EUROPEAN COMMISSION Strasbourg, 17.4.2018 SWD(2018) 110 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT

Accompanying the document Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement {COM(2018) 212 final}

{SWD(2018) 111 final}



1Policy and legal context 1.1.Introduction 1.2.Policy and legal context 2Problem definition 2.1.What are the problems (and their drivers)? 2.1.1. Insufficient acceptance of ID and residence documents in another Member State 2.1.2. Document fraud and lack of authentication of ID and residence documents 2.1.3. Complexity of issuance and administration of ID and residence documents 2.2.How will the problem evolve? 3Why should the EU act? 3.1.Legal basis 3.2.Subsidiarity: Necessity of EU action 3.3.Subsidiarity: Added value of EU action 4Objectives: What is to be achieved? 5What are the available policy options? 5.1.What if there is no EU action? 5.2.Policy Option ID – format and security of ID cards 5.3.Policy Option RES – format and security of residence documents 5.4.Policy option PROCESS – process regarding the issuance of ID cards and residence documents, as well as Member States sharing information about the related processes

6What are the impacts of the policy options? 6.1.Impacts of the options for ID cards 6.2.Impacts of the options for residence documents 6.3.Impacts of the options for PROCESS 7How do the options compare? 7.1.Comparing the options for ID cards 7.2.Comparing the options for residence documents 7.3.Comparing the options for PROCESS 7.4.How sensitive are the preferred options to using different weights for the criteria? 8Preferred option 8.1.The preferred options 8.2.Combined impact of the preferred options 8.3.REFIT (simplification and improved efficiency) 9How will actual impacts be monitored and evaluated? Annex 1: Procedural information Annex 2: Stakeholder consultation Annex 3: Who is affected and how? Annex 4: Analytical methods Annex 5: Scope of initiative (ID cards and residence documents) Annex 6: Consequences to problems identified

Annex 7: Policy Options - details Annex 8: The preferred option(s) - details Annex 9: Monitoring and evaluation of impacts - details Annex 10: Impact of preferred option per Member State Glossary Term or acronym Meaning or definition DOVID Diffractive Optical Variable Image Device EES Entry Exit System eID Electronic identity eID card Card with a chip on which electronic information for identification purposes can be stored eIDAS Regulation electronic IDentification, Authentication and trust Services FADO False and Authentic Documents Online GDPR General Data Protection Regulation ICAO International Civil Aviation Organisation ID card Identity card MRTD Machine readable travel document MRZ Machine readable zone OVD Optically variable device PKD Public key directory PKI Public key infrastructure PRADO Public register of travel and identity documents REFIT Regulatory Fitness and Performance Programme RFID chip Radio-frequency identification chip SIS Schengen information system SLTD Stolen and Lost Travel Document TCN Third country national TCN FAM Third country national family members TFEU Treaty on the functioning of the European Union YEA Your Europe Advice



1Policy and legal context 1.1.Introduction European citizens are increasingly mobile. They make hundreds of millions of journeys every year within the EU or entering and leaving its external borders. More than 15 million EU citizens reside in another EU country and more than 11 million working in another Member State. European students and young people increasingly use their free movement rights to do an ERASMUS in another EU country or when joining the European Solidarity Corps. The free movement of EU citizens relies on ID cards, which can be used by EU citizens as travel documents and also to establish their identity when exercising their right to live in another country ('mobile citizens') after three months. These mobile citizens – and their non-EU family members – also receive documents to prove their residence in their host Member State. These documents (registration certificates, residence cards and permanent residence cards for EU citizens and their non-EU family members) are not travel documents. However, residence cards of non-EU family members of mobile EU citizens used together with a passport give the right to travel visa-free if they travel with or join the EU citizen. There is no standardisation at the EU level of the information all these documents contain and/or of their security features. There are currently about 250 different versions of ID cards and residence documents in valid circulation in the European Union. This diversity creates insufficient acceptance by public and private entities of both ID cards and residence documents. Insufficient security of both ID cards and residence documents for non-EU family members hampers the free movement of citizens and undermines security within borders. In addition, there have been a number of problems reported related to the issuance, handling and administration of all these documents. This initiative addresses difficulties in exercising free movement and aims to increase security within the European Union. Security and free movement are inherently linked: in the Preamble to the Treaty on the European Union the Member States are “resolved to facilitate the free movement of persons, while ensuring the safety and security of their peoples, by ensuring an area of freedom, security and justice (…)” This Impact Assessment is based on the findings of an external study, a public consultation and stakeholder consultation and other sources. (See Annex 5 for more details on the scope.) 1.2.Policy and legal context Europeans consider free movement to be a major achievement of European integration. It covers the right to enter and leave territory of another Member State, as well as the right to stay there. Measures regarding free movement are inseparable from measures introduced to guarantee security within the European Union. The most relevant EU instrument in this context is the Free Movement Directive (2004/38/EC) which establishes the conditions for the exercise of the right of free movement and residence (both temporary and permanent) for EU citizens and their family members. This directive lays down that, in conjunction with a valid ID card or passport, EU citizens and their family members may enter and live in another Member State (subject to exceptional restrictions) and may register for residence documentation. The Directive, however, does not regulate the format and minimum standards for ID cards to be used to enter or leave EU Member States. In the same way, it does not provide for specific standards as regards residence documents issued to EU citizens and their non-EU family members. EU law already provides for standards for security features and biometrics in passports and travel documents issued by Member States and on uniform formats for visas and residence permits for third country nationals. These standards are also used for local border permits and permits issued in the framework of the EU legal migration acquis, but not for the documents under consideration in this impact assessment. In 25 October 2017, a new common design for the residence permit for third-country nationals was adopted to improve its security features. This ‘uniform format’ may be used for another purpose, such as for residence and permanent residence cards for third country national family members of mobile EU citizens ("TCN FAM cards"), if this purpose is clearly indicated on the card. The Schengen Borders Code sets out procedures for checks on EU and non-EU nationals at the external borders. Border guards have to perform these checks quickly and efficiently and rely on technologies/databases, training and guidance tools to enable them to verify travel documents, including identity cards. The recent amendment of the Schengen Borders Code makes it obligatory to check all persons and verify their travel documents, regardless of the holder’s nationality, against the Schengen Information System (SIS) and the Interpol Stolen and Lost Travel Document (SLTD) database. The security features of electronic identity (eID) documents should also be checked when technically possible. Holders of eID documents should be able to use e-gates, freeing up time for border guards to handle other travellers.

To contribute to the modernisation of the border management at the external Schengen borders, to help Member States dealing with ever increasing number of travellers, and to identify over-stays and contribute to EU security, a Regulation establishing an Entry Exit System (EES) has been recently adopted. This system will register the entry and exit data of non-EU nationals crossing the EU’s external borders who are admitted for a short stay into the Schengen area (maximum 90 days in any 180-day period) including third country family members of EU citizens exercising their free movement rights . However, this system will not register data for third country family member holders of a residence card, as their right to stay/reside is not limited to a short term stay. The system is expected to be operational by the end of 2020. Again in relation to short stays, in November 2016 the Commission presented a legislative proposal to establish the European Travel Information and Authorisation System (ETIAS). This initiative aims to improve control over who is allowed to enter the EU and who is admitted for a short stay into the Schengen area (maximum 90 days in any 180-day period), including the third country family members of EU citizens exercising their free movement rights. Like the EES, the ETIAS legislative proposal excludes the registration of both EU citizens and of third country nationals holding a residence card , given that their rights to reside are different. The initiative addresses applications of ID card and residence documents where a person is mobile, crosses a border, travels or temporarily or permanently moves to another country with the intention of residing there. When moving to and residing in other countries certain actions, such as registration at school or opening a bank account are carried out. Usually this will require personal interaction. The ID cards and residence documents addressed should help citizens do these things. In the future a lot of these actions, however, might be carried electronically. ID cards and residence documents can also serve as platforms for electronic functionalities such as eID , digital signature, etc. which are key to accessing electronic services abroad. ID cards and residence documents are also used by EU citizens and their non-EU family members to identify themselves to public and private entities for instance at polling stations during European elections or to buy specific products. They enable the completion of certain administrative formalities online (e.g. birth certificate requests) or access to certain services (waste recycling facilities in a municipality), for instance . This initiative supports this development, however improvement of cross-border access to services is mainly tackled by other initiatives, such as the eIDAS Regulation and the Single Digital Gateway. Technical and data protection requirements will have to be respected, so that the main functionalities of ID cards and residence documents (proof of identity and residence and travel documents) are not jeopardised. The eIDAS Regulation ('Regulation on electronic Identification and Authentication Services’) entered fully into force on 1 July 2016. This Regulation introduced the EU-wide mutual recognition of electronic identifications in access to public services. The eIDAS Regulation helps citizens moving to another Member State by requiring electronic identification means to be recognised in another Member States. One of the means is to include electronic identification on the identity card. The Regulation is aligned with the objectives of the Digital Agenda for Europe , one of the seven pillars of the Europe 2020 Strategy and thus plays a key role in achieving growth and security in the European Union . In May 2017 the Commission submitted a proposal for a Regulation on the Single Digital Gateway . The General Approach reached in November 2017 states that users should have easy, online access to information about, inter alia, travel documents (including ID cards) and residence documents via the ‘single portal’. The European Commission 2018 Work Programme (REFIT) includes the presentation of a legislative initiative to improve the security of ID cards and residence documents of EU citizens and of their non-EU family members. There is support for an initiative on ID cards and residence documents at political level. This initiative addresses the Council's repeated calls to improve the security of identity and residence documents. Most recently, in 2017, it adopted two sets of Council Conclusions, recognising the crucial importance of secured travel and identity documents to tackle the phenomenon of travel document fraud, underlining the importance of security standards of ID cards and residence documents, and called on the Commission to ensure appropriate follow up. These Conclusions followed the Commission's presentation of its: ·2017 citizenship report, in which the Commission committed analyse policy options to improve the security of identity cards and residence documents ·2016 Communication on security and mobility , in which the Commission highlighted the need for quality and certainty in identity documents, and ·2016 Action Plan on document security of December 2016 , in which the Commission addresses travel document fraud including identity cards and residence documents. The European Parliament in its Resolution on the EU Citizenship Report 2017, adopted on 12 December 2017, supported the possibility of introducing a European identity card in addition to national identification documents. At technical level there is a more mixed response to a potential initiative, depending on the Member State and the part of the national administration answering. Member States experts in charge of borders largely support harmonisation of security features of ID cards and residence cards, whereas national experts from the FREEMO expert group (in charge of free movement) support to a lesser extent harmonisation of the security features for ID cards and residence documents. EU citizens and their family members responding to the open public consultation were largely in favour of an EU intervention on ID cards and residence documents largely support the idea of an EU intervention. Around 70% of respondents supported it for ID cards, with almost 75% supporting strong or very strong security features. 70% would even support a European format for ID card. Certain civil society organisations support Member States phasing out of paper-based identity cards as soon as possible and argue for minimum harmonisation as regards security features and format but without the need ‘that the ID cards should necessarily look exactly the same’. More details from the stakeholder consultations are presented in Annex 2.



