Legal provisions of COM(2018)212 - Strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and family members exercising their right of free movement

Please note

This page contains a limited version of this dossier in the EU Monitor.

dossier COM(2018)212 - Strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and ...
document COM(2018)212 EN
date June 20, 2019

Contents

CHAPTER I - SUBJECT MATTER, SCOPE AND DEFINITIONS


Article 1

Subject matter

This Regulation strengthens the security standards applicable to identity cards issued by Member States to their nationals and to residence documents issued by Member States to Union citizens and their family members when exercising their right to free movement.

Article 2 - Scope

This Regulation applies to:

(a)identity cards issued by Member States to their own nationals as referred to in Article 4(3) of Directive 2004/38/EC;

This Regulation shall not apply to identification documents issued on a provisional basis with a period of validity of less than six months.

(b)registration certificates issued in accordance with Article 8 of Directive 2004/38/EC to Union citizens residing for more than three months in a host Member State and documents certifying permanent residence issued in accordance with Article 19 of Directive 2004/38/EC to Union citizens upon application;

(c)residence cards issued in accordance with Article 10 of Directive 2004/38/EC to family members of Union citizens who are not nationals of a Member State and permanent residence cards issued in accordance with Article 20 of Directive 2004/38/EC to family members of Union citizens who are not nationals of a Member State.

CHAPTER II - NATIONAL IDENTITY CARDS

Article 3 - Security standards/format/specifications

1. Identity cards issued by Member States shall be produced in ID-1 format and shall contain a machine-readable zone (MRZ). Such identity cards shall be based on the specifications and minimum security standards set out in ICAO Document 9303 and shall comply with the requirements set out in points (c), (d), (f) and (g) of the Annex to Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954.

2. The data elements included on identity cards shall comply with the specifications set out in part 5 of ICAO document 9303.

By way of derogation from the first subparagraph, the document number may be inserted in zone I and the designation of a person's gender shall be optional.

3. The document shall bear the title ‘Identity card’ or another well-established national designation in the official language or languages of the issuing Member State, and the words ‘Identity card’ in at least one other official language of the institutions of the Union.

4. The identity card shall contain, on the front side, the two-letter country code of the Member State issuing the card, printed in negative in a blue rectangle and encircled by 12 yellow stars.

5. Identity cards shall include a highly secure storage medium which shall contain a facial image of the holder of the card and two fingerprints in interoperable digital formats. For the capture of biometric identifiers, Member States shall apply the technical specifications as established by Commission Implementing Decision C(2018) 7767 (13).

6. The storage medium shall have sufficient capacity and capability to guarantee the integrity, the authenticity and the confidentiality of the data. The data stored shall be accessible in contactless form and secured as provided for in Implementing Decision C(2018) 7767. Member States shall exchange the information necessary to authenticate the storage medium and to access and verify the biometric data referred to in paragraph 5.

7. Children under the age of 12 years may be exempt from the requirement to give fingerprints.

Children under the age of 6 years shall be exempt from the requirement to give fingerprints.

Persons in respect of whom fingerprinting is physically impossible shall be exempt from the requirement to give fingerprints.

8. When necessary and proportionate to the aim to be achieved, Member States may enter such details and observations for national use as may be required in accordance with national law. The efficiency of minimum security standards and the cross-border compatibility of identity cards shall not be diminished as a result.

9. Where Member States incorporate a dual interface or a separate storage medium in the identity card, the additional storage medium shall comply with the relevant ISO standards and shall not interfere with the storage medium referred to in paragraph 5.

10. Where Member States store data for electronic services such as e-government and e-business in the identity cards, such national data shall be physically or logically separated from the biometric data referred to in paragraph 5.

11. Where Member States add additional security features to identity cards, the cross-border compatibility of such identity cards and the efficiency of the minimum security standards shall not be diminished as a result.

Article 4 - Period of validity

1. Identity cards shall have a minimum period of validity of five years and a maximum period of validity of ten years.

2. By way of derogation from paragraph 1, Member States may provide for a period of validity of:

(a)less than five years, for identity cards issued to minors;

(b)in exceptional cases, less than five years, for identity cards issued to persons in special and limited circumstances and where their period of validity is limited in compliance with Union and national law;

(c)more than 10 years, for identity cards issued to persons aged 70 and above.

3. Member States shall issue an identity card having a validity of 12 months or less where it is temporarily physically impossible to take fingerprints of any of the fingers of the applicant.

Article 5 - Phasing out

1. Identity cards which do not meet the requirements set out in Article 3 shall cease to be valid at their expiry or by 3 August 2031, whichever is earlier.

2. By way of derogation from paragraph 1:

(a)identity cards which do not meet the minimum security standards set out in part 2 of ICAO document 9303 or which do not include a functional MRZ, as defined in paragraph 3, shall cease to be valid at their expiry or by 3 August 2026, whichever is earlier;

(b)identity cards of persons aged 70 and above at 2 August 2021, which meet the minimum security standards set out in part 2 of ICAO document 9303 and which have a functional MRZ, as defined in paragraph 3, shall cease to be valid at their expiry.

