EN Official Journal of the European Union C 320/21

Opinion of the European Data Protection Supervisor on the modified proposal for a Council Regulation amending Regulation (EC) 1030/2002 laying down a uniform format for residence permits for third-country nationals.

(2006/C 320/10)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular its Article 41,

Having regard to the request for an opinion in accordance with Article 28(2) of Regulation (EC) No 45/2001 received on 11 May 2006 from the Commission;

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION

On 13 June 2002, in an effort to harmonize the format of residence permits issued by Member States to third-country nationals, the Council adopted Regulation (EC) No 1030/2002 laying down a uniform format for residence permits for third-country nationals (1). In the sixth recital of the regulation, Member States and the European Commission agreed to consider at regular intervals and according to technological developments what changes should be made in order to enhance the security features built into permits. Biometric features were given as an illustrative example.

On 24 September 2003, the European Commission proposed a Council regulation amending Regulation (EC) No 1030/2002 (2). This Regulation was proposed together with another proposal for a Council Regulation amending regulation (EC) 1683/95 laying down a uniform format for visas. The main goal of both proposals was to introduce biometric data (facial image and two fingerprint images of the holder) in these new uniform formats of residence permits and visas. Due to a number of technological uncertainties, the format of the residence permit (sticker or stand-alone card) was not defined. Following a consultation procedure, these proposals were submitted to the European Parliament.

On 10 March 2006, the European Commission submitted a modified proposal (hereafter ‘the proposal’) for a Council regulation amending Regulation (EC) 1030/2002. In this modified proposal, a stand-alone card was the format decided upon due to potential collisions between contact-less chips. A defined area (zone 16 according to the annex of the proposal) will also be offered to those Member States which intend to embed a contact chip in the residence permit dedicated to e-services.

The proposal for the residence permit is based on Article 63(3)(a) TEC. The EDPS stresses that a residence permit should not be considered to be a travel document. It is unfortunate that the 2003 proposal included proposals for the visa and residence permit in the same document as this may have raised some misunderstandings, although the aim was to adopt a coherent approach on biometric identifiers in the EU. The EDPS therefore welcomes the fact that the visa and the residence permit are no longer linked.

2. ANALYSIS OF THE PROPOSAL

2.1 General

The EDPS welcomes being consulted on the basis of Article 28(2) of Regulation (EC) No 45/2001. However, in view of the mandatory character of Article 28(2), the present opinion should be mentioned in the preamble of the text.

The proposal introduces the use of biometrics in the residence permit. The EDPS recognises the advantages of the use of biometrics, but stresses the major impact of the use of such data and suggests the insertion of stringent safeguards for any kinds of use of biometric data.

The EDPS welcomes the reasoning of the Council and of the Estonian government in particular to treat their citizens and third country residents equally, giving them access to e-services via ID-cards and residence permits (3). This sound statement also confirms the fact that the residence permit shall not be considered as a travel document per se.

2.2 Biometric features

As already underlined in several opinions of the EDPS (4) and of the Article 29 Working Party (5), the introduction and processing of biometric data for identity related documents need to be supported by particularly consistent and serious safeguards. Indeed biometric data are highly sensitive, due to some specific characteristics and present some risks in their implementation which have to be mitigated. In his opinion on the SIS II proposal previously mentioned, the EDPS has proposed a non exhaustive list of common obligations or requirements related to the specificity of such data as well as a common methodology and best practices for their implementation.

As biometric systems are neither accessible to all (6) nor completely accurate, readily available fallback procedures shall be implemented in order to respect the dignity of persons who could not provide readable fingerprints or could have been wrongly identified and to avoid transferring onto them the burden of the system imperfections.

The EDPS recommends that fallback procedures are developed and included in Article 2, paragraph 1 of the proposal. These procedures should neither decrease the security level of the residence permit nor stigmatize those individuals with unreadable fingerprints.

Article 4a of the proposal states that ‘Member states shall also include fingerprints in interoperable formats’. The EDPS recommends modifying this provision as follows so as to make it more accurate: ‘Member states shall also include two fingerprints in interoperable formats’. This clarification will reinforce the proportionality principle which shall be respected at all stages of this proposal.

According to the third recital of the proposal, the integration of biometric identifiers should follow the specifications set out in the ICAO document No 9303 on machine readable visas. As has already been stated, the residence permit is not a travel document. As underlined in the explanatory memorandum, the residence permit is usually considered to be an ID card for third country nationals. It is therefore logical that the same high security standards defined for national ID card should also be applied to the residence permit. The EDPS recommends therefore to delete the third recital and to define higher security specifications for the biometric features which will be stored in the residence permit. The reference made in the annex to the ICAO standards should also be replaced by high security specifications corresponding to the situations under which a residence permit is used.

2.3 Access and use of data

As a preliminary remark the EDPS welcomes the progress made by this latest proposal for respecting the principle of purpose limitation better. Indeed, according to the proposed modifications biometric features stored in residence permits shall only be used for verifying ‘the authenticity of the document and the identity of the holder by means of directly available comparable features’.