2Problem definition

Figure 2.1 Problem Tree – Initiative on ID and residence documents 2.1.What are the problems (and their drivers)? 2.1.1.Insufficient acceptance of ID and residence documents in another Member State Up to 370 of the 440 million citizens in 26 Member States (DK and UK do not issue ID cards) could hold national ID cards. While Member States are obliged to accept each other’s (at least 86 currently circulated versions of) national ID cards as travel documents on the basis of the EU free movement acquis, there are no EU identity document standards (see Table 2.1 in Annex 5 for examples of national ID cards issued). Member States do not apply a common format, minimum standard information or minimum production standards. Public and private actors must nonetheless all treat all these ID cards, of variable quality, as being of equal evidential value. This creates problemsbecause of the inconsistent design and information provided, it is often challenging even to identify ID cards as such and verify they are validly issued. This causes citizens to be wrongly turned away at the border or refused boarding on flights, and to be unable to access public or private services they are entitled to. These problems discourage citizens from exercising their rights to move freely in the Union. Along with the issues of security and authentication considered below, this means that despite the legal obligation to recognise each other's documents, in practice ID cards issued in one Member State are often not accepted in another. Compared to ID cards residence documents have a narrower function and use. They are usually not used as stand-alone documents but in combination with an identity document to register with an administration, access a service or TCN family members to cross a border without a visa. The order of magnitude of the problems associated with residence documents is therefore somewhat narrower than those for ID cards. It is estimated that there are at least 181 different types of residence documents issued in the EU with no consistent terminology applied, great variety in their format, the information they bear, and – if needed – their security features. Not all residence documents include the most relevant data (e.g. date and place of issue). Regarding residence documents for EU citizens there are at least 15 Member States and regarding TCN FAM residence documents 10 Member States where no translation of the title to another EU language is provided. Not every Member State issues all the various types of residence documents, and certain residence documents, in particular registration certificates, are still very often issued on plain paper (see Annex 5, Table 2.3 for more details). There is also some considerable confusion over the legal status and the distinctive role of the various types of residence documents. This confusion and inconsistency among residence documents creates problems for mobile EU citizens when they have to prove their residence in other Member States. As regards insufficient acceptance of documents, there is only indirect evidence, as no public or private entity collects statistics on this. The indirect evidence relies upon citizens affected by this who subsequently report this incident directly to us or via Your Europe Advice, SOLVIT, consultations, REFIT, surveys or other channels. What can be said is that dozens of non-acceptance cases have been reported very regularly throughout the years and that certain incidents of non-acceptance can be attributed to documents issued by certain Member States. Of the 250 respondents to the open public consultation, over a third reported difficulties regarding acceptance of their national ID cards as proof of ID when dealing with public and private services. Consequences The problems related to the lack of acceptance of ID and residence documents have interrelated consequences for mobile EU citizens, authorities, including border guards, and private sector entities (for more details see Annex 6 – sections 2 and 3). - Difficulties with document acceptance cause delays for citizens when using national ID cards as proof of identity or residence documents as proof of residence to access basic social services (healthcare, childcare etc.), banking and other services in other Member States. - The use of differing residence documents for TCN family members at borders increases delays or even exposes people to the risk of being wrongly refused entry or passage. For instance Italian and Greek paper ID cards are frequently rejected at certain border checks (e.g. in UK, Germany and Spain). The fact that border control officials are not always familiar with the various identity documents in circulation can also result in more profound consequences, or at least, delays and inconvenience for citizens when exercising their right of free movement due to lengthy document checks. Furthermore, there is a constant and costly need for border control agencies to provide training to officials to deal with the huge variety of different documents and to ensure they are able to detect fraudulent documents. 2.1.2.Document fraud and lack of authentication of ID and residence documents Swift and reliable authentication of a document and its holder requires a high quality document. While there are currently no EU standards for national identity documents, there are international standards for machine readable travel documents set out in DOC 9303 by the International Civil Aviation Organization (ICAO) providing for global interoperability in respect of documentary recognition, authentication and security characteristics. The Passport Regulation which harmonises the security features for passports in the EU, applies this standard, including the parts on biometric e-passports. This can be considered the current state-of-the-art in the EU for secure travel documents. Some ID cards and TCN FAM residence cards are not up to those standards regarding document security (see Annex 5, Tables 2.2 and 2.3 for more details). This does not allow for their swift and reliable authentication. Some Member States include biometric data in their ID cards and TCN FAM residence cards and others do not. Physical security features also differ, such as printing techniques and UV (ultraviolet) features. This makes fraud based on the ‘weakest link’ easier. Documents are particularly prone to fraud where they lack key security features or where issuing Member States do not ensure that the digital data contained in the contactless (RFID) chip are sufficiently protected. Forged cards and the prevention and detection of fraud create costs for private and public sector entities.

Three Member States issue ID cards without a functional machine readable zone as set by ICAO DOC 9303 for travel documents. Seven countries issue ID cards without a RFID chip. Thirteen Member States do not include any biometric data. Facial images and fingerprints – included in passports – provide assurance in cases where there is a doubt on the identity of the card holder. Machine readability and RFID chips facilitate this. (See Annex 5, Table 2.2 for more details.) For ID card holders, this negatively affects the interoperability and efficiency of border checks across the EU. It means that citizens cannot use them in automatic e-gates, and it means that they are much more likable to be tampered with, much harder to authenticate, thus more susceptible to being misused, which increases the likelihood that they will be rejected wrongly, or that false or misused documents will be allowed to circulate. Security in the Union is reduced, citizens are disadvantaged and risk and cost for authorities and private service providers is increased. Where TCN FAM residence card are falsified exploiting weak document standards, their bearers could be wrongly exempted from the visa obligation at external borders. A wider security risk to the European Union stems from the fact that, once a person has entered the Schengen Area using a fraudulent document, they can travel on to other Schengen Member States without in principle facing another document inspection. The European Border and Coast Guard Agency (FRONTEX) has collected statistics on fraudulent ID and residence documents over the last years. The number of documents detected does not seem very high (38 870 ID cards from 2013-2017) but this is based upon a small sample of random checks. Fraudulent ID cards (all reasons) 2013-2017 Top 3 countries 2017 Counterfeit ID cards Top 3 countries 2017 Stolen blank ID Top 3 countries 2017 Photo substituted ID 38 870 Romania (775) Italy (752) Greece (636) Italy (816) France (26) Poland (7) Italy (367) Greece (185) France (45) In its 2017 annual risk analysis, FRONTEX underlined that EU Member States’ ID cards with fewer security features were facing a higher risk of document fraud, in particular those issued by Italy, Greece, Romania and Bulgaria. Less secure travel documents can be more easily forged and so are more vulnerable than well-secured ones”. In its analysis FRONTEX specified that Italian ID cards are the most reported fraudulent documents, especially counterfeited and stolen blanks Italian ID cards. The impostor phenomenon recorded 9% increase and remained the second most reported fraud type in 2017. There is a 4% decrease on the external EU borders, while there is a 9% increase on intra-EU/Schengen movements. Top nationalities using fraudulent documents are Ukrainians, Moroccans, Albanians and Iranians, while fraudulent EU documents, in particular ID cards were the most commonly used. Air routes accounted for 74% of all detections, while UK (38%), Germany (13%) and Ireland (12%) are the most affected points of destinations. By type of fraud the trend depicts 71% on document fraud versus 29% on identity fraud. In the later, 72% are impostors and 28% are fraudulently obtained genuine documents. Counterfeits represent 53% of the document fraud and are more frequent on less secure documents. According to FRONTEX while at the external borders passports are slightly on the lead, on the intra-EU/Schengen movements the ID cards are by far the most fraudulently document used. The precise cost of fraud is difficult to estimate but the costs to citizens who are victims of identity theft , and/or their insurers can be considerable, especially when their ID is used to make purchases or carry out monetary transactions. 0.8 M individuals in the EU are affected by identity theft (0.2% of the EU’s population) with an average individual loss of around EUR 250 or EUR 2bn at the EU level. ID documents account around 16% of all types of ID thefts , and the average time victims spend trying to resolve each incident of ID abuse theft is up to 12 hours and the average out-of-pocket cost to victim to resolve each identity theft abuse is estimated EUR 354. In order to ensure a high level of border control, access to sensitive security relevant document data such as fingerprints, is required. Keys to read this data need to be exchanged among Member States on a bilateral basis. However, the keys to access data change over time and they are not always communicated immediately to the relevant national authorities. Member States do not cooperate enough in other areas affecting the swift authentication of ID and residence documents. For example, the Council has established two web registries on documents issued by Member States, but many ID cards and residence documents are missing in practice because Member State authorities do not always update them in practice. Consequences - Since the authenticity of documents needs to be checked carefully, border checks can take longer when documents lack up-to-date format and security features. For instance, while Directive 2004/38 provides that EU citizens can travel between Member States on the basis of their ID cards, Italian citizens reported being advised by UK border officials to apply for a passport if they want to enter the UK the next time as the Italian ID card was “just a piece of paper”, thus being confronted with obstacles to their free movement. In turn, paper documents make it more challenging to identify whether the person is the rightful holder. - Even though Member States are supposed to exchange information about all the documents they issue, including valid ID cards, this is often not done. In the Czech Republic, 10 valid ID card versions have accumulated over time and never been phased out. The information shared about them is incomplete, which does not assist easy authentication of documents, which leads both to obstacles to free movement and to security risks. - In France and Spain, security gaps have been identified by imposters using genuine ID documents, a much larger problem than counterfeited documents. In France, these are often African migrants who speak French fluently, pretend to be French nationals or residents. - In Poland, human traffickers often help Ukrainian citizens enter Poland, obtain a Polish ID and use that to travel to the UK. Swedish police officers confirmed problems with imposters, stating that it is increasingly difficult to detect cases where persons use genuine documents belonging to another, similar-looking person, i.e. confusing the ‘life image’ and the image on the document. Biometric data, such as fingerprints and facial image, are important to stop this.

