Case C‑61/22
Detlev Sieber
v
Landeshauptstadt Wiesbaden
(Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden)
Judgment of the Court (Grand Chamber) of 21 March 2024
(Reference for a preliminary ruling – Regulation (EU) 2019/1157 – Strengthening the security of identity cards of EU citizens – Validity – Legal basis – Article 21(2) TFEU – Article 77(3) TFEU – Regulation (EU) 2019/1157 – Article 3(5) – Obligation for Member States to include two fingerprints in interoperable digital formats in the storage medium of identity cards – Article 7 of the Charter of Fundamental Rights of the European Union – Respect for private and family life – Article 8 of the Charter of Fundamental Rights – Protection of personal data – Regulation (EU) 2016/679 – Article 35 – Obligation to carry out a data protection impact assessment – Maintaining the effects for a certain time of a regulation which has been declared invalid)
1. Acts of the institutions – Choice of legal basis – Criteria – Existence of a specific legal basis – Regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement – Adoption on the basis of the specific provisions of Article 77(3) TFEU and not Article 21(2) TFEU
(Arts 21(2) and 77(3) TFEU; European Parliament and Council Regulation 2019/1157)
(see paragraphs 46, 49-56, 61)
2. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Obligation on the person responsible for processing personal data which could result in a high risk to the rights and freedoms of natural persons first to carry out an impact assessment – Obligation not applicable in respect of the adoption of a regulation which does not itself involve any processing of personal data – Infringement – None
(European Parliament and Council Regulations 2016/679, Art. 35(1) and (10) and 2019/1157)
(see paragraphs 66,67)
3. Fundamental rights – Charter of Fundamental Rights – Respect for private life – Protection of personal data – Taking and storage of fingerprints in the identity cards of EU citizens – Included – Threats to rights recognised by Articles 7 and 8 of the Charter
(Charter of Fundamental Rights of the European Union, Arts 7 and 8; European Parliament and Council Regulation 2019/1157, Art. 3(5))
(see paragraphs 70, 72, 73)
4. Fundamental rights – Charter of Fundamental Rights – Respect for private life – Protection of personal data – Regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement – Taking and storage of fingerprints in the identity cards of EU citizens – Interference in those fundamental rights – Limitations on the exercise of those rights – Whether permissible – Conditions
(Charter of Fundamental Rights of the European Union, Arts 7, 8 and 52(1); European Parliament and Council Regulation 2019/1157, Art. 3(5))
(see paragraphs 75, 76, 79, 81, 84, 90-92, 98-101, 104, 108-110, 119, 120, 123, 124)
5. Questions referred for a preliminary ruling – Assessment of validity – Declaration that a regulation is void – Declaration of invalidity of the regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement – Effects – Temporal limitation
(European Parliament and Council Regulation 2019/1157)
(see paragraphs 126-128, operative parts 1, 2)
Résumé
Having received a reference for a preliminary ruling from the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany), the Court of Justice, sitting in Grand Chamber formation, declares invalid Regulation 2019/1157 (1) on strengthening the security of identity cards of Union citizens, in so far as it was adopted on an incorrect legal basis. It notes, however, that the mandatory insertion in identity cards of two fingerprints, provided for by that regulation, is compatible, inter alia, with the fundamental rights to respect for private life and to the protection of personal data. The Court is therefore maintaining its effects until the entry into force of a new regulation, based on the appropriate specific legal basis, and intended to replace it.
In November 2021, the applicant in the main proceedings applied to the City of Wiesbaden (2) for a new identity card to be issued, requesting that it should not contain his fingerprints. The City of Wiesbaden rejected that application on the ground, inter alia, that, since 2 August 2021, the inclusion of two fingerprints in the storage medium of identity cards had been mandatory under the provision of national law which transposes, in essence, Article 3(5) of Regulation 2019/1157.
On 21 December 2021, the applicant in the main proceedings brought an action before the referring court against the decision of the City of Wiesbaden, seeking an order requiring the City of Wiesbaden to issue him with an identity card with no fingerprints being collected.
Since it had doubts as to the lawfulness of the grounds of the contested decision, because, inter alia, it was uncertain whether the validity of Regulation 2019/1157 could itself be disputed, the referring court stayed the proceedings and asked the Court whether that regulation is invalid on the grounds that, first, it had been incorrectly been adopted on the basis of Article 21(2) TFEU instead of Article 77(3) TFEU, second, it infringed the General Data Protection Regulation, (3) and, third, it infringed Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. (4)
Findings of the Court
The first ground of invalidity: incorrect legal basis
As regards the respective scopes of Article 21(2) TFEU and Article 77(3) TFEU, the Court notes that the competence conferred on the European Union by the first of those two provisions to adopt the provisions necessary to facilitate the exercise of the right of citizens of the European Union to move and reside freely within the territory of the Member States (5) is subject to the powers laid down to that effect by the Treaties. Article 77(3) TFEU (6) expressly lays down such powers in relation to the adoption of provisions concerning passports, identity cards, residence permits or any other such document issued to citizens of the European Union for the purpose of facilitating the exercise of the right to move and reside freely.
It is true that Article 77(3) TFEU falls within the title of the TFEU which concerns the area of freedom, security and justice and the chapter entitled ‘Policies on border checks, asylum and immigration’. However, it follows from Article 77(1) TFEU that the European Union is to develop a policy with a view to ensuring the absence of any controls on persons, whatever their nationality, when crossing internal borders, to carrying out checks on persons and efficient monitoring of the crossing of external borders, and to the gradual introduction of an integrated management system for such borders. The provisions (7) referred to in Article 77(3) TFEU form an integral part of any such EU policy. As regards EU citizens, those documents enable them, inter alia, to certify that they benefit from the right to move and reside freely, and therefore to exercise that right. Consequently, Article 77(3) is capable of providing the basis for the adoption of measures relating to those documents if such action appears necessary to facilitate the exercise of the right to move and reside freely.
