You are here:

Finland / Supreme Administrative Court / 3872/2017; 3736/3/15

X v the Embassy of Finland in Switzerland

Deciding Body type:
National Court/Tribunal
Deciding Body:
Supreme Administrative Court
Type:
Decision
Decision date:
15/08/2017

Key facts of the case:

The Finnish Embassy in Switzerland had rejected a passport application because the applicant had not agreed to it that his fingerprints are stored not only in the passport’s data chip but also in the passport register. The applicant claimed that storing the fingerprints in the passport register was an undue interference with the right to private life and the protection of personal data.

The Passport Act (671/2006) provides for, e.g., the security features for passports and contains provisions on biometric data, including fingerprints, and the storing of fingerprints in the passport register. The Act on the Processing of Personal Data by the Police (761/2003) regulates the use of the data in the passport register. The Act provides, e.g., that the police is allowed to use the fingerprint data in the passport register for other purposes than collecting and recording that data only in cases where the police needs to identify a victim of a natural or other disaster or a victim of crime or when a victim cannot be identified by any other means. The fingerprint data extracted from the passport register must be erased as soon as the comparison of fingerprints has been completed.

The Supreme Administrative Court held that storing fingerprint data in a register, outside of the data chip integrated in the passport, constitutes processing of personal data, which is regulated in the Personal Data Act (523/1999), as amended in order to incorporate the Data Protection Directive (1995/46/EC). Storage of fingerprint data in the passport register thus falls within the scope of EU law and the Charter is also applicable.

Outcome of the case: 

The Supreme Administrative Court found that the storing of fingerprints in an external data system, which is not integrated in the passport, provides more extensive protection for privacy, because it not only protects the passport against fraudulent use but also protects the true identity and person of the passport holder. By comparing a passport applicant’s fingerprints to the data in the passport register it is possible to prevent identity theft as well as situations where a person applies for multiple passports using different identities. Also, with the help of the data in the register, a person’s identity can be verified in cases where the passport chip has been damaged or the person has lost his or her identity document. The regulations are both for the protection of the individual and public safety. The court also noted that the use of fingerprint data in the passport register is restricted by law.

The court concluded that the provisions in the Passport Act concerning storage of fingerprint data in the passport register and the limitations imposed on the right to private life and the protection of personal data are precise and defined in sufficient detail. They are compatible with the Charter, the ECHR and the criteria that must be met in the restriction of constitutional rights, as defined in the Finnish constitutional rights system. The passport application could thus be rejected on grounds that it did not meet the requirements prescribed in the Passport Act.