Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 45 - Freedom of movement and of residence
Article 52 - Scope and interpretation
Key facts of the case:
Reference for a preliminary ruling – Regulation (EU) 2019/1157 – Strengthening the security of identity cards of EU citizens – Validity – Legal basis – Article 21(2) TFEU – Article 77(3) TFEU – Regulation (EU) 2019/ 1157 – Article 3(5) – Obligation for Member States to include two fingerprints in interoperable digital formats in the storage medium of identity cards – Article 7 of the Charter of Fundamental Rights of the European Union – Respect for private and family life – Article 8 of the Charter of Fundamental Rights – Protection of personal data – Regulation (EU) 2016/679 – Article 35 – Obligation to carry out a data protection impact assessment – Maintaining the effects for a certain time of a regulation which has been declared invalid.
Outcome of the case:
On those grounds, the Court (Grand Chamber) hereby rules:
1. Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement is invalid.
2. The effects of Regulation 2019/1157 are to be maintained until the entry into force, within a reasonable period which may not exceed two years from 1 January of the year following the date of delivery of the present judgment, of a new regulation based on Article 77(3) TFEU and intended to replace it.
32 In the third place, the referring court asks, more specifically, whether Article 3(5) of Regulation 2019/1157 is compatible with Articles 7 and 8 of the Charter relating, respectively, to respect for private and family life and the protection of personal data. The obligation on the Member States to issue identity cards whose storage medium contains two fingerprints constitutes a limitation on the exercise of the rights recognised by those two provisions of the Charter, a limitation which can be justified only if it satisfies the conditions laid down in Article 52(1) of the Charter.
...
35 On the other hand, it is apparent from Opinion 7/2018 that the inclusion and storage of fingerprints would have a wide-ranging impact on up to 370 million EU citizens, potentially subjecting 85% of the EU population to a mandatory requirement to have fingerprints taken. That wide-ranging impact, combined with the very sensitive nature of the data processed (a facial image combined with two fingerprints), means that the limitation placed on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter, resulting from the compulsory collection of fingerprints for the purpose of producing identity cards, is greater than for passports, which, in turn, requires a stronger justification and a careful assessment of the measure at issue under a test of strict necessity.
41 Finally, and in essence, the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter could be non-legitimate since, in Opinion 7/2018, the EDPS noted that when Regulation 2019/1157 was adopted, the number of fraudulent identity cards was relatively small in proportion to the number of cards issued (38 870 fraudulent cards detected between 2013 and 2017) and that that number had been decreasing for a number of years.
43 By its question, the referring court seeks, in essence, to ascertain whether Regulation 2019/1157 is invalid, as a whole or in part, on the grounds that (i) it was adopted on an incorrect legal basis, (ii) it infringes Article 35(10) of the GDPR and, (iii) it is contrary to Articles 7 and 8 of the Charter.
69 The third ground of invalidity in respect of Regulation 2019/1157 referred to by the referring court concerns whether the obligation to include two complete fingerprints in the storage medium of identity cards issued by Member States, laid down in Article 3(5) of that regulation, entails an unjustified limitation of the rights guaranteed in Articles 7 and 8 of the Charter.
70 Article 7 of the Charter provides, inter alia, that everyone has the right to respect for his or her private life. Pursuant to Article 8(1) of the Charter, everyone has the right to the protection of personal data concerning him or her. It follows from a joint reading of those provisions that, as a general rule, any processing of personal data by a third party may constitute a threat to those rights (judgment of 17 October 2013, Schwarz, C‑291/12, EU:C:2013:670, paragraph 25).
73 Therefore, the obligation to include two fingerprints in the storage medium of identity cards, laid down in Article 3(5) of Regulation 2019/1157, constitutes a limitation both of the right to respect for private life and of the right to the protection of personal data, enshrined in Articles 7 and 8 of the Charter respectively.
74 In addition, that obligation involves carrying out, in advance, two successive personal data processing operations, namely the collection of those fingerprints from the data subject, then the temporary storage of those fingerprints for the purposes of personalisation of identity cards, since those operations are governed by Article 10 of that regulation. Those operations also constitute limitations of the rights enshrined in Articles 7 and 8 of the Charter.
2. The justification for the limitation
75 As is apparent from settled case-law, the right to respect for private life and the right to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter respectively, are not absolute rights, but must be considered in relation to their function in society (see, to that effect, judgment of 20 September 2022, SpaceNet and Telekom Deutschland, C‑793/19 and C‑794/19, EU:C:2022:702, paragraph 63).
76 Limitations may therefore be placed on those rights, provided that, in accordance with the first sentence of Article 52(1) of the Charter, they are provided for by law and respect the essence of those rights. In addition, in accordance with the second sentence of that paragraph, in compliance with the principle of proportionality, such limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. In that regard, Article 8(2) of the Charter states that personal data must, inter alia, be processed ‘for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law’.
(a) Whether the principle of legality has been complied with
77 As regards the requirement laid down in the first sentence of Article 52(1) of the Charter that any limitation on the exercise of rights recognised by the Charter must be provided for by law, it should be recalled that that requirement implies that the act which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned, bearing in mind, on the one hand, that that requirement does not preclude the limitation in question from being formulated in terms which are sufficiently open to be able to adapt to different scenarios and keep pace with changing circumstances and, on the other hand, that the Court may, where appropriate, specify, by means of interpretation, the actual scope of the limitation in the light of the very wording of the EU legislation in question as well as its general scheme and the objectives it pursues, as interpreted in view of the fundamental rights guaranteed by the Charter (judgment of 21 June 2022, Ligue des droits humains, C‑817/19, EU:C:2022:491, paragraph 114).
