Posted on April 25, 2015 by ALISON KNIGHT
…But side-steps the bigger issue about the compatibility of possible secondary use and storage of such biometric data with privacy and data protection law
With the development of biometric technology and its expanding use in the public and the private sector, privacy and security concerns are increasingly growing and formal guidance correspondingly sought on the legal rules that govern them. On 16 April, the Court of Justice of the European Union (CJEU) issued its preliminary ruling in Willems and Others v Burgemeester van Nuth and Others C-446-12 to C-449/12 in this area. The case concerned the interpretation of an EU Regulation (2252/2004, ‘the Regulation’) on standards for security features and biometrics in passports and travel documents issued by Member States (subsequently amended by Regulation (EC) No 444/2009). More details about the Regulation, and why it was introduced as a counter-terrorism measure, can be found here.
The referral request to the CJEU in this case was made by a Dutch court adjudicating on similar claims by Dutch nationals who had made passport or identity card applications. In each case, the individual in question has refused to provide biometrics (digital fingerprints and a facial image) and the Dutch authority had refused their applications as a result. The claims alleged that the creation and storing of their biometric data by the authority constituted a breach of the individuals’ physical integrity and right to privacy. In particular, the claimants alleged that there are no provisions clearly identifying the persons who will have access to biometric data and, in the future, the authorities might use biometric data for purposes other than those for which it was provided to them (e.g. for use by the intelligence and security services). This likelihood was portrayed in the context of concern that the biometric data would be stored on a centralised, and potentially non-secure, database.
The first question referred related to Article 1(3) of the Regulation, which states that the Regulation “applies to passports and travel documents issued by Member States” but not to “identity cards issued by Member States to their nationals or to temporary passports and travel documents having a validity of 12 months or less”. It was asked whether Article 1(3) must be interpreted as meaning that it does not apply to identity cards, such as the Netherlands identity cards, issued by Member States to their nationals, regardless of their period of validity and regardless of the possibilities of using them as travel documents? (In other words, the point here is that such identity cards may be used as passports for travel within the EU.) The CJEU responded by confirming that the Regulation does not apply to identity cards.
The second, more contentious, question asks about the interpretation Member States should give to Article 4(3) of the Regulation. This states as follows: “For the purposes of the Regulation, the biometric features in passports and travel documents should only be used for verifying (a) the authenticity of the document; and (b) the identity of the holder by means of directly available comparable features when the passport or other travel documents are required to be produced by law”. In particular, the CJEU was asked to consider whether Article 4(3) must be interpreted as meaning that, when the Member States give effect to the Regulation, there should be a statutory guarantee that the biometric data collected and stored pursuant to that regulation may not be collected, processed and used for any purposes other than the issuing of the document concerned? The added twist was that this question was framed from the perspective that Article 4(3) be read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’, Articles 7 and 8), the European Convention on Human Rights (‘the ECHR’, Article 8(2)), and the Data Protection Directive (‘the DP Directive’, Articles 6(1)(b) and 7(f) read in conjunction).
The CJEU ruled that the Regulation only governs the use of data for its specified purposes. Thus, it answered that that the Regulation does not require Member States to legislate to provide guarantees that biometric data could not be used for purposes other than those set out within it. In other words, the setting up or maintaining storage of biometric data by national institutions is a matter of domestic law (albeit that it might fall within the scope of EU law privacy and data protection if such rights are triggered for consideration by national courts).
In explaining its decision, the CJEU refers first to its 2013 decision in Michael Schwarz v Stadt Bochum [2013] EUECJ C-291/12 in response to a preliminary referral from a German court concerning the application of the Directive to the Regulation. In that judgement, the CJEU held that the requirement of a passport-issuing national authority for fingerprints to be submitted and stored on passports (in addition to photographs) was compatible with the Charter and the DP Directive. In particular, interference with privacy rights and the processing of personal data involved was justified on the basis that it was for a legitimate (security-related) public interest and the storage/use measures were proportionate to this interest. For example, the CJEU referred to the fact that the Regulation provided that the fingerprints could only be used to verify identity and that there would be no centralised database storing fingerprints. The CJEU also elucidated that, although fingerprint technology may be subject to fraud, this risk is justified because the technology is sufficiently effective and the taking of fingerprints is less invasive than an iris scan (and no more intrusive than having an official photograph taken).
What is most interesting about this decision is its omission. The CJEU found that there was no need to rule on the applicability or otherwise of the Charter, the ECHR, or the DP Directive to domestic law on the storage and use of biometric data for secondary purposes. Yet, this was exactly the issue that it appears the referring court was asking for guidance on!
This decision seems like a wasted opportunity by the Court to provide guidance on a crucial area of legal dispute and concern by citizens worried about state infringement of civil liberties. As there was no CJEU Advocate General’s Opinion in this case, outstanding questions on this topic to formally guide national courts may only be addressed fully upon another preliminary reference to the CJEU in the future.
In the meantime, provisions within the draft General Data Protection Regulation (the final text of which is currently under negotiation between the European Council and the European Parliament) underline the importance of the law’s role in ensuring the proportionate storage and use of biometric data, and its effective protection from misuse. These are the inclusion of a definition for “biometric data” (Article 4(11)) and recognition that processing such data presents “specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes” in respect of which the controller or the processor must carry out a data protection impact assessment (Article 33).
The EU Article 29 Working party has also produced a working document on biometrics (12168/02/EN) which raises particular concerns about systems using biometric data that can be collected without the data subject’s awareness, as well as an opinion on facial recognition in online and mobile services (WP192). A useful summary of the impact of data protection legislation on biometric data and systems is contained within a new white paper, entitled ‘The Impact of Privacy and Data Protection Legislation on Biometric Authentication’ published by market research firm, Goode Intelligence. It can be found here.
Even without the CJEU’s guidance, it is clear that those using biometric data must consider carefully their data protection obligations and put in place safeguards to ensure that biometrics are not used for non-legitimate purposes. Let’s hope EU case law catches up soon…
Alison Knight
