Proposal for a COUNCIL REGULATION on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement
Date: 2024-07-23
Institutions: Directorate-General for Justice and Consumers, European Commission
Subjects: EU national, data protection, family relationship, free movement of persons, freedom of movement, identity document, personal data, residence permit, technical specification

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 23.7.2024  COM(2024) 316 final 2024/0187 (CNS)  Proposal for a COUNCIL REGULATION on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement (Text with EEA relevance)  
 
EXPLANATORY MEMORANDUM 

1. 

• 

CONTEXT OF THE PROPOSAL 

Reasons for and objectives of the proposal 

On 17 April 2018, the Commission adopted a proposal for a Regulation on strengthening the 
security  of  identity  cards  of  Union  citizens  and  of  residence  documents  issued  to  Union 
citizens and their family members exercising their right of free movement1. The Commission 
proposed  that  the  Parliament  and  the  Council  base  the  regulation  on  Article  21(2)  of  the 
Treaty on the Functioning of the European Union (TFEU). On the basis of that proposal, the 
Parliament  and  the  Council  adopted,  on  20  June  2019,  Regulation  (EU)  2019/11572,  which 
has been in application since 2 August 2021. 
In  case  Landeshauptstadt  Wiesbaden3,  the  Court  of  Justice  ruled  that  Regulation  (EU) 
2019/1157 is invalid due to it having been adopted erroneously on the basis of Article 21(2) 
TFEU and under the ordinary legislative procedure. According to the Court, Regulation (EU) 
2019/1157 is one of the measures that falls within the specific scope of Article 77(3) TFEU, 
which  provides  for  a  special  legislative  procedure  and,  in  particular,  for  unanimity  in  the 
Council. 

While  declaring  Regulation  (EU)  2019/1157  invalid,  the  Court  ruled  that  the  “effects  of 
Regulation  2019/1157  are  to  be  maintained  until  the  entry  into  force,  within  a  reasonable 
period  which  may  not  exceed  two  years  from  1  January  of  the  year  following  the  date  of 
delivery  of  the  present  judgment,  of  a  new  regulation  based  on  Article  77(3)  TFEU  and 
intended to replace it”. 

The  purpose  of  this  proposal  is  to  set  in  motion  the  procedure  for  a  new  regulation  on 
strengthening  the  security  of  identity  cards  of  Union  citizens  and  of  residence  documents 
issued  to  Union  citizens  and  their  family  members  exercising  their  right  of  free  movement 
being adopted on the appropriate legal basis, namely Article 77(3) TFEU. 

This proposal essentially reproduces the text of Regulation (EU) 2019/1157 as adopted by the 
Parliament and the Council. In particular, the Court ruled that the limitations of the right to 
respect  for  private  life  and  of  the  right  to  the  protection  of  personal  data,  enshrined  in 
Articles 7  and  8  of  the  Charter  respectively,  flowing  from  the  obligation  to  include  two 
fingerprints  in  the  storage  medium  of  identity  cards  are  not  contrary  to  the  principle  of 
proportionality4. 

Nevertheless, the Commission considers that it is appropriate to adapt the text in certain minor 
aspects.  These  adaptations  are  explained  in  the  section  on  ‘Detailed  explanation  of  the 
specific provisions of the proposal’. 

• 

Consistency with existing policy provisions in the policy area 

The Union offers its citizens an area of freedom, security and justice without internal borders, 
in which the free movement of persons is ensured in conjunction with appropriate measures 

1 
2 

3 
4 

COM(2018) 212 final. 
Regulation  (EU)  2019/1157  of  the  European  Parliament  and  of  the  Council  of  20  June  2019  on 
strengthening  the  security  of  identity  cards  of  Union  citizens  and  of  residence  documents  issued  to 
Union citizens and their family members exercising their right of free movement (OJ L 188, 12.7.2019, 
p. 67, ELI: http://data.europa.eu/eli/reg/2019/1157/oj).  
Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251. 
Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraph 
124. 

EN 

1 

  EN 

 
regarding  external  border  management,  asylum,  immigration  and  the  prevention  and 
combating of crime and terrorism. Many of the Union’s security  measures  rely  upon secure 
travel and residence documents – such as the systematic checks established by the Schengen 
Borders Code5 in the Schengen Information System.  
According to Article 77(1) TFEU, and as noted by the Court in Landeshauptstadt Wiesbaden6, 
the  Union  is  to  develop  a  policy  with  a  view  to  ensuring  the  absence  of  any  controls  on 
persons, whatever their nationality, when crossing internal borders, to carrying out checks on 
persons  and  efficient  monitoring  of  the  crossing  of  external  borders,  and  to  the  gradual 
introduction of an integrated management system for such borders. The provisions concerning 
passports,  identity  cards,  residence  permits  or  any  other  such  document  referred  form  an 
integral part of any such Union policy. As regards Union citizens, the documents covered by 
the proposed regulation enable them, among other things, to certify that they benefit from the 
right to move and reside freely within the territory of the Member States referred to in Article 
20(2)(a) TFEU and therefore to exercise that right. 
Directive 2004/38/EC of the European Parliament and of the Council7 sets out the conditions 
for the exercise of the right of free movement and residence (both temporary and permanent) 
in  the  Union  for  Union  citizens  and  their  family  members.  That  Directive  provides  that,  in 
conjunction  with  a valid identity card or passport,  Union citizens  and their family  members 
may  enter  and  live  in  another  Member  State  and  apply  for  the  appropriate  residence 
documentation. Directive 2004/38/EC, however, does not regulate the format and standards of 
identity cards to be used to enter or leave Member States. Similarly, it does not provide for 
specific standards for residence documents issued to Union citizens and their family members 
apart from their title. 

By maintaining the security standards introduced by Regulation (EU) 2019/1157 applicable to 
identity cards issued by Member States to their nationals and to residence documents issued 
by Member States to Union citizens and their family members when exercising their right to 
free  movement,  this  proposal  is  fully  consistent  with  the  existing  policy  measures  outlined 
above. 

2. 

LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY 

Legal basis 

• 
As stated by the Court in Landeshauptstadt Wiesbaden8, Article 77(3) TFEU confers on the 
Union a competence to adopt provisions on passports, identity cards, residence permits or any 
other such document intended to facilitate the exercise of the right to move and reside freely 
within  the  territory  of  the  Member  States  guaranteed  in  Article 20(2)(a)  TFEU.  The  Court 
ruled that it follows from the purpose and main components of Regulation (EU) 2019/1157 – 

5 

6 

7 

8 

Regulation (EU) 2017/458 of the European Parliament and of the Council of 15 March 2017 amending 
Regulation (EU) 2016/399 as regards the reinforcement of checks against relevant databases at external 
borders (OJ L 74, 18.3.2017, p. 1, ELI: http://data.europa.eu/eli/reg/2017/458/oj). 
Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraph 
51. 
Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of 
citizens  of  the  Union  and  their  family  members  to  move  and  reside  freely  within  the  territory  of  the 
Member  States  amending  Regulation  (EEC)  No  1612/68  and  repealing  Directives  64/221/EEC, 
68/360/EEC,  72/194/EEC,  73/148/EEC,  75/34/EEC,  75/35/EEC,  90/364/EEC,  90/365/EEC  and 
93/96/EEC (OJ L 158, 30.4.2004, p. 77, ELI: http://data.europa.eu/eli/dir/2004/38/oj). 
Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraph 
54. 

