Opinion of the European Data Protection Supervisor on the draft Council Regulation (EC) laying down the form of the laissez-passer to be issued to members and servants of the institutions
Date: 2006-10-13
Institutions: European Data Protection Supervisor
Subjects: European official, data protection, identity document, personal data, protection of privacy, servant (EU)

C 313/36

EN

Official Journal of the European Union

20.12.2006

Opinion of the European Data Protection Supervisor on the draft Council Regulation (EC) laying
down the form of the laissez-passer to be issued to members and servants of the institutions

(2006/C 313/13)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular Article 286 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Article 8
thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995
on the protection of individuals with regard to the processing of personal data and on the free movement of
such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18
December 2000 on the protection of individuals with regard to the processing of personal data by the Com-
munity institutions and bodies and on the free movement of such data,

Having regard to the request for an opinion pursuant to Article 28(2) of Regulation (EC) No 45/2001
received from the Commission on 31 July 2006;

HAS ADOPTED THE FOLLOWING OPINION:

1. PRELIMINARY REMARKS

1.
The Commission sent the European Data Protection Supervisor (EDPS) the draft Council Regulation
laying down the form of the laissez-passer to be issued to members and staff of the institutions under cover
of a letter dated 26 July 2006. The EDPS interprets this letter as a request for an opinion pursuant to Article
28(2) of Regulation (EC) No 45/2001.

The Protocol on Privileges and Immunities (PPI) of

2.
the European Communities, adopted on
8 April 1965 and annexed to the Treaty establishing a single Council and a single Commission of the Euro-
pean Communities, in particular Article 7 thereof, provides that the Council shall prescribe the form of
Community laissez-passer (CLP), which shall be recognised as valid travel documents by the authorities of
the Member States. This text constitutes the legal basis for the processing of the data (Article 5(a) of Regu-
lation (EC) No 45/2001). The Council, which is the competent institution in this area, considers that the
CLP no longer meets, at the present time, the security standards required for this type of document and that
a complete overhaul is required in order to comply with the minimum standards of the ICAO (International
Civil Aviation Organisation) and those required of the European passport (in particular biometrics), using
new technologies to guarantee the greatest possible protection against falsification. For reasons of technical
expertise, the Board of Heads of Administration has asked the Commission to study this question.

3.
The EDPS considers it important to give an opinion on the proposal for a new CLP, since it envisages
the inclusion, in a storage medium, of biometric data in interoperable and machine-readable formats. This
opinion is the EDPS's opportunity to express his views on this issue, as he has already done previously in
his opinions on the VIS (1) and SIS II (2) programmes.

(1) Opinion of 23 March 2005 on the proposal for a Regulation of the European Parliament and of the Council concerning
the Visa Information System (VIS) and the exchange of data between Member States on short stay visas (COM(2004) 835
final), OJ C 181.

(2) Opinion of 19 October 2005 on three proposals on the second generation Schengen Information System (SIS II) (COM

(2005) 230 final, COM (2005) 236 final and COM (2005) 237 final), OJ C 91.

20.12.2006

EN

Official Journal of the European Union

C 313/37

Biometric data are of a distinctive nature because they relate to a person's behavioural and physiolo-
4.
gical characteristics and can make it possible to identify that person with greater accuracy. In the EDPS's
view, further processing falls within the scope of Article 27(1) of Regulation (EC) No 45/2001. Such proces-
sing must therefore be subject to prior checking by the EDPS, as it is likely to present risks to the rights and
freedoms of data subjects by virtue of the nature of the data.

2. ANALYSIS OF THE PROPOSAL

2.1 General comments

The EDPS is being consulted on the basis of Article 28(2) of Regulation (EC) No 45/2001. However,

5.
as that provision is binding, this opinion should be mentioned in the preamble to the text.

The EDPS welcomes the fact that he is being consulted on the proposal for a new CLP, since the
6.
proposal forms one aspect of the policy for improving travel documents and enhancing their security with a
view to making them more proof against falsification.

2.2 Biometric data

7.
The proposal for a new CLP introduces the possibility of processing a new category of data which
deserves special attention: biometric data. The EDPS recognises the importance of making the laissez-passer
more secure in order to combat falsification and the fraudulent use of these documents. However, the intro-
duction of biometrics and the corresponding processing of personal data must comply with a number of
principles, the purpose of which is to protect the fundamental rights and freedoms of persons, in particular
their rights with regard to the processing of their personal data. It is essential to comply with these princi-
ples in respect of the processing of biometric data which, by their very nature, give information on a specific
person, especially as certain biometric data can leave traces in persons' daily lives and can therefore be
collected without their knowledge (fingerprints, in particular).