2.1.3.Complexity of issuance and administration of ID and residence documents Apart from the legally incorrect application of the free movement acquis by Member State administrations which is not the subject of this initiative, problems arise for EU citizens regarding the issuance and administrative handling of ID cards and residence documents. For example, currently not all Member States offer their citizens the opportunity to request ID cards outside their country . As a consequence, EU citizens need to travel back to their home country to request ID cards, resulting in considerably higher costs. Summing up the number of expatriates from those seven countries suggests that approximately 4.6 M people are affected by this. Most Member States also charge either shipping costs or a considerably higher fee when documents are requested from abroad. The typical timeframe for obtaining registration certificates varies between Member States. Six EU countries usually issues registration certificates quickly following a successful application. However, EU citizens can face delays and excessive formalities when applying in other countries. Examples of this have been reported in BE, DE , ES, IE , SE , and UK. Although documents are more likely to be issued more quickly if citizens are able to apply for ID and residence documentation online, very few Member States do this. Consequences Delays can cause applicants significant inconvenience if they are obliged to wait weeks or even months to obtain a registration certificate. An example from the YEA database concerns a Bulgarian national who moved to Belgium: “[the Bulgarian national] was told that this procedure [to obtain the registration certificate] may last 2 months. Moreover, his bank is asking him [for] this registration certificate to enable him to operate with his bank account where he is paid, and his boss also requires him this document.” In Spain the procedure for obtaining a residence document requires three separate visits to the immigration office before family members can obtain a card. The family member requests an appointment at the first visit. Once a letter with an appointment is received, s/he must make a second visit to provide fingerprints, signature, photo and pay a fee. At the third visit, s/he collects the card (this can be done by a proxy). An NGO representative underlined that the abovementioned process can be expensive for applicants. This is especially the case if they do not live in a regional capital and need to travel an hour or more to visit the immigration office, which also entails a potential cost in terms of lost working days. For further details see Annex 6 – section 3. 2.2.How will the problem evolve? It is assumed that some aspects of the problems identified will improve slightly with time because Member States will gradually upgrade their documents. For instance Bulgaria has announced to introduce new ID cards in 2018. Belgium will add mandatory fingerprints to the national ID cards by 2019. Greece has started a tendering process to replace its current paper ID cards. Moreover, EL, IE, PT and RO have recently established the uniform format for their TCN FAM residence documents (see Annex 5, Tables 2.2 and 2.3 for a more detailed overview about the state of play). Such improvements are more likely to address the problems of non-acceptance based on appearance because it may be sufficient to issue documents with a more modern "look and feel" to make documents more acceptable to private or public services, whereas to actually tackle the problem of document fraud more ambitious changes would be needed with substantial inclusion of security features (including biometrics). It is clear that Member States have not consistently converged on such improvements, as while a number have recently updated the appearance of their ID cards, they have not been consistent in the security features that they have introduced, and some have not introduced biometrics, for instance. Moreover, as the general security level is shaped by the weakest link, a single country issuing weak documents remains sufficient to undermine the overall EU security. For instance, an unsecure Italian ID card could be misused to enter Germany by plane. Since there is e a clear upward trend as regards mobility and travel, it is also likely that any gains through unilateral upgrades will be outweighed by the absolute increase in fraud expected through this development. Mobility area Period Increase/Decrease/Totals Mobile EU citizens (taking residence) Workers 2014-2015 +5.3% (2014: 11.1 million, 2015: 11.3 million) Retired 2015 (2015: 1.4 million) Students (Erasmus +) 2015-2016 +15.4% (2015: 628 000,2016: 725 000 movers) Travel Travel (all reasons) 2014-2015 -0.9% (2014: 1.17 billion, 2015: 1.16 billion trips) Border crossings (EU/EEA/CH citizens only, entering and leaving Schengen zone) 2020-2025 +4.2% (2025: 586 million crossings total (417 air; 112 land; 57 sea)) In 2015 residents (aged 15 and above) from within the EU28 made an estimated 1.2 billion trips for personal or business purposes which crossed an internal or external EU border. As the volume of EU travel continues to rise, the pressure on the external border and on checks within the territory will also continue to grow. Simultaneously, the number of EU citizens working or studying in a Member State other than that of their nationality is also steadily increasing. In 2015 around 11.3 million EU28 citizens were working in a Member State other than their country of citizenship. This is an increase of 5.3% on 2014. Intra-EU mobility reached an annual growth rate of over 5% in recent years and this trend is expected to continue. It is estimated that up to 19.6 million citizens could be affected by problems related to residence in another Member State in the three years up to 2019. Furthermore, due to a high number of citizens travelling in the EU, many citizens could be affected by problems in relation to ID cards when travelling from one Member State to another, or when they reside outside their home country. Public authorities and private service providers such as banks or airlines will continue to have to handle a large and evolving variety of ID and residence documents presented to them by EU citizens, which requires continuous training as an ongoing cost. Even if mutual understanding regarding currently validly circulating documents improves the cost of maintaining awareness of diverse and probably further diverging documents will remain. The missing and inconsistent security features in documents will continue to raise security and border management related issues. Even if it is assumed that Member States will incrementally adapt to new technology when issuing such documents and gradually improve the security of ID and residence documents, the remaining inconsistency of identity and residence documents, the lack of simultaneous and coordinated action and the lack of consistent and timely communication, will make the overall problems with acceptance and verification persist. Although the number of fraud detections fluctuates instead of showing a clear upward trend , it can still be expected that pressure on border control officials will be higher in the foreseeable future due to the upward trend in the number of journeys, increased security concerns, increased requirements for document controls and the general pressure on maintaining efficiency while keeping costs down.