EN 

2 

  EN 

 
to strengthen the security standards applicable to identity cards and residence documents and 
to  set  out  the  requirements,  notably  in  terms  of  security,  with  which  such  documents  must 
comply  –  that  it  is  one  of  the  measures  that  falls  within  the  specific  scope  of  Article 77(3) 
TFEU9. The same applies to this proposal, which replicates Regulation (EU) 2019/1157 with 
the exception of limited adjustments that do not affect its purpose and main components. 

Article  77(3)  TFEU  provides  for  a  special  legislative  procedure.  When  adopting  measures 
pursuant  to  Article  77(3)  TFEU,  the  Council  is  to  act  unanimously  after  consulting  the 
Parliament. 

• 

Subsidiarity (for non-exclusive competence)  

The Union is committed to ensuring the free movement of persons within an area of freedom, 
security and justice. Secure identity cards and residence documents are essential elements to 
ensure the trust needed for free movement within that area. 

Without  a  common  standard  at  Union  level,  it  is  likely  that the  obstacles  to  free  movement 
resulting  from  the  problems  in  the  acceptance  of  certain  documents  observed  prior  to  the 
adoption of Regulation (EU) 2019/1157 re-emerge10. The same would apply to the previously 
experienced  security  gaps  resulting  from  insufficiently  secure  documents.  The  absence  of 
action at Union level would also result in more practical problems for Union citizens, national 
authorities  and  businesses  in  a  context  where  citizens  live  and  travel  within  the  Union. 
Addressing  such  systemic  problems  by  maintaining  a  high  level  of  security  for  national 
identity cards and residence documents clearly requires continued action on a Union scale. 

The objectives of any initiative seeking to prevent the re-emergence of such problems cannot 
be  achieved  at  a  national  level.  The  documents  covered  by  this  proposal  have  an  intrinsic 
European  dimension  because  of  their  connection  with  the  exercise  of  the  right  to  free 
movement in an area of freedom, security and justice. Member States already confirmed the 
necessity to act at Union level by adopting Regulation (EU) 2019/1157. 

The  regulation  would  not  require  Member  States  to  issue  documents  that  are  not  currently 
being issued.  

• 

Proportionality 

Union  action  can  continue  to  add  considerable  value  in  addressing  the  challenges  outlined 
above. Union citizens face obstacles in the exercise of their rights if they cannot be sure that 
their documents will reliably be accepted outside their Member State(s) of issuance. 

Ongoing  security  challenges  demonstrate  the  inextricable  link  between  free  movement  of 
persons  inside  the  Union  and  robust  external  border  management.  Insofar  as  identity  cards 
may  be  used  to  cross  external  borders,  measures  to  improve  security  and  external  border 
management, such as the systematic checks against databases on all persons, including Union 
citizens,  crossing  the  external  borders  would  be  weakened  if  security  standards  for  identity 
cards were to deteriorate. Overall, the minimum standards for the information to be provided 
on the documents covered by this proposal and for security features common to all Member 
States  that  issue  them  will  facilitate  the  exercise  of  free  movement  and  improve  security 
within the Union and at its borders. 

9 

10 

Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraphs 
59-61. 
For a more detailed description on the situation prior to the adoption of Regulation (EU) 2019/1157, see 
SWD(2018) 110 final. 

EN 

3 

  EN 

 
Complete harmonisation of the design of identity cards is not warranted and a proportionate 
measure ensuring minimum document standards is proposed. This includes the mandatory use 
of  fingerprints,  which  are  a  reliable  and  effective  means  of  establishing,  with  certainty,  the 
identity  of  a  person,  and  a  proportionate  measure  in  light  of  the  objectives  to  facilitate  the 
exercise of the right to free movement and residence, to combat the production of fraudulent 
identity cards and identity theft, and to ensure the interoperability of identification document 
verification systems11. 

For residence cards issued to third-country family members, it is suggested to continue to use 
the  same  format  as  already  agreed  at  Union  level  in  respect  of  residence  permits  of  third-
country nationals. 

• 

Choice of the instrument 

A  regulation  is  the  only  legal  instrument  ensuring  the  direct  and  common  application  of 
Union  law  in  all  Member  States.  In  a  field  where  divergences  have  previously  proved 
detrimental  to  free  movement  and  security,  a  regulation  will  ensure  that  the  desired 
commonality is maintained.  

3. 

• 

RESULTS 
CONSULTATIONS AND IMPACT ASSESSMENTS 

EX-POST 

EVALUATIONS, 

OF 

STAKEHOLDER 

Impact assessment 

No  impact  assessment  was  carried  out  in  the  preparation  of  this  proposal  as  it  essentially 
reproduces the text of Regulation (EU) 2019/1157, which itself was based on a proposal12 that 
had been accompanied by an impact assessment13. Thus, this proposal is not expected to lead 
to  new 
the 
implementation  report  adopted  on  20  September  202314.  Since  not  even  three  years  have 
passed  since  the  entry  into  application  of  Regulation  (EU)  2019/1157,  no  evaluation  was 
undertaken. 

impacts.  Moreover,  this  proposal  considers 

learned  from 

lessons 

the 

• 

Fundamental rights 

This  proposal  has  a positive impact  on Union  citizens’ fundamental  right to  free movement 
and residence under Article 45 of the Charter of Fundamental Rights of the European Union 
(Charter)  by  addressing  difficulties  in  recognition  and  insufficient  security  of  both  identity 
cards and residence documents. 

This proposal implies processing of personal data, including biometric data, namely a facial 
image and two fingerprints. Processing the personal data of individuals, including collection, 
access  and  use  of  personal  data,  affects  the  right  to  privacy  and  the  right  to  protection  of 
personal data enshrined in Articles 7 and 8 of the Charter. 

In particular, the obligation to include two fingerprints in the storage medium of identity cards 
and residence cards, as well as the obligations to collect and temporarily store such biometric 

11 
12 
13 
14 

See judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251. 
COM(2018) 212 final. 
SWD(2018) 110 final. 
Report from the Commission to the European Parliament, the Council and the European Economic and 
Social Committee pursuant to Article 13(1) of Regulation (EU) 2019/1157 of the European Parliament 
and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and 
of residence documents issued to Union citizens and their family members exercising their right of free 
movement (COM(2023) 538 final). 

EN 

4 

  EN 

 
data for the purposes of producing the documents, constitutes a limitation to both the right to 
respect for private life and the right to the protection of personal data15.  

Limitations  on  those  rights  must  be  provided  for  by  law  and  respect  the  essence  of  those 
rights. In addition, in compliance with the principle of proportionality, such limitations may 
be  made  only  if  they  are  necessary  and  genuinely  meet  objectives  of  general  interest 
recognised by the Union or the need to protect the rights of others16. 