8.
Furthermore, there is a constantly increasing tendency to make use of biometric data in European
Union information systems (VIS, SIS II, EURODAC, European passports, etc), without any concomitant close
examination of the risks involved and the guarantees required. The Article 29 Working Party considered
that data of this type [biometric] are of a special nature because they relate to a person's behavioural and
physiological characteristics and can make it possible to identify him or her unambiguously (1). The use of
biometric data must therefore be accompanied by the adoption of additional guarantees and enhanced
checking procedures.

The EDPS has already proposed, in an earlier opinion (2), that a list of common basic requirements
9.
should be drawn up, taking into account the fact that biometric data are sensitive by definition. It should be
possible to apply the list to any system of any kind which uses biometrics.

10.
In the same opinion, the EDPS stressed the importance of the enrolment phase for biometric
systems. In the proposal as it stands, the origin of the biometric data and the manner in which they will be
gathered are not described in detail. The enrolment phase is an essential step and it is not sufficient to
define it by means of annexes; it directly affects the outcome of the procedure, i.e. the number of false rejec-
tions or false acceptances which might ensue.

For example, the EDPS recommends that easily accessible fallback procedures (of a technical nature
11.
and relating to the right of access) should be established and implemented during the enrolment phase, so
that the dignity of persons unable to provide fingerprints acceptable to the system is respected.

(1) Working document on biometrics (MARKT/12168/02/FR — WP 80)
(2) Opinion of 19 October 2005 on three proposals on the second generation Schengen Information System (SIS II) (COM

(2005) 230 final, COM (2005) 236 final and COM (2005) 237 final), OJ C 91.

C 313/38

EN

Official Journal of the European Union

20.12.2006

Article 2 of the proposal for a Regulation states that the storage medium shall contain the personal
12.
data entered in the laissez-passer, a digitised facial image and fingerprints stored in interoperable formats. Article 4 of
the proposal states that the biometrics of the CLP shall be used only to check the authenticity of the document
and the identity of the holder by means of comparable features directly available. In the light of these two arti-
cles, the EDPS wishes to make the following comments:

— On 28 February 2005, the European Commission adopted a ‘Decision establishing the technical specifi-
cations on the standards for security features and biometrics in passports and travel documents issued
by Member States’. On 28 June 2006 it also adopted a ‘Decision establishing the technical specifications
on the standards for security features and biometrics in passports and travel documents issued by
Member States’; this Decision laid down additional technical specifications for the storage and protection
of the fingerprints required. The EDPS recommends that these documents should be referred to in the
Regulation as they concern the technical aspects of the biometric data, in particular the form of the
fingerprints and the facial image.

— As the CLP are intended to be used in third countries, interoperability between the European systems
and those of third countries must be guaranteed. The EDPS has already broached this issue in his
opinion on the VIS system (1). He would emphasise once again that the interoperability of systems must
not breach the purpose limitation principle of the processing of data, and that any proposal in that area
must be submitted to him.

— The proposal remains vague as to the possibility of storing fingerprints in an institutional database
which thus becomes a register of the CLP issued. The Article 29 Working Party emphasises in its
opinion 3/2005 (2) its opposition to the storage of biometric and other data of all the holders of a pass-
port within the EU in a central database of European passports and travel documents. The EDPS feels
that the same situation applies in the case of the CLP. The purpose of a CLP is to authenticate persons in
third countries when they cross the border. Creating and setting up a central database containing
personal data, in particular biometric data, of all persons authorised to receive a CLP is not justified,
would violate the basic principle of proportionality, and should therefore be avoided. This issue should
be distinguished from the processing of CLP application forms which are administered by the depart-
ment responsible for issuing the CLP; we will return to this question later.

As regards the security of the CLP, the machine-readable data page is in conformity with ICAO docu-
13.
ment 9303 Part 1 (machine-readable passports), and its mode of issue is in accordance with the specifica-
tions applicable to machine-readable passports laid down there, and with the minimum security standards
laid down in Regulation No 2252/2004.

2.3 Technical medium

14.
Article 2(2) of the proposal for a Regulation lays down that the CLP shall contain a storage medium
[…]. The storage medium shall have sufficient capacity to guarantee the integrity, authenticity and confidentiality of the
data. This wording is in line with a Resolution of the European Parliament of 2 December 2004 (3) and this
position is also supported by the Article 29 Working Party (4).

(1) See above page C 181/26.
(2) Opinion 3/2005 on the implementation of Council Regulation (EC) No 2252/2004 of 13 December 2004 on standards

for security features and biometrics in passports and travel documents issued by Member States.

