{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-61-22-62022cj0061","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-61-22-62022cj0061)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-23","fingerprint":"ewai:eu:b67bfc","proof":"sha256:0ec71192b62226bfdb7593459497fbcd92857038f92f16a22b236fa4dc562409","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-61-22-62022cj0061","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62022CJ0061","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Grand Chamber)","paragraphs":[]},{"title":"21 March 2024 (\n *1\n )","paragraphs":["para_4","para_5","para_6"]},{"title":"RL","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27","para_28","para_29","para_30","para_31","para_32","para_33"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_36"]},{"title":"2","paragraphs":["para_38"]},{"title":"I.   Legal context","paragraphs":[]},{"title":"A.   European Union law","paragraphs":[]},{"title":"1.\n  \n Regulation 2019/1157","paragraphs":[]},{"title":"3","paragraphs":["para_43","para_44","para_45"]},{"title":"(2)","paragraphs":["para_47","para_48"]},{"title":"(4)","paragraphs":["para_50"]},{"title":"(5)","paragraphs":["para_52","para_53"]},{"title":"(17)","paragraphs":["para_55"]},{"title":"(18)","paragraphs":["para_57"]},{"title":"(19)","paragraphs":["para_59"]},{"title":"(20)","paragraphs":["para_61"]},{"title":"(21)","paragraphs":["para_63","para_64"]},{"title":"(23)","paragraphs":["para_66","para_67"]},{"title":"(26)","paragraphs":["para_69"]},{"title":"(27)","paragraphs":["para_71"]},{"title":"(28)","paragraphs":["para_73"]},{"title":"(29)","paragraphs":["para_75","para_76"]},{"title":"(32)","paragraphs":["para_78"]},{"title":"(33)","paragraphs":["para_80","para_81"]},{"title":"(36)","paragraphs":["para_83","para_84"]},{"title":"(40)","paragraphs":["para_86"]},{"title":"(41)","paragraphs":["para_88"]},{"title":"(42)","paragraphs":["para_90","para_91"]},{"title":"(46)","paragraphs":["para_93"]},{"title":"4","paragraphs":[]},{"title":"Article 1 of Regulation 2019/1157, which is entitled ‘Subject matter’, provides:","paragraphs":["para_96"]},{"title":"5","paragraphs":[]},{"title":"Article 2 of that regulation, which is entitled ‘Scope’, provides:","paragraphs":["para_99"]},{"title":"(a)","paragraphs":["para_101","para_102"]},{"title":"(b)","paragraphs":["para_104"]},{"title":"(c)","paragraphs":["para_106"]},{"title":"6","paragraphs":["para_108","para_109","para_110","para_111","para_112","para_113","para_114","para_115"]},{"title":"7","paragraphs":[]},{"title":"Article 5 of that regulation, which is entitled ‘Phasing out’ provides as follows:","paragraphs":["para_118"]},{"title":"2.   By way of derogation from paragraph 1:","paragraphs":[]},{"title":"(a)","paragraphs":["para_121","para_122"]},{"title":"3.   For the purpose of paragraph 2, a functional MRZ shall mean:","paragraphs":[]},{"title":"(a)","paragraphs":["para_125"]},{"title":"(b)","paragraphs":["para_127","para_128"]},{"title":"8","paragraphs":["para_130","para_131","para_132"]},{"title":"(f)","paragraphs":["para_134","para_135"]},{"title":"9","paragraphs":["para_137","para_138","para_139","para_140","para_141","para_142"]},{"title":"10","paragraphs":["para_144","para_145","para_146","para_147"]},{"title":"(a)","paragraphs":["para_149"]},{"title":"(b)","paragraphs":["para_151"]},{"title":"11","paragraphs":["para_153","para_154"]},{"title":"(a)","paragraphs":["para_156"]},{"title":"(b)","paragraphs":["para_158"]},{"title":"(c)","paragraphs":["para_160","para_161","para_162"]},{"title":"2.\n  \n The GDPR","paragraphs":[]},{"title":"12","paragraphs":[]},{"title":"Recital 51 of the GDPR states:","paragraphs":["para_166"]},{"title":"13","paragraphs":[]},{"title":"Article 4 of that regulation, which is entitled ‘Definitions’, is worded as follows:","paragraphs":["para_169","para_170"]},{"title":"(2)","paragraphs":["para_172","para_173"]},{"title":"(7)","paragraphs":["para_175","para_176"]},{"title":"14","paragraphs":["para_178","para_179"]},{"title":"15","paragraphs":["para_181","para_182","para_183","para_184"]},{"title":"(a)","paragraphs":["para_186"]},{"title":"(b)","paragraphs":["para_188"]},{"title":"(c)","paragraphs":["para_190","para_191","para_192"]},{"title":"3.\n  \n Regulation (EU) 2016/399","paragraphs":[]},{"title":"16","paragraphs":["para_195","para_196","para_197","para_198"]},{"title":"(a)","paragraphs":["para_200"]},{"title":"(b)","paragraphs":["para_202","para_203","para_204"]},{"title":"4.\n  \n Directive 2004/38","paragraphs":[]},{"title":"17","paragraphs":["para_207","para_208","para_209","para_210"]},{"title":"18","paragraphs":["para_212","para_213"]},{"title":"No entry visa or equivalent formality may be imposed on Union citizens.’","paragraphs":[]},{"title":"19","paragraphs":["para_216","para_217","para_218"]},{"title":"20","paragraphs":["para_220","para_221","para_222"]},{"title":"3.   For the registration certificate to be issued, Member States may only require that","paragraphs":["para_224","para_225","para_226","para_227","para_228","para_229"]},{"title":"5.\n  \n The Interinstitutional Agreement","paragraphs":[]},{"title":"21","paragraphs":["para_232","para_233","para_234","para_235","para_236","para_237","para_238"]},{"title":"B.   German law","paragraphs":[]},{"title":"22","paragraphs":["para_241","para_242"]},{"title":"23","paragraphs":[]},{"title":"Paragraph 6 of the PAuswG, provides in subparagraphs 1 and 2 thereof as follows:","paragraphs":["para_245","para_246"]},{"title":"24","paragraphs":["para_248","para_249"]},{"title":"25","paragraphs":["para_251","para_252","para_253"]},{"title":"26","paragraphs":["para_255"]},{"title":"27","paragraphs":["para_257"]},{"title":"28","paragraphs":["para_259"]},{"title":"29","paragraphs":["para_261"]},{"title":"30","paragraphs":["para_263"]},{"title":"31","paragraphs":["para_265"]},{"title":"32","paragraphs":["para_267"]},{"title":"33","paragraphs":["para_269"]},{"title":"34","paragraphs":["para_271"]},{"title":"35","paragraphs":["para_273"]},{"title":"36","paragraphs":["para_275"]},{"title":"37","paragraphs":["para_277"]},{"title":"38","paragraphs":["para_279"]},{"title":"39","paragraphs":["para_281"]},{"title":"40","paragraphs":["para_283"]},{"title":"41","paragraphs":["para_285"]},{"title":"42","paragraphs":["para_287","para_288"]},{"title":"(a)","paragraphs":[]},{"title":"Article 77(3) TFEU","paragraphs":[]},{"title":"(b)","paragraphs":["para_292"]},{"title":"(c)","paragraphs":[]},{"title":"Article 35(10) of the [GDPR]","paragraphs":["para_295"]},{"title":"III.   Consideration of the question referred","paragraphs":[]},{"title":"43","paragraphs":["para_298"]},{"title":"A.   The first ground of invalidity: incorrect legal basis","paragraphs":[]},{"title":"44","paragraphs":["para_301"]},{"title":"1.\n  \n Preliminary observations","paragraphs":[]},{"title":"45","paragraphs":["para_304"]},{"title":"46","paragraphs":["para_306"]},{"title":"47","paragraphs":["para_308"]},{"title":"2.\n  \n The respective scopes of Article 21(2) TFEU and Article 77(3) TFEU","paragraphs":[]},{"title":"48","paragraphs":["para_311"]},{"title":"49","paragraphs":["para_313"]},{"title":"50","paragraphs":["para_315"]},{"title":"51","paragraphs":["para_317"]},{"title":"52","paragraphs":["para_319"]},{"title":"53","paragraphs":["para_321"]},{"title":"54","paragraphs":["para_323"]},{"title":"55","paragraphs":["para_325"]},{"title":"56","paragraphs":["para_327"]},{"title":"3.\n  \n The purpose or the main or predominant component of Regulation 2019/1157","paragraphs":[]},{"title":"57","paragraphs":["para_330"]},{"title":"58","paragraphs":["para_332"]},{"title":"59","paragraphs":["para_334"]},{"title":"60","paragraphs":["para_336"]},{"title":"61","paragraphs":["para_338"]},{"title":"62","paragraphs":["para_340"]},{"title":"63","paragraphs":["para_342"]},{"title":"B.   The second ground of invalidity: failure to comply with Article 35(10) of the GDPR","paragraphs":[]},{"title":"64","paragraphs":["para_345"]},{"title":"65","paragraphs":["para_347"]},{"title":"66","paragraphs":["para_349"]},{"title":"67","paragraphs":["para_351"]},{"title":"68","paragraphs":["para_353","para_354"]},{"title":"69","paragraphs":["para_356"]},{"title":"1.\n  \n Whether there is a limitation","paragraphs":[]},{"title":"70","paragraphs":["para_359"]},{"title":"71","paragraphs":["para_361"]},{"title":"72","paragraphs":["para_363"]},{"title":"73","paragraphs":["para_365"]},{"title":"74","paragraphs":["para_367"]},{"title":"2.\n  \n The justification for the limitation","paragraphs":[]},{"title":"75","paragraphs":["para_370"]},{"title":"76","paragraphs":["para_372"]},{"title":"(a)\n  \n Whether the principle of legality has been complied with","paragraphs":[]},{"title":"77","paragraphs":["para_375"]},{"title":"78","paragraphs":["para_377"]},{"title":"79","paragraphs":["para_379","para_380"]},{"title":"80","paragraphs":["para_382"]},{"title":"81","paragraphs":["para_384"]},{"title":"(c)\n  \n Whether the principle of proportionality has been complied with","paragraphs":[]},{"title":"82","paragraphs":["para_387"]},{"title":"83","paragraphs":["para_389"]},{"title":"84","paragraphs":["para_391","para_392"]},{"title":"(i)   Whether the objectives pursued by the measure at issue are of general interest","paragraphs":[]},{"title":"85","paragraphs":["para_395"]},{"title":"86","paragraphs":["para_397"]},{"title":"87","paragraphs":["para_399"]},{"title":"88","paragraphs":["para_401","para_402"]},{"title":"89","paragraphs":["para_404"]},{"title":"90","paragraphs":["para_406"]},{"title":"91","paragraphs":["para_408"]},{"title":"92","paragraphs":["para_410"]},{"title":"93","paragraphs":["para_412"]},{"title":"94","paragraphs":["para_414"]},{"title":"95","paragraphs":["para_416"]},{"title":"96","paragraphs":["para_418"]},{"title":"97","paragraphs":["para_420","para_421"]},{"title":"98","paragraphs":["para_423"]},{"title":"99","paragraphs":["para_425"]},{"title":"100","paragraphs":["para_427"]},{"title":"101","paragraphs":["para_429"]},{"title":"102","paragraphs":["para_431"]},{"title":"103","paragraphs":["para_433"]},{"title":"104","paragraphs":["para_435"]},{"title":"105","paragraphs":["para_437","para_438","para_439"]},{"title":"106","paragraphs":["para_441"]},{"title":"107","paragraphs":["para_443"]},{"title":"108","paragraphs":["para_445"]},{"title":"109","paragraphs":["para_447"]},{"title":"110","paragraphs":["para_449"]},{"title":"111","paragraphs":["para_451"]},{"title":"112","paragraphs":["para_453"]},{"title":"113","paragraphs":["para_455"]},{"title":"114","paragraphs":["para_457"]},{"title":"115","paragraphs":["para_459"]},{"title":"116","paragraphs":["para_461"]},{"title":"117","paragraphs":["para_463"]},{"title":"118","paragraphs":["para_465"]},{"title":"(ii)   The significance of the objectives pursued","paragraphs":[]},{"title":"119","paragraphs":["para_468"]},{"title":"120","paragraphs":["para_470"]},{"title":"121","paragraphs":["para_472"]},{"title":"122","paragraphs":["para_474"]},{"title":"(iii)   Balancing","paragraphs":[]},{"title":"123","paragraphs":["para_477"]},{"title":"124","paragraphs":["para_479"]},{"title":"125","paragraphs":["para_481"]},{"title":"IV.   Maintaining the effects of Regulation 2019/1157 for a certain time","paragraphs":[]},{"title":"126","paragraphs":["para_484"]},{"title":"127","paragraphs":["para_486"]},{"title":"128","paragraphs":["para_488"]},{"title":"V.   