The limitations, as well as the conditions for application and scope of those limitations, will 
be defined in the regulation.  The Court held that the limitation entailed by the obligation to 
include  two  fingerprints  in  the  storage  medium  does  not  adversely  affect  the  essence  of  the 
fundamental rights enshrined in Articles 7 and 8 of the Charter, as the information provided 
by  fingerprints  does  not,  in  itself,  make  it  possible  to  have  an  overview  of  the  private  and 
family life of data subjects17. 

As noted by the Court, the specific objectives pursued by the regulation,  namely combating 
document  fraud  and  the  interoperability  of  identification  document  verification  systems, 
constitute objectives of general interest recognised by the Union. In addition, the Court found 
that  the  inclusion  of  two  complete  fingerprints  is  appropriate  for  attaining  those  general 
interest objectives18. As far as the necessity of the inclusion of fingerprints is concerned, the 
Court  considered  that  the  limitations  placed  on  fundamental  rights  guaranteed  in  Articles  7 
and 8 of the Charter arising  from  the obligation to  include two complete  fingerprints in  the 
storage medium appear to comply with what is strictly necessary19. 

Finally,  the  Court  considered  that  the  limitations  resulting  from  the  inclusion  of  two 
fingerprints do not appear to be – having regard to the nature of the data at issue, the nature of 
the  processing  operations,  the  manner  in  which  they  are  carried  out  and  the  safeguards  laid 
down – of a seriousness that is disproportionate when compared with the significance of the 
various objectives pursued by the regulation. Accordingly, such a measure must be regarded 
as being based on a fair balance between, on the one hand, those objectives and, on the other, 
the  fundamental  rights  involved.  As  a  result,  the  Court  concluded,  in  Landeshauptstadt 
Wiesbaden, that the limitations on the exercise of the rights guaranteed in Articles 7 and 8 of 
the Charter are not contrary to the principle of proportionality20. 

4. 

BUDGETARY IMPLICATIONS 

The proposal has no implications for the Union budget. 

15 

16 

17 

18 

19 

20 

Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraphs 
73 to 74. 
Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraph 
76. 
Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraphs 
80 to 81. 
See, to that effect, judgment of 17 October 2013, Schwarz, C-291/12, EU:C:2013:670, paragraphs 36 to 
38, judgment of 3 October 2019,  A and Others, C-70/18, EU:C:2019:823, paragraph 46 and the case-
judgment  of  21  March  2024,  C-61/22,  Landeshauptstadt  Wiesbaden, 
law  cited,  and 
ECLI:EU:C:2024:251, paragraphs 87 to 89. 
Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraph 
105. 
Judgment of 21 March 2024, C-61/22, Landeshauptstadt Wiesbaden, ECLI:EU:C:2024:251, paragraphs 
123 to 124. 

EN 

5 

  EN 

 
5. 

• 

OTHER ELEMENTS 

Implementation plans and monitoring, evaluation and reporting arrangements 

To ensure an effective implementation of the measures foreseen, and to monitor their results, 
the  Commission  will  continue  to  work  closely  with  relevant  stakeholders  from  national 
authorities and Union agencies, such as the European Border and Coast Guard Agency. 

The  Commission  will  adopt  a  monitoring  programme  to  monitor  the  outputs,  results  and 
impacts of the regulation based on the monitoring programme adopted pursuant to Regulation 
(EU) 2019/115721. 

The Commission will evaluate the effectiveness, efficiency, relevance, coherence and  Union 
added  value  of  the  resulting  legal  framework  6  years  after  the  date  of  application  of  the 
regulation. This will ensure that sufficient data is available for the evaluation. 

• 

Detailed explanation of the specific provisions of the proposal 

In  essence,  the  attached  proposal  reproduces  Regulation  (EU)  2019/1157  as  adopted  by  the 
Parliament  and  the  Council.  However,  the  Commission  considers  that  the  text  of  that 
Regulation should be adapted in the following respects: 

– 

– 

– 

– 

– 

– 

– 

– 

– 

In order to take account of the ruling in Landeshauptstadt Wiesbaden, the legal basis 
for the regulation is Article 77(3) TFEU. 

In the recitals of the regulation, references to policy documents adopted several years 
ago are removed. 

The  explicit  reference  in  the  recitals  to  the  passport  card  issued  by  Ireland  is 
removed, given that Ireland is not taking part in the adoption of the regulation unless 
it  notifies  that  it  wishes  to  take  part  in  its  adoption  and  application.  In  such  case, 
while  the  passport  card  issued  by  Ireland  is  a  travel  document  compliant  with 
International  Civil  Aviation  Organization  Document  9303  on  Machine  Readable 
Travel Documents, it does not serve identification purposes in Ireland, and therefore 
should not be considered as falling within the scope of the regulation. 

In  the  recitals  of  the  regulation,  a  reference  is  added  to  the  fact  that  the  Court  of 
Justice has ruled that the mandatory inclusion of fingerprints on the storage medium 
is compatible with the fundamental rights to respect for private life and to protection 
of personal data as guaranteed in Articles 7 and 8 of the Charter. 

The recital on the phasing-out of documents not complying with the requirements of 
the  regulation  is  adapted  to  reflect  the  fact  that  the  deadlines  established  by 
Regulation (EU) 2019/1157 should continue to apply. 

Recitals are added to reflect the respective opt-outs of Ireland and Denmark. 

A new consultation of the European Data Protection Supervisor will be carried out. 

Since the Commission has not received a notification pursuant to Article 5(3), point 
(b), of Regulation EU 2019/1157, the references to such notifications are removed. 

Pursuant  to  Article  8(2)  of  Regulation  (EU)  2019/1157,  certain  residence  cards  of 
family members of Union citizens who are not nationals of a Member State ceased to 
be valid at their expiry or by 3 August 2023, whichever was earlier. As this date is in 
the past, the regulation merely states that such residence cards are no longer valid. 

21 

SWD(2021) 45 final. 

EN 

6 

  EN 

 
– 

– 

– 

– 

Pursuant to Article 11(6) of Regulation (EU) 2019/1157, biometric data stored in the 
storage medium of identity cards and residence documents, namely the facial image 
and two fingerprints of the holder, is only to be used by the duly authorised staff of 
competent national authorities and Union agencies. Given the electronic signature on 
the storage medium of identity cards, identifying the holder by checking the data in 
the  storage  medium  is  more  reliable  than  a  visual  check  of  the  document,  in 
particular in situations of remote identification. Union citizens may therefore wish to 
use the data in the storage medium of their identity card, including the facial image, 
to  identify  themselves  towards  private  entities,  such  as  banks  or  air  carriers.  The 
wording  of  the  provision  is  thus  adapted  to  state  that  only  fingerprints  can  be 
accessed  exclusively  by  duly  authorised  staff  of  competent  national  authorities  and 
Union  agencies.  In  any  event,  cryptographic  protection  prevents  unauthorised 
persons from accessing the fingerprints on the storage medium. 

To  reduce  reporting  obligations  for  Member  State  authorities,  the  obligation  to 
maintain,  and  communicate  annually  to  the  Commission,  a  list  of  the  competent 
authorities  with  access  to  the  biometric  data  stored  on  the  storage  medium  is 
removed. 