(3) European Parliament legislative resolution on the proposal, submitted by the Commission, for a Council Regulation on
standards for security features and biometrics in EU citizens' passports (COM(2004)0116 — C5-0101/2004 —
2004/0039(CNS)),
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:52004AP0073(01):EN:HTML

(4) Letter of 18 August 2004 from the Chairman of the Article 29 Working Party to the President of the European Parliament,
the Chairman of the LIBE Committee, the Secretary-General of the Council of the European Union, the President of the
European Commission, the Director of DG Enterprise and the Director-General of DG Justice and Home Affairs (not
published).

20.12.2006

EN

Official Journal of the European Union

C 313/39

In order to comply with the decisions applicable to travel document security at European level, a
15.
basic access control is compulsory for all data stored in the chip, which means that all readers will also have
to be equipped with a scanner which will deduce from the data entered in the passport the key required to
open and read the chip. Furthermore, extended access control is compulsory for fingerprints. This system
uses encryption which requires careful management of the access keys.

2.4 Purpose and proportionality

The introduction of biometric identifiers and the corresponding processing of personal data must
16.
comply with a number of principles aimed at protecting the fundamental rights and freedoms of persons,
particularly their rights with regard to the processing of their personal data. It is essential to comply with
these principles in respect of the processing of biometric data which, by their very nature, give information
on a specific person, especially as certain biometric data can leave traces in persons' daily lives and can
therefore be collected without their knowledge (fingerprints, in particular).

The EDPS would therefore point out that,

17.
in accordance with Article 6 of Directive 95/46/EC,
personal data must be collected only for specified, explicit and legitimate purposes, and not further
processed in a way incompatible with those purposes. Furthermore, such data must be adequate, relevant
and not excessive in relation to the purposes for which they were collected or for which they are further
processed (principle of purpose).

The principles of purpose (personal data should be collected and processed for specified and explicit
18.
purposes and their subsequent use may only be authorised in accordance with very strict conditions) and of
proportionality (the processing of personal data is authorised only to the extent necessary and insofar as no
other means involving a lesser breach of privacy is as effective) must be complied with when biometric data
are processed. As already mentioned above, setting up a central database containing the personal data and,
in particular, biometric data, of all persons authorised to receive a CLP would breach the principle of propor-
tionality.

2.5 Information and access

19.
The proposal for a Regulation contains a reference to the right to information (right of access, verifi-
cation, rectification or deletion of data) of the persons to whom a laissez-passer is issued. However, the
EDPS would like a reference to Article 33 of Regulation No 45/2001 on the right of Community staff to
seek remedies to be added to recital 6 of the proposal.

20.
The designation of the authorities and bodies authorised to consult the data present on the storage
medium of the documents is governed by the relevant provisions of Community law, European Union law,
or international agreements. The EDPS recommends that the authorities to whom this Regulation is
addressed and the rights of access which are granted should be specified. It must also be guaranteed, in the
interests of security of processing, that only the competent authorities may have access to the data stored on
the chip.

21.
There is no answer at present to other questions that arise where a CLP is checked in a third country:
what data on the storage medium will third countries have access to? Furthermore, are protection measures
taken to ensure that third countries do not retain the data which they have access to? At the very least, the
questions concerning access to this information remain problematical.

3. OTHER COMMENTS

3.1 Issue of the CLP

22.
The rules for issuing CLP, as laid down in Article 3 of the proposal, specify that CLP shall be issued
by each institution, perhaps through a specialised body. However, one or more institutions may entrust to
one of them the task of issuing their laissez-passer. It is also envisaged that the Commission should —
following a call for tenders — designate a body to be responsible for printing blank CLP — and perhaps for
personalising them by adding the personal data of the holder. Because of the special nature of the processing
to be carried out and the necessary protection requirements associated with it, the rules governing the
choice of the body responsible for processing will have to take special account of the principles laid down
in Regulation No 45/2001 as regards the security and confidentiality of the data (Articles 21, 22 and 23 of
the Regulation).

C 313/40

EN

Official Journal of the European Union

20.12.2006

23. Without prejudice to the EDPS's opinion in the context of the prior checking procedure, which will
follow notification (1) by the data protection officer of the institution(s) responsible for the future processing
of CLP, the EDPS wishes to set down, at this point, a number of general ideas as regards future processing.

