Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 52 - Scope and interpretation
Key facts of the case:
The Finnish Embassy in Switzerland had rejected a passport application because the applicant had not agreed to it that his fingerprints are stored not only in the passport’s data chip but also in the passport register. The applicant claimed that storing the fingerprints in the passport register was an undue interference with the right to private life and the protection of personal data.
The Passport Act (671/2006) provides for, e.g., the security features for passports and contains provisions on biometric data, including fingerprints, and the storing of fingerprints in the passport register. The Act on the Processing of Personal Data by the Police (761/2003) regulates the use of the data in the passport register. The Act provides, e.g., that the police is allowed to use the fingerprint data in the passport register for other purposes than collecting and recording that data only in cases where the police needs to identify a victim of a natural or other disaster or a victim of crime or when a victim cannot be identified by any other means. The fingerprint data extracted from the passport register must be erased as soon as the comparison of fingerprints has been completed.
The Supreme Administrative Court held that storing fingerprint data in a register, outside of the data chip integrated in the passport, constitutes processing of personal data, which is regulated in the Personal Data Act (523/1999), as amended in order to incorporate the Data Protection Directive (1995/46/EC). Storage of fingerprint data in the passport register thus falls within the scope of EU law and the Charter is also applicable.
Outcome of the case:
The Supreme Administrative Court found that the storing of fingerprints in an external data system, which is not integrated in the passport, provides more extensive protection for privacy, because it not only protects the passport against fraudulent use but also protects the true identity and person of the passport holder. By comparing a passport applicant’s fingerprints to the data in the passport register it is possible to prevent identity theft as well as situations where a person applies for multiple passports using different identities. Also, with the help of the data in the register, a person’s identity can be verified in cases where the passport chip has been damaged or the person has lost his or her identity document. The regulations are both for the protection of the individual and public safety. The court also noted that the use of fingerprint data in the passport register is restricted by law.
The court concluded that the provisions in the Passport Act concerning storage of fingerprint data in the passport register and the limitations imposed on the right to private life and the protection of personal data are precise and defined in sufficient detail. They are compatible with the Charter, the ECHR and the criteria that must be met in the restriction of constitutional rights, as defined in the Finnish constitutional rights system. The passport application could thus be rejected on grounds that it did not meet the requirements prescribed in the Passport Act.
The rights enshrined in Articles 7 and 8 of the Charter are not absolute rights. According to Article 52(1) of the Charter, the exercise of these rights may be subject to limitations, when such limitations are provided for by law and respect the essence of the rights. Moreover, such limitations must be proportionate and meet the objectives recognized by the Union and they must be necessary in order to protect the rights and freedoms of others. Similarly, according to Article 8(2) of the ECHR, public authorities may not interfere with the right to private life except when such interference is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
The right of the police to use fingerprint data for purposes other than issuing and producing passports is strictly limited by law to situations where it is necessary to identify a victim of a natural disaster or other major disaster or catastrophe or a victim of crime or when a victim’s identity cannot be verified by other means. In such cases fingerprints can be compared to fingerprints stored in [the passport] register. However, the data extracted from the register can only be used as long as the comparison is being carried out and must be erased immediately after the comparison has been completed. Therefore, and also in view of what has been presented above, it can be concluded that fingerprint data stored in the passport register meets the requirements set in Article 52(1) [of the Charter] and Article 8(2) of the ECHR and is also in accordance with the general requirements for limitations on constitutional rights, particularly the requirements of acceptability and proportionality.
Perusoikeuskirjan 7 ja 8 artiklan tarkoittamat oikeudet eivät ole ehdottomia. Niiden käyttämistä voidaan 52 artiklan 1 kohdan mukaan rajoittaa, mikäli rajoituksista säädetään lailla ja niiden keskeistä sisältöä kunnioitetaan. Rajoitusten on lisäksi oltava oikeassa suhteessa niillä tavoiteltuun, unionin tunnustamaan päämäärään nähden ja niiden on oltava tarpeen muiden henkilöiden oikeuksien ja vapauksien suojelemiseksi. Vastaavasti Euroopan ihmisoikeussopimuksen 8 artiklan 2 kohdan mukaan viranomaiset saavat puuttua yksityiselämän suojaan, kun laki sen sallii ja se on välttämätöntä demokraattisessa yhteiskunnassa kansallisen ja yleisen turvallisuuden tai maan taloudellisen hyvinvoinnin vuoksi, tai epäjärjestyksen tai rikollisuuden estämiseksi, terveyden tai moraalin suojaamiseksi, tai muiden henkilöiden oikeuksien ja vapauksien turvaamiseksi.
Poliisin oikeus käyttää sormenjälkitietoja muuhun kuin passin myöntämistä ja valmistamista koskeviin tarkoituksiin on täsmällisesti ja tarkkarajaisesti rajattu lailla vain tilanteisiin, joissa on kyse luonnononnettomuuden, suuronnettomuuden tai muun katastrofin taikka rikoksen kohteeksi joutuneen tai muuten tunnistamattomaksi jääneen uhrin tunnistamisesta. Näissä tilanteissa sormenjälkiä voidaan verrata rekisteröityihin sormenjälkiin, mutta vertaamista varten otettuja tietoja voidaan käyttää vain vertaamisen ajan ja ne on hävitettävä välittömästi sen jälkeen. Tämän vuoksi ja edellä muutoin esitetyn perusteella voidaan todeta sormenjälkien tallettamisen passirekisteriin täyttävän 52 artiklan 1 kohdassa ja Euroopan ihmisoikeussopimuksen 8 artiklan 2 kohdassa mainitut edellytykset sekä myös perustuslain suojaamien perusoikeuksien rajoitusedellytykset erityisesti rajoitusten hyväksyttävyyden ja oikeasuhtaisuuden vaatimusten kannalta.
