Highest Court in the European Union To Rule On Biometrics PrivacyCourts are investigating the legality of a European Union regulation requiring biometric passports in Europe. Last month, the Dutch Council of State (Raad van State, the highest Dutch administrative court) asked the European Court of Justice (ECJ) to decide if the regulation requiring fingerprints in passports and travel documents violates citizens right to privacy. The case entered the courts when three Dutch citizens were denied passports and another citizen was denied an ID card for refusing to provide their fingerprints. The ECJ ruling will play an important role in determining the legality of including biometrics in passports and travel documents in the European Union. The Netherlands has mandated fingerprints in passports and ID-cards since 2009. The Dutch biometric Passport Act is the misshapen offspring of the European Regulation (read here and here) compelling security features and biometrics in passports. The Regulation mandates that passports include two fingerprints taken flat in interoperable formats. The Amsterdam-based Privacy First Foundation (Stichting Privacy First) appreciates the critical stance on biometrics taken by the Dutch Council of State in line with the position taken by a German court. We hope the ECJ will soon rule that the European Passport Regulation is invalid both in a formal, procedural sense (having been improperly adopted in 2004) and in a material sense (violating the human right to privacy and data protection). In the meantime, we hope the Dutch Parliament will scrap compulsory fingerprinting for Dutch ID cards as soon as possible. A government proposal to this effect is currently before the Dutch House of Representatives. The Dutch Council concerns echo questions raised by a German court earlier this year regarding the legality of the German biometric passports with RFID chips. The German court has questioned whether the EU regulation is compatible with the Charter of Fundamental Rights of the European Union (EU Charter) and the European Convention of Human Rights (ECHR). The German case was preempted when a German citizen, Michael Schwarz, refused to provide his fingerprints to obtain his new passport and the City of Bochum decided not to issue him one. Mr. Schwarz argued that the regulation infringes privacy as protected under the ECHR and the EU Charter. In this case, the German court argued that the European Union has no legislative competence to enact rules on standards for security features and biometrics in passports as there is no direct relation of such rules to the protection and security of EU external frontiers. The German court decided that the requirement of biometric data in passports is a serious infringement on privacy, arguing that the measure does not satisfy the proportionality test of being appropriate, necessary, or reasonable. The German court outlined in detail the technical limitations of biometric passports, arguing that (paraphrased): a biometric passport is not an appropriate measure because of the rate of mistakes which are made at border controls. Another problem is the durability of the RFID chips inside the passports, and their susceptibility to being read by people who have no legal authority to read them. If the goal of the measure is to prevent terrorist attacks, then these biometric passports are suitable only to a very limited degree. The primary problem is the security risk that arises from the use of real passports that incorporate a fraudulently obtained identity. In 2008, the European Court of Human Rights issued a landmark judgment on biometric privacy. In S. and Marper v. the United Kingdom, the Court held that the long-term retention of both fingerprints and DNA samples interfered with an individuals right to privacy and, consequently, found a breach of Article 8 of the ECHR. The fingerprints and DNA samples were collected following the arrest of the complainants and retained even after their release, even though the complainants had asked for the destruction of the samples. European countries are increasingly collecting and storing citizens biometric data. Throughout the world, countries are beginning to implement contactless RFID chips in passports or mandatory national biometric ID cards. Other countries, such as the Netherlands, have implemented database storage. Last year, an alliance of more than 80 civil society organizations including EFF requested the Council of Europes (CoE) Secretary General to start an in-depth investigation on the collection and storage of biometric data by Member States. EFF will continue to fight against the collection and storage of mandatory ID biometrics by governments, especially in view of its inherent unreliability and the new threats to privacy and security posed by such technology. Resources: linkwithin_text=Related Articles: 