The legitimacy of the principle of free movement will continue to be undermined by its abuse by counterfeiters and fraudsters. Action in relation to ID cards is particularly urgent from a security perspective as otherwise the situation is likely to deteriorate. As a result, while there is an increasing need to use identity and residence documents and, security gaps notwithstanding, the considerable resultant difficulties in exercising free movement rights will remain or increase. 3Why should the EU act? 3.1.Legal basis The Treaties provide for the necessary legal basis for the initiative. Article 20 TFEU (Part Two of TFEU on non-discrimination and citizenship of the Union) establishes Union citizenship and Article 21 TFEU refers to the right to move and reside freely within the territory of the Member States. Article 21 provides for the possibility for the Union to act and adopt provisions with a view to facilitating the right to move and reside freely within the territory of the Member States if action to attain this objective is necessary to facilitate the exercise of this right. The ordinary legislative procedure applies. Article 77 (3) TFEU (in Part Three, Title V of the TFEU on an area of freedom, security and justice) participates to the policies on border checks, asylum and migration and provides that the Council may adopt provisions concerning passports, identity cards, residence permits or any other such document if action by the Union should prove necessary to facilitate the exercise of the right to move and reside freely (Article 20(2)(a) TFEU) if the Treaties have not provided the necessary powers. In such cases a special legislative procedure applies: the Council shall act unanimously after consulting the European Parliament. The UK and Ireland have a flexible opt-out from the legislation adopted in the area of freedom, security and justice, and Denmark does not take part in the adoption of measures pursuant to this Title. 3.2.Subsidiarity: Necessity of EU action Individual Member States have been using their scope for initiatives to improve security and support the right to free movement in relation to ID and residence documents. For example, some Member States have established web registries allowing both public and private sector entities to check the authenticity of documents. However, a common approach to enhancing the security features of documents and establishing the data that documents should provide as a minimum is still missing and results in continuing problems across Member States and an open door to document fraud. If measures are not taken consistently they will result in even more problems for European citizens, national authorities and businesses. National measures are subject to the obvious limitation that their direct benefits are largely or exclusively confined to a single Member State (or several Member States in case of data exchange and other forms of cooperation), whereas addressing systemic problems in relation to free movement clearly requires action with an EU-wide dimension. There are also real obstacles to free movement (e.g. no acceptance of the visa exemption for TCN family members), a lack of awareness with respect to ID and residence documentation (e.g. no awareness that residence documents are not travel documents), and administrative delays in respect of ID and residence documentation (e.g. a long waiting time after submitting an application and before receiving registration certificates). Border control authorities and private sector entities are often ill-informed about specific ID and residence requirements, while databases are not updated and the exchange of information does not take place regularly. The national authorities or private sector services lack information about ID cards and residence requirements elsewhere in the EU. Relying on uncoordinated national initiatives is likely to entail a lack of focus on improving the sharing of information and practical cooperation between EU Member States. Member States cannot improve the current situation by acting alone, since the underlying problem is that cross-border acceptance and verification of ID and residence documents is hampered due to the problem drivers and root causes described in section 2.1. There is a high likelihood that such problems will persist. Economic discrepancies in Europe, and citizens’ increased mobility, knowledge of foreign languages and ease of travel across Europe drive citizens to use their ID and residence documents to exercise their rights. Since the unanimously adopted Council Conclusions from 2005, where Member States unanimously agreed to work together to establish minimum security standards for national identity cards, including inter alia “to use as a starting point the technical specifications established for the integration of biometrics in the passport in accordance with Regulation (EC) 2252/2004” , there have been a number of political agreements and repeated calls to improve the security of identity and residence documents. Only recently another set of Council Conclusions have been adopted that underpin the same issue. The Commission itself has made successive calls for such action, including in its Communication on Security and mobility in 2016, not to mention its Action Plan on document security of December 2016 . Despite some progress having been achieved, a considerable number of countries still issue weak documents (13 Member States use no biometrics for their ID cards and at least 16 do not use the uniform format including biometrics for their family member residence documents). It is therefore unlikely that any further non-binding guidelines, political agreements or recommendations (either from the Council or the Commission) would achieve sufficient progress and address the problems within an acceptable time frame. Stakeholder views: While the Council Conclusions of 2017 (and with them the security and border protection community) stress the need to reinforce document security, within the free movement community 15 out of 19 Member States, agreed that common security features and a certain or partial harmonisation are required for ID cards. 15 out of 17 Member States also support this for residence documents, and in particular for TCN FAM residence cards. Some Member States authorities in the field of free movement did not express any preferences for action (e.g. in BE, SE) or favoured the status quo (e.g. authorities in AT, PL) as they did not feel that there are serious obstacles to free movement due to the diversity of ID and residence documentation. Some of them were not aware of any of their citizens experiencing problems in other Member States, and several others argued that the EU should not intervene on ID cards, as it is a national identity issue.

Over two thirds of the EU citizens who responded to the open public consultation were for an ID card harmonised at EU level, and a huge majority (almost 9 out of 10) of those with experience of residence documents saw the advantages of EU harmonisation. 3.3.Subsidiarity: Added value of EU action EU action can add considerable value in addressing the challenges mentioned above. The current situation affects the security within the EU and at its borders and the opportunity for EU citizens fully to enjoy their free movement rights. External borders and the European Union as a whole have been placed under considerable strain lately. Ongoing challenges have underlined the inextricable link between free movement of persons inside the EU and robust external border management. Measures to enhance security checks on persons entering the EU and to improve external border management are weakened if the main instrument for identifying citizens is problematic even within a national context. Looking at the ‘weakest link’, it is essential that all Member States comply with minimum standards as regards ID and residence document security and features in order to maintain an adequate level of security within the EU and its borders. The issuance, handling and administration of ID and residence documents are a national matter. Nevertheless, good administrative practices around the issuance of documents should be effectively communicated across the EU and properly trained at EU level. As a result, the objectives of any initiative to remedy this situation could not be achieved at a national level and there is a strong argument for EU action. Even if the documents originate from a national competence (notably ID cards), they all have an intrinsic European dimension because of their interconnection with the exercise of free movement. 4Objectives: What is to be achieved? The objectives of this EU policy initiative are to: ·improve security within the EU and at its borders, and ·facilitate and promote the EU citizens’ and their family members’ right to move and reside freely within the EU. Such goals complement and reinforce each other, as security and free movement are inherently linked. The abolition of internal border controls in the Schengen Area relies on authorities in the Member States following certain minimum standards with regard to document and border security. The specific objectives of the initiative are to reduce document fraud, to improve the acceptance and authentication of the ID and residence documents and improve the identification of people based on them, in answer to the problems detailed in section 2.1. In particular document fraud (see section 2.1.2) is aggravated by the wide variety of documents and their lack of security features. Another specific objective is to raise awareness among citizens, national authorities and the private sector about the documents issued, and the right to free movement linked to them. A cross-cutting overall goal is to simplify daily life for EU citizens, cut red tape and lower costs both for citizens and private and public entities, by reducing administrative barriers for citizens and their family members related to the use of ID cards and residence documents, in the exercise of their rights, as well as in the issuance and administrative processes related to the documents. For example, citizens and their family members are often unable to access certain services with their ID and residence documents due to the national authority or private sector actor’s non-acceptance of those documents. They are at once faced with administrative delays and hurdles when requesting documents. This results in costs and barriers for them. The various policy options analysed here intend to achieve these objectives and tackle the problems identified in section 2.1 and the individuals concerned by this initiative are EU citizens and their family members. 5What are the available policy options? Currently there is no significant hard or soft lawat EU level as regards format, security or process related issues for ID cards and residence documents issued to EU citizens and their family members. It is therefore neither necessary nor possible to include an option in this assessment which could aim to do less or simplify an existing EU framework. 2 out of 28 Member States do not issue ID cards (Denmark and the United Kingdom). Their citizens travel in the EU with their passports which already include security features and therefore do not pose the security risks under discussion. Six Member States do not issue registration certificates for EU mobile citizens. Nationals of those Member States could encounter occasional problems when exercising their free movement rights without these documents. However, requiring these Member States to introduce or reintroduce such documents would place a substantial administrative burden both on citizens and on the authorities, for modest benefit to a limited group of citizens. As a consequence, this is excluded from all the policy options considered. There is no evidence to support the case for optional harmonisation in this context, as this would not tackle the problems arising from the current diversity of documents. Member States might not feel sufficiently encouraged to adopt the necessary changes on an optional basis. The intervention logic with a view to the policy options chosen is presented in Figure 5.1.

5.1.What if there is no EU action? The baseline scenarios for the format and security issues for ID cards and residence documentation, and for the process related issues are to maintain the status quo. Three baselines are therefore considered. At baseline, the situation remains unchanged. Pressure at external borders will increase, and more persons are going to try to irregularly enter the EU and want to exercise free movement by means of document fraud (see also section 2.2). ID cards and residence documents continue to be regulated differently across EU Member States. Based on the experience of the Council Conclusion of 2005, voluntary alignment is not happening or does so at such a slow a pace that it constitutes a security risk within the EU. There is no evidence that there will be swift convergence regarding the choice of substrate (paper, laminated paper, plastic) and format (ID-1, ID-2, A4 paper document), and security features will still vary providing an opportunity for forgers to target the documents of those countries where the standards are relatively low. Currently, only 2 out of 13 Member States issuing ID cards not compliant with ICAO Doc 9303 plan to upgrade their ID cards’ design in the near future. Member States' policies towards harmonisation will still show discrepancies between EU Member States as policies will continue to be uneven and asymmetrical. For instance, the DE authorities recently introduced e-gates at airports, but due to lacking interoperability, the e-gates can only be used with DE national ID cards. Moreover, differences will be kept among Member States with regard to the use of ID cards to access public and private sector services. Under the “no policy change” scenario, some measures for residence documents are also already underway, e.g. DE and ES both recently abolished residence cards for EU citizens, but there is no coordination whatsoever of these policies. Cross-border use of electronic identity (eID) functions was boosted by EU legislation (eIDAS Regulation). Nevertheless the development of an eID infrastructure is technically challenging and expensive, and a lot of Member States are still quite slow in introducing national ID cards with eID function. If the status quo is maintained, this could lead to continued uncertainty among citizens as to whether they can use eID features with their cards in other Member States. There are currently big differences with regard to the process-related aspects of ID and residence documents, and these will remain or even increase with the growing mobility of citizens. Whereas several countries already have online application systems for residence cards , the administrative inconveniences, in particular the considerable delays around the issuance of residence documents will also remain. Furthermore, some nationals will continue to not be able to request an ID card when being abroad. OPTIONS TO FULFILL THE OBJECTIVES OF THE INITIATIVE Figure 5.1: Intervention logic of options (ID and residence documents) PROBLEMS GENERAL OBJECTIVES SPECIFIC OBJECTIVES DRIVERS OF THE PROBLEMS ADDRESSED BY THIS INITIATIVE 5.2.Policy Option ID – format and security of ID cards Option ID SOFT) Non-legislative measures related to ID cards The suggested soft law measures would be mainly directed at preparing stakeholders in the best possible way to deal with the legislative diversity in the EU. Awareness raising measures across the EU to inform citizens better about various obligations and rights in relation to their documents (e.g. through the Your Europe Portal, the Single Digital Gateway and information campaigns with target groups in frequent contact with mobile citizens such as universities and employers from other EU countries). Soft reinforcement of the authority of SOLVIT centres within their national administration in order to simplify the daily lives of mobile citizens in relation to residence documents. Capacity-building and training organised through an EU-wide network. For example, training organised via FRONTEX, CEPOL or OSCE for border control officials.