To reduce reporting obligations for Member State authorities, the rules on reporting 
and evaluation are streamlined. Article 13 of the regulation provides that instead of 
evaluating  the  regulation every six  years, a single evaluation  will be carried out  by 
the Commission six years after the regulation enters into force, specifically focusing 
on a number of elements falling within the scope of the regulation. 

Given that Member States are already applying Regulation (EU) 2019/1157, it is not 
necessary to delay the entry into application of this regulation. The regulation should 
thus start to apply with its entry into force. 

EN 

7 

  EN 

2024/0187 (CNS) 

Proposal for a 

COUNCIL REGULATION 

on strengthening the security of identity cards of Union citizens and of residence 
documents issued to Union citizens and their family members exercising their right of 
free movement 

(Text with EEA relevance) 

THE COUNCIL OF THE EUROPEAN UNION, 

Having  regard  to  the  Treaty  on  the  Functioning  of  the  European  Union,  and  in  particular 
Article 77(3) thereof, 

Having regard to the proposal from the European Commission, 

After transmission of the draft legislative act to the national parliaments, 
Having regard to the opinion of the European Parliament1, 

Acting in accordance with a special legislative procedure, 

Whereas: 

(1) 

(2) 

(3) 

1 
2 

The Treaty on the European Union (TEU) resolved to facilitate the free movement of 
persons  while  ensuring  the  safety  and  security  of  the  peoples  of  Europe,  by 
establishing an area of freedom, security and justice, in accordance with the provisions 
of the TEU and of the Treaty on the Functioning of the European Union (TFEU). 

Citizenship  of  the  Union  confers  on  every  citizen  of  the  Union  the  right  of  free 
movement, subject to certain limitations and conditions. Directive 2004/38/EC of the 
European  Parliament  and  of  the  Council2  gives  effect  to  that  right.  Article  45  of  the 
Charter of Fundamental Rights of the European Union (the Charter) also provides for 
freedom  of  movement  and  residence.  Freedom  of  movement  entails  the  right  to  exit 
and enter Member States with a valid identity card or passport. 

Pursuant  to  Directive  2004/38/EC,  Member  States  are  to  issue  and  renew  identity 
cards  or  passports  to  their  nationals  in  accordance  with  national  laws.  Furthermore, 
that  Directive  provides  that  Member  States  may  require  Union  citizens  and  their 
family members to register with the relevant authorities. Member States are required to 
issue  registration  certificates  to  Union  citizens  under  the  conditions  set  out  therein. 
Pursuant to that Directive, Member States are also required to issue residence cards to 

OJ C […], […], p. […]. 
Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of 
citizens  of  the  Union  and  their  family  members  to  move  and  reside  freely  within  the  territory  of  the 
Member  States  amending  Regulation  (EEC)  No  1612/68  and  repealing  Directives  64/221/EEC, 
68/360/EEC,  72/194/EEC,  73/148/EEC,  75/34/EEC,  75/35/EEC,  90/364/EEC,  90/365/EEC  and 
93/96/EEC (OJ L 158, 30.4.2004, p. 77, ELI: http://data.europa.eu/eli/dir/2004/38/oj). 

EN 

8 

  EN 

 
(4) 

(5) 

(6) 

(7) 

(8) 

(9) 

family members who are not nationals of a Member State and, on application, to issue 
documents certifying permanent residence and to issue permanent residence cards. 

Directive 2004/38/EC provides that Member States may adopt the necessary measures 
to  refuse,  terminate  or  withdraw  any  right  conferred  by  that  Directive  in  the  case  of 
abuse  of  rights  or  fraud.  Document  forgery  or  false  presentation  of  a  material  fact 
concerning  the  conditions  attached  to  the  right  of  residence  have  been  identified  as 
typical cases of fraud under that Directive. 

Prior to the adoption of rules at Union level, considerable differences existed between 
the  security  levels  of  national  identity  cards  and  residence  documents  for  Union 
citizens and their family members residing in another Member State. Such differences 
increase  the  risk  of  falsification  and  document  fraud  and  also  give  rise  to  practical 
difficulties for citizens when they wish to exercise their right of free movement.  

Secure travel and identity documents are crucial whenever it is necessary to establish 
without  doubt  a  person’s  identity.  A  high  level  of  document  security  is  important  to 
prevent  abuses  and  threats  to  internal  security,  in  particular  related  to  terrorism  and 
cross-border crime. Insufficiently secure national identity cards have in the past been 
among the most frequently detected false documents used for travel within the Union. 

In order to deter identity fraud, Member States should ensure that the falsification and 
counterfeiting of identification documents and the use of such falsified or counterfeit 
documents are adequately penalised by their national law. 

Issuing  authentic  and  secure  identity  cards  requires  a  reliable  identity  registration 
process  and  secure  ‘breeder’  documents  to  support  the  application  process.  The 
Commission, the Member States and the relevant  Union agencies should continue to 
work together to make breeder documents less vulnerable to fraud, given the increased 
use of false breeder documents. 

This  Regulation  does  not  require  Member  States  to  introduce  identity  cards  or 
residence documents where they are not provided for under national law, nor does it 
affect  the  competence  of  the  Member  States  to  issue,  under  national  law,  other 
residence documents which fall outside the scope of Union law, for example residence 
cards  issued  to  all  residents  on  the  territory  regardless  of  their  nationality. 
Furthermore, this Regulation does not affect the principle, resulting from the case-law 
of the Court of Justice, that the entitlement to the right of free movement and residence 
can be attested by any means of proof. 

(10)  This  Regulation  does  not  prevent  Member  States  from  accepting,  in  a  non-
discriminatory  manner,  documents  other  than  travel  documents  for  identification 
purposes, such as driving licences. 

(11) 

Identification  documents  issued  to  citizens  whose  right  of  free  movement  has  been 
restricted in accordance with Union or national law, and which expressly indicate that 
they cannot be used as travel documents, should not be considered as falling within the 
scope of this Regulation. 

(12)  Travel  documents  compliant  with  International  Civil  Aviation  Organization  (ICAO) 
Document  9303  on  Machine  Readable  Travel  Documents  (‘ICAO  Document  9303’) 
that do not  serve identification purposes  in  the issuing  Member States  should  not  be 
considered as falling within the scope of this Regulation. 

(13)  This Regulation does not affect the use of identity cards and residence documents with 
eID  function  by  Member  States  for  other  purposes,  nor  does  it  affect  the  rules  laid 

EN 

9 

  EN 

down  in  Regulation  (EU)  No  910/2014  of  the  European  Parliament  and  of  the 
Council3,  which  provides  for  Union-wide  mutual  recognition  of  electronic 
identifications in access to public services and which helps citizens who are moving to 
another  Member  State  by  requiring  mutual  recognition  of  electronic  identification 
means  subject  to  certain  conditions.  Improved  identity  cards  should  ensure  easier 
identification and contribute to better access to services. 