Costs","paragraphs":[]},{"title":"129","paragraphs":["para_491"]},{"title":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraphs":["para_493","para_494","para_495","para_496","para_497","para_498"]}],"paragraphs":[{"text":"62022CJ0061","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Grand Chamber)","paragraph_id":"para_2"},{"text":"21 March 2024 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Regulation (EU) 2019/1157 – Strengthening the security of identity cards of EU citizens – Validity – Legal basis – Article 21(2) TFEU – Article 77(3) TFEU – Regulation (EU) 2019/1157 – Article 3(5) – Obligation for Member States to include two fingerprints in in …","paragraph_id":"para_4"},{"text":"In Case C‑61/22,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany), made by decision of 13 January 2022, received at the Court on 1 February 2022, in the proceedings","paragraph_id":"para_6"},{"text":"RL","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"Landeshauptstadt Wiesbaden,","paragraph_id":"para_9"},{"text":"THE COURT (Grand Chamber),","paragraph_id":"para_10"},{"text":"composed of K. Lenaerts, President, L. Bay Larsen, Vice-President, A. Arabadjiev, A. Prechal, E. Regan (Rapporteur), T. von Danwitz, F. Biltgen and Z. Csehi, Presidents of Chambers, J.-C. Bonichot, S. Rodin, D. Gratsias, M.L. Arastey Sahún and M. Gavalec, Judges,","paragraph_id":"para_11"},{"text":"Advocate General: L. Medina,","paragraph_id":"para_12"},{"text":"Registrar: D. Dittert, Head of Unit,","paragraph_id":"para_13"},{"text":"having regard to the written procedure and further to the hearing on 14 March 2023,","paragraph_id":"para_14"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_15"},{"text":"–","paragraph_id":"para_16"},{"text":"RL, by W. Achelpöhler, Rechtsanwalt,","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"the German Government, by J. Möller and P.-L. Krüger, acting as Agents,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"the Belgian Government, by P. Cottin and A. Van Baelen, acting as Agents, and by P. Wytinck, advocaat,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the Spanish Government, by L. Aguilera Ruiz, acting as Agent,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"the Polish Government, by B. Majczyna, acting as Agent,","paragraph_id":"para_25"},{"text":"–","paragraph_id":"para_26"},{"text":"the European Parliament, by G.C. Bartram, P. López-Carceller and J. Rodrigues, acting as Agents,","paragraph_id":"para_27"},{"text":"–","paragraph_id":"para_28"},{"text":"the Council of the European Union, by M. França and Z. Šustr, acting as Agents,","paragraph_id":"para_29"},{"text":"–","paragraph_id":"para_30"},{"text":"the European Commission, by H. Kranenborg, E. Montaguti and I. Zaloguin, acting as Agents,","paragraph_id":"para_31"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 29 June 2023,","paragraph_id":"para_32"},{"text":"gives the following","paragraph_id":"para_33"},{"text":"Judgment","paragraph_id":"para_34"},{"text":"1","paragraph_id":"para_35"},{"text":"The request for a preliminary ruling concerns the validity of Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement ( OJ 2019 L 188, p. 67 ) and, in particular, Article 3(5) thereof.","paragraph_id":"para_36"},{"text":"2","paragraph_id":"para_37"},{"text":"The request has been made in proceedings between RL and the Landeshauptstadt Wiesbaden (City of Wiesbaden, Land capital, Germany) (‘the City of Wiesbaden’) concerning the rejection by the latter of RL’s application for an identity card which does not include RL’s fingerprints.","paragraph_id":"para_38"},{"text":"I.   Legal context","paragraph_id":"para_39"},{"text":"A.   European Union law","paragraph_id":"para_40"},{"text":"1.\n  \n Regulation 2019/1157","paragraph_id":"para_41"},{"text":"3","paragraph_id":"para_42"},{"text":"Recitals 1, 2, 4, 5, 17 to 21, 23, 26 to 29, 32, 33, 36, 40 to 42 and 46 of Regulation 2019/1157 are worded as follows:","paragraph_id":"para_43"},{"text":"‘(1)","paragraph_id":"para_44"},{"text":"The Treaty [on European Union (TEU)] resolved to facilitate the free movement of persons while ensuring the safety and security of the peoples of Europe, by establishing an area of freedom, security and justice, in accordance with the provisions of the TEU and of the [TFEU].","paragraph_id":"para_45"},{"text":"(2)","paragraph_id":"para_46"},{"text":"Citizenship of the [European] Union confers on every citizen of the Union the right of free movement, subject to certain limitations and conditions. Directive 2004/38/EC of the European Parliament and of the Council [of 29 April 2004 on the right of citizens of the Union and their family members to …","paragraph_id":"para_47"},{"text":"…","paragraph_id":"para_48"},{"text":"(4)","paragraph_id":"para_49"},{"text":"Directive [2004/38] provides that Member States may adopt the necessary measures to refuse, terminate or withdraw any right conferred by that Directive in the case of abuse of rights or fraud. Document forgery or false presentation of a material fact concerning the conditions attached to the right of residence have been identified as typical cases of fraud under that Directive.","paragraph_id":"para_50"},{"text":"(5)","paragraph_id":"para_51"},{"text":"Considerable differences exist between the security levels of national identity cards issued by Member States and residence permits for Union nationals residing in another Member State and their family members. Those differences increase the risk of falsification and document fraud and also give ris …","paragraph_id":"para_52"},{"text":"…","paragraph_id":"para_53"},{"text":"(17)","paragraph_id":"para_54"},{"text":"Security features are necessary to verify if a document is authentic and to establish the identity of a person. The establishment of minimum security standards and the integration of biometric data in identity cards and in residence cards of family members who are not nationals of a Member State are …","paragraph_id":"para_55"},{"text":"(18)","paragraph_id":"para_56"},{"text":"The storage of a facial image and two fingerprints (“biometric data”) on identity and residence cards, as already provided for in respect of biometric passports and residence permits for third-country nationals, represents an appropriate combination of reliable identification and authentication with a reduced risk of fraud, for the purpose of strengthening the security of identity and residence cards.","paragraph_id":"para_57"},{"text":"(19)","paragraph_id":"para_58"},{"text":"As a general practice, Member States should, for the verification of the authenticity of the document and the identity of the holder, primarily verify the facial image and, where necessary to confirm without doubt the authenticity of the document and the identity of the holder, Member States should also verify the fingerprints.","paragraph_id":"para_59"},{"text":"(20)","paragraph_id":"para_60"},{"text":"Members States should ensure that, in cases where a verification of biometric data does not confirm the authenticity of the document or the identity of its holder, a compulsory manual check is carried out by qualified staff.","paragraph_id":"para_61"},{"text":"(21)","paragraph_id":"para_62"},{"text":"This Regulation does not provide a legal basis for setting up or maintaining databases at national level for the storage of biometric data in Member States, which is a matter of national law that needs to comply with Union law regarding data protection. Moreover, this Regulation does not provide a legal basis for setting up or maintaining a centralised database at Union level.","paragraph_id":"para_63"},{"text":"…","paragraph_id":"para_64"},{"text":"(23)","paragraph_id":"para_65"},{"text":"The specifications of ICAO [International Civil Aviation Organization] Document 9303 which ensure global interoperability including in relation to machine readability and use of visual inspection should be taken into account for the purpose of this Regulation.","paragraph_id":"para_66"},{"text":"…","paragraph_id":"para_67"},{"text":"(26)","paragraph_id":"para_68"},{"text":"Member States should ensure that appropriate and effective procedures for the collection of biometric identifiers are in place and that such procedures comply with the rights and principles set out in the Charter, the Convention for the Protection of Human Rights and Fundamental Freedoms of the Coun …","paragraph_id":"para_69"},{"text":"(27)","paragraph_id":"para_70"},{"text":"Where difficulties are encountered in the collection of biometric identifiers, Member States should ensure that appropriate procedures are in place to respect the dignity of the person concerned. Therefore, specific considerations relating to gender, and to the specific needs of children and of vulnerable persons should be taken into account.","paragraph_id":"para_71"},{"text":"(28)","paragraph_id":"para_72"},{"text":"The introduction of minimum security and format standards for identity cards should allow Member States to rely on the authenticity of those documents when Union citizens exercise their right of free movement. The introduction of reinforced security standards should provide sufficient guarantees to public authorities and private entities to enable them to rely on the authenticity of identity cards when used by Union citizens for identification purposes.","paragraph_id":"para_73"},{"text":"(29)","paragraph_id":"para_74"},{"text":"A distinguishing sign in the form of the two-letter country code of the Member State issuing the document, printed in negative in a blue rectangle and encircled by 12 yellow stars, facilitates the visual inspection of the document, in particular when the holder is exercising the right of free movement.","paragraph_id":"para_75"},{"text":"…","paragraph_id":"para_76"},{"text":"(32)","paragraph_id":"para_77"},{"text":"Member States should take all necessary steps to ensure that biometric data correctly identify the person to whom an identity card is issued. To this end, Member States could consider collecting biometric identifiers, particularly the facial image, by means of live enrolment by the national authorities issuing identity cards.","paragraph_id":"para_78"},{"text":"(33)","paragraph_id":"para_79"},{"text":"Member States should exchange with each other such information as is necessary to access, authenticate and verify the information contained on the secure storage medium. The formats used for the secure storage medium should be interoperable, including in respect of automated border crossing points.","paragraph_id":"para_80"},{"text":"…","paragraph_id":"para_81"},{"text":"(36)","paragraph_id":"para_82"},{"text":"Residence documents issued to citizens of the Union should include specific information to ensure that they are identified as such in all Member States. This should facilitate the recognition of the Union citizen’s use of the right of free movement and of the rights inherent to this use, but harmoni …","paragraph_id":"para_83"},{"text":"…","paragraph_id":"para_84"},{"text":"(40)","paragraph_id":"para_85"},{"text":"Regulation (EU) 2016/679 of the European Parliament and of the Council [of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ 2016 L 119, p …","paragraph_id":"para_86"},{"text":"(41)","paragraph_id":"para_87"},{"text":"Member States should be responsible for the proper processing of biometric data, from collection to integration of the data on the highly secure storage medium, in accordance with [the GDPR].","paragraph_id":"para_88"},{"text":"(42)","paragraph_id":"para_89"},{"text":"Member States should exercise particular caution when cooperating with an external service provider. Such cooperation should not exclude any liability of the Member States arising under Union or national