Enhanced administrative cooperation can focus on engaging in best practice sharing with regard to detecting fraudulent documents and practices and on exchanging views about having the necessary equipment in place to check ID cards. With regard to the practicalities of enhanced administrative cooperation and the further refinement of the technical standards for the documents, the expertise of the Article 6 Committee will be of particular use and beneficial to discuss matters in relation to security features of ID cards and residence documents. Other groups composed by Member States experts, such as the FREEMO expert group or Schengen related structures, should also be involved. Databases or web registries use by Member State authorities shall be fostered. For example, the role of FADO could be further developed as an information sharing tool. To designate a structured Points of Contact network, as main entry and exit points for information exchange in each EU Member State, to provide a route for enquiries from another Member State being routed through to the correct authority. To inform citizens about the usefulness and functioning of eID functions on their (ID or residence) documents to access public and private services, in particular as regards the possibility for cross-border transactions in the Internal Market (which are facilitated by the eIDAS Regulation). To exploit the full potential of cards with eID functionality across the EU, the interoperability of eID infrastructure of the Member States will also need to be improved. The respective forums and working groups will be used for this. Recent policy developments for managing EU sector specific “identities” of citizens (e.g. social security, taxation, and student mobility) will be taken into account. Option ID 1) ID SOFT) + Minimum common requirements for ID format and security In addition to the non-legislative measures under ID SOFT this option involves legislative action at EU level to promote the minimum harmonisation of ID card features. This largely mirrors the approach taken for passports of EU citizens. This will address the objective to improve internal security but also facilitate free movement. Firstly, it is required that the ID or identity card should actually be named as such (rather than other terms currently used in some Member States). Secondly, Member States shall require that ID cards are regularly renewed for security reasons. A maximum validity period of 10 years for ID cards is proposed (except where under national law facilitation for a specific age group is foreseen, i.e. senior citizens; see Annex 5, Table 2.2 for more details on validity regimes). This option also includes adopting a format with some common features such as the information on the card and minimum security features taking into account ICAO Doc 9303 (see Annex 7, Table 5.1 for detailed list of mandatory features). Member States can however freely choose the colour of the ID card. Given the key objective to improve the security of ID cards as travel documents, a mandatory RFID chip including biometrics (facial image mandatory, fingerprints optional) is proposed. The EU data protection acquis shall apply to all aspects of the ID cards and adequate safeguards and protections will be provided for citizens in order to ensure compliance with fundamental rights as provided by the Charter of Fundamental Rights of the European Union (“the Charter”). The data contained in the chip shall be described in a closed list and be protected in its integrity, authenticity, and security. A purpose limitation should be included for the use of the biometric features in IDs, such as that provided in Art. 4 Regulation 2252/2004: "the biometric features in passports and travel documents shall only be used for verifying: a) the authenticity of the document; b) the identity of the holder by means of directly available comparable features when the passport or other travel documents are required to be produced by law". Exceptions and safeguards must be provided for cases where fingerprints are required from vulnerable persons, to ensure their rights under EU law and the Charter of fundamental rights are upheld, particularly regarding children and individuals who are unable to provide fingerprints. In this sense, the same rules shall apply as for passports: "children under the age of 12 years are exempt from the requirement to give fingerprints" (Art 1(1) para 2a (a) Regulation No 444/2009 amending Council Regulation No 2252/2004. Moreover, in order to ensure the access and accuracy of the data as provided under Article 8(2) of the Charter, the proposal would ensure that data subjects right under GDPR fully apply and guarantee the data subject's right to effective remedies available to challenge any decisions, which shall in any case include an effective remedy before a court or tribunal in line with Article 47 of the Charter, without prejudice to the rights under the general data protection regime. Optional elements can be added as required in the light of the national provisions, such as the address of the holder, the national emblem, etc. Member States could also enter details, for instance numbers which are used for e-government, tax identification, personal identification number or social security. Member States could also incorporate a dual interface or a separate contact chip for additional eID functionality . Such additional storage shall comply with ISO standards and in no way interfere with the RFID chip for biometrics. In parallel but not addressed here (as at this point in time it is considered premature to completely replace physical ID cards by digital identification in particular for travelling throughout Europe), Member States may also develop fully digital mobile phone based identification solutions. Member States can also look into the integration of format features that render the ID cards more accessible and user-friendly to people with disabilities, such as visually impaired persons. A requirement will be introduced to phase out all documents currently in circulation and which do not meet the requirements suggested under this option by a fixed deadline. The deadline should allow sufficient time for the authorities and citizens to cope with the transition to new documents. This option would require that all previous non-compliant versions of ID cards are phased out within 10 years after entry into force of the EU measure. Member States not producing ID cards with a properly functional machine readable zone (MRZ) according to ICAO shall shorten this time period to five years in order to achieve the desired effects more quickly. Option ID 2) ID SOFT) + ID 1) + Common format for ID cards In addition to the measures under ID SOFT and ID 1) this option represents a more ambitious approach with measures to harmonise all key features of national ID cards beyond ICAO requirements. The card will bear the EU emblem and the colour will be fixed. The inclusion of fingerprints will be mandatory. The phasing out of currently circulating old documents will follow the same approach as under option ID 1). Option ID 3) ID SOFT) + EU ID cards in addition In addition to the non-legislative measures an alternative legislative instrument to ID 1) and ID 2) can provide Member States with the option to adopt an EU identity card in addition to their national ID cards. This EU ID card can be specifically created to serve the purposes of the rights as Union citizen.

The format and security of these additional EU ID cards follow the completely harmonised features as laid out in option ID 2). The production of the cards would still rely upon the Member States. National ID cards are not addressed by this option. None of the old currently circulating national ID cards will be required to be phased out. 5.3.Policy Option RES – format and security of residence documents A potential legislative instrument can lay down requirements for only one, some or all of the different residence documents (see Annex 5, Table 2.3 for more details). With the exception of TCN FAM residence documents which are used as a visa waiver, there is no evidence suggesting the need to distinguish the different residence documents. Option RES SOFT) Non-legislative measures related to residence documents Soft law measures related to residence documents follow a similar path to the one under ID SOFT) and would include similar activities (Your Europe, Single Digital Gateway, SOLVIT, training, enhanced administrative cooperation, FADO, etc.) and actors (FRONTEX, FREEMO expert group and other Member State expert groups etc.). Regarding residence documents, awareness-raising will specifically focus on: (i) residence requirements; (ii) the procedure for obtaining different forms of residence documents; (iii) rights and duties in regard to residence documentation. Option RES 1) RES SOFT) + Harmonise a limited amount of residence document data This option will require some mandatory features in addition to the non-legislative measures under RES SOFT). First, the use of the document title as referred to in Directive 2004/38/EC (registration certificate, document certifying permanent residence, residence and permanent residence cards to family members of a Union citizen). The document title in the national language shall be repeated in at least one other (maximum two) official languages of the institutions of the Union, in order to facilitate the recognition of the document. Second, the document number, name (surname and forenames(s)) of the holder, date of issue, and place of issue will be required. There will be no other mandatory requirements, such as regarding the substrate, format, printing technique, etc. On an optional basis, other features could be added (e.g. date and place of birth of the holder, nationality of the holder, sex of the holder, address of the holder, date/signature/issuing authority, date/signature/document holder). The validity of documents will not be affected by this option, because the intervention is too minor to justify quicker replacement of non-compliant TCN FAM cards. The replacement of valid residence documents of EU citizens could create legal uncertainties in relation to Directive 2004/38/EC, and is therefore excluded (no phasing out). Option RES 2) RES SOFT) + RES 1) + Common format for TCN FAM residence documents As only TCN FAM residence documents act as visa waivers, there is a substantive argument that only these should be improved. In addition to soft law measures (RES SOFT) and a harmonisation of a limited amount of residence document data (RES 1) this option therefore suggests harmonising TCN FAM residence documents. TCN FAM residence cards and permanent residence cards will draw on the specifications set out in the ICAO document 9303 and use the common uniform format for residence permits, including biometrics (both mandatory facial image and fingerprints). (See Annex 7 Table 5.2 for a list of all mandatory and optional features.) As for ID cards, the collection of personal data under this option should be implemented with strong fundamental rights checks, guarantees and balances and ensure full compliance with the Charter of Fundamental Rights of the European Union and applicable data protection legislation, including the rights of the data subject and right to effective remedy. Moreover, insofar as this option entails the mandatory collection of fingerprints relating to minors, measures shall provide for robust fundamental rights safeguards and protection measures in light with Article 24 of the EU Charter on Fundamental Rights . The card will be made entirely of a substrate compliant with ICAO Doc 9303 (lasting for at least 10 years), using specific printing techniques and be a specific colour. Documents not compliant with any of the mandatory elements based upon the uniform format as stipulated by the latest legislation (Regulation (EU) No 2017/1954) should be phased out within 10 years. However, Member States, whose current TCN FAM residence documents do not even comply with the older uniform format under Council Regulation (EC) No 380/2008 will need to phase those documents out within 5 years after the proposed legislation enters into force. No phasing out for residence documents issued to EU citizens. Option RES 3) RES SOFT) + RES 1) + Common format for all residence documents

