State Council: storing fingerprints in databases unlawful

Storage of fingerprints violates right to privacy

Following the Hague Court of Appeal, the Council of State has judged today that the municipal ("decentralised") storage of fingerprints under the Passport Act is unlawful for violating the right to privacy. The Council of State reached this opinion in seven administrative law cases brought by individual citizens (supported by Civil Rights Association Vrijbit). In early 2014, the Court of Appeal of The Hague already came to a similar opinion in the civil Passport lawsuit filed by Privacy First Foundation and 19 (other) citizens. However, our Passport lawsuit was subsequently declared inadmissible by the Supreme Court and referred to the administrative court. Privacy First then submitted the complete civil litigation file to the Council of State to strengthen the passport cases pending there. As the highest administrative court, the Council of State is now ruling in a similar manner to earlier Court of Appeal in The Hague. Despite the subsequent inadmissibility at the Supreme Court, the ban on storing everyone's fingerprints in databases thus once again stands firm.

Deficient judgment and litigation

However, as with the earlier decision of the Court of Appeal in The Hague, Privacy First regrets that the Council of State did not want to declare the storage unlawful on purely principled grounds (namely for lack of social necessity, proportionality and subsidiarity), but 'only' on the basis of technical unsoundness. Privacy First will therefore advise affected citizens to continue litigating towards the European Court of Human Rights (ECHR) in Strasbourg. After all, based on existing Strasbourg case law, there is a good chance that the Netherlands will then still be condemned in principle for violation of the right to privacy (art. 8 ECHR). In addition, Privacy First expects a Strasbourg conviction for violation of the right to access to justice and an effective remedy (art. 6 and 13 ECHR). Indeed, civil litigation against the Passport Act proved impossible, and administrative law was only indirectly possible after rejection of an individual application for a new passport or identity card (due to refusal of fingerprinting). As a result, to achieve the current "victory" at the Council of State, the citizens concerned had to go through life without a passport or identity card for years, with all the problems and risks involved.

Exception for conscientious objectors

The Council of State today also ruled that the mandatory taking of two fingerprints for a new passport applies equally to everyone and that no exceptions can be made for people who do not want to give fingerprints due to conscientious objections. Privacy First doubts that this judgment of the Council of State will stand up in Strasbourg. After all, besides violation of the right to privacy, this also seems to violate freedom of conscience (art. 9 ECHR). The fact that the European Passport Regulation contains no such exception is irrelevant in this context, as this regulation is subordinate to the ECHR.

RFID chips and facial scans

Privacy First regrets that the Council of State did not want to critically assess the risks of remotely readable RFID chips (containing sensitive personal data) in passports and identity cards. The same applies to the mandatory storage of facial scans in municipal databases. These aspects will also be open to challenge in Strasbourg.

Own responsibility of municipalities

The bright spot in the State Council's opinion on ID cards is mainly that municipalities and mayors have a own responsibility have to independently comply with human rights (including the right to privacy), even if this means that to do so they must independently disapply national legislation due to conflict with higher international or European law: 

"In so far as the mayor argues that there is no possibility for him to deviate from the provisions of [national legislation], the [Council of State] considers that, pursuant to Article 94 of the Constitution, statutory provisions applicable within the Kingdom shall not be applied if such application is incompatible with universally binding provisions of treaties and of decisions of international organisations." (Source, para 6.)

This judgment of the Council of State applies in all areas and could have far-reaching consequences in the future.

Free new identity card

It follows from the judgment of the Council of State that, since 2009, fingerprints have been taken (and stored) en masse when applying for identity cards without a valid legal basis. Privacy First therefore advises anyone who has an identity card with fingerprints to exchange it (if desired) with his/her municipality for a new one free of charge without fingerprints. Should municipalities refuse to offer this service, Privacy First reserves the right to take further legal action to this end.

Click HERE For the press release of the Council of State, also published on Rechtspraak.nl (with reference to the full statements). Click HERE For an initial reaction from Privacy First at RTL News. See also the news item from NRC Handelsblad.