law for breaches of obligations with regard to personal data.","paragraph_id":"para_90"},{"text":"…","paragraph_id":"para_91"},{"text":"(46)","paragraph_id":"para_92"},{"text":"Since the objectives of this Regulation, namely to enhance security and to facilitate the exercise of the rights of free movement by Union citizens and their family members cannot be sufficiently achieved by the Member States but can rather, by reason of the scale and effects of the action, be bette …","paragraph_id":"para_93"},{"text":"4","paragraph_id":"para_94"},{"text":"Article 1 of Regulation 2019/1157, which is entitled ‘Subject matter’, provides:","paragraph_id":"para_95"},{"text":"‘This Regulation strengthens the security standards applicable to identity cards issued by Member States to their nationals and to residence documents issued by Member States to Union citizens and their family members when exercising their right to free movement.’","paragraph_id":"para_96"},{"text":"5","paragraph_id":"para_97"},{"text":"Article 2 of that regulation, which is entitled ‘Scope’, provides:","paragraph_id":"para_98"},{"text":"‘This Regulation applies to:","paragraph_id":"para_99"},{"text":"(a)","paragraph_id":"para_100"},{"text":"identity cards issued by Member States to their own nationals as referred to in Article 4(3) of Directive [2004/38];","paragraph_id":"para_101"},{"text":"This Regulation shall not apply to identification documents issued on a provisional basis with a period of validity of less than six months.","paragraph_id":"para_102"},{"text":"(b)","paragraph_id":"para_103"},{"text":"registration certificates issued in accordance with Article 8 of Directive [2004/38] to Union citizens residing for more than three months in a host Member State and documents certifying permanent residence issued in accordance with Article 19 of Directive [2004/38] to Union citizens upon application;","paragraph_id":"para_104"},{"text":"(c)","paragraph_id":"para_105"},{"text":"residence cards issued in accordance with Article 10 of Directive [2004/38] to family members of Union citizens who are not nationals of a Member State and permanent residence cards issued in accordance with Article 20 of Directive [2004/38] to family members of Union citizens who are not nationals of a Member State.’","paragraph_id":"para_106"},{"text":"6","paragraph_id":"para_107"},{"text":"Article 3 of that regulation, which is entitled ‘Security standards/format/specifications’, provides, in paragraphs 5 to 7 and 10 thereof:","paragraph_id":"para_108"},{"text":"‘5.   Identity cards shall include a highly secure storage medium which shall contain a facial image of the holder of the card and two fingerprints in interoperable digital formats. For the capture of biometric identifiers, Member States shall apply the technical specifications established by Commis …","paragraph_id":"para_109"},{"text":"6.   The storage medium shall have sufficient capacity and capability to guarantee the integrity, the authenticity and the confidentiality of the data. The data stored shall be accessible in contactless form and secured as provided for in Implementing Decision C(2018) 7767. Member States shall exchange the information necessary to authenticate the storage medium and to access and verify the biometric data referred to in paragraph 5.","paragraph_id":"para_110"},{"text":"7.   Children under the age of 12 years may be exempt from the requirement to give fingerprints.","paragraph_id":"para_111"},{"text":"Children under the age of 6 years shall be exempt from the requirement to give fingerprints.","paragraph_id":"para_112"},{"text":"Persons in respect of whom fingerprinting is physically impossible shall be exempt from the requirement to give fingerprints.","paragraph_id":"para_113"},{"text":"…","paragraph_id":"para_114"},{"text":"10.   Where Member States store data for electronic services such as e-government and e-business in the identity cards, such national data shall be physically or logically separated from the biometric data referred to in paragraph 5.’","paragraph_id":"para_115"},{"text":"7","paragraph_id":"para_116"},{"text":"Article 5 of that regulation, which is entitled ‘Phasing out’ provides as follows:","paragraph_id":"para_117"},{"text":"‘1.   Identity cards which do not meet the requirements set out in Article 3 shall cease to be valid at their expiry or by 3 August 2031, whichever is earlier.","paragraph_id":"para_118"},{"text":"2.   By way of derogation from paragraph 1:","paragraph_id":"para_119"},{"text":"(a)","paragraph_id":"para_120"},{"text":"Identity cards which … do not include a functional MRZ, as defined in paragraph 3, shall cease to be valid at their expiry or by 3 August 2026, whichever is earlier.","paragraph_id":"para_121"},{"text":"…","paragraph_id":"para_122"},{"text":"3.   For the purpose of paragraph 2, a functional MRZ shall mean:","paragraph_id":"para_123"},{"text":"(a)","paragraph_id":"para_124"},{"text":"a machine-readable zone compliant with part 3 of ICAO document 9303; or","paragraph_id":"para_125"},{"text":"(b)","paragraph_id":"para_126"},{"text":"any other machine-readable zone for which the issuing Member State notifies the rules required for reading and displaying the information contained therein, unless a Member State notifies the [European] Commission, by 2 August 2021, of its lack of capacity to read and display this information.","paragraph_id":"para_127"},{"text":"…’","paragraph_id":"para_128"},{"text":"8","paragraph_id":"para_129"},{"text":"The first paragraph of Article 6 of Regulation 2019/1157, which is entitled ‘Minimum information to be indicated’, provides as follows:","paragraph_id":"para_130"},{"text":"‘Residence documents when issued by Member States to Union citizens, shall indicate at a minimum the following:","paragraph_id":"para_131"},{"text":"…","paragraph_id":"para_132"},{"text":"(f)","paragraph_id":"para_133"},{"text":"the information to be included on registration certificates and documents certifying permanent residence, issued in accordance with Articles 8 and 19 of Directive [2004/38], respectively;","paragraph_id":"para_134"},{"text":"…’","paragraph_id":"para_135"},{"text":"9","paragraph_id":"para_136"},{"text":"Article 10 of Regulation 2019/1157, which is entitled ‘Collection of biometric identifiers’, provides:","paragraph_id":"para_137"},{"text":"‘1.   The biometric identifiers shall be collected solely by qualified and duly authorised staff designated by the authorities responsible for issuing identity cards or residence cards, for the purpose of being integrated into the highly secure storage medium provided for in Article 3(5) for identit …","paragraph_id":"para_138"},{"text":"With a view to ensuring the consistency of biometric identifiers with the identity of the applicant, the applicant shall appear in person at least once during the issuance process for each application.","paragraph_id":"para_139"},{"text":"2.   Member States shall ensure that appropriate and effective procedures for the collection of biometric identifiers are in place and that those procedures comply with the rights and principles set out in the Charter, the Convention for the Protection of Human Rights and Fundamental Freedoms and the United Nations Convention on the Rights of the Child.","paragraph_id":"para_140"},{"text":"Where difficulties are encountered in the collection of biometric identifiers, Member States shall ensure that appropriate procedures are in place to respect the dignity of the person concerned.","paragraph_id":"para_141"},{"text":"3.   Other than where required for the purpose of processing in accordance with Union and national law, biometric identifiers stored for the purpose of personalisation of identity cards or residence documents shall be kept in a highly secure manner and only until the date of collection of the document and, in any case, no longer than 90 days from the date of issue. After this period, these biometric identifiers shall be immediately erased or destroyed.’","paragraph_id":"para_142"},{"text":"10","paragraph_id":"para_143"},{"text":"Article 11 of that regulation, which is entitled ‘Protection of personal data and liability’, provides in paragraphs 4 and 6 thereof as follows:","paragraph_id":"para_144"},{"text":"‘4.   Cooperation with external service providers shall not exclude any liability on the part of a Member State which may arise under Union or national law in respect of breaches of obligations with regard to personal data.","paragraph_id":"para_145"},{"text":"…","paragraph_id":"para_146"},{"text":"6.   Biometric data stored in the storage medium of identity cards and residence documents shall only be used in accordance with Union and national law, by the duly authorised staff of competent national authorities and Union agencies, for the purpose of verifying:","paragraph_id":"para_147"},{"text":"(a)","paragraph_id":"para_148"},{"text":"the authenticity of the identity card or residence document;","paragraph_id":"para_149"},{"text":"(b)","paragraph_id":"para_150"},{"text":"the identity of the holder by means of directly available comparable features where the identity card or residence document is required to be produced by law.’","paragraph_id":"para_151"},{"text":"11","paragraph_id":"para_152"},{"text":"Paragraphs 1 and 2 of Article 14 of that regulation, which is entitled ‘Additional technical specifications’, provide as follows:","paragraph_id":"para_153"},{"text":"‘1.   In order to ensure, where appropriate, that identity cards and residence documents referred to in points (a) and (c) of Article 2 comply with future minimum security standards, the Commission shall establish, by means of implementing acts, additional technical specifications, relating to the following:","paragraph_id":"para_154"},{"text":"(a)","paragraph_id":"para_155"},{"text":"additional security features and requirements, including enhanced anti-forgery, counterfeiting and falsification standards;","paragraph_id":"para_156"},{"text":"(b)","paragraph_id":"para_157"},{"text":"technical specifications for the storage medium of the biometric features referred to in Article 3(5) and their security, including prevention of unauthorised access and facilitation of validation;","paragraph_id":"para_158"},{"text":"(c)","paragraph_id":"para_159"},{"text":"requirements for quality and common technical standards for the facial image and the fingerprints.","paragraph_id":"para_160"},{"text":"Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 15(2).","paragraph_id":"para_161"},{"text":"2.   In accordance with the procedure referred to in Article 15(2), it may be decided that the specifications referred to in this Article are to be secret and are not to be published. …’","paragraph_id":"para_162"},{"text":"2.\n  \n The GDPR","paragraph_id":"para_163"},{"text":"12","paragraph_id":"para_164"},{"text":"Recital 51 of the GDPR states:","paragraph_id":"para_165"},{"text":"‘Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. … The processing of photographs should not systematical …","paragraph_id":"para_166"},{"text":"13","paragraph_id":"para_167"},{"text":"Article 4 of that regulation, which is entitled ‘Definitions’, is worded as follows:","paragraph_id":"para_168"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_169"},{"text":"…","paragraph_id":"para_170"},{"text":"(2)","paragraph_id":"para_171"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_172"},{"text":"…","paragraph_id":"para_173"},{"text":"(7)","paragraph_id":"para_174"},{"text":"“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;","paragraph_id":"para_175"},{"text":"…’","paragraph_id":"para_176"},{"text":"14","paragraph_id":"para_177"},{"text":"Paragraph 1 of Article 9 of the GDPR, which is entitled ‘Processing of special categories of personal data’, provides as follows:","paragraph_id":"para_178"},{"text":"‘Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.’","paragraph_id":"para_179"},{"text":"15","paragraph_id":"para_180"},{"text":"Paragraphs 1, 3 and 10 of Article 35 of that regulation, which is entitled ‘Data protection impact assessment’, provides as follows:","paragraph_id":"para_181"},{"text":"‘1.   Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an asse …","paragraph_id":"para_182"},{"text":"…","paragraph_id":"para_183"},{"text":"3.   A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:","paragraph_id":"para_184"},{"text":"(a)","paragraph_id":"para_185"},{"text":"a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;","paragraph_id":"para_186"},{"text":"(b)","paragraph_id":"para_187"},{"text":"processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or","paragraph_id":"para_188"},{"text":"(c)","paragraph_id":"para_189"},{"text":"a systematic monitoring of a publicly accessible area on a large scale.","paragraph_id":"para_190"},{"text":"…","paragraph_id":"para_191"},{"text":"10.   Where processing pursuant to point (c) or (e) of Article 6(1) has a legal basis in Union law or in the law of the Member State to which the controller is subject, that law regulates the specific processing operation or set of operations in question, and a data protection impact assessment has …","paragraph_id":"para_192"},{"text":"3.\n  \n Regulation (EU) 2016/399","paragraph_id":"para_193"},{"text":"16","paragraph_id":"para_194"},{"text":"Article 8 of Regulation (EU) 2016/399 of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code) ( OJ 2016 L 77, p. 1 ), as amended by Regulation (EU) 2017/458 of the European Parliament and of the Council of 15 March 2017 ( OJ 2017 L 74, p. 1 ), provides, in paragraphs 1 and 2 thereof:","paragraph_id":"para_195"},{"text":"‘1.   Cross-border movement at external borders shall be subject to checks by border guards. Checks shall be carried out in accordance with this chapter.","paragraph_id":"para_196"},{"text":"…","paragraph_id":"para_197"},{"text":"2.   On entry and on exit, persons enjoying the right of free movement under Union law shall be subject to the following checks:","paragraph_id":"para_198"},{"text":"(a)","paragraph_id":"para_199"},{"text":"verification of the identity and the nationality of the person and of the authenticity and validity of the travel document for crossing the border, including by consulting the relevant databases …","paragraph_id":"para_200"},{"text":"(b)","paragraph_id":"para_201"},{"text":"verification that a person enjoying the right of free movement under Union law is not considered to be a threat to public policy, internal security, public health or the international relations of any of the Member States, …","paragraph_id":"para_202"},{"text":"Where there are doubts as to the authenticity of the travel document or the identity of its holder, at least one of the biometric identifiers integrated into the passports and travel documents issued in accordance with [Council] Regulation (EC) No 2252/2004 [of 13 December 2004 on standards for secu …","paragraph_id":"para_203"},{"text":"…’","paragraph_id":"para_204"},{"text":"4.\n  \n Directive 2004/38","paragraph_id":"para_205"},{"text":"17","paragraph_id":"para_206"},{"text":"Paragraphs 1 and 3 of Article 4 of Directive 2004/38, which is entitled ‘Right of exit’, provides as follows:","paragraph_id":"para_207"},{"text":"‘1.   Without prejudice to the provisions on travel documents applicable to national border controls, all Union citizens with a valid identity card or passport and their family members who are not nationals of a Member State and who hold a valid passport shall have the right to leave the territory of a Member State to travel to another Member State.","paragraph_id":"para_208"},{"text":"…","paragraph_id":"para_209"},{"text":"3.   Member States shall, acting in accordance with their laws, issue to their own nationals, and renew, an identity card or passport stating their nationality.’","paragraph_id":"para_210"},{"text":"18","paragraph_id":"para_211"},{"text":"Paragraph 1 of Article 5 of that directive, which is entitled ‘Right of entry’, provides as follows:","paragraph_id":"para_212"},{"text":"‘Without prejudice to the provisions on travel documents applicable to national border controls, Member States shall grant Union citizens leave to enter their territory with a valid identity card or passport and shall grant family members who are not nationals of a Member State leave to enter their territory with a valid passport.","paragraph_id":"para_213"},{"text":"No entry visa or equivalent formality may be imposed on Union citizens.’","paragraph_id":"para_214"},{"text":"19","paragraph_id":"para_215"},{"text":"Article 6 of that directive, which is entitled ‘Right of residence for up to three months’, provides as follows:","paragraph_id":"para_216"},{"text":"‘1.   Union citizens shall have the right of residence on the territory of another Member State for a period of up to three months without any conditions or any formalities other than the requirement to hold a valid identity card or passport.","paragraph_id":"para_217"},{"text":"2.   The provisions of paragraph 1 shall also apply to family members in possession of a valid passport who are not nationals of a Member State, accompanying or joining the Union citizen.’","paragraph_id":"para_218"},{"text":"20","paragraph_id":"para_219"},{"text":"Paragraphs 1 and 3 of Article 8 of Directive 2004/38, which is entitled ‘Administrative formalities for Union citizens’, provide as follows:","paragraph_id":"para_220"},{"text":"‘1.   Without prejudice to Article 5(5), for periods of residence longer than three months, the host Member State may require Union citizens to register with the relevant authorities.","paragraph_id":"para_221"},{"text":"…","paragraph_id":"para_222"},{"text":"3.   For the registration certificate to be issued, Member States may only require that","paragraph_id":"para_223"},{"text":"–","paragraph_id":"para_224"},{"text":"Union citizens to whom point (a) of Article 7(1) applies present a valid identity card or passport, a confirmation of engagement from the employer or a certificate of employment, or proof that they are self-employed persons;","paragraph_id":"para_225"},{"text":"–","paragraph_id":"para_226"},{"text":"Union citizens to whom point (b) of Article 7(1) applies present a valid identity card or passport and provide proof that they satisfy the conditions laid down therein;","paragraph_id":"para_227"},{"text":"–","paragraph_id":"para_228"},{"text":"Union citizens to whom point (c) of Article 7(1) applies present a valid identity card or passport, provide proof of enrolment at an accredited establishment and of comprehensive sickness insurance cover and the declaration or equivalent means referred to in point (c) of Article 7(1). Member States may not require this declaration to refer to any specific amount of resources.’","paragraph_id":"para_229"},{"text":"5.\n  \n The Interinstitutional Agreement","paragraph_id":"para_230"},{"text":"21","paragraph_id":"para_231"},{"text":"Points 12 to 14 of the Interinstitutional Agreement between the European Parliament, the Council of the European Union and the European Commission on Better Law-Making of 13 April 2016 ( OJ 2016 L 123, p. 1 ) (‘the Interinstitutional Agreement’) is worded as follows:","paragraph_id":"para_232"},{"text":"‘12. …","paragraph_id":"para_233"},{"text":"Impact assessments are a tool to help the three Institutions reach well-informed decisions and not a substitute for political decisions within the democratic decision-making process. …","paragraph_id":"para_234"},{"text":"Impact assessments should cover the existence, scale and consequences of a problem and the question whether or not Union action is needed. They should map out alternative solutions and, where possible, potential short and long-term costs and benefits, assessing the economic, environmental and social …","paragraph_id":"para_235"},{"text":"13. The Commission will carry out impact assessments of its legislative … initiatives … which are expected to have significant economic, environmental or social impacts. The initiatives included in the Commission Work Programme or in the joint declaration will, as a general rule, be accompanied by an impact assessment.","paragraph_id":"para_236"},{"text":"… The final results of the impact assessments will be made available to the European Parliament, the Council [of the European Union] and national Parliaments, and will be made public along with the opinion(s) of the Regulatory Scrutiny Board at the time of adoption of the Commission initiative.","paragraph_id":"para_237"},{"text":"14. The … Parliament and the Council, upon considering Commission legislative proposals, will take full account of the Commission’s impact assessments. To that end, impact assessments shall be presented in such a way as to facilitate the consideration by the … Parliament and the Council of the choices made by the Commission.’","paragraph_id":"para_238"},{"text":"B.   German law","paragraph_id":"para_239"},{"text":"22","paragraph_id":"para_240"},{"text":"Paragraph 5 of the Gesetz über Personalausweise und den elektronischen Identitätsnachweis (Law on identity cards and electronic proof of identity) of 18 June 2009 (BGBl. I, p. 1346), in the version applicable to the facts in the main proceedings (‘the PAuswG’), entitled ‘Model identity card; stored data’, provides at subparagraph 9 thereof as follows:","paragraph_id":"para_241"},{"text":"‘The two fingerprints of the [identity card] applicant to be stored on the electronic storage medium pursuant to Regulation [2019/1157] shall be stored on the storage and electronic processing medium of the identity card in the form of the flat print of the left index and right index fingers. If an …","paragraph_id":"para_242"},{"text":"23","paragraph_id":"para_243"},{"text":"Paragraph 6 of the PAuswG, provides in subparagraphs 1 and 2 thereof as follows:","paragraph_id":"para_244"},{"text":"‘(1)   Identity cards shall be issued for a validity period of 10 years.","paragraph_id":"para_245"},{"text":"(2)   Before the validity of an identity card expires, a new identity card may be applied for if it can be shown that there is a legitimate interest in issuing a new card.’","paragraph_id":"para_246"},{"text":"24","paragraph_id":"para_247"},{"text":"Paragraph 9 of the PAuswG, which is entitled ‘Issuing the card’, states in the first sentence of subparagraph 1 thereof as follows:","paragraph_id":"para_248"},{"text":"‘Identity cards and provisional identity cards shall be issued on application to Germans within the meaning of Paragraph 116(1) of the Basic Law.’","paragraph_id":"para_249"},{"text":"25","paragraph_id":"para_250"},{"text":"Paragraph 28 of the PAuswG, which is entitled ‘Invalidity’, provides in subparagraph 3 thereof as follows:","paragraph_id":"para_251"},{"text":"‘Malfunctioning which affects the electronic storage and processing medium shall not affect the validity of the identity card.’","paragraph_id":"para_252"},{"text":"II.   