In addition to the requirements under RES SOFT) and RES 1) this option will involve establishing a harmonised common format not only for TCN FAM cards but for all types of residence documentation as referred to by Directive 2004/38/EC. The harmonised format will be again the uniform format used for residence permits (see RES 2). Due to their impact on border and other security, phasing out is again required for old non-compliant TCN FAM residence documents. The validity of existing residence documents issued to EU citizens should not be touched upon for legal reasons, even if their format will be harmonised (see RES 1). There will be no phasing out under RES 3) for residence documents issued to EU citizens. 5.4.Policy option PROCESS – process regarding the issuance of ID cards and residence documents, as well as Member States sharing information about the related processes Option PROCESS SOFT) Promote more and better options for requesting and receiving documents and improving Member States sharing information about related processes This option includes the promotion of online application tools. When promoting such online tools, security requirements will be carefully taken into account, such as the need to have at least one physical contact with the applicant when issuing a ID and residence document including biometric data. Moreover, state-of-the-art safeguards regarding data security and protection need to be respected. Moreover under this option, Member States should step up the sharing of information and views on issues they all face relating to the production, issuing and use of ID cards and residence documents. Furthermore, experiences regard the abolition of certain types of documents can be exchanged (e.g. Member States stopping the production of residence cards for EU citizens and the phasing out of old versions of ID cards). The listed EU-wide fora, such as the FREEMO expert group (see also ID SOFT and RES SOFT) will also be better used to exchange Member States experiences in this regard. Option PROCESS 1) PROCESS SOFT) + Issue ID cards through consular networks of all Member States A potentially effective solution to mobile EU citizens’ problem of renewing ID cards is to issue ID cards through the consular network. In addition to the soft law under PROCESS SOFT, PROCESS 1) will thus require the Member State consular networks to issue ID cards to their mobile citizens on a mandatory basis. This will be linked to the requirement not to charge citizens more for this service than the costs in the home country for requesting ID cards (except for the additional shipping costs). 6What are the impacts of the policy options? This section explains the impacts of the given set of policy options described above in comparison with the dynamic baseline scenario (see also section 2.2 and 5.1). Actions and measures on ID cards and residence documents tackle different "instruments" (types of documents with different functions, uses and legal value) and cannot be compared with each other. Equally, process related issues cannot be compared with format related issues. Hence, there are no relevant interdependencies between them and the impacts of each "instrument/measure" for (a) ID cards, (b) residence documents and (c) process-related issues are therefore discussed and assessed separately. The impact assessment attends particularly to potential impacts on three groups: citizens, business including small and medium sized enterprises, and public administration. Member States’ authorities and the private sector are reluctant to share data regarding the production and issuance of national documents, as well as the costs associated with the use of those documents. As a result, precise quantification of impacts (in particular aggregate impacts) of the different options is hardly possible. It is however fair to assume that the costs of policy change and implementation for most options would be set off by the reduction of costs to citizens, business and public authorities. These costs are, especially for citizens, mainly ‘hassle’ costs , a very broad category of costs that vary greatly from individual to individual and as a result are even more difficult to quantify. Many of the implementation and operation-related costs are based on estimates of monetary costs and possible cost savings for public administrations and private service operators. In addition there could be considerable intangible gains and benefits. All options should have wider economic and social impacts. It is safe to assume that the more effectively hurdles for free movement are removed the more positive these impacts will be. Reduced constraints on cross-border mobility could potentially have benefits for a quite wide range of economic sectors. Whether SMEs are affected to the same extent as larger companies by facilitated freedom of movement is difficult to assess. Rendering documents more secure will also contribute to the level of security within the EU and the Member States, since it would be more difficult to falsify documents and to enter the EU based on falsified documents. Fraud in accessing social benefits should also be reduced. Moreover, this could also be a promoter of social inclusion with the affected individuals feeling they are treated on an equal basis to nationals of the host country and being generally able to access the same public and private sector services. As regards environmental impact, facilitation of free movement can increase air traffic, which would however be impossible to attribute directly to any option implemented. The environmental costs of a potentially increased plastic card production (depending on the option chosen) are rather low and negligible. Fundamental rights are also affected. There are three main rights affected by the policy initiatives: Article 45 of the Charter of Fundamental Rights of the EU (CFEU) on freedom of movement, and Article 7 CFEU on the respect of private life read and Article 8 on the right to the protection of personal data. We assume that all the policy option positively affect the right of freedom of movement and residence. By strengthening the security of ID and residence cards and dependent services, all policy options aim at facilitate free movement of persons and residence, particularly for TCN. Additionally, the policy options, particularly on the residence cards, present ancillary benefits/impact for other fundamental rights such as Articles 39 and 40 CFEU, since the exercise of political rights would be facilitated while residing in a Member State other than their country of origin. Moreover, some of the policy options will have a positive impact in Article 26 CFEU (the right to integration of persons with disabilities), as they will have a targeted positive impact by facilitating the reading of documents.

The processing, including collection, access and use of personal data falls under Article 8 of the Charter of Fundamental Rights of the European Union because it constitutes the processing of personal data within the meaning of that article. Accordingly, data protection including data security shall be implemented in light of the relevant EU acquis . Options, which require the processing of the personal data of citizens including collection, access and use of personal data, affect the right to the protection of personal data under the Charter. Interference with this fundamental right must be justified, and this will be analysed specifically in this section. The CJEU established the criteria for justification of such interference in the context of Regulation 2252/2004 in Case C-291/12 Schwarz v Stadt Bochum, ECLI:EU:C:2013:670. It recalled that limitations to Charter rights must be ‘provided for by law, respect the essence of those rights, and, in accordance with the principle of proportionality, [be] necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others’ and found that the objective ‘to prevent the falsification of passports and the second, to prevent fraudulent use thereof’ met those criteria. No derogation from the data protection regime is envisaged and clear rules, conditions and safeguards shall be considered as appropriate. In particular, nothing in these initiatives shall provide a legal basis for the centralised storage of data collected thereunder or for the use of such data for purposes other than that of verifying the authenticity of the document and the identity of the holder by means of directly applicable comparable features when the ID are required to be produced by law. 6.1.Impacts of the options for ID cards General impacts Free movement of persons: Through better awareness of rights ID SOFT) will have a positive impact on free movement of persons, including labour mobility. Laying down a limited harmonisation of national ID cards (ID 1) or a completely harmonised ID card (ID 2) will reduce the negative effects of the diversity of documents and improve the acceptance of IDs because e.g. paper-based ID cards will be replaced in Member States still issuing them. The effect of ID 3) is lower because national ID cards are not phased out, and thus the problems related to national ID cards remain. Reduction of document fraud: By enhancing administrative cooperation, such as exchanging information about fraudulent documents through FADO and more training (FRONTEX), ID SOFT) will reduce document fraud. ID 1) will require the addition of security features and make documents even less vulnerable regarding falsification. Under ID 2) fingerprints will be added and further reduce the likelihood of counterfeiting. In general ID 3) has a less significant positive impact than ID 1 and 2) because national ID cards are not phased out. Reduction of identity theft: ID SOFT) will help to reduce identity theft caused by ID cards (also as a consequence of its effect on reducing document fraud). The impact of the options ID 1) and ID 2) will be even more significant because the upgraded security features will help to tackle a root cause of identity theft. The effect of ID 3) is less significant because the other national ID cards are not phased out. Security (reduction of crime, fraud, terrorism): Soft law measures will help to reduce crime and improve security including at the borders through enhanced administrative cooperation, such as optimised information exchange between police forces. For combating all types of serious crime the availability of fingerprints on ID cards has added value because fingerprints could be checked against databases (e.g. Prüm checks, Europol Information System). ID 2) (where fingerprints are mandatory) has therefore a more positive impact than ID 1), also regarding the detection of criminals and the reduction of crime and terrorism. Although ID 3) also foresees mandatory fingerprints, its impact on the reduction of crime is again weaker than under ID 2) because national ID cards are not phased out. Regarding the reduction of fraud the effects of ID 1) and 2) will be more or less equal because – on the contrary to the security agencies - private and public services affected will not have access to fingerprints. Fundamental rights: Beyond reinforcing Article 45 CFEU, ID SOFT) will have a positive (albeit very limited) effect on the rights of persons with disabilities (Art. 26 CFEU) by creating a forum (e.g. drawing from the expertise of the Article 6 Committee) to discuss the specific needs of disabled persons (such as Braille for visually impaired) in relation to ID cards. All the legislative options will add to this effect by encouraging Member States to voluntarily opt for specific features on their ID cards that increase the accessibility for disabled persons. The exercise of fundamental political rights (Arts. 39-40 CFEU) as well as the exercise of the right of petition (Art. 44 CFEU) will be positively impacted by the soft law measures because better acceptance of ID cards will facilitate the participation of mobile EU citizens in elections or the launch of a petition through easier registration. All the regulatory options will have a positive impact in a similar extent. Both soft-law and regulatory options will improve the security of ID cards and reduce document fraud, which reinforces the individual’s right to liberty and security (Art. 6 CFEU) by enabling national authorities to better prevent and detect identity theft. The fundamental rights to a private and family life under Article 7 CFEU, and the right to the protection of personal data under Article 8 CFEU are negatively impacted, particularly by the regulatory options ID 1-3. Data processing will be involved in all options. ID SOFT) will not significantly change data processing as compared to the baseline. ID 1) will require biographical data and an obligatory facial image, which needs to be encrypted. For this purpose cryptographic keys need to be exchanged with the specific services (border guards, police). ID 2) and ID 3) will extend this requirement to fingerprints and certain biometric data will be collected. As this is currently not done under national ID schemes (though for national passports), more people will be affected in their protected rights. Nevertheless, it is established that the use of biometrics of the type proposed and accessible in the manner proposed (as under the Passports Regulation) are justified by the objectives of reducing travel document fraud, improving the acceptance and authentication of the ID and improving the identification of people based on them, and are proportionate to achieving these objectives, particularly in terms of extending their use to the entire EU population who possess national ID cards which can be used as travel documents. The question of how Member States set up their national databases to store biometrics is not touched upon by any policy option in keeping with the principle of the administrative autonomy of the Member States, though naturally any implementation will have to be compatible with EU law and the fundamental rights it protects. The right of the individuals to access their personal data, rectification and objection is not impacted by any of the options, and no derogation to the general data protection regime will be created. There is therefore no change as compared to the baseline under any option. Data processing activities by private services which might be accelerated through better acceptance of documents will only use biographical data which have been already used so far, i.e. none of the options will have a significant impact as compared to the baseline. In addition to the EU-wide mutual recognition of electronic identifications in access to public services , cross-border data use deriving from cards with eID functionality will require specific work on personal data safeguard mechanisms. Data processing activities by private services will be certainly fostered through better use of cross-border eID functionality (optional under ID 1), ID 2) and ID 3)). Should Member States opt for such functionalities this will bear additional risks which must be addressed by safeguards. Table 6.1 Summary table on the general impacts under the Policy Option ID