78 In the present case, the limitations on the exercise of the fundamental rights guaranteed in Articles 7 and 8 of the Charter arising from the obligation to include two complete fingerprints in the storage medium of identity cards issued by Member States and the conditions for application and the scope of those limitations are defined clearly and precisely by Article 3(5) and Article 10(1) and (3) of Regulation 2019/1157, which were adopted by the EU legislature in accordance with the ordinary legislative procedure and the effects of which will be maintained by the present judgment.
79 Therefore, those limitations on the exercise of the fundamental rights guaranteed in Articles 7 and 8 of the Charter comply with the principle of legality referred to in the first sentence of Article 52(1) of the Charter.
(b) Compliance with the essence of the fundamental rights guaranteed in Articles 7 and 8 of the Charter
80 It should be stated that the information provided by fingerprints does not, in itself, make it possible to have an overview of the private and family life of data subjects.
81 In those circumstances, the limitation entailed by the obligation to include two fingerprints in the storage medium of identity cards issued by the Member States, laid down in Article 3(5) of Regulation 2019/1157, does not adversely affect the essence of the fundamental rights enshrined in Articles 7 and 8 of the Charter (see, by analogy, judgment of 21 June 2022, Ligue des droits humains, C‑817/19, EU:C:2022:491, paragraph 120).
(c) Whether the principle of proportionality has been complied with
82 As is apparent from the second sentence of Article 52(1) of the Charter, in order for limitations on the exercise of the fundamental rights guaranteed by the Charter to be made in accordance with the principle of proportionality, those limitations must be necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.
83 More specifically, derogations from and limitations on the protection of personal data should apply only in so far as is strictly necessary, it being understood that where there is a choice between several measures appropriate to meeting the legitimate objectives pursued, recourse must be had to the least onerous. In addition, an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure at issue, by properly balancing the objective of general interest against the rights concerned, in order to ensure that the disadvantages caused by that measure are not disproportionate to the aims pursued. Thus, the question whether a limitation on the rights guaranteed in Articles 7 and 8 of the Charter can be justified must be assessed by measuring the seriousness of the interference which such a limitation entails and by verifying that the importance of the objective of general interest pursued by that limitation is proportionate to that seriousness (judgment of 22 November 2022, Luxembourg Business Registers, C‑37/20 and C‑601/20, EU:C:2022:912, paragraph 64 and the case-law cited).
84 Accordingly, in order to ascertain whether, in the present case, the interference with the rights guaranteed in Articles 7 and 8 of the Charter resulting from the obligation to include two fingerprints in the storage medium of identity cards, provided for in Article 3(5) of Regulation 2019/1157, comply with the principle of proportionality, it is necessary to examine, first, whether that measure pursues one or more objectives of general interest recognised by the European Union and is actually appropriate for attaining those objectives, second, whether the resulting interferences are limited to what is strictly necessary, in the sense that those objectives could not reasonably be achieved in an equally effective manner by other means less prejudicial to those fundamental rights of the data subjects, and, third, whether those interferences are not disproportionate to the objectives, which implies, in particular, a balancing of those objectives and the seriousness of those interferences (see, to that effect, judgments of 22 November 2022, Luxembourg Business Registers, C‑37/20 and C‑601/20, EU:C:2022:912, paragraph 66, and of 8 December 2022, Orde van Vlaamse Balies and Others, C‑694/20, EU:C:2022:963, paragraph 42).
106 The assessment of the seriousness of the interference caused by a limitation on the rights guaranteed in Articles 7 and 8 of the Charter entails account being taken of the nature of the personal data concerned, in particular whether those data may be sensitive, as well as of the nature and specific arrangements for the processing of the data, in particular the number of persons who have access to those data and the arrangements for access to them. Where appropriate, account must also be taken of the existence of measures intended to prevent those data being the subject of unlawful processing.
107 In the present case, it is true that the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter resulting from Regulation 2019/1157 is capable of affecting a large number of persons, the Commission in its impact assessment having evaluated that number at 370 million of the then 440 million citizens of the European Union. Fingerprints, as biometric data, are by their nature particularly sensitive and, as is apparent in particular from recital 51 of the GDPR, enjoy specific protection under EU law.
111 Accordingly, as regards, first, data collection, Article 10(1) and (2) of Regulation 2019/1157 states that biometric identifiers are to be collected ‘solely by qualified and duly authorised staff’ and that those staff must comply with ‘appropriate and effective procedures for the collection of biometric identifiers’, since those procedures must observe the rights and principles set out in the Charter, the Convention for the Protection of Human Rights and Fundamental Freedoms and the United Nations Convention on the Rights of the Child. In addition, as has been pointed out in paragraph 93 of the present judgment, Article 3(7) of that regulation contains special rules for children under the age of 12 years (first and second subparagraphs) and for persons in respect of whom fingerprinting is physically impossible (third subparagraph), those persons being ‘exempt from the requirement to give fingerprints’.