3. For the purpose of paragraph 2, a functional MRZ shall mean:

(a)a machine-readable zone compliant with part 3 of ICAO document 9303; or

(b)any other machine-readable zone for which the issuing Member State notifies the rules required for reading and displaying the information contained therein, unless a Member State notifies the Commission, by 2 August 2021, of its lack of capacity to read and display this information.

Upon receipt of a notification as referred to in point (b) of the first subparagraph, the Commission shall inform the Member State concerned and the Council accordingly.

CHAPTER III - RESIDENCE DOCUMENTS FOR UNION CITIZENS

Article 6 - Minimum information to be indicated

Residence documents when issued by Member States to Union citizens, shall indicate at a minimum the following:

(a)the title of the document in the official language or languages of the Member State concerned and in at least one other official language of the institutions of the Union;

(b)a clear reference that the document is issued to a Union citizen in accordance with Directive 2004/38/EC;

(c)the document number;

(d)the name (surname and forename(s)) of the holder;

(e)the date of birth of the holder;

(f)the information to be included on registration certificates and documents certifying permanent residence, issued in accordance with Articles 8 and 19 of Directive 2004/38/EC, respectively;

(g)the issuing authority;

(h)on the front-side, the two-letter country code of the Member State issuing the document, printed in negative in a blue rectangle and encircled by twelve yellow stars.

If a Member State decides to take fingerprints, Article 3(7) shall apply accordingly.

Persons in respect of whom fingerprinting is physically impossible shall be exempt from the requirement to give fingerprints.

CHAPTER IV - RESIDENCE CARDS FOR FAMILY MEMBERS WHO ARE NOT NATIONALS OF A MEMBER STATE

Article 7 - Uniform format

1. When issuing residence cards to family members of Union citizens who are not nationals of a Member State, Member States shall use the same format as established by Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954, and as implemented by Implementing Decision C(2018) 7767.

2. By way of derogation from paragraph 1, a card shall bear the title ‘Residence card’ or ‘Permanent residence card’. Member States shall indicate that these documents are issued to a family member of a Union citizen in accordance with Directive 2004/38/EC. For this purpose, Member States shall use the standardised code ‘Family Member EU Art 10 DIR 2004/38/EC’ or ‘Family Member EU Art 20 DIR 2004/38/EC’, in data field , as referred to in the Annex to Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954.

3. Member States may enter data for national use in accordance with national law. When entering and storing such data, Member States shall respect the requirements set out in the second paragraph of Article 4 of Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954.

Article 8 - Phasing out of existing residence cards

1. Residence cards of family members of Union citizens who are not nationals of a Member State, which do not meet the requirements of Article 7 shall cease to be valid at their expiry or by 3 August 2026, whichever is earlier.

2. By way of derogation from paragraph 1, residence cards of family members of Union citizens who are not nationals of a Member State, which do not meet the minimum security standards set out in part 2 of ICAO document 9303 or which do not include a functional MRZ compliant with part 3 of ICAO document 9303, shall cease to be valid at their expiry or by 3 August 2023, whichever is earlier.

CHAPTER V - COMMON PROVISIONS

Article 9 - Contact point

1. Each Member State shall designate at least one central authority as a contact point for the implementation of this Regulation. Where a Member State has designated more than one central authority, it shall designate which of those authorities will be the contact point for the implementation of this Regulation. It shall communicate the name of that authority to the Commission and the other Member States. If a Member State changes its designated authority, it shall inform the Commission and the other Member States accordingly.

2. Member States shall ensure that the contact points are aware of relevant information and assistance services at Union level included in the Single Digital Gateway set out in Regulation (EU) 2018/1724 of the European Parliament and of the Council (14) and that they are able to cooperate with such services.

Article 10 - Collection of biometric identifiers

1. The biometric identifiers shall be collected solely by qualified and duly authorised staff designated by the authorities responsible for issuing identity cards or residence cards, for the purpose of being integrated into the highly secure storage medium provided for in Article 3(5) for identity cards and in Article 7(1) for residence cards. By way of derogation from the first sentence, fingerprints shall be collected solely by qualified and duly authorised staff of such authorities, except in the case of applications submitted to the diplomatic and consular authorities of the Member State.

With a view to ensuring the consistency of biometric identifiers with the identity of the applicant, the applicant shall appear in person at least once during the issuance process for each application.

2. Member States shall ensure that appropriate and effective procedures for the collection of biometric identifiers are in place and that those procedures comply with the rights and principles set out in the Charter, the Convention for the Protection of Human Rights and Fundamental Freedoms and the United Nations Convention on the Rights of the Child.

Where difficulties are encountered in the collection of biometric identifiers, Member States shall ensure that appropriate procedures are in place to respect the dignity of the person concerned.