The dispute in the main proceedings and the question referred for a preliminary ruling","paragraph_id":"para_253"},{"text":"26","paragraph_id":"para_254"},{"text":"On 30 November 2021, the applicant in the main proceedings applied to the City of Wiesbaden for a new identity card to be issued, on the ground that the electronic chip in his old card was defective. The applicant requested, however, that the new card should not contain his fingerprints.","paragraph_id":"para_255"},{"text":"27","paragraph_id":"para_256"},{"text":"The City of Wiesbaden rejected that application on two grounds. First, the applicant in the main proceedings was not entitled to have a new identity card issued, since he was already in possession of a valid identity document. In accordance with Paragraph 28(3) of the PAuswG, an identity card remain …","paragraph_id":"para_257"},{"text":"28","paragraph_id":"para_258"},{"text":"On 21 December 2021, the applicant in the main proceedings brought an action before the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany), which is the referring court, seeking an order requiring the City of Wiesbaden to issue him with an identity card with no fingerprints being collected.","paragraph_id":"para_259"},{"text":"29","paragraph_id":"para_260"},{"text":"The referring court has doubts regarding the lawfulness of the two grounds of the decision at issue in the main proceedings. As regards, in particular, the second ground, it tends toward the view that the validity of Regulation 2019/1157 or, at least, the validity of Article 3(5) thereof can be disputed.","paragraph_id":"para_261"},{"text":"30","paragraph_id":"para_262"},{"text":"In the first place, the referring court asks whether that regulation ought to have been adopted on the basis of Article 77(3) TFEU and, therefore, after the special legislative procedure provided for by that provision had been concluded, rather than on the basis of Article 21(2) TFEU and under the o …","paragraph_id":"para_263"},{"text":"31","paragraph_id":"para_264"},{"text":"In the second place, the referring court refers to the possible existence of a procedural defect vitiating the adoption of Regulation 2019/1157. As the European Data Protection Supervisor (‘the EDPS’) pointed out in Opinion 7/2018 of 10 August 2018 on the proposal for a regulation on strengthening t …","paragraph_id":"para_265"},{"text":"32","paragraph_id":"para_266"},{"text":"In the third place, the referring court asks, more specifically, whether Article 3(5) of Regulation 2019/1157 is compatible with Articles 7 and 8 of the Charter relating, respectively, to respect for private and family life and the protection of personal data. The obligation on the Member States to …","paragraph_id":"para_267"},{"text":"33","paragraph_id":"para_268"},{"text":"First, that limitation might not meet an objective of general interest. It is true that the Court accepted, in the judgment of 17 October 2013, Schwarz ( C‑291/12 , EU:C:2013:670 ), that combating illegal entry by third-country nationals into the territory of the European Union is an objective recog …","paragraph_id":"para_269"},{"text":"34","paragraph_id":"para_270"},{"text":"Second, assuming that that regulation pursues an objective of general interest recognised by EU law, there are doubts as to the proportionality of that limitation. The solution adopted by the Court in the judgment of 17 October 2013, Schwarz ( C‑291/12 , EU:C:2013:670 ), is not transposable to Regulation 2019/1157, since it relates to passports, which it is optional to hold in Germany, unlike identity cards, and the use of which pursues a different objective.","paragraph_id":"para_271"},{"text":"35","paragraph_id":"para_272"},{"text":"On the other hand, it is apparent from Opinion 7/2018 that the inclusion and storage of fingerprints would have a wide-ranging impact on up to 370 million EU citizens, potentially subjecting 85% of the EU population to a mandatory requirement to have fingerprints taken. That wide-ranging impact, com …","paragraph_id":"para_273"},{"text":"36","paragraph_id":"para_274"},{"text":"In any event, the need to carry out a strict review of proportionality also follows from Article 9(1) of the GDPR, under which the processing of such biometric data is, in principle, prohibited and may be authorised only in exceptional and strictly limited situations.","paragraph_id":"para_275"},{"text":"37","paragraph_id":"para_276"},{"text":"In that context, while the referring court is of the opinion that the use of biometric data reduces the risk that a document may be falsified, it has doubts whether that fact alone can justify the extent of the limitation on the right to protection of personal data in the light, in particular, of the following reasons.","paragraph_id":"para_277"},{"text":"38","paragraph_id":"para_278"},{"text":"First of all, in Opinion 7/2018, the EDPS stated that other secure printing techniques for identification documents, such as holograms or watermarks, are much less intrusive, while also enabling the falsification of those documents to be prevented and their authenticity to be verified. Moreover, the …","paragraph_id":"para_279"},{"text":"39","paragraph_id":"para_280"},{"text":"Next, Article 3(7) of Regulation 2019/1157 authorises Member States to exempt children under the age of 12 years from the obligation to provide their fingerprints and, in any event, requires Member States to exempt children under the age of six years from that obligation, which demonstrates that it is not strictly necessary to take two fingerprints.","paragraph_id":"para_281"},{"text":"40","paragraph_id":"para_282"},{"text":"Furthermore, Article 3(5) of Regulation 2019/1157 would not comply with the principle of data minimisation, set out in Article 5 of the GDPR, from which it is apparent that the collection and use of personal data must be adequate, relevant and limited to what is necessary in relation to the purposes …","paragraph_id":"para_283"},{"text":"41","paragraph_id":"para_284"},{"text":"Finally, and in essence, the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter could be non-legitimate since, in Opinion 7/2018, the EDPS noted that when Regulation 2019/1157 was adopted, the number of fraudulent identity cards was relatively small in proportion to the number of cards issued (38870 fraudulent cards detected between 2013 and 2017) and that that number had been decreasing for a number of years.","paragraph_id":"para_285"},{"text":"42","paragraph_id":"para_286"},{"text":"In those circumstances, the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:","paragraph_id":"para_287"},{"text":"‘Does the obligation to take fingerprints and store them in identity cards in accordance with Article 3(5) of Regulation [2019/1157] infringe higher-ranking EU law, in particular","paragraph_id":"para_288"},{"text":"(a)","paragraph_id":"para_289"},{"text":"Article 77(3) TFEU","paragraph_id":"para_290"},{"text":"(b)","paragraph_id":"para_291"},{"text":"Articles 7 and 8 of the [Charter],","paragraph_id":"para_292"},{"text":"(c)","paragraph_id":"para_293"},{"text":"Article 35(10) of the [GDPR]","paragraph_id":"para_294"},{"text":"and is it therefore invalid on one of those grounds?’","paragraph_id":"para_295"},{"text":"III.   Consideration of the question referred","paragraph_id":"para_296"},{"text":"43","paragraph_id":"para_297"},{"text":"By its question, the referring court seeks, in essence, to ascertain whether Regulation 2019/1157 is invalid, as a whole or in part, on the grounds that (i) it was adopted on an incorrect legal basis, (ii) it infringes Article 35(10) of the GDPR and, (iii) it is contrary to Articles 7 and 8 of the Charter.","paragraph_id":"para_298"},{"text":"A.   The first ground of invalidity: incorrect legal basis","paragraph_id":"para_299"},{"text":"44","paragraph_id":"para_300"},{"text":"The first ground of invalidity mentioned by the referring court concerns whether, having regard in particular to the explicit reference to identity cards in Article 77(3) TFEU and the solution adopted in the judgment of 17 October 2013, Schwarz ( C‑291/12 , EU:C:2013:670 ), Regulation 2019/1157 ough …","paragraph_id":"para_301"},{"text":"1.\n  \n Preliminary observations","paragraph_id":"para_302"},{"text":"45","paragraph_id":"para_303"},{"text":"According to settled case-law, the choice of legal basis for an EU measure must rest on objective factors that are amenable to judicial review; these include the aim and content of that measure (judgments of 16 February 2022, Hungary v Parliament and Council, C‑156/21 , EU:C:2022:97 , paragraph  107 , and of 16 February 2022, Poland v Parliament and Council, C‑157/21 , EU:C:2022:98 , paragraph  121 ).","paragraph_id":"para_304"},{"text":"46","paragraph_id":"para_305"},{"text":"In addition, it should be noted that where the Treaties contain a more specific provision that is capable of constituting the legal basis for the measure in question, the measure must be founded on that provision (judgments of 6 September 2012, Parliament v Council, C‑490/10 , EU:C:2012:525 , paragraph  44 , and of 8 December 2020, Poland v Parliament and Council, C‑626/18 , EU:C:2020:1000 , paragraph  48 and the case-law cited).","paragraph_id":"para_306"},{"text":"47","paragraph_id":"para_307"},{"text":"Lastly, if examination of an EU measure reveals that it pursues several purposes or that it comprises several components and if one of those purposes or components is identifiable as the main or predominant purpose or component, whereas the others are merely incidental or are only extremely limited …","paragraph_id":"para_308"},{"text":"2.\n  \n The respective scopes of Article 21(2) TFEU and Article 77(3) TFEU","paragraph_id":"para_309"},{"text":"48","paragraph_id":"para_310"},{"text":"Article 21(2) TFEU states that if action by the Union should prove necessary to guarantee every citizen of the European Union the right to move and reside freely within the territory of the Member States, and if the Treaties have not provided powers to that effect, the European Parliament and the Council, acting in accordance with the ordinary legislative procedure, may adopt provisions with a view to facilitating the exercise of those rights.","paragraph_id":"para_311"},{"text":"49","paragraph_id":"para_312"},{"text":"It follows that that provision confers on the European Union a general competence to adopt provisions necessary for the purposes of facilitating the exercise of the right of citizens of the European Union to move and reside freely within the territory of the Member States referred to in Article 20(2)(a) TFEU, subject to the powers laid down to that effect by the Treaties.","paragraph_id":"para_313"},{"text":"50","paragraph_id":"para_314"},{"text":"Unlike Article 21(2) TFEU, Article 77(3) TFEU expressly lays down such powers in relation to the adoption of measures relating to passports, identity cards, residence permits or any other such document issued to citizens of the European Union for the purposes of facilitating the exercise of the right, referred to in Article 20(2)(a) TFEU, to move and reside freely within the territory of the Member States.","paragraph_id":"para_315"},{"text":"51","paragraph_id":"para_316"},{"text":"It is true that Article 77(3) TFEU is found in Title V of that treaty, which concerns the area of freedom, security and justice and, more specifically, in Chapter 2 of that Title V which is entitled ‘Policies on border checks, asylum and immigration’. However, according to Article 77(1) TFEU, the Eu …","paragraph_id":"para_317"},{"text":"52","paragraph_id":"para_318"},{"text":"That interpretation of the material scope of Article 77(3) TFEU cannot be invalidated either by the historical development of the Treaties in relation to European Union’s competence to adopt measures relating