.
3.Member States shall provide the Commission with the data and other evidence necessary for such monitoring.
Article 13
Evaluation
1.No sooner than [six years after the entry into force of this Regulation], the Commission shall carry out an evaluation of this Regulation and present a report on the main findings to the European Parliament, to the Council and to the European Economic and Social Committee. The report shall in particular focus on:
(a)the impact of this Regulation on fundamental rights;
(b)the mobility of Union citizens;
(c)the effectiveness of biometric verification in ensuring the security of travel documents;
(d)a possible further visual harmonisation of identity cards.
2.Member States and relevant Union agencies shall provide the Commission with the information necessary for the preparation of these reports.
Article 14
Additional technical specifications
1.In order to ensure, where appropriate, that identity cards and residence documents referred to in Article 2, points (a) and (c), comply with future minimum security standards, the Commission shall establish, by means of implementing acts, additional technical specifications, relating to the following:
(a)additional security features and requirements, including enhanced anti-forgery, counterfeiting and falsification standards;
(b)technical specifications for the storage medium of the biometric features referred to in Article 3(5) and their security, including prevention of unauthorised access and facilitation of validation;
(c)requirements for quality and common technical standards for the facial image and the fingerprints.
Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 15(2).
2.In accordance with the procedure referred to in Article 15(2), it may be decided that the specifications referred to in this Article are to be secret and are not to be published. In such a case, they shall be made available only to the bodies designated by the Member States as responsible for printing and to persons duly authorised by a Member State or by the Commission.
3.Each Member State shall designate one body having responsibility for printing identity cards, and one body having responsibility for printing residence cards of family members of Union citizens, and shall communicate the names of such bodies to the Commission and to the other Member States. Member States shall be entitled to change such designated bodies and shall inform the Commission and the other Member States accordingly.
Member States may also decide to designate a single body having responsibility for printing both identity cards and residence cards of family members of Union citizens and shall communicate the name of this body to the Commission and to the other Member States.
Two or more Member States may also decide to designate a single body for those purposes and shall inform the Commission and the other Member States accordingly.
Article 15
Committee procedure
1.The Commission shall be assisted by the Committee established by Article 6 of Regulation (EC) No 1683/95. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.
2.Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the committee does not deliver an opinion, the Commission shall not adopt the draft implementing act and Article 5(4), third subparagraph, of Regulation (EU) No 182/2011 shall apply.
Article 16
Entry into force
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.
Done at Brussels,
For the Council
The President