Privacy risks to EU citizens from plans to strengthen ID security

EU plans to overhaul national identity documents by adding fingerprints and facial imagery could put EU citizens’ privacy and personal data at risk, finds the latest Opinion from the EU Agency for Fundamental Rights.

Freedom of movement allows people to travel across the EU with their identity card. But there are about 86 different types of card throughout the EU. This complicates checks by authorities. Some are also less secure which makes fraud easier.

To counter this, the EU proposes regulating to unify the identity documents of EU citizens and the residence cards of non-EU family members of EU citizens living in a Member State other than their own. The EU also proposes to improve security by adding fingerprinting data and facial imagery to the cards’ chip. This would increase reliability and acceptance of these documents as proof of who someone is. It should also reduce fraud.

To explore the impact of these changes, the European Parliament asked FRA to give its Opinion on the fundamental rights implications of using biometrics in identity documents. The findings include:

  • Given the various purposes for which they are used, identity cards do not need the same level of security as passports, which are used to cross the external border of the EU. For identity cards facial imagery alone should be enough to improve security. If also fingerprints are included then safeguards are needed to reduce the risk of misuse.
  • The duty to collect biometrics from citizens could lead EU Member States to create national databases to store the data. However, this goes against privacy principles as the data should be deleted as soon as they are stored on the card’s chip.
  • Force should not be used when collecting biometric data. When getting fingerprints from children, it should be done in a child-friendly manner.
  • The biometrics of children and older people are less reliable and more likely to result in matching errors. Facial imagery for people with disabilities who have suffered paralysis, for example, may also be less reliable. In such cases, there should either be exemptions from including biometrics or special provisions, such as manual checks by biometrics experts, to avoid the negative consequences of wrong matches. 

This Opinion raises awareness of some of the potential fundamental rights risks in the proposed Regulation and reminds policy makers to ensure that personal data is only used for the purposes for which it is collected.

FRA issues Opinions on specific thematic topics, following requests for advice from the European Parliament, the EU Council or the European Commission. These Opinions are part of the Agency's fundamental rights assistance and expertise that it provides to EU institutions and Member States.