Legal provisions of COM(2024)316 - Strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement
Please note
This page contains a limited version of this dossier in the EU Monitor.
| dossier | COM(2024)316 - Strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their ... |
|---|---|
| document | COM(2024)316  |
| date | July 23, 2024 |
Chapter I
Subject matter, scope and definitions
Contents
- Article 1 - Subject matter
- Article 2 - Scope
- Article 3 - Security standards/format/specifications
- Article 4 - Period of validity
- Article 5 - Phasing out
- Article 6 - Minimum information to be indicated
- Article 7 - Uniform format
- Article 8 - Phasing out of existing residence cards
- Article 9 - Contact point
- Article 10 - Collection of biometric identifiers
- Article 11 - Protection of personal data and liability
- Article 12 - Monitoring
- Article 13 - Evaluation
- Article 14 - Additional technical specifications
- Article 15 - Committee procedure
- Article 16 - Entry into force
Article 1 - Subject matter
Article 2 - Scope
(a)identity cards issued by Member States to their own nationals as referred to in Article 4(3) of Directive 2004/38/EC;
(b)registration certificates issued in accordance with Article 8 of Directive 2004/38/EC to Union citizens residing for more than three months in a host Member State and documents certifying permanent residence issued in accordance with Article 19 of Directive 2004/38/EC to Union citizens upon application;
(c)residence cards issued in accordance with Article 10 of Directive 2004/38/EC to family members of Union citizens who are not nationals of a Member State and permanent residence cards issued in accordance with Article 20 of Directive 2004/38/EC to family members of Union citizens who are not nationals of a Member State.
This Regulation shall not apply to identification documents issued on a provisional basis with a period of validity of less than six months.
Chapter II
National identity cards
Article 3 - Security standards/format/specifications
2. The data elements included on identity cards shall comply with the specifications set out in part 5 of ICAO document 9303.
By way of derogation from the first subparagraph, the document number may be inserted in zone I and the designation of a person’s gender shall be optional.
3. The document shall bear the title ‘Identity card’ or another well-established national designation in the official language or languages of the issuing Member State, and the words ‘Identity card’ in at least one other official language of the Union.
4. The identity card shall contain, on the front side, the two-letter country code of the Member State issuing the card, printed in negative in a blue rectangle and encircled by 12 yellow stars.
5. Identity cards shall include a highly secure storage medium which shall contain a facial image of the holder of the card and two fingerprints in interoperable digital formats. For the capture of biometric identifiers, Member States shall apply the technical specifications as established by Commission Implementing Decision C(2018) 7767 33 as amended by Commission Implementing Decision C(2021) 3726 34 .
6. The storage medium shall have sufficient capacity and capability to guarantee the integrity, the authenticity and the confidentiality of the data. The data stored shall be accessible in contactless form and secured as provided for in Implementing Decision C(2018) 7767 as amended by Implementing Decision C(2021) 3726. Member States shall exchange the information necessary to authenticate the storage medium and to access and verify the biometric data referred to in paragraph 5.
7. Children under the age of 12 years may be exempt from the requirement to give fingerprints.
Children under the age of 6 years shall be exempt from the requirement to give fingerprints.
Persons in respect of whom fingerprinting is physically impossible shall be exempt from the requirement to give fingerprints.
8. When necessary and proportionate to the aim to be achieved, Member States may enter such details and observations for national use as may be required in accordance with national law. The efficiency of minimum security standards and the cross-border compatibility of identity cards shall not be diminished as a result.
9. Where Member States incorporate a dual interface or a separate storage medium in the identity card, the additional storage medium shall comply with the relevant ISO standards and shall not interfere with the storage medium referred to in paragraph 5.
10. Where Member States store data for electronic services such as e-government and e-business in the identity cards, such national data shall be physically or logically separated from the biometric data referred to in paragraph 5.
11. Where Member States add additional security features to identity cards, the cross-border compatibility of such identity cards and the efficiency of the minimum security standards shall not be diminished as a result.
Article 4 - Period of validity
2. By way of derogation from paragraph 1, Member States may provide for a period of validity of:
(a)less than five years, for identity cards issued to minors;
(b)in exceptional cases, less than five years, for identity cards issued to persons in special and limited circumstances and where their period of validity is limited in compliance with Union and national law;
(c)more than 10 years, for identity cards issued to persons aged 70 and above.
3. Member States shall issue an identity card having a validity of 12 months or less where it is temporarily physically impossible to take fingerprints of any of the fingers of the applicant.
Article 5 - Phasing out
2. By way of derogation from paragraph 1:
(a)identity cards which do not meet the minimum security standards set out in part 2 of ICAO document 9303 or which do not include a functional MRZ, as defined in paragraph 3, shall cease to be valid at their expiry or by 3 August 2026, whichever is earlier;
(b)identity cards of persons aged 70 and above at 2 August 2021, which meet the minimum security standards set out in part 2 of ICAO document 9303 and which have a functional MRZ, as defined in paragraph 3, shall cease to be valid at their expiry.
3. For the purpose of paragraph 2, a functional MRZ shall mean any of the following:
(a)a machine-readable zone compliant with ICAO document 9303;
(b)any other machine-readable zone for which the issuing Member State notifies the rules required for reading and displaying the information contained therein.
Chapter III
Residence documents for Union citizens
Article 6 - Minimum information to be indicated
(a)the title of the document in the official language or languages of the Member State concerned and in at least one other official language of the Union;
(b)a clear reference that the document is issued to a Union citizen in accordance with Directive 2004/38/EC;
(c)the document number;
(d)the name (surname and forename(s)) of the holder;
(e)the date of birth of the holder;
(f)the information to be included on registration certificates and documents certifying permanent residence, issued in accordance with Articles 8 and 19 of Directive 2004/38/EC, respectively;
(g)the issuing authority;
(h)on the front-side, the two-letter country code of the Member State issuing the document, printed in negative in a blue rectangle and encircled by twelve yellow stars.