(14)  Proper  verification  of  identity  cards  and  residence  documents  requires  that  Member 
States  use  the  correct  title  for  each  type  of  document  covered  by  this  Regulation.  In 
order  to  facilitate  the  checking  of  documents  covered  by  this  Regulation  in  other 
Member States, the document title should also appear in at least one additional official 
language  of  the  Union.  Where  Member  States  already  use,  for  identity  cards,  well-
established  designations  other  than  the  title  ‘identity  card’,  they  should  be  able  to 
continue  to  do  so  in  their  official  language  or  languages.  However,  no  new 
designations should be introduced in the future. 

(15)  Security features are necessary to verify if a document is authentic and to establish the 
identity  of  a  person.  The  establishment  of  minimum  security  standards  and  the 
integration  of  biometric  data  in  identity  cards  and  in  residence  cards  of  family 
members  who  are  not  nationals  of  a  Member  State  are  important  steps  in  rendering 
their use in the Union more secure. The inclusion of such biometric identifiers should 
allow Union citizens to fully benefit from their right of free movement. 

(16)  The storage of a  facial  image and two fingerprints  (‘biometric data’) on identity  and 
residence  cards,  as  already  provided  for  in  respect  of  biometric  passports  for  Union 
citizens  and  residence  permits  for  third-country  nationals,  represents  an  appropriate 
combination of reliable identification and authentication with a reduced risk of fraud, 
for  the  purpose  of  strengthening  the  security  of  identity  and  residence  cards.  As  the 
Court  of  Justice  confirmed,  the  mandatory  inclusion  of  fingerprints  on  the  storage 
medium  is  compatible  with  the  fundamental  rights  to  respect  for  private  life  and  to 
protection of personal data as guaranteed in Articles 7 and 8 of the Charter. 

(17)  As a general practice, Member States should, for the verification of the authenticity of 
the  document  and  the  identity  of  the  holder,  primarily  verify  the  facial  image  and, 
where  necessary  to  confirm  without  doubt  the  authenticity  of  the  document  and  the 
identity of the holder, Member States should also verify the fingerprints. 

(18)  Members  States  should  ensure  that,  in  cases  where  a  verification  of  biometric  data 
does  not  confirm  the  authenticity  of  the  document  or  the  identity  of  its  holder,  a 
compulsory manual check is carried out by qualified staff. 

(19)  This Regulation does not provide a legal basis for setting up or maintaining databases 
at national level for the storage of biometric data in Member States, which is a matter 
of  national  law  that  needs  to  comply  with  Union  law  regarding  data  protection, 
including  its  necessity  and  proportionality  requirements.  Moreover,  this  Regulation 
does not  provide a legal basis for setting  up or  maintaining  a centralised database at 
Union level. 

3 

EN 

Regulation  (EU)  No  910/2014  of  the  European  Parliament  and  of  the  Council  of  23  July  2014  on 
electronic  identification  and  trust  services  for  electronic  transactions  in  the  internal  market  and 
ELI: 
repealing 
http://data.europa.eu/eli/reg/2014/910/oj). 

1999/93/EC 

28.8.2014, 

Directive 

257, 

(OJ 

73, 

p. 

L 

10 

  EN 

 
(20)  Biometric identifiers should be collected and stored in the storage medium of identity 
cards  and  residence  documents  for  the  purposes  of  verifying  the  authenticity  of  the 
document and the identity of the holder. Given the electronic signature on the storage 
medium  of  identity  cards,  identifying  the  holder  by  means  of  the  storage  medium, 
which contains the same biographic data as printed on the document, is more reliable 
than a visual check of the document. Union citizens should thus be allowed to use the 
data stored in the storage medium of their identity card to identify themselves towards 
private  entities.  However,  the  verification  of  the  fingerprints  stored  on  the  storage 
medium  should  only  be  carried  out  by  duly  authorised  staff  and  only  when  the 
document is required to be produced by law.  

(21)  Biometric  data  stored  for  the  purpose  of  the  personalisation  of  identity  cards  or 
residence documents should be kept in a highly secure manner and only until the date 
of collection of the document and, in any case, no longer than 90 days from the date of 
issue of the document. After that period, those biometric data should be immediately 
erased or destroyed. This should be without prejudice to any other processing of these 
data in accordance with Union and national law regarding data protection. 

(22)  The  specifications  of  ICAO  Document  9303,  which  ensure  global  interoperability 
including  in  relation  to  machine  readability  and  use  of  visual  inspection,  should  be 
taken into account for the purpose of this Regulation. 

(23)  Member  States  should  be  able  to  decide  whether  to  include  a  person’s  gender  on  a 
document  covered  by  this  Regulation.  Where  a  Member  State  includes  a  person’s 
gender  on  such  a  document,  the  specifications  of  ICAO  Document  9303  ‘F’,  ‘M’  or 
‘X’  or  the  corresponding  single  initial  used  in  the  language  or  languages  of  that 
Member State should be used, as appropriate. 

(24) 

Implementing powers should be conferred on the Commission in order to ensure that 
future  security  standards  and  technical  specifications  adopted  pursuant  to  Council 
Regulation  (EC)  No  1030/20024  are  duly  taken  into  account,  where  appropriate,  for 
identity  cards  and  residence  cards.  Those  powers  should  be  exercised  in  accordance 
with  Regulation  (EU) No 182/2011  of the European Parliament  and of the Council5. 
To  that  end,  the  Commission  should  be  assisted  by  the  Committee  established  by 
Article  6  of  Council  Regulation  (EC)  No  1683/956.  Where  necessary,  it  should  be 
possible for the implementing acts adopted to remain secret in order to prevent the risk 
of counterfeiting and falsifications. 

(25)  Member  States  should  ensure  that  appropriate  and  effective  procedures  for  the 
collection of biometric identifiers are in place and that such procedures comply with 
the  rights  and  principles  set  out  in  the  Charter,  the  Convention  for  the  Protection  of 
Human  Rights  and  Fundamental  Freedoms  of  the  Council  of  Europe  and  the  United 
Nations Convention on the Rights of the Child. Member States should ensure that the 
best  interest  of  the  child  is  a  primary  consideration  throughout  the  collection 

4 

5 

6 

for 

nationals 

third-country 

Council Regulation (EC) No 1030/2002 of 13 June 2002 laying down a uniform format for residence 
permits 
ELI: 
(OJ 
http://data.europa.eu/eli/reg/2002/1030/oj). 
Regulation  (EU)  No  182/2011  of  the  European  Parliament  and  of  the  Council  of  16  February  2011 
laying down the rules and general principles concerning mechanisms for control by the Member States 
of  the  Commission's  exercise  of  implementing  powers  (OJ  L  55,  28.2.2011,  p.  13,  ELI: 
http://data.europa.eu/eli/reg/2011/182/oj). 
Council Regulation (EC) No 1683/95 of 29 May 1995 laying down a uniform format for visas (OJ L 
164, 14.7.1995, p. 1, ELI: http://data.europa.eu/eli/reg/1995/1683/oj). 

15.6.2002, 

157, 

1, 

p. 

L 

EN 

11 

  EN 

 
procedure.  To  that  end,  qualified  staff  should  receive  appropriate  training  on  child-
friendly practices for the collecting of biometric identifiers. 

(26)  Where difficulties are encountered in the collection of biometric identifiers, Member 
States should ensure that appropriate procedures are in place to respect the dignity of 
the person concerned. Therefore, specific considerations relating to gender and to the 
specific needs of children and of vulnerable persons should be taken into account. 

