Show us your fingerprints and we tell you who you are – the CJEU has made its decision

On 21 March 2024, the Court of Justice of the European Union (CJEU) decided on the issue of two mandatory fingerprints for identity cards. The case originated in Wiesbaden, where a German man appealed to the national court against the decision of the state capital Wiesbaden to reject his application for an identity card without fingerprints. The dispute went all the way to the CJEU, where the German court asked the EU’s highest judicial body to examine the validity of EU Regulation 2019/1157, which imposes an obligation to include two fingerprints in the data storage of identity cards.

After examination, the CJEU concluded that although the obligation to include two full fingerprints in the data storage of identity cards restricts the fundamental right to privacy and the protection of personal data guaranteed by the Charter of Fundamental Rights of the European Union, the requirement does help to combat identity fraud and identity theft. Therefore, this type of obligation is not disproportionate to these objectives, as the measure to insert two fingerprints can contribute to the protection of the privacy of the EU citizens concerned. Other positive aspects of the fingerprinting obligation have been argued by the CJEU, such as its contribution to the fight against crime and terrorism and the fact that it allows EU citizens to be identified in a reliable way, thus ensuring their right to move and reside freely. Furthermore, the CJEU also argued that the introduction of reinforced security standards should provide sufficient guarantees to public authorities and private entities to enable them to rely on the authenticity of identity cards when used by EU citizens for identification purposes.

In the CJEU's view, the exclusive use of a facial image is not sufficient for full and effective identification, given the circumstances that affect a person's facial image and facial anatomy over time, including disease, signs of aging, and other plastic or surgical procedures that may occur.

Finally, the CJEU found that Regulation (EU) 2019/1157 was adopted on the wrong legal basis. This meant opting for the ordinary legislative procedure instead of the special legislative procedure, which required a unanimous decision of the Council. Accordingly, in its judgment, the CJEU declared the regulation invalid, maintaining its effects until the entry into force of a new regulation based on the appropriate legal basis within a reasonable period of time, but no later than 31 December 2026.