3. Other than where required for the purpose of processing in accordance with Union and national law, biometric identifiers stored for the purpose of personalisation of identity cards or residence documents shall be kept in a highly secure manner and only until the date of collection of the document and, in any case, no longer than 90 days from the date of issue. After this period, these biometric identifiers shall be immediately erased or destroyed.

Article 11 - Protection of personal data and liability

1. Without prejudice to Regulation (EU) 2016/679, Member States shall ensure the security, integrity, authenticity and confidentiality of the data collected and stored for the purpose of this Regulation.

2. For the purpose of this Regulation, the authorities responsible for issuing identity cards and residence documents shall be considered as the controller referred to in Article 4(7) of Regulation (EU) 2016/679 and shall have responsibility for the processing of personal data.

3. Member States shall ensure that supervisory authorities can fully exercise their tasks as referred to in Regulation (EU) 2016/679, including access to all personal data and all necessary information as well as access to any premises or data processing equipment of the competent authorities.

4. Cooperation with external service providers shall not exclude any liability on the part of a Member State which may arise under Union or national law in respect of breaches of obligations with regard to personal data.

5. Information in machine-readable form shall only be included in an identity card or residence document in accordance with this Regulation and the national law of the issuing Member State.

6. Biometric data stored in the storage medium of identity cards and residence documents shall only be used in accordance with Union and national law, by the duly authorised staff of competent national authorities and Union agencies, for the purpose of verifying:

(a)the authenticity of the identity card or residence document;

(b)the identity of the holder by means of directly available comparable features where the identity card or residence document is required to be produced by law.

7. Member States shall maintain, and communicate annually to the Commission, a list of the competent authorities with access to the biometric data stored on the storage medium referred to in Article 3(5) of this Regulation. The Commission shall publish online a compilation of such national lists.

Article 12 - Monitoring

By 2 August 2020, the Commission shall establish a detailed programme for monitoring the outputs, results and impact of this Regulation, including its impact on fundamental rights.

The monitoring programme shall set out the means by which and the intervals at which the data and other necessary evidence are to be collected. It shall specify the action to be taken by the Commission and by Member States in collecting and analysing the data and other evidence.

Member States shall provide the Commission with the data and other evidence necessary for such monitoring.

Article 13 - Reporting and Evaluation

1. Two years, and 11 years, respectively, after the date of application of this Regulation, the Commission shall report to the European Parliament, to the Council and to the European Economic and Social Committee on its implementation, in particular on the protection of fundamental rights and personal data.

2. Six years after the date of application of this Regulation, and every subsequent six years, the Commission shall carry out an evaluation of this Regulation and present a report on the main findings to the European Parliament, to the Council and to the European Economic and Social Committee. The report shall in particular focus on:

(a)the impact of this Regulation on fundamental rights;

(b)the mobility of Union citizens;

(c)the effectiveness of biometric verification in ensuring the security of travel documents;

(d)a possible use of residence cards as travel documents;

(e)a possible further visual harmonisation of identity cards;

(f)the necessity of introducing common security features of identification documents used on a provisional basis in view of their better recognition.

3. Member States and relevant Union agencies shall provide the Commission with the information necessary for the preparation of these reports.

Article 14 - Additional technical specifications

1. In order to ensure, where appropriate, that identity cards and residence documents referred to in points (a) and (c) of Article 2 comply with future minimum security standards, the Commission shall establish, by means of implementing acts, additional technical specifications, relating to the following:

(a)additional security features and requirements, including enhanced anti-forgery, counterfeiting and falsification standards;

(b)technical specifications for the storage medium of the biometric features referred to in Article 3(5) and their security, including prevention of unauthorised access and facilitation of validation;

(c)requirements for quality and common technical standards for the facial image and the fingerprints.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 15(2).

2. In accordance with the procedure referred to in Article 15(2), it may be decided that the specifications referred to in this Article are to be secret and are not to be published. In such a case, they shall be made available only to the bodies designated by the Member States as responsible for printing and to persons duly authorised by a Member State or by the Commission.

3. Each Member State shall designate one body having responsibility for printing identity cards, and one body having responsibility for printing residence cards of family members of Union citizens, and shall communicate the names of such bodies to the Commission and to the other Member States. Member States shall be entitled to change such designated bodies and shall inform the Commission and the other Member States accordingly.

Member States may also decide to designate a single body having responsibility for printing both identity cards and residence cards of family members of Union citizens and shall communicate the name of this body to the Commission and to the other Member States.

Two or more Member States may also decide to designate a single body for those purposes and shall inform the Commission and the other Member States accordingly.

Article 15 - Committee procedure

1. The Commission shall be assisted by the Committee established by Article 6 of Regulation (EC) No 1683/95. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the committee does not deliver an opinion, the Commission shall not adopt the draft implementing act and the third subparagraph of Article 5(4) of Regulation (EU) No 182/2011 shall apply.

Article 16 - Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 2 August 2021.

This Regulation shall be binding in its entirety and directly applicable in all Member States.