(27)  The introduction of minimum security and format standards for identity cards should 
allow  Member  States  to  rely  on  the  authenticity  of  those  documents  when  Union 
citizens exercise their right of free movement. The introduction of reinforced security 
standards should provide sufficient guarantees to public authorities and private entities 
to  enable  them  to  rely  on  the  authenticity  of  identity  cards  when  used  by  Union 
citizens for identification purposes. 

(28)  A distinguishing sign in the form of the two-letter country code of the Member State 
issuing  the  document,  printed  in  negative  in  a  blue  rectangle  and  encircled  by  12 
yellow stars,  facilitates the visual inspection of the document, in  particular when the 
holder is exercising the right of free movement. 

(29)  While  the  option  to  provide  for  additional  national  features  is  maintained,  Member 
States should ensure that those features do not diminish the efficiency of the common 
security  features  or  negatively  affect  the  cross-border  compatibility  of  the  identity 
cards, such as the capability that the identity cards can be read by machines used by 
Member States other than those which issue the identity cards. 

(30)  The  introduction  of  security  standards  in  identity  cards  and  in  residence  cards  of 
family  members  who  are  not  nationals  of  a  Member  State  should  not  result  in  a 
disproportionate increase in fees for Union citizens or third-country nationals. Member 
States should take this principle into consideration when issuing calls for tender. 

(31)  Member States should take all necessary steps to ensure that biometric data correctly 
identify  the  person  to  whom  an  identity  card  is  issued.  To  this  end,  Member  States 
could consider collecting biometric identifiers, particularly the facial image, by means 
of live enrolment by the national authorities issuing identity cards. 

(32)  Member States should exchange with  each other such information as is  necessary to 
access,  authenticate  and  verify  the  information  contained  on  the  secure  storage 
medium.  The  formats  used  for  the  secure  storage  medium  should  be  interoperable, 
including in respect of automated border crossing points. 

(33)  Directive  2004/38/EC  addresses  the  situation  where  Union  citizens,  or  family 
members of Union citizens who are not nationals of a Member State, who do not have 
the necessary travel documents are to be given every reasonable opportunity to prove 
by other means that they are covered by the right of free movement. Such means can 
include  identification  documents  used  on  a  provisional  basis  and  residence  cards 
issued to such family members. 

(34)  This  Regulation  respects  the  obligations  set  out  in  the  Charter  and  in  the  United 
Nations  Convention  on  the  Rights  of  Persons  with  Disabilities.  Therefore,  Member 
States  are  encouraged  to  work  with  the  Commission  to  integrate  additional  features 
that render identity cards more accessible and user-friendly to people with disabilities, 
such as visually impaired persons. Member States are to explore the use of solutions, 
such  as  mobile  registration  devices,  for  the  issuance  of  identity  cards  to  persons 
incapable of visiting the authorities responsible for issuing identity cards. 

EN 

12 

  EN 

(35)  Residence  documents  issued  to  citizens  of  the  Union  should  include  specific 
information to ensure that they are identified as such in all Member States. This should 
facilitate the recognition of the Union citizen’s use of the right of free movement and 
of  the  rights  inherent  to  this  use,  but  harmonisation  should  not  go  beyond  what  is 
appropriate to address the weaknesses of current documents. Member States are free to 
select the format in which these documents are issued and could issue them in a format 
complying with the specifications of ICAO Document 9303. 

(36)  As regards residence documents issued to family members who are not nationals of a 
Member State, it is appropriate to make use of the same format and security features as 
those provided for in Regulation (EC) No 1030/2002 as amended by Regulation (EU) 
2017/1954 of the European Parliament and of the Council7. In addition to proving the 
right  of  residence,  those  documents  also  exempt  their  holders  who  are  otherwise 
subject to a visa obligation from the requirement to obtain a visa when accompanying 
or joining the Union citizen within the Union territory. 

(37)  Directive 2004/38/EC provides that documents issued to family members who are not 
nationals of a Member State are to be called ‘Residence card of a family member of a 
Union  citizen’.  In  order  to  facilitate  their  identification,  residence  cards  of  a  family 
member of a Union citizen should bear a standardised title and code. 

(38)  Taking  into  account  both  the  security  risk  and  the  costs  incurred  by  Member  States, 
identity cards as well as residence cards of family members of Union citizens that do 
not meet the requirements of this Regulation should be phased out. For documents that 
are missing important security features, or are not machine readable, a shorter phasing-
out period is necessary on security grounds. 

(39)  Regulation  (EU)  2016/679  of  the  European  Parliament  and  of  the  Council8  applies 
with regard to the personal data to be processed in the context of the application of this 
Regulation.  It  is  necessary  to  further  specify  safeguards  applicable  to  the  processed 
personal  data  and  in  particular  to  sensitive  data  such  as  biometric  identifiers.  Data 
subjects  should  be  made  aware  of  the  existence  in  their  documents  of  the  storage 
medium containing their biometric data including its accessibility in contactless form 
as well as of all instances where the data contained in their identity cards and residence 
documents  are  used.  In  any  case,  data  subjects  should  have  access  to  personal  data 
processed in their identity cards and residence documents and should have the right to 
have  them  rectified  by  way  of  issuance  of  a  new  document  where  such  data  is 
erroneous or incomplete. The storage medium should be highly secure and effectively 
protect personal data stored on it from unauthorised access. 

(40)  Member States should be responsible for the proper processing of biometric data, from 
collection  to  integration  of  the  data  on  the  highly  secure  storage  medium,  in 
accordance with Regulation (EU) 2016/679. 

(41)  Member States should  exercise particular caution when  cooperating with  an external 
service  provider.  Such  cooperation  should  not  exclude  any  liability  of  the  Member 

7 

8 

Regulation  (EU)  2017/1954  of  the  European  Parliament  and  of  the  Council  of  25  October  2017 
amending Council Regulation (EC) No 1030/2002 laying down a uniform format for residence permits 
for third-country nationals (OJ L 286, 1.11.2017, p. 9, ELI: http://data.europa.eu/eli/reg/2017/1954/oj). 
Regulation  (EU)  2016/679  of  the  European  Parliament  and  of  the  Council  of  27  April  2016  on  the 
protection of natural persons with regard to the processing of personal data and on the free movement of 
such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, 
p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj). 

EN 

13 

  EN 

 
(42) 

(43) 

States arising under Union or national law for breaches of obligations with regard to 
personal data. 

It is necessary to specify in this Regulation the basis for the collection and storage of 
data on the storage medium of identity cards and residence documents. In accordance 
with  Union  or  national  law  and  respecting  the  principles  of  necessity  and 
proportionality, Member States should be able to store other data on a storage medium 
for electronic services or for other purposes relating to the identity card or residence 
document.  The  processing  of  such  other  data  including  their  collection  and  the 
purposes for which they can be used should be authorised by Union or national law. 
All  national  data  should  be  physically  or  logically  separated  from  biometric  data 
referred to in this Regulation and should be processed in accordance with Regulation 
(EU) 2016/679. 