to passports, identity cards, residence permits and other similar documents, to which the P …","paragraph_id":"para_319"},{"text":"53","paragraph_id":"para_320"},{"text":"It is true that the Treaty of Lisbon removed the provision previously set out in Article 18(3) EC, which expressly precluded the EU legislature from having recourse to Article 18(2) EC (now Article 21(2) TFEU) as the legal basis for the adoption of ‘provisions on passports, identity cards, residence …","paragraph_id":"para_321"},{"text":"54","paragraph_id":"para_322"},{"text":"In those circumstances, it cannot be inferred from the removal of the provision previously set out in Article 18(3) EC that it would from then on be possible to adopt ‘provisions on passports, identity cards, residence permits or any other such document’ on the basis of Article 21(2) TFEU. On the co …","paragraph_id":"para_323"},{"text":"55","paragraph_id":"para_324"},{"text":"In addition, the statement in Article 77(3) TFEU that that provision is to apply ‘if the Treaties have not provided the necessary powers’ must be understood, having regard to the general scheme of the FEU Treaty, as meaning that the powers thereby referred to are conferred not by a provision with a more general scope, such as Article 21(2) TFEU, but by a provision which is even more specific.","paragraph_id":"para_325"},{"text":"56","paragraph_id":"para_326"},{"text":"Therefore, the adoption of Regulation 2019/1157 could be based on Article 21(2) TFEU only if the purpose or the main or predominant component of that regulation were to fall outside the specific scope of Article 77(3) TFEU, namely the issuing of passports, identity cards, residence permits or any other such document, for the purposes of facilitating the exercise of the right referred to in Article 20(2)(a) TFEU.","paragraph_id":"para_327"},{"text":"3.\n  \n The purpose or the main or predominant component of Regulation 2019/1157","paragraph_id":"para_328"},{"text":"57","paragraph_id":"para_329"},{"text":"In the first place, as regards the purpose of Regulation 2019/1157, Article 1 thereof states that it is to strengthen the security standards applicable to identity cards issued by Member States to their nationals and to residence documents issued by Member States to Union citizens and their family members when exercising their right to free movement.","paragraph_id":"para_330"},{"text":"58","paragraph_id":"para_331"},{"text":"Similarly, recital 46 of that regulation states that the objectives of that regulation are to ‘enhance security’ of those travel and identity documents in order ‘to facilitate the exercise of the rights of free movement by Union citizens and their family members’, which is also confirmed by recitals 1, 2, 5, 17, 28, 29 and 36 of that regulation.","paragraph_id":"para_332"},{"text":"59","paragraph_id":"para_333"},{"text":"In the second place, as regards the content of Regulation 2019/1157, it should be noted that that regulation comprises 16 articles. Articles 1 and 2 of that regulation define, respectively, its subject matter and scope. Articles 3, 4, 6 and 7 of that regulation, which form the main components thereo …","paragraph_id":"para_334"},{"text":"60","paragraph_id":"para_335"},{"text":"It is true that Article 2 of Regulation 2019/1157 states that that regulation applies not only to identity cards issued by Member States to their own nationals, but also to registration certificates issued in accordance with Article 8 of Directive 2004/38 to Union citizens residing for more than thr …","paragraph_id":"para_336"},{"text":"61","paragraph_id":"para_337"},{"text":"In those circumstances, it follows from the purpose and main components of Regulation 2019/1157 that that regulation is one of the measures which falls within the specific scope of Article 77(3) TFEU, as identified in paragraphs 48 to 51 of the present judgment.","paragraph_id":"para_338"},{"text":"62","paragraph_id":"para_339"},{"text":"Accordingly, by adopting Regulation 2019/1157 on the basis of Article 21(2) TFEU, the EU legislature infringed Article 77(3) TFEU and had recourse to an inappropriate legislative procedure.","paragraph_id":"para_340"},{"text":"63","paragraph_id":"para_341"},{"text":"It follows that the first ground of invalidity mentioned by the referring court, alleging that Regulation 2019/1157 was adopted erroneously on the basis of Article 21(2) TFEU and under the ordinary legislative procedure, is such as to result in the invalidity of that regulation.","paragraph_id":"para_342"},{"text":"B.   The second ground of invalidity: failure to comply with Article 35(10) of the GDPR","paragraph_id":"para_343"},{"text":"64","paragraph_id":"para_344"},{"text":"The second ground of invalidity mentioned by the referring court alleges that Regulation 2019/1157 was adopted without a data protection impact assessment having been carried out, contrary to Article 35(10) of the GDPR.","paragraph_id":"para_345"},{"text":"65","paragraph_id":"para_346"},{"text":"In that regard, it should be stated that Article 35(1) of the GDPR provides that where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natura …","paragraph_id":"para_347"},{"text":"66","paragraph_id":"para_348"},{"text":"Given that, in the present case, Regulation 2019/1157 does not itself undertake any operation applied to personal data or sets of personal data, but merely provides for Member States to carry out certain processing operations where an application for an identity card is made, it must be held that th …","paragraph_id":"para_349"},{"text":"67","paragraph_id":"para_350"},{"text":"It follows that, since, as is apparent from the foregoing, Article 35(1) of the GDPR did not apply when Regulation 2019/1157 was adopted, it was not possible for that adoption to infringe Article 35(10) of the GDPR.","paragraph_id":"para_351"},{"text":"68","paragraph_id":"para_352"},{"text":"In the light of the foregoing, the second ground alleging infringement of Article 35(10) of the GDPR is not such as to result in the invalidity of Regulation 2019/1157.","paragraph_id":"para_353"},{"text":"C.   The third ground of invalidity: Article 3(5) of Regulation 2019/1157 is incompatible with Articles 7 and 8 of the Charter","paragraph_id":"para_354"},{"text":"69","paragraph_id":"para_355"},{"text":"The third ground of invalidity in respect of Regulation 2019/1157 referred to by the referring court concerns whether the obligation to include two complete fingerprints in the storage medium of identity cards issued by Member States, laid down in Article 3(5) of that regulation, entails an unjustified limitation of the rights guaranteed in Articles 7 and 8 of the Charter.","paragraph_id":"para_356"},{"text":"1.\n  \n Whether there is a limitation","paragraph_id":"para_357"},{"text":"70","paragraph_id":"para_358"},{"text":"Article 7 of the Charter provides, inter alia, that everyone has the right to respect for his or her private life. Pursuant to Article 8(1) of the Charter, everyone has the right to the protection of personal data concerning him or her. It follows from a joint reading of those provisions that, as a …","paragraph_id":"para_359"},{"text":"71","paragraph_id":"para_360"},{"text":"In the present case, Article 3(5) of Regulation 2019/1157 provides that the highly secure storage medium to be included in identity cards issued by Member States to their own nationals must contain biometric data, namely a facial image and two fingerprints in interoperable digital formats.","paragraph_id":"para_361"},{"text":"72","paragraph_id":"para_362"},{"text":"Such personal data allow for the precise identification of the natural persons concerned and are particularly sensitive due to the significant risks to the fundamental rights and freedoms which their use can constitute, as is apparent, in particular, from recital 51 of the GDPR, which applies to the data at issue, as stated in recital 40 of Regulation 2019/1157.","paragraph_id":"para_363"},{"text":"73","paragraph_id":"para_364"},{"text":"Therefore, the obligation to include two fingerprints in the storage medium of identity cards, laid down in Article 3(5) of Regulation 2019/1157, constitutes a limitation both of the right to respect for private life and of the right to the protection of personal data, enshrined in Articles 7 and 8 of the Charter respectively.","paragraph_id":"para_365"},{"text":"74","paragraph_id":"para_366"},{"text":"In addition, that obligation involves carrying out, in advance, two successive personal data processing operations, namely the collection of those fingerprints from the data subject, then the temporary storage of those fingerprints for the purposes of personalisation of identity cards, since those operations are governed by Article 10 of that regulation. Those operations also constitute limitations of the rights enshrined in Articles 7 and 8 of the Charter.","paragraph_id":"para_367"},{"text":"2.\n  \n The justification for the limitation","paragraph_id":"para_368"},{"text":"75","paragraph_id":"para_369"},{"text":"As is apparent from settled case-law, the right to respect for private life and the right to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter respectively, are not absolute rights, but must be considered in relation to their function in society (see, to that effect, judgment of 20 September 2022, SpaceNet and Telekom Deutschland, C‑793/19 and C‑794/19 , EU:C:2022:702 , paragraph  63 ).","paragraph_id":"para_370"},{"text":"76","paragraph_id":"para_371"},{"text":"Limitations may therefore be placed on those rights, provided that, in accordance with the first sentence of Article 52(1) of the Charter, they are provided for by law and respect the essence of those rights. In addition, in accordance with the second sentence of that paragraph, in compliance with t …","paragraph_id":"para_372"},{"text":"(a)\n  \n Whether the principle of legality has been complied with","paragraph_id":"para_373"},{"text":"77","paragraph_id":"para_374"},{"text":"As regards the requirement laid down in the first sentence of Article 52(1) of the Charter that any limitation on the exercise of rights recognised by the Charter must be provided for by law, it should be recalled that that requirement implies that the act which permits the interference with those r …","paragraph_id":"para_375"},{"text":"78","paragraph_id":"para_376"},{"text":"In the present case, the limitations on the exercise of the fundamental rights guaranteed in Articles 7 and 8 of the Charter arising from the obligation to include two complete fingerprints in the storage medium of identity cards issued by Member States and the conditions for application and the sco …","paragraph_id":"para_377"},{"text":"79","paragraph_id":"para_378"},{"text":"Therefore, those limitations on the exercise of the fundamental rights guaranteed in Articles 7 and 8 of the Charter comply with the principle of legality referred to in the first sentence of Article 52(1) of the Charter.","paragraph_id":"para_379"},{"text":"(b)\n  \n Compliance with the essence of the fundamental rights guaranteed in Articles 7 and 8 of the Charter","paragraph_id":"para_380"},{"text":"80","paragraph_id":"para_381"},{"text":"It should be stated that the information provided by fingerprints does not, in itself, make it possible to have an overview of the private and family life of data subjects.","paragraph_id":"para_382"},{"text":"81","paragraph_id":"para_383"},{"text":"In those circumstances, the limitation entailed by the obligation to include two fingerprints in the storage medium of identity cards issued by