BL ID SOFT ID 1 ID 2 ID 3 Functioning of the internal market ·Free movement of persons 0 +/++ ++/+++ +++ ++ Security ·Reduction of document fraud 0 + ++ ++/+++ +/++ ·Reduction of identity theft 0 + ++/+++ ++/+++ +/++ ·Reduction of fraud 0 + ++/+++ ++/+++ +/++ ·Reduction of terrorism risk 0 + ++ ++/+++ +/++ ·Criminal’s chances of detection 0 + ++ ++/+++ ++ ·Reduction of number of criminal acts 0 + ++ ++/+++ +/++ ·Improve security including at the borders 0 + ++ ++/+++ +/++ Fundamental rights ·Liberty and security (Art 6 CFEU) 0 + + + + ·Private and family life (Art 7 CFEU) 0 0/- -/-- --/--- -- ·Protection of personal data (Art 8 CFEU) 0 0/- -/-- --/--- -- ·Integration of persons with disabilities (Art 26 CFEU) 0 + +/++ +/++ +/++ ·Political rights (Art 39-40, 44 CFEU) 0 +/++ +/++ +/++ +/++ Note: The evaluation is based on a scale of 10 steps from very negative impact (---) to very positive impact (+++) "0" indicates no change (i.e. neutrality) Impacts on citizens Reduction of administrative burden: With non-legislative measures (ID SOFT), citizens will be better informed about their rights and obligations (e.g. via the Single Digital Gateway) in respect to ID cards before relocating to another Member State and before engaging in intra-EU travel. Through soft law promoting a more and better use of (cross-border) eID functionality online procedures to make cross-border purchases can be further simplified. The additional elements under the legislative options can further reduce the administrative burden for citizens, (e.g. by making it possible to use e-gates at airports with an ID card). Since under ID 3) national ID cards are not phased out, the positive impact is not as high as for ID 1) and 2). Reduction of hassle costs: Under ID SOFT) citizens will continue to experience differences in respect to ID cards across the EU. Nevertheless, e.g. training measures for border guards should already reduce the hassle costs for citizens crossing borders. The potential cost savings to citizens (e.g. from quicker border checks) will increase with progressive harmonisation of ID cards (from ID 1 to 2). The exact amount, however, cannot be quantified. The benefits and cost savings of ID 3) to citizens are likely to be limited, since all Member States will likely still need also to accept national ID cards. Therefore, potentially many citizens would not apply for an (extra) EU ID card. Awareness: Citizens’ awareness is mainly improved through non-legislative measures (e.g. Your Europe and in the future the Single Digital Gateway). None of the legislative options has a large impact on awareness. Access to services: The impact of the different options is similar as for free movement. Access is facilitated with a similar (ID 1) or identical layout of ID cards (ID 2 and 3). Citizens can expect to face fewer problems when traveling to other Member States and in accessing private sector services (e.g. opening bank accounts or making use of other private/public services where an ID card is required). Quantification of these effects is however not possible. Compliance costs: Soft law implies no compliance costs for citizens. So does ID 3), since the additional EU ID card is voluntary. Under any legislative measure the implementation foresees that the production of cards with upgraded features is initiated as early as possible. Old not compliant cards will be in principle replaced naturally after they expire. However, to tackle the most imminent security features missing, a card will need to be replaced before the originally defined expiry date because it does not fulfil the requirements as referred to by the phasing out regime. This could also create some replacement costs to citizens in those cases when the country charges its citizens for a renewal of the card. However, a simple technical upgrade (such as from contact to contactless chip) should not render the production of a card more expensive. Replacement costs would be equally high under option ID 1) and ID 2) as the phasing out regime would impact on the same countries and citizens under both options. Social impacts: The impacts of the various options on employment levels and social inclusion generally mirror the impacts on free movement of persons. The higher the awareness about ID cards, the better their acceptance and the smoother their authentication, the more positive will be the effects for mobile EU citizens and their family members when integrating into the labour market and the social system of another Member State. Table 6.2 Summary table on the impacts on citizens under the Policy Option ID Impacts on citizens BL ID SOFT ID 1 ID 2 ID 3 Economic ·Reduction of administrative burdens 0 + ++/+++ ++/+++ +/++ ·Reduction of hassle costs 0 + ++/+++ +++ +/++ ·Awareness 0 + + + + ·Access to public and private services 0 + ++ ++/+++ +/++ ·Compliance costs 0 0 -/-- (15M+63M) -/-- (15M+63M)146 0 Social ·Employment levels 0 + ++/+++ ++/+++ +/++ ·Social Inclusion 0 + ++/+++ ++/+++ +/++ Note: The evaluation is based on a scale of 10 steps from very negative impact (---) to very positive impact (+++) "0" indicates no change (i.e. neutrality) Impacts on businesses Compliance costs: There are no compliance costs for companies under any option because any technical upgrades to read cards will be voluntary. Cost savings at pre-boarding checks and when opening a bank account: Private sector entities such as banks or airlines will continue to have to deal with a large variety of documents under ID SOFT) but awareness raising measures and training could speed the process up when dealing with EU mobile citizens. Currently, it takes banks longer on average to open a bank account for non-national EU citizens than for nationals due to longer background checks. This applies also to airlines carrying out pre-boarding checks on nationals and non-national EU citizens. If procedures were as quick for non-national EU citizens for nationals EUR 3.9M could be annually saved when opening a bank account and EUR 12.4M for pre-boarding checks. It can be assumed that ID cards under ID 1) are sufficiently harmonised to achieve the same impact as under full harmonisation under ID 2). The costs for private sector services of having to deal with an additional EU ID card under ID 3) would most likely be higher than any potential benefit to them from it. At best it can thus be assumed that ID 3) is cost neutral compared to the baseline.