In accordance with the Interinstitutional Agreement of 13 April 2016 on Better Law-
Making9, the Commission should, no sooner than six years after the date of application 
of this Regulation carry out an evaluation of this Regulation, including on the basis of 
information gathered through specific monitoring arrangements, in order to assess the 
actual effects of this Regulation and the need for any further action. For the purpose of 
monitoring,  Member  States  should  collect  statistics  on  the  number  of  identity  cards 
and residence documents which they issued. 

(44)  Since the objectives of this Regulation, namely to enhance security and to facilitate the 
exercise  of  the  right  of  free  movement  by  Union  citizens  and  their  family  members, 
cannot be sufficiently achieved by the Member States but can rather, by reason of the 
scale and effects of the action, be better achieved at Union level, the Union may adopt 
measures, in accordance with the principle of subsidiarity as set out in Article 5 TEU. 
In  accordance  with  the  principle  of  proportionality,  as  set  out  in  that  Article,  this 
Regulation does not go beyond what is necessary in order to achieve those objectives. 

(45) 

(46) 

In  accordance  with  Articles  1  and  2  of  Protocol  No  22  on  the  position  of  Denmark, 
annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of 
this Regulation and is not bound by it or subject to its application. 

In accordance with Articles 1 and 2 of Protocol  No 21 on the position of the United 
Kingdom and Ireland in respect of the area of freedom, security and justice, annexed 
to  the  TEU  and  to  the  TFEU,  and  without  prejudice  to  Article  4  of  that  Protocol, 
Ireland is not taking part in the adoption of this Regulation and is not bound by it or 
subject to its application. 

(47)  This Regulation respects the fundamental rights and observes the principles recognised 
in  particular by the Charter including  human dignity,  the right to  the integrity of the 
person, the prohibition of inhuman or degrading treatment, the right to equality before 
the law and non-discrimination, the rights of children, the rights of the elderly, respect 
for private and family life, the right to the protection of personal data, the right of free 
movement  and  the  right  to  an  effective  remedy.  Member  States  should  comply  with 
the Charter when implementing this Regulation. 

9 

OJ L 123, 12.5.2016, p. 1, ELI: http://data.europa.eu/eli/agree_interinstit/2016/512/oj. 

EN 

14 

  EN 

 
(48)  The  European  Data  Protection  Supervisor  was  consulted  in  accordance  with  Article 
42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council10 
and delivered an opinion on XXXX11, 

HAS ADOPTED THIS REGULATION: 

Chapter I 
Subject matter, scope and definitions 

Article 1 
Subject matter 

This  Regulation  strengthens  the  security  standards  applicable  to  identity  cards  issued  by 
Member  States  to  their  nationals  and  to  residence  documents  issued  by  Member  States  to 
Union citizens and their family members when exercising their right to free movement. 

Article 2 
Scope 

This Regulation applies to: 

(a) 

(b) 

(c) 

identity cards issued by Member States to their own nationals as referred to in Article 
4(3) of Directive 2004/38/EC; 

registration certificates issued in accordance with Article 8 of Directive 2004/38/EC 
to  Union  citizens  residing  for  more  than  three  months  in  a  host  Member  State  and 
documents  certifying  permanent  residence  issued  in  accordance  with  Article  19  of 
Directive 2004/38/EC to Union citizens upon application; 

residence  cards  issued  in  accordance  with  Article  10  of  Directive  2004/38/EC  to 
family  members  of  Union  citizens  who  are  not  nationals  of  a  Member  State  and 
permanent  residence  cards  issued  in  accordance  with  Article  20  of  Directive 
2004/38/EC to family members of Union citizens who are not nationals of a Member 
State. 

This Regulation shall not apply to identification documents issued on a provisional basis with 
a period of validity of less than six months. 

Chapter II 
National identity cards 

Article 3 
Security standards/format/specifications 

Identity  cards issued by  Member States shall be  produced in  ID-1 format and shall 
contain  a  machine-readable  zone  (MRZ).  Such  identity  cards  shall  be  based  on  the 

Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the 
protection of natural persons with regard to the processing of personal data by the Union institutions, 
bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 
45/2001 
39,  ELI: 
and  Decision  No 
http://data.europa.eu/eli/reg/2018/1725/oj). 
OJ C […], […], p. […]. 

1247/2002/EC 

21.11.2018, 

(OJ  L 

295, 

p. 

1. 

10 

11 

EN 

15 

  EN 

 
 
specifications and minimum security standards set out in ICAO Document 9303 and 
shall comply with the requirements set out in points (c), (d), (f) and (g) of the Annex 
to Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954. 

The data elements included on identity cards shall comply with the specifications set 
out in part 5 of ICAO document 9303. 

By  way  of  derogation  from  the  first  subparagraph,  the  document  number  may  be 
inserted in zone I and the designation of a person’s gender shall be optional. 

The document shall bear the title ‘Identity card’ or another well-established national 
designation  in  the  official  language  or  languages  of  the  issuing  Member  State,  and 
the words ‘Identity card’ in at least one other official language of the Union. 

The identity card shall contain, on the front side, the two-letter country code of the 
Member State issuing the card, printed in negative in a blue rectangle and encircled 
by 12 yellow stars. 

Identity  cards  shall  include  a  highly  secure  storage  medium  which  shall  contain  a 
facial  image  of  the  holder  of  the  card  and  two  fingerprints  in  interoperable  digital 
formats.  For  the  capture  of  biometric  identifiers,  Member  States  shall  apply  the 
technical  specifications  as  established  by  Commission  Implementing  Decision 
C(2018) 776712 as amended by Commission Implementing Decision C(2021) 372613. 

The  storage  medium  shall  have  sufficient  capacity  and  capability  to  guarantee  the 
integrity, the authenticity and the confidentiality of the data. The data stored shall be 
accessible in contactless form and secured as provided for in Implementing Decision 
C(2018) 7767 as amended by Implementing Decision C(2021) 3726. Member States 
shall exchange the information necessary to authenticate the storage medium and to 
access and verify the biometric data referred to in paragraph 5. 

Children  under  the  age  of  12  years  may  be  exempt  from  the  requirement  to  give 
fingerprints. 

Children  under  the  age  of  6  years  shall  be  exempt  from  the  requirement  to  give 
fingerprints. 

Persons in respect of whom fingerprinting is physically impossible shall be exempt 
from the requirement to give fingerprints. 

When  necessary  and  proportionate  to  the  aim  to  be  achieved,  Member  States  may 
enter such details and observations for national use as may be required in accordance 
with  national  law.  The  efficiency  of  minimum  security  standards  and  the  cross-
border compatibility of identity cards shall not be diminished as a result. 

Where Member States incorporate a dual interface or a separate storage medium in 
the identity card, the additional storage medium shall comply with the relevant ISO 
standards and shall not interfere with the storage medium referred to in paragraph 5. 

Commission  Implementing  Decision  C(2018)  7767  of  30 November  2018  laying  down  the  technical 
specifications  for  the  uniform  format  for  residence  permits  for  third  country  nationals  and  repealing 
Decision C(2002) 3069. 
Commission  Implementing  Decision  C(2021)  3726  of  4  June  2021  amending  Annex  III  to 
Implementing Decision C(2018) 7767 as regards the list of normative references. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 

9. 

