EU court leaves ruling on fingerprint storage to national courts

Today, the European Court of Justice (EU Court) in Luxembourg issued a long-awaited ruling in four Dutch cases concerning the storage of fingerprints under the Dutch Passport Act. The EU Court did so at the request of the Dutch Council of State. The EU Court ruled that the storage of fingerprints in databases falls outside the scope of the European Passport Regulation. The Court thus leaves judicial review of such storage to national courts and the European Court of Human Rights.

Reason for the ruling

In the four Dutch cases citizens had refused to give up their fingerprints (and facial scans) when applying for a new passport or identity card. For this reason, they were denied a new passport or identity card. Their subsequent court cases on this ended up at the Council of State in 2012, which subsequently decided to ask the EU Court for clarification of relevant European legislation (European Passport Regulation) before ruling on the cases itself. The EU Court subsequently ruled in a similar German case in 2013 (Schwarz case) that the obligation to provide fingerprints under the Passport Regulation was not unlawful. However, there was no thorough review by the EU Court of the privacy law requirements of necessity and proportionality in this German case. Moreover, the EU Court refused to merge the Dutch (more thoroughly argued) cases with the German case, although the Council of State had expressly requested this. The EU Court's ruling in the German case then presented the Council of State (and 300 million European citizens) with a disappointing fait accompli. During the court hearing at the end of 2014 in the Dutch cases at the EU Court, new arguments and new factual evidence proved to fall on deaf ears: the EU Court did not want to revisit the German case and appeared uninterested in the now-proven lack of necessity and proportionality of fingerprint capture (low passport fraud statistics) and the huge error rates in biometric fingerprint verification (25-30%). In this sense, the current EU Court ruling unfortunately does not surprise Privacy First Foundation.

Bright spot: fingerprint-free ID card

The only bright spot in the EU Court's ruling is the confirmation that national identity cards do not fall under the scope of the European Passport Regulation. The Dutch State seems to have already anticipated this Court ruling by abolishing fingerprinting for identity cards as of 20 January 2014. In this sense, the EU Court's ruling does not change the current situation, but it does confirm that the introduction of a "fingerprint-free" ID card in early 2014 was the right choice of the Dutch government. Incidentally, most other European member states have never had fingerprint ID cards; indeed, under the European Passport Regulation, mandatory fingerprinting only applied to passports. That the Netherlands wished to go further than the rest of Europe in the 2009-2014 period was therefore at the Netherlands' own risk.

EU court leaves judgment on database storage to national courts and European Court of Human Rights

The EU Court in Luxembourg rules that any storage and use of fingerprints in databases does not fall within the scope of the European Passport Regulation and leaves the review of such storage to national courts and the European Court of Human Rights in Strasbourg. However, in the various (more than a dozen) individual cases brought so far in the Netherlands against the Passport Act, the administrative courts have so far ruled that such review is beyond their jurisdiction, as the relevant provisions of the Passport Act have not (yet) entered into force. It is now up to the Council of State to rule on this issue. At the same time, the Supreme Court is currently considering the collective civil law Passport Trial of Privacy First and 19 co-plaintiffs (citizens) in which such review has already been successfully conducted by the Court of Appeal of The Hague and is now before the Supreme Court. In February 2014, the Hague Court of Appeal correctly ruled that central storage of fingerprints violates the right to privacy. In that sense, Privacy First's case follows the line of the EU Court: review of database storage by national courts, possibly followed by the European Court of Human Rights. The current individual cases at the Council of State may soon continue at the European Court of Human Rights. Privacy First hopes that this complex interplay between different judges will eventually produce the desired privacy result: abolishing the collection and storage of fingerprints for passports!

Read HERE The full EU court ruling.

Update 17 April 2015: Unfortunately, the EU court ruling yesterday led to a lot of misleading coverage via the ANP (see for example HERE at the Volkskrant). Better is Comment at SOLV Lawyers, this English-language commentary by Prof Steve Peers and the comment below by the Telegraph today:

"Cheeky thing.

A database of fingerprints given off when applying for a passport seems to have moved a step closer. This could be inferred from a European Court of Justice ruling.

The Council of State had asked judges in Luxembourg for an opinion in four cases of citizens who refused to give up their fingerprints. They were denied passports and appealed. In a similar German case, the court earlier ruled that mandatory fingerprinting is not unlawful under European law.

In the Dutch case, the Court ruled yesterday that the storage of fingerprints is a Member State competence. The national courts must therefore review it. The Netherlands was the only member state that wanted a central register of fingerprints; a file that would even be accessible to the secret services. The Passport Act regulating this has not yet entered into force, and last year the court in The Hague ruled that central storage violates the right to privacy.

Research shows that such a database carries numerous risks, ranging from security leaks to improper use and criminal manipulation. This makes it certain that this whole system is a monstrosity that should never be introduced."   Source: Telegraph 17 April 2015, p. 2.