Awareness: The proposed sector-oriented training sessions and the improved FADO functionalities (ID SOFT) should help raise awareness of the layout of the different types of documents. As they include the soft law measures the legislative options will have the same impact on awareness. Reduction of training costs: Training via associations as proposed under ID SOFT) will save costs invested in training. This will lead to more efficiency in handling different types of documents. The training costs of banks and airlines will be lower if ID cards comply with the ICAO standards as set out by policy options ID 1) and 2). Companies producing the cards: The companies will benefit from activities carried out under ID SOFT), e.g. awareness raising, the direct exchange of Member States and private sector association experts, as well as the information retrieved via the single digital gateway. ID 3) will offer an opportunity to companies to produce a limited number of fully harmonised EU ID cards which will not replace national ID cards. ID 2) will do this on a larger scale. Under ID 1) each Member State will do its own national tendering process based upon ID card requirements that will be Member State specific, and it is more likely that more companies across the EU will benefit from this situation. Table 6.3 Summary table on the impacts on businesses under the Policy Option ID Impacts on businesses BL ID SOFT ID 1 ID 2 ID 3 Economic ·Compliance costs 0 0 0 0 0 ·Cost savings pre-boarding checks - time 0 + ++ (12.4M/yr) ++ (12.4M/yr) 0 ·Cost savings in private services (bank) - time 0 + ++ (3.9M/yr) ++ (3.9M/yr) 0 ·Awareness 0 + + + + ·Reduction of training costs 0 + +/++ ++/+++ 0/+ ·Companies producing the cards 0 + ++/+++ ++ +/++ Note: The evaluation is based on a scale of 10 steps from very negative impact (---) to very positive impact (+++) "0" indicates no change (i.e. neutrality) Impacts on public authorities Costs of guidance, dissemination, awareness-raising, training: Soft law measures will build on existing structures and activities in the Member States and at EU level. Under ID SOFT) (as well as included under all legislative options) there will be certain costs for e.g. awareness raising and information campaigns, support for citizens’ requests, a Points of Contact system within Member States to facilitate exchange of information and checks on documents or an improved FADO (PRADO) web registry. Following the implementation of soft law measures national administrations and border control officials will be more aware of the layout, design, security features of documentation in other EU countries. Although not possible to determine exactly how this could also reduce cost, in particular by increasing efficiency in border and local administrations which issue and check documentation. EU-wide training workshops and capacity-building will be based on existing FRONTEX workshops. Increased training will have a positive impact on the detection of fraudulent documents. Such activities across the EU could cost around EUR 11 M per year. Costs of enhancing regulatory and advisory bodies: Enhanced administrative cooperation mechanisms will be via e.g. the Member States expert groups on document security and its sub-groups and the FREEMO expert group. The additional costs for tasking these groups will be marginal. Remove regulatory complexity: ID SOFT) will not remove any regulatory complexity. ID 1) will largely harmonise and ID 2) fully harmonise the Member States rules on format and security of ID cards, whereas ID 3) will even add further complexity by establishing another ID card with specific format and security features. Compliance costs – implementation: Under the legislative options ID 1) to 3) public administrations will have to invest administrative and financial resources, hardware and software updates in changing the format and security of ID cards. In particular the upgrade to chips and biometrics will add some costs. Nevertheless, equipment to issue passports is already available and can also be used for the issuance of ID cards. Under ID 1) at least 19 Member States will require a certain upgrade, whereas under ID 2) this is the case for all 26 Member States which currently produce ID cards. Under option ID 3) all Member States would need to establish a new card which – at the request of the citizens - would be issued in addition to the national ID cards. As option ID 2) and 3) establish a fully harmonised format for national ID cards, the production costs would be marginally higher than for ID 1). Moreover, the obligatory use of fingerprints would also increase these options’ overall implementation costs. The same reading equipment at border control points used for passports could be used for verifying biometric ICAO-compliant ID cards, meaning the cost of additional card reader infrastructure to fully implement policy options ID 1) to 3) would be marginal. Compliance costs (production) – phasing out: Member States either already fulfil the basic requirements or the phasing out of non-compliant ID cards will mostly coincide with the natural replacement cycle of usually 10 years. ID cards from EL, IT and FR do not possess fully functional machine readable zones (MRZ) and would thus incur higher additional costs because of the quicker phasing out foreseen under options ID 1) and 2). Moreover, a number of other Member States (BE, BG, CZ, ES, HU, RO, SI, SK) issue specific cards for senior citizens with longer or indefinite validity which – if replaced – would also bear some additional costs after the ten-year transition phase, again for both options ID 1) and 2). The total cost for phasing out in all cases will amount to EUR 778.3M. ID 3) does not foresee any phasing out and is thus cost neutral. Time savings – public services: Public services, such as national social security providers will continue to have to deal with a large variety of documents under ID SOFT) but those non-legislative measures will speed up processes. With increasing harmonisation of ID cards under ID 1) and 2) procedures can be as quick for non-national EU citizens as for nationals. ID 3) would not add anything here because another ID card would just add complexity. At best ID 3) will be cost neutral. Time savings – border control: Border guards deal with diverse ID cards. Through training of border officials, the use of FADO/PRADO and other measures ID SOFT) could save time and thus costs.

Simultaneously, however, border control authorities will further benefit from common features in ID cards, such as under ID 1) and 2), as this would substantially facilitate the procedures at borders and could again facilitate the detection of fraudulent cards, thus increasing security. It is shown that if ID cards were more largely harmonised and checks for non-national EU citizens would be as fast as for nationals , considerable cost savings of around EUR 17.1M per year could be obtained throughout the EU. Under ID 3) none of the current ID cards will be replaced but instead another document will be added to the numerous documents that are already subject to border checks. Access to social protection systems: The social protection systems will benefit from increased awareness of document formats and security features under ID SOFT), as this reduces scope for abuse. ID 1) and 2) will further reduce document fraud, whereas adding another document under ID 3) that will not replace other documents will not. Governance and good administration: Beyond removing regulatory complexity governance will benefit both from non-binding soft law, and from some harmonisation of ID cards because the authentication of the documents and the identification of persons will be improved. In online services eID functionality on ID cards could speed up bureaucratic processes, cut paperwork and reduce administrative spending. E-government: eID functionality will be optional under all options. Apart from general capacity building and contributions by research and innovation from non-legislative measures there is no additional effect from legislative measures. Table 6.4 Summary table on the impacts on public authorities under the Policy Option ID Impacts on public authorities BL ID SOFT ID 1 ID 2 ID 3 Economic ·Costs of guidance, dissemination and awareness-raising, training 0 - (11M/yr) - (11M/yr)157 - (11M/yr)157 - (11M/yr)157 ·Costs of enhancing regulatory and advisory bodies 0 -/0 -/0 -/0 -/0 ·Remove regulatory complexity 0 0 +/++ ++ - ·Compliance costs – implementation 0 0 -- --- --/--- ·Compliance costs – phasing out 0 0 --/--- (778.3M) --/--- (778.3M) 0 ·Time savings – public services 0 + ++ ++ 0 ·Time savings – border control 0 + ++ (17.1M/yr) ++ (17.1M/yr) 0 Social ·Access to social protection systems 0 + ++ ++ +/++ ·Governance and good administration 0 + ++ ++ +/++ ·E-government 0 + + + + Note: The evaluation is based on a scale of 10 steps from very negative impact (---) to very positive impact (+++) "0" indicates no change (i.e. neutrality) 6.2.Impacts of the options for residence documents General impacts Free movement persons: Soft law measures, such as awareness raising about the rights linked to residence documents , have a positive impact on the free movement of persons, including indirectly on labour mobility. The more harmonised residence documents across Member States are (from RES 1 to 3), the higher is the positive impact because the consequences of the diversity of documents are reduced. Reduction of document fraud: By enhancing administrative cooperation, such as exchanging information about fraudulent documents through FADO/PRADO and more training, RES SOFT) will reduce document fraud. The more security features are progressively added from RES 1) to 3) the less prone they are to counterfeiting. Security (reduction of crime, fraud, and terrorism): Soft law measures (e.g. training) will contribute to reducing crime and improving security within the EU and at its borders because administrations, border guards and police will be more aware about false residence documents. Streamlining formats for and adding security features under RES 2) and 3), such as mandatory fingerprints to TCN FAM cards, may be particularly beneficial to internal security. The main effects will be on border security. Fundamental rights: By creating more harmonised and robust TCN FAM cards the policy options RES 2) and 3) have clearly some impact on private and family life (Art 7 CFEU) because unjustified denial of their holders’ entry at the borders or their boarding of planes entering the EU will become less likely. By taking up the discussion in the relevant forum, such as the Member States expert groups on free movement and on document security RES SOFT) will have a positive effect on the rights of persons with disabilities (Art 26 CFEU). No additional effect will be achieved by the legislative options. Both soft-law and regulatory options will contribute equally to preventing the current forgery of documentation, which reinforces the individual’s right to liberty and security (Art. 6 CFEU) by enabling national authorities to better prevent and detect identity theft. The obligation to collect personal data affects the protection of Articles 7 and 8 CFEU. RES SOFT) will not significantly change data processing compared to the baseline. The harmonisation of the very limited amount of data for other residence documents (for EU citizens) under RES 1) will not change these requirements. Apart from the name of the holder, which is already an indispensable feature of any document, the minimum data proposed (title of the document, document number, place and date of issue…) are administrative data which aim to increase the acceptance of the documents by other stakeholders. Higher impacts on fundamental rights are anticipated by policy options RES 2) and RES 3), since they include an obligation to collect mandatory biometrics. The use of biometrics can have positive impacts on reducing the risk of mistaken identity and also contribute to addressing protection risks for children (such as children going missing or falling victims of trafficking). Because the collection, storing and processing of such data affects the fundamental rights of protection of private life and personal data as enshrined in the CFEU, any measures need to be implemented, corresponding to the safeguards already applied for the biometric data required under the Residence Permit Regulation with a set of complementary safeguards to fully comply with data protection acquis . This is particularly relevant for those cases where minors over the age of six are under options RES 2) and RES 3) will be required to provide fingerprints and other biometric features. Article 24 of the Charter emphasises that the best interests of the child must be a primary consideration in all actions public authorities and private actors take concerning children. This also