The first recital recalls the aim of the Amsterdam Treaty which among others is to confer the right of initiative to the European Commission in order to take the relevant measures on a harmonised immigration policy. It is therefore regrettable that the European Commission cannot use this opportunity in the proposal to clearly identify and define those authorities which have access to the data stored in the residence permit storage medium due to constitutional limitations. The EDPS recommends that the European Commission develop an appropriate procedure to create better harmonisation of the definition and the list of the competent authorities for carrying out checks on residence permits. This list of competent authorities is not only relevant for the Member State who issued the residence permit but also for the other Member States within the Schengen area where the third country resident might need to be identified.

This recommendation is even more important in view of a possible inclusion in the residence permit of an additional chip for e-services. This new element will no doubt increase the number of authorities which might have access to the residence permit. According to the EDPS, such a result is highly undesirable.

2.4 Comitology

Article 2 of the regulation lists the cases in which additional technical specifications for the uniform format for residence permits relating to the following shall be established in accordance with the comitology-procedure referred to in Article 7(2). The present proposal gives a further specification of the cases in which such decisions should be taken. These decisions will have a significant impact on the proper implementation of the principle of purpose limitation and the proportionality principle. The EDPS advises that decisions with a substantial impact on data protection such as access to and introduction of data, quality of data, technical compliance of storage medium, security measures for the protection of the biometric features, etc. should be made by way of Regulation, in accordance with co-decision procedure.

For all other cases with an impact on data protection, the EDPS should be given the possibility to advise on the choices made by this committee. The EDPS' advisory role should be included in Article 7 of the Regulation.

2.5 Electronic platform

As the residence permit is not a travel document, there is no consistent reason for following the ICAO standards and therefore to use a contact-less chip. This technology has not been proven to be safer than a contact chip and will only bring additional risks to the deployment of the residence permit.

According to the new proposed Article 4, the Member States could embed a second chip in the stand-alone card of the residence permit. This second chip would be a contact chip and be dedicated to e-services. The EDPS would like to specifically stress the inadequacy of such a proposal since it does not respect basic and elementary rules of security policy required for sensitive data.

This additional chip offers a full range of new applications and purposes for the residence permit card. The structure of the security protection profile of the first contact-less chip which will store biometric features can only be rigorously and properly defined in the light of the risks produced by the other purposes such as e-business and e-government applications. There is no guarantee indeed that these applications will not take place for example in a relatively unsafe environment for the contact-less chip. It would indeed be unfortunate if the use of this additional chip jeopardizes the security of the sensitive data stored in the primary chip. The EDPS strongly recommends therefore that the proposal defines the following elements:

— a limited list of purposes envisaged for the additional chip

— a list of data which will be stored in the additional chip

— the need for an impact assessment and a risk assessment of the co-existence of the two chips on the same stand-alone card

3. CONCLUSION

The EDPS welcomes this proposal which aims at better harmonising the EU immigration policy in general and the development of a uniform format for residence permit in particular.

The EDPS recognises the fact that the use of biometric features may improve protection of resident permits as well as fighting illegal immigration and illegal residence. However, the insertion of biometric data will contribute to these goals only if stringent safeguards for their use are implemented and only if their imperfections are mitigated with proper fallback procedures.

The EDPS recommends postponing the insertion of an additional chip for e-services purposes until complete impact assessment and risks assessment studies have been conducted and their results have been properly analysed.

Considering that while a residence permit is not a travel document it will be used in the Schengen area as an ID related document, the EDPS stresses the need for adopting highest security standards in line with the security specifications adopted by the Members States which are developing an e-ID card.

Concerning the residence permit development and implementation, technological choices with consistent impact on data protection should preferably be made by way of regulation, in accordance with the co-decision procedure. In other cases with an impact on data protection, the EDPS shall be given an advisory role included in Article 7 of the Regulation on the choices made by the committee foreseen by the proposal.

Done at Brussels on 16 October 2006 Peter HUSTINX European Data Protection Supervisor

(1) OJ L 157, 15.6.2002, p. 1.

(2) COM/2003/558 Final.

(3) As described in the Explanatory Memorandum

(4) Opinion of 23 March 2005 on the Proposal for a Regulation of the European Parliament and of the Council concerning the Visa Information System (VIS) and the exchange of data between Member States on short stay-visas, OJ C 181, 23.7.2005, p. 13.

Opinion of 19 October 2005 on three Proposals regarding the Second Generation Schengen Information System (SIS II) (COM (2005)230 final, COM (2005)236 final and COM (2005)237 final), OJ C 91, 19.4.2006, p. 38.

(5) Opinion No 7/2004 on the inclusion of biometric elements in residence permits and visas taking account of the establishment of the European information system on visas (VIS) (Markt/11487/04/EN — WP 96) and Working document on biometrics (MARKT/10595/03/EN — WP 80).

(6) Up to 5 % of people are estimated not to be able to enrol (because they have no readable fingerprints or no fingerprints at all).