3.2 The form

The documentation submitted for consultation does not contain any information about the form
24.
which persons interested in having a CLP (or authorised to have one) must fill in. However, in a case he
dealt with previously, the EDPS reached the conclusion that the personal data processed when the old-style
CLP are issued are not data relating to health, and that such data as might be linked to health (under the
heading ‘distinguishing marks’) were not compulsory. Furthermore, the data subject's consent, defined in
Article 2(h) of Regulation No 45/2001, applies. For this reason and so that he can form an exact picture of
the procedure envisaged, the EDPS recommends that a copy of the CLP form should be attached to the
dossier submitted for the procedure laid down in Article 27 of Regulation No 45/2001, and also any other
document which facilitates the analysis of the case.

3.3 Data quality

Article 4(1)(c) of Regulation No 45/2001 lays down that the data must be ‘adequate, relevant and
25.
not excessive in relation to the purposes for which they are collected and/or further processed’. The data
processed in the context of the procedure under consideration may be regarded as of significant magnitude
(at least as regards the biometric data), which means that it is difficult to establish a priori and without
knowledge of the specific case, whether they are ‘adequate, relevant and not excessive’. It is therefore impor-
tant that the persons who will process the data in the context of the various procedures are correctly
informed of the obligation to comply with the principle laid down in Article 4(1)(c), and that they process
the data in the light of that principle. In the context of the procedure laid down in Article 27 of Regulation
No 45/2001, the EDPS will recommend drafting principles of conduct so that such persons are correctly
informed of their obligations. He will also ask for specific training programmes to be set up on the issues
associated with the processing of sensitive data.

26.
In addition, the data must be accurate and, where necessary, kept up to date (Article 4(1)(d)). It is not
possible, from the information submitted, to check whether the accuracy of the data will be guaranteed.
Similarly, it is not possible at present to check that the procedure or the system will, in itself, fully guarantee
the quality of the data. As stated in the preceding point, only an analysis under the Article 27 procedure
will allow a check to be made that adequate protection measures have been put in place.

3.4 Data retention

27.
The text states that the new laissez-passer would be valid for 5 years. However, it does not say how
long the data relating to each application should be kept. Regulation No 45/2001 states that that data shall
be ‘kept in a form which permits identification of data subjects for no longer than is necessary for the
purposes for which the data were collected or for which they are further processed’ (Article 4(1)(e)). As
stated above, the retention of biometric data in a database must be avoided. The EDPS therefore recom-
mends separating the processing of the biometric data from the processing of the data provided on the CLP
application forms. The latter may be kept as part of the normal procedure for processing CLP applications.

4. RECOMMENDATIONS

The EDPS welcomes the fact that he has been consulted on the Community laissez-passer. Neverthe-

28.
less, the comments set out below should be taken into account:

— This opinion should be mentioned in the preamble to the Regulation, before the recitals (‘Having regard

to the opinion …’ )

(1) On the basis of Article 27(3) of Regulation (EC) No 45/2001.

20.12.2006

EN

Official Journal of the European Union

C 313/41

— Easily accessible fallback procedures must be implemented during the enrolment phase for the biometric

data.

— The Commission Decisions of 28 February 2005 and 28 June 2006 ‘establishing the technical specifica-
tions on the standards for security features and biometrics in passports and travel documents issued by
Member States’ must be mentioned where they address the technical aspects of the CLP.

— The biometric data must not be stored in a central database.

— The content and format of the biometric data envisaged and the guarantees attached to the introduction

of biometric data into the CLP must be described more precisely.

— Interoperability of the systems may not be introduced if it breaches the principle of limitation of the
purposes of the processing of the data and any proposal in this area should be submitted to the EDPS.

— The principles of purpose and proportionality must be given particular attention in the processing of

biometric data.

— In order to draw the attention of members and servants of the institutions to this issue, the reference to
Article 33 of Regulation No 45/2001 on the right of Community staff to seek remedies should be
added to recital 6 of the proposal.

— The EDPS wishes the proposal to specify that a limitative list be drawn up of the competent authorities

that will have access to the data, also defining the rights of access they will be granted.

— The criteria for selecting the body referred to in Article 3 of the proposal must be carefully defined, in

the light of the special nature of biometric data.

— The procedure for issuing the Community laissez-passer must be subject to prior checking by the Euro-

pean Data Protection Supervisor, pursuant to Article 27(1) of Regulation No 45/2001.

— The CLP application form should be provided so that data protection issues can be considered in the

context of prior checking, and also any other document which facilitates the analysis of the case.

— The drawing up of principles of conduct should be recommended so that the persons responsible for
processing the data are correctly informed of their obligations. Specific training programmes on issues
relating to the processing of sensitive data should also be contemplated.

— It must be ensured that procedures are in place to guarantee data quality.

Done at Brussels, 13 October 2006.

Peter HUSTINX

European Data Protection Supervisor