the Member States, laid down in Article 3(5) of Regulation 2019/1157, does not adversely affect the essence of the fundamental rights enshrined in Articles 7 and 8 of the Charter (see, by analogy, judgment of 21 June 2022, Ligue des droits humains, C‑817/19 , EU:C:2022:491 , paragraph  120 ).","paragraph_id":"para_384"},{"text":"(c)\n  \n Whether the principle of proportionality has been complied with","paragraph_id":"para_385"},{"text":"82","paragraph_id":"para_386"},{"text":"As is apparent from the second sentence of Article 52(1) of the Charter, in order for limitations on the exercise of the fundamental rights guaranteed by the Charter to be made in accordance with the principle of proportionality, those limitations must be necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.","paragraph_id":"para_387"},{"text":"83","paragraph_id":"para_388"},{"text":"More specifically, derogations from and limitations on the protection of personal data should apply only in so far as is strictly necessary, it being understood that where there is a choice between several measures appropriate to meeting the legitimate objectives pursued, recourse must be had to the …","paragraph_id":"para_389"},{"text":"84","paragraph_id":"para_390"},{"text":"Accordingly, in order to ascertain whether, in the present case, the interference with the rights guaranteed in Articles 7 and 8 of the Charter resulting from the obligation to include two fingerprints in the storage medium of identity cards, provided for in Article 3(5) of Regulation 2019/1157, com …","paragraph_id":"para_391"},{"text":"(1)   Whether one or more objectives of general interest recognised by the European Union is pursued and whether the measure to attain those objectives is appropriate","paragraph_id":"para_392"},{"text":"(i)   Whether the objectives pursued by the measure at issue are of general interest","paragraph_id":"para_393"},{"text":"85","paragraph_id":"para_394"},{"text":"Article 1 of Regulation 2019/1157 states that the purpose of that regulation is to strengthen the security standards applicable, inter alia, to identity cards issued by Member States to their nationals when exercising their right to free movement.","paragraph_id":"para_395"},{"text":"86","paragraph_id":"para_396"},{"text":"More specifically, and as is apparent from recitals 4, 5, 17 to 20 and 32 of Regulation 2019/1157, the inclusion of biometric data, including two complete fingerprints, in the storage medium of identity cards is intended to ensure the authenticity of those cards and to enable the holder of that card …","paragraph_id":"para_397"},{"text":"87","paragraph_id":"para_398"},{"text":"The Court has already had occasion to rule on the issuing of passports (see, to that effect, judgment of 17 October 2013, Schwarz, C‑291/12 , EU:C:2013:670 , paragraphs  36 to  38 ) and the establishment of an identification file for third-country nationals (see, to that effect, judgment of 3 Octobe …","paragraph_id":"para_399"},{"text":"88","paragraph_id":"para_400"},{"text":"The objective of interoperability of identification document verification systems is also of general interest since, as is apparent from recital 17 of Regulation 2019/1157, it contributes to facilitating the exercise by EU citizens of the right granted to them by Article 20 TFEU to move and reside freely within the territory of the Member States.","paragraph_id":"para_401"},{"text":"(ii)   Whether the measure at issue is appropriate for actually meeting the objectives of general interest pursued","paragraph_id":"para_402"},{"text":"89","paragraph_id":"para_403"},{"text":"In the present case, the inclusion of two complete fingerprints in the storage medium of identity cards is appropriate for attaining the general interest objectives of combating the production of false identity cards and identity theft as well as the interoperability of verification systems, put forward by the EU legislature in order to justify that measure.","paragraph_id":"para_404"},{"text":"90","paragraph_id":"para_405"},{"text":"First of all, the inclusion of biometric data, such as fingerprints, in identity cards is liable to make it more difficult to produce false identity cards, in so far as, inter alia, in accordance with Article 3(5) of Regulation 2019/1157, read in conjunction with Article 14(1) and (2) of that regulation, such data must be stored in accordance with precise technical specifications and be capable of being kept secret.","paragraph_id":"para_406"},{"text":"91","paragraph_id":"para_407"},{"text":"Next, the inclusion of such biometric data is a means making it possible, in accordance with Article 11(6) and recitals 18 and 19 of Regulation 2019/1157, reliably to verify the authenticity of the identity card and the identity of the cardholder, and thereby to reduce the risk of fraud.","paragraph_id":"para_408"},{"text":"92","paragraph_id":"para_409"},{"text":"Finally, the choice made by the EU legislature to provide for complete fingerprints to be included also appears to be appropriate for achieving the objective of interoperability of identity card verification systems since the use of complete fingerprints makes it possible to ensure compatibility with all automated systems for the identification of fingerprints used by the Member States, even though such systems do not necessarily use the same identification mechanism.","paragraph_id":"para_410"},{"text":"93","paragraph_id":"para_411"},{"text":"The referring court also observes that the first subparagraph of Article 3(7) of Regulation 2019/1157 authorises Member States to exempt from the collection of their fingerprints, inter alia, children under the age of 12 and even requires them, in its second subparagraph, to exempt children under the age of six from that collection.","paragraph_id":"para_412"},{"text":"94","paragraph_id":"para_413"},{"text":"It is true that legislation is appropriate for ensuring that the objective pursued is attained only if the measures it lays down genuinely reflect a concern to attain it and if they are implemented in a consistent and systematic manner (see, by analogy, judgment of 5 December 2023, Nordic Info, C‑128/22 , EU:C:2023:951 , paragraph  84 and the case-law cited).","paragraph_id":"para_414"},{"text":"95","paragraph_id":"para_415"},{"text":"However, Regulation 2019/1157 meets that requirement even though it lays down exemptions from the obligation to collect children’s fingerprints since, as is apparent from recital 26 thereof, those exemptions are intended to take into account the best interests of the child.","paragraph_id":"para_416"},{"text":"96","paragraph_id":"para_417"},{"text":"The same is true of the rule laid down in Article 5 of Regulation 2019/1157 that identity cards which do not meet the requirements set out in Article 3 of that regulation only cease to be valid at their expiry or by 3 August 2031 at the latest. The EU legislature was entitled to take the view that s …","paragraph_id":"para_418"},{"text":"97","paragraph_id":"para_419"},{"text":"As to the fact that certain Member States provide in their legislation that the identity cards which they issue remain valid notwithstanding the electronic storage medium being defective, it is sufficient to note that such legislation is compatible with Regulation 2019/1157 only in so far as the transition period mentioned in the preceding paragraph has not expired.","paragraph_id":"para_420"},{"text":"(2)   Whether recourse to the measure at issue is necessary for the purpose of attaining the objectives of general interest pursued","paragraph_id":"para_421"},{"text":"98","paragraph_id":"para_422"},{"text":"As regards, in the first place, the very principle of including fingerprints in the storage medium of identity cards, it must be stated that fingerprints are a reliable and effective means of establishing, with certainty, the identity of a person and that the process used to collect those fingerprints is simple to implement.","paragraph_id":"para_423"},{"text":"99","paragraph_id":"para_424"},{"text":"In particular, as the Advocate General observed in point 90 of her Opinion, simply inserting a facial image is a less effective means of identification than inserting two fingerprints in addition to that image, since ageing, lifestyle, illness, plastic surgery or reconstructive surgery may also alter the anatomical characteristics of the face.","paragraph_id":"para_425"},{"text":"100","paragraph_id":"para_426"},{"text":"It is true that the impact assessment carried out by the Commission which accompanied the proposal for a regulation which gave rise to Regulation 2019/1157 indicated that the option of not requiring two fingerprints to be included in the storage medium of identity cards was to be preferred.","paragraph_id":"para_427"},{"text":"101","paragraph_id":"para_428"},{"text":"However, apart from the fact that the Commission itself did not select that option in its legislative proposal, it should be noted that, while paragraph 14 of the Interinstitutional Agreement provides that, upon considering Commission legislative proposals, the Parliament and the Council must take f …","paragraph_id":"para_429"},{"text":"102","paragraph_id":"para_430"},{"text":"Accordingly, the mere fact that the EU legislature adopted a different and, as the case may be, more onerous measure than that recommended following the impact assessment is not such as to demonstrate that it exceeded the limits of what was necessary in order to attain the stated objective (see, to that effect, judgment of 4 May 2016, Pillbox 38, C‑477/14 , EU:C:2016:324 , paragraph  65 ).","paragraph_id":"para_431"},{"text":"103","paragraph_id":"para_432"},{"text":"In the present case, the impact assessment carried out by the Commission found that the option of requiring fingerprints to be included in the storage medium of identity cards was the most effective for the purposes of attaining the specific objective of combating the production of false identity ca …","paragraph_id":"para_433"},{"text":"104","paragraph_id":"para_434"},{"text":"In the second place, as regards the inclusion of two complete fingerprints rather than just some of the characteristics of those fingerprints (‘the minutiae’), first, as the Advocate General observed in point 93 of her Opinion, the minutiae do not offer the same guarantees as a complete fingerprint. …","paragraph_id":"para_435"},{"text":"105","paragraph_id":"para_436"},{"text":"It follows from the foregoing considerations that the limitations placed on the fundamental rights guaranteed in Articles 7 and 8 of the Charter which arise from the obligation to include two complete fingerprints in the storage medium appear to comply with what is strictly necessary.","paragraph_id":"para_437"},{"text":"(3)   Whether there is a balance between, on the one hand, the seriousness of the interference with the fundamental rights involved, and, on the other hand, the objectives pursued by that measure","paragraph_id":"para_438"},{"text":"(i)   The seriousness of the interference caused by the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter","paragraph_id":"para_439"},{"text":"106","paragraph_id":"para_440"},{"text":"The assessment of the seriousness of the interference caused by a limitation on the rights guaranteed in Articles 7 and 8 of the Charter entails account being taken of the nature of the personal data concerned, in particular whether those data may be sensitive, as well as of the nature and specific …","paragraph_id":"para_441"},{"text":"107","paragraph_id":"para_442"},{"text":"In the present