If a Member State decides to take fingerprints, Article 3(7) shall apply accordingly.
Chapter IV
Residence cards for family members who are not nationals of a Member State
Article 7 - Uniform format
2. By way of derogation from paragraph 1, a card shall bear the title ‘Residence card’ or ‘Permanent residence card’. Member States shall indicate that these documents are issued to a family member of a Union citizen in accordance with Directive 2004/38/EC. For this purpose, Member States shall use the standardised code ‘Family Member EU Art 10 DIR 2004/38/EC’ or ‘Family Member EU Art 20 DIR 2004/38/EC’, in data field , as referred to in the Annex to Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954.
3. Member States may enter data for national use in accordance with national law. When entering and storing such data, Member States shall respect the requirements set out in Article 4, second paragraph, of Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954.
Article 8 - Phasing out of existing residence cards
2. By way of derogation from paragraph 1, residence cards of family members of Union citizens who are not nationals of a Member State which do not meet the minimum security standards set out in part 2 of ICAO document 9303 or which do not include a functional MRZ compliant with part 3 of ICAO document 9303 shall be invalid.
Chapter V
Common provisions
Article 9 - Contact point
2. Member States shall ensure that the contact points are aware of relevant information and assistance services at Union level included in the Single Digital Gateway set out in Regulation (EU) 2018/1724 of the European Parliament and of the Council 35 and that they are able to cooperate with such services.
Article 10 - Collection of biometric identifiers
With a view to ensuring the consistency of biometric identifiers with the identity of the applicant, the applicant shall appear in person at least once during the issuance process for each application.
2. Member States shall ensure that appropriate and effective procedures for the collection of biometric identifiers are in place and that those procedures comply with the rights and principles set out in the Charter, the Convention for the Protection of Human Rights and Fundamental Freedoms and the United Nations Convention on the Rights of the Child.
Where difficulties are encountered in the collection of biometric identifiers, Member States shall ensure that appropriate procedures are in place to respect the dignity of the person concerned.
3. Other than where required for the purpose of processing in accordance with Union and national law, biometric identifiers stored for the purpose of personalisation of identity cards or residence documents shall be kept in a highly secure manner and only until the date of collection of the document and, in any case, no longer than 90 days from the date of issue. After this period, these biometric identifiers shall be immediately erased or destroyed.
Article 11 - Protection of personal data and liability
2. For the purpose of this Regulation, the authorities responsible for issuing identity cards and residence documents shall be considered as the controller referred to in Article 4(7) of Regulation (EU) 2016/679 and shall have responsibility for the processing of personal data.
3. Member States shall ensure that supervisory authorities can fully exercise their tasks as referred to in Regulation (EU) 2016/679, including access to all personal data and all necessary information as well as access to any premises or data processing equipment of the competent authorities.
4. Cooperation with external service providers shall not exclude any liability on the part of a Member State which may arise under Union or national law in respect of breaches of obligations with regard to personal data.
5. Information in machine-readable form shall only be included in an identity card or residence document in accordance with this Regulation and the national law of the issuing Member State.
6. Biometric data stored in the storage medium of identity cards and residence documents shall only be used in accordance with Union and national law for the purpose of verifying:
(a)the authenticity of the identity card or residence document;
(b)the identity of the holder by means of directly available comparable features where the identity card or residence document is required to be produced by law.
The two fingerprints stored in the storage medium shall only be accessed by duly authorised staff of competent national authorities and Union agencies.
Article 12 - Monitoring
2. The monitoring programme shall set out the means by which and the intervals at which the data and other necessary evidence are to be collected. It shall specify the action to be taken by the Commission and by Member States in collecting and analysing the data and other evidence.
3. Member States shall provide the Commission with the data and other evidence necessary for such monitoring.
Article 13 - Evaluation
(a)the impact of this Regulation on fundamental rights;
(b)the mobility of Union citizens;
(c)the effectiveness of biometric verification in ensuring the security of travel documents;
(d)a possible further visual harmonisation of identity cards.
2. Member States and relevant Union agencies shall provide the Commission with the information necessary for the preparation of these reports.
Article 14 - Additional technical specifications
(a)additional security features and requirements, including enhanced anti-forgery, counterfeiting and falsification standards;
(b)technical specifications for the storage medium of the biometric features referred to in Article 3(5) and their security, including prevention of unauthorised access and facilitation of validation;
(c)requirements for quality and common technical standards for the facial image and the fingerprints.
Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 15(2).
2. In accordance with the procedure referred to in Article 15(2), it may be decided that the specifications referred to in this Article are to be secret and are not to be published. In such a case, they shall be made available only to the bodies designated by the Member States as responsible for printing and to persons duly authorised by a Member State or by the Commission.
3. Each Member State shall designate one body having responsibility for printing identity cards, and one body having responsibility for printing residence cards of family members of Union citizens, and shall communicate the names of such bodies to the Commission and to the other Member States. Member States shall be entitled to change such designated bodies and shall inform the Commission and the other Member States accordingly.
Member States may also decide to designate a single body having responsibility for printing both identity cards and residence cards of family members of Union citizens and shall communicate the name of this body to the Commission and to the other Member States.
Two or more Member States may also decide to designate a single body for those purposes and shall inform the Commission and the other Member States accordingly.
Article 15 - Committee procedure
2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where the committee does not deliver an opinion, the Commission shall not adopt the draft implementing act and Article 5(4), third subparagraph, of Regulation (EU) No 182/2011 shall apply.
Article 16 - Entry into force
This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.