That interpretation of the scope of Article 77(3) TFEU cannot be invalidated either by the historical development of the Treaties in relation to the European Union’s competence to adopt measures relating to, inter alia, passports and identity cards, or by the fact that that provision states that it is to apply ‘if the Treaties have not provided the necessary powers’.
In that regard, the Court notes, first, that it is true that the Treaty of Lisbon removed the provision (8) which expressly excluded the EU legislature from having recourse to Article 18(2) EC (now Article 21(2) TFEU) as the legal basis for the adoption of, inter alia, ‘provisions concerning passports [and] identity cards’. However, at the same time, that treaty expressly conferred on the European Union a power to take action in that field, in Article 77(3) TFEU, making the adoption of measures in that field subject to a special legislative procedure and, in particular, to unanimity in the Council.
In those circumstances, that removal cannot mean that it would from then on be possible to adopt provisions concerning passports and identity cards on the basis of Article 21(2) TFEU. On the contrary, according to the Court, it follows from the historical treaty development that, by means of Article 77(3) TFEU, the authors of the Treaties intended to confer on the European Union a competence for the adoption of such provisions intended to facilitate the exercise of the right to move and reside freely, which is more specific than the more general competence laid down in Article 21(2) TFEU.
Second, the Court interprets the statement that Article 77(3) TFEU is to apply ‘if the Treaties have not provided the necessary powers’, as meaning that the powers referred to are conferred not by a provision with a more general scope, such as Article 21(2) TFEU, but by a provision which is even more specific.
From that, the Court infers that Regulation 2019/1157 could be adopted on the basis of Article 21(2) TFEU only if the purpose or the main or predominant component of that regulation were to fall outside the specific scope of Article 77(3) TFEU, which concerns, for the purposes of facilitating the exercise of the right to move and reside freely, the issuing of passports, identity cards, residence permits or any other such document.
It follows from the purpose and main components of Regulation 2019/1157 that that regulation falls within the specific scope of Article 77(3) TFEU. Consequently, by adopting that regulation on the basis of Article 21(2) TFEU, and having done so in accordance with the ordinary legislative procedure, the EU legislature had recourse to an incorrect legal basis, which is such as to result in the invalidity of that regulation.
The second ground of invalidity: infringement of Article 35(10) of the GDPR
Noting that Regulation 2019/1157 does not undertake any operation applied to personal data, but merely provides for Member States to carry out certain processing operations where an application for an identity card is made, the Court finds that Article 35(1) of the GDPR (9) did not apply when Regulation 2019/1157 was adopted. Since Article 35(10) of the GDPR establishes a derogation to Article 35(1) thereof, it was not possible therefore for the adoption of Regulation 2019/1157 to infringe Article 35(10).
The third ground of invalidity: infringement of Articles 7 and 8 of the Charter
In the first place, the Court states that the obligation to include two complete fingerprints in the storage medium of identity cards issued by Member States, laid down in Article 3(5) of Regulation 2019/1157, constitutes a limitation both of the right to respect for private life and of the right to the protection of personal data, enshrined in Articles 7 and 8 of the Charter respectively. (10) In addition, that obligation involves carrying out, in advance, two successive personal data processing operations, namely the collection of those fingerprints from the data subject, then the temporary storage of those fingerprints for the purposes of personalisation of identity cards, which also constitute limitations of the rights enshrined in Articles 7 and 8 of the Charter.
In the second place, the Court examines whether the limitations in question are justified and proportionate.
In that regard, it considers, first, that the limitations in question comply with the principle of legality and do not adversely affect the essence of the fundamental rights enshrined in Articles 7 and 8 of the Charter.
Second, as regards the principle of proportionality, the Court states, first, that the measure in question pursues a number of objectives of general interest recognised by the European Union, namely combating the production of false identity cards and identity theft, and the interoperability of verification systems, and that it is appropriate for attaining those objectives. The inclusion of fingerprints in identity cards makes it more difficult to produce false identity cards. It also makes it possible reliably to verify the authenticity of the identity card and the identity of the cardholder, thereby reducing the risk of fraud. As regards the objective of interoperability of identification document verification systems, the use of complete fingerprints makes it possible to ensure compatibility with all automated systems for the identification of fingerprints used by the Member States, even though such systems do not necessarily use the same identification mechanism.
Second, the Court considers that the limitations in question comply with what is strictly necessary in order to attain the objectives pursued.
As regards the very principle of including fingerprints in the storage medium of identity cards, it is a reliable and effective means of establishing, with certainty, a person’s identity. In particular, simply inserting a facial image is a less effective means of identification than inserting two fingerprints in addition to that image, since various factors may alter the anatomical characteristics of the face. The process used to collect those fingerprints is, in addition, simple to implement.
As regards the inclusion of two complete fingerprints rather than just some of the characteristics of those fingerprints, apart from the fact that the second option does not offer the same guarantees as a complete fingerprint, the inclusion of a complete fingerprint is also necessary for identification document verification systems to be interoperable. Member States use different fingerprints identification technologies. The inclusion in the storage medium of the identity card of only certain fingerprint characteristics would therefore compromise the attainment of the interoperability objective.
Third, the Court considers that, having regard to the nature of the data at issue, the nature of the processing operations and the manner in which they are carried out and the safeguards laid down, the limitations thereby placed on the fundamental rights enshrined in Articles 7 and 8 of the Charter are not of a seriousness which is disproportionate when compared with the significance of the objectives pursued, but that, on the contrary, the measure in question is based on a fair balance between, on the one hand, the objectives it pursues and, on the other, the fundamental rights involved.