case, it is true that the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter resulting from Regulation 2019/1157 is capable of affecting a large number of persons, the Commission in its impact assessment having evaluated that number at 370 million o …","paragraph_id":"para_443"},{"text":"108","paragraph_id":"para_444"},{"text":"However, it is important to point out that the collection and storage of two complete fingerprints are permitted by Regulation 2019/1157 only for the purpose of including those fingerprints in the storage medium of identity cards.","paragraph_id":"para_445"},{"text":"109","paragraph_id":"para_446"},{"text":"In addition, it follows from Article 3(5) of that regulation, read in conjunction with Article 10(3) thereof, that, once that those fingerprints have been included and the identity card collected by the person concerned, the fingerprints collected are to be stored only in the storage medium of that card, which is, in principle, in the physical possession of that person.","paragraph_id":"para_447"},{"text":"110","paragraph_id":"para_448"},{"text":"Lastly, Regulation 2019/1157 lays down a set of safeguards intended to limit the risks that, when it is implemented, personal data may be collected or used for purposes other than the attainment of the objectives which it pursues, not only as regards the personal data processing operations which that regulation makes mandatory, but also with regard to the main processing operations to which fingerprints included in the storage medium of identity cards may be subject.","paragraph_id":"para_449"},{"text":"111","paragraph_id":"para_450"},{"text":"Accordingly, as regards, first, data collection, Article 10(1) and (2) of Regulation 2019/1157 states that biometric identifiers are to be collected ‘solely by qualified and duly authorised staff’ and that those staff must comply with ‘appropriate and effective procedures for the collection of biome …","paragraph_id":"para_451"},{"text":"112","paragraph_id":"para_452"},{"text":"As regards, second, data storage, on the one hand, Regulation 2019/1157 requires Member States to store, as biometric data, a facial image and two fingerprints. In that regard, recital 21 of that regulation expressly states that that regulation does not provide ‘a legal basis for setting up or maint …","paragraph_id":"para_453"},{"text":"113","paragraph_id":"para_454"},{"text":"It follows, in particular, that Article 10(3) of Regulation 2019/1157 does not permit Member States to process biometric data for purposes other than those laid down in that regulation. In addition, that provision precludes the centralised storage of fingerprints which goes beyond the temporary storage of those fingerprints for the purpose of personalising identity cards.","paragraph_id":"para_455"},{"text":"114","paragraph_id":"para_456"},{"text":"Lastly, Article 11(6) of Regulation 2019/1157 refers to the possibility that biometric data contained in the secure storage medium may be used, in accordance with EU and national law, by duly authorised staff of the competent national authorities and EU agencies.","paragraph_id":"para_457"},{"text":"115","paragraph_id":"para_458"},{"text":"Article 11(6)(a) of that regulation permits the use of biometric data stored in the storage medium of identity cards and residence documents only for the purpose of verifying the authenticity of the identity card or residence document.","paragraph_id":"para_459"},{"text":"116","paragraph_id":"para_460"},{"text":"Article 11(6)(b) of that regulation provides that biometric data stored on the storage medium of identity cards and residence documents may be used to verify the identity of the holder ‘by means of directly available comparable features where the identity card or residence document is required to be …","paragraph_id":"para_461"},{"text":"117","paragraph_id":"para_462"},{"text":"As regards, third, the consultation of biometric data recorded in the storage medium of identity cards, it should be noted that recital 19 of Regulation 2019/1157 lays down an order of priority for the use of methods of verifying the authenticity of the document and the identity of the holder, by pr …","paragraph_id":"para_463"},{"text":"118","paragraph_id":"para_464"},{"text":"As regards, fourth, the risk of unauthorised access to the data stored, Article 3(5) and (6) of Regulation 2019/1157 provides, in order to minimise that risk as far as possible, that fingerprints are to be stored on a ‘highly secure storage medium’, which has ‘sufficient capacity and capability to g …","paragraph_id":"para_465"},{"text":"(ii)   The significance of the objectives pursued","paragraph_id":"para_466"},{"text":"119","paragraph_id":"para_467"},{"text":"As has been recalled at paragraph 86 of the present judgment, the inclusion of two fingerprints in the storage medium of identity cards is intended to combat the production of false identity cards and identity theft and to ensure the interoperability of identification document verification systems. On that basis, it is capable of contributing to the protection of the privacy of data subjects as well as, more broadly, to combating crime and terrorism.","paragraph_id":"para_468"},{"text":"120","paragraph_id":"para_469"},{"text":"In addition, such a measure makes it possible to meet the requirement for every EU citizen to have a means of identifying himself or herself which is reliable and, for the Member States, to ensure that the persons relying on rights conferred by EU law do indeed hold those rights. It thereby contribu …","paragraph_id":"para_470"},{"text":"121","paragraph_id":"para_471"},{"text":"Furthermore, the legitimacy and significance of those objectives are in no way called into question by the fact, mentioned by the referring court, that paragraphs 24 to 26 of Opinion 7/2018 stated that only 38870 cases of fraudulent identity cards were detected between 2013 and 2017 and that that figure had been falling for a number of years.","paragraph_id":"para_472"},{"text":"122","paragraph_id":"para_473"},{"text":"Even if it were considered that the number of fraudulent identity cards was low, the EU legislature was not required to wait for that number to increase in order to be able to adopt measures to prevent the risk of such cards being used, but could, particularly with a view to managing risks, anticipate such an increase, provided that the other conditions relating to compliance with the principle of proportionality were observed.","paragraph_id":"para_474"},{"text":"(iii)   Balancing","paragraph_id":"para_475"},{"text":"123","paragraph_id":"para_476"},{"text":"In the light of the foregoing, it must be found that the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter resulting from the inclusion of two fingerprints in the storage medium of identity cards does not appear to be – having regard to the nature of the data at …","paragraph_id":"para_477"},{"text":"124","paragraph_id":"para_478"},{"text":"Therefore, the limitation on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter is not contrary to the principle of proportionality, with the result that the third ground is not such as to result in the invalidity of Regulation 2019/1157.","paragraph_id":"para_479"},{"text":"125","paragraph_id":"para_480"},{"text":"It follows from all the foregoing that Regulation 2019/1157 is invalid in so far as it was adopted on the basis of Article 21(2) TFEU.","paragraph_id":"para_481"},{"text":"IV.   Maintaining the effects of Regulation 2019/1157 for a certain time","paragraph_id":"para_482"},{"text":"126","paragraph_id":"para_483"},{"text":"The effects of an act which has been declared invalid may be maintained on grounds of legal certainty, in particular where the immediate effects of the judgment finding such invalidity would give rise to serious negative consequences for the persons concerned (see, to that effect, judgment of 17 March 2016, Parliament v Commission, C‑286/14 , EU:C:2016:183 , paragraph  67 ).","paragraph_id":"para_484"},{"text":"127","paragraph_id":"para_485"},{"text":"In the present case, Regulation 2019/1157 being invalid with immediate effect would be likely to have serious negative consequences for a significant number of EU citizens, in particular for their safety in the area of freedom, security and justice.","paragraph_id":"para_486"},{"text":"128","paragraph_id":"para_487"},{"text":"In those circumstances, the Court holds that the effects of Regulation 2019/1157 must be maintained until the entry into force, within a reasonable period which may not exceed two years from 1 January of the year following the date of delivery of the present judgment, of a new regulation based on Article 77(3) TFEU and intended to replace it.","paragraph_id":"para_488"},{"text":"V.   Costs","paragraph_id":"para_489"},{"text":"129","paragraph_id":"para_490"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_491"},{"text":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraph_id":"para_492"},{"text":"1.","paragraph_id":"para_493"},{"text":"Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement is invalid.","paragraph_id":"para_494"},{"text":"2.","paragraph_id":"para_495"},{"text":"The effects of Regulation 2019/1157 are to be maintained until the entry into force, within a reasonable period which may not exceed two years from 1 January of the year following the date of delivery of the present judgment, of a new regulation based on Article 77(3) TFEU and intended to replace it.","paragraph_id":"para_496"},{"text":"[Signatures]","paragraph_id":"para_497"},{"text":"(\n *1\n ) Language of the case: German.","paragraph_id":"para_498"}],"word_count":14357,"cites":["C-291/12","C-156/21","C-157/21","C-490/10","C-626/18","C-626/15","C-659/16","C-793/19","C-794/19","C-817/19","C-37/20","C-601/20","C-694/20","C-70/18","C-128/22","C-5/16","C-477/14","C-286/14"],"sha256":"6947a815f8a98e301cdaffe0fa4f93b2f9da36081ba71927cf4f4fc9995777bd","source_url":"https://publications.europa.eu/resource/celex/62022CJ0061.ENG.xhtml.ECR_62022CJ0061_EN_01.html","fetched_at":"2026-10-03T01:41:26.455+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-61-22-62022cj0061","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-61-22-62022cj0061","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-61-22-62022cj0061","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-61-22-62022cj0061"},"hash":"sha256:0ec71192b62226bfdb7593459497fbcd92857038f92f16a22b236fa4dc562409","version":"legal-2026-10-23","expires":"2026-10-25T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-23+legal-2026-10-23+2026-10-23T14:34:08","content_hash":"sha256:0ec71192b62226bfdb7593459497fbcd92857038f92f16a22b236fa4dc562409","revalidate_after":"2026-10-24T17:04:52.377Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-61-22-62022cj0061","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-61-22-62022cj0061"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-61-22-62022cj0061"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-61-22-62022cj0061"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":7},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-61-22-62022cj0061","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-0751c369ec284e3c77effd0df3133e46","response_hash":"sha256:0ec71192b62226bfdb7593459497fbcd92857038f92f16a22b236fa4dc562409"}},"freshness":{"freshness_class":"stable","as_of":"2026-11-02T23:27:59.285Z","valid_for":604800,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-61-22-62022cj0061","note":"Oföränderligt objekt med hash. Får cachas länge.","tokens":32345}}