12 

13 

EN 

16 

  EN 

 
10. 

11. 

1. 

2. 

3. 

1. 

2. 

Where Member States store data for electronic services such as e-government and e-
business  in  the  identity  cards,  such  national  data  shall  be  physically  or  logically 
separated from the biometric data referred to in paragraph 5. 

Where  Member  States  add  additional  security  features  to  identity  cards,  the  cross-
border  compatibility  of  such  identity  cards  and  the  efficiency  of  the  minimum 
security standards shall not be diminished as a result. 

Article 4 
Period of validity 

Identity cards shall have a minimum period of validity of five years and a maximum 
period of validity of ten years. 

By way of derogation from paragraph 1, Member States may provide for a period of 
validity of: 

(a) 

(b) 

less than five years, for identity cards issued to minors; 

in exceptional cases, less than five years, for identity cards issued to persons in 
special and limited circumstances and where their period of validity is limited 
in compliance with Union and national law; 

(c)  more than 10 years, for identity cards issued to persons aged 70 and above. 

Member  States  shall  issue  an  identity  card  having  a  validity  of  12  months  or  less 
where it is temporarily physically impossible to take fingerprints of any of the fingers 
of the applicant. 

Article 5 
Phasing out 

Identity cards which do not meet the requirements set out in Article 3 shall cease to 
be valid at their expiry or by 3 August 2031, whichever is earlier. 

By way of derogation from paragraph 1: 

(a) 

(b) 

identity cards which do not meet the minimum security standards set out in part 
2  of  ICAO  document  9303  or  which  do  not  include  a  functional  MRZ,  as 
defined in  paragraph 3,  shall cease to  be valid  at  their expiry or by 3 August 
2026, whichever is earlier; 

identity cards of persons aged 70 and above at 2 August 2021, which meet the 
minimum  security  standards  set  out  in  part  2  of  ICAO  document  9303  and 
which have a functional MRZ, as defined in paragraph 3, shall cease to be valid 
at their expiry. 

3. 

For the purpose of paragraph 2, a functional MRZ shall mean any of the following: 

(a) 

(b) 

a machine-readable zone compliant with ICAO document 9303; 

any other machine-readable zone for which the issuing Member State notifies 
the rules required for reading and displaying the information contained therein. 

EN 

17 

  EN 

 
Chapter III 
Residence documents for Union citizens 

Article 6 
Minimum information to be indicated 

Residence  documents,  when  issued  by  Member  States  to  Union  citizens,  shall  indicate  at  a 
minimum the following: 

(a) 

(b) 

(c) 

(d) 

(e) 

(f) 

(g) 

(h) 

the title of the document in the official language or languages of the Member State 
concerned and in at least one other official language of the Union; 

a clear reference that the document is  issued to  a Union citizen in  accordance with 
Directive 2004/38/EC; 

the document number; 

the name (surname and forename(s)) of the holder; 

the date of birth of the holder; 

the  information  to  be included  on  registration  certificates  and  documents  certifying 
permanent  residence,  issued  in  accordance  with  Articles  8  and  19  of  Directive 
2004/38/EC, respectively; 

the issuing authority; 

on  the  front-side,  the  two-letter  country  code  of  the  Member  State  issuing  the 
document,  printed  in  negative  in  a  blue  rectangle  and  encircled  by  twelve  yellow 
stars. 

If a Member State decides to take fingerprints, Article 3(7) shall apply accordingly. 

Chapter IV 
Residence cards for family members who are not nationals of a 
Member State 

Article 7 
Uniform format 

1. 

2. 

When  issuing  residence  cards  to  family  members  of  Union  citizens  who  are  not 
nationals of a Member State, Member States shall use the same format as established 
by Regulation (EC) No 1030/2002 as amended by Regulation (EU) 2017/1954, and 
as 
implemented  by  Implementing  Decision  C(2018)  7767  as  amended  by 
Implementing Decision C(2021) 3726. 

By way of derogation from paragraph 1, a card shall bear the title ‘Residence card’ 
or ‘Permanent residence card’. Member States shall indicate that these documents are 
issued  to  a  family  member  of  a  Union  citizen  in  accordance  with  Directive 
2004/38/EC.  For  this  purpose,  Member  States  shall  use  the  standardised  code 
‘Family Member EU Art 10 DIR 2004/38/EC’  or ‘Family Member EU Art 20 DIR 
2004/38/EC’, in  data field  [10], as referred to  in  the Annex to  Regulation  (EC) No 
1030/2002 as amended by Regulation (EU) 2017/1954. 

EN 

18 

  EN 

 
3. 

1. 

2. 

1. 

2. 

1. 

14 

Member  States  may  enter  data  for  national  use  in  accordance  with  national  law. 
When entering and storing such data, Member States shall respect the requirements 
set out in Article 4, second paragraph, of Regulation (EC) No 1030/2002 as amended 
by Regulation (EU) 2017/1954. 

Article 8 
Phasing out of existing residence cards 

Residence  cards  of  family  members  of  Union  citizens  who  are  not  nationals  of  a 
Member State which do not meet the requirements of Article 7 shall cease to be valid 
at their expiry or by 3 August 2026, whichever is earlier. 

By way of derogation from paragraph 1, residence cards of family members of Union 
citizens who  are not  nationals  of a Member State which do not  meet  the  minimum 
security standards set out in part 2 of ICAO document 9303 or which do not include 
a functional MRZ compliant with part 3 of ICAO document 9303 shall be invalid. 

Chapter V 
Common provisions 

Article 9 
Contact point 

Each  Member  State  shall  designate  at  least  one  central  authority  as  a  contact  point 
for  the  implementation  of  this  Regulation.  Where  a  Member  State  has  designated 
more than one central authority, it shall designate which of those authorities will be 
the contact point for the implementation of this Regulation. It shall communicate the 
name of that authority to the Commission and the other Member States. If a Member 
State changes its designated authority, it shall inform the Commission and the other 
Member States accordingly. 

Member States shall ensure that the contact points are aware of relevant information 
and assistance services at Union level included in the Single Digital Gateway set out 
in Regulation (EU) 2018/1724 of the European Parliament and of the Council14 and 
that they are able to cooperate with such services. 

Article 10 
Collection of biometric identifiers 

The  biometric  identifiers  shall  be  collected  solely  by  qualified  and  duly  authorised 
staff designated by the authorities responsible for issuing identity cards or residence 
cards,  for  the  purpose  of  being  integrated  into  the  highly  secure  storage  medium 
provided for in Article 3(5) for identity cards and in Article 7(1) for residence cards. 
By way of derogation from the first sentence, fingerprints shall be collected solely by 
qualified  and  duly  authorised  staff  of  such  authorities,  except  in  the  case  of 

Regulation  (EU)  2018/1724  of  the  European  Parliament  and  of  the  Council  of  2  October  2018 
establishing a single digital gateway  to provide access to information, to procedures and to assistance 
and problem-solving services and amending Regulation (EU) No 1024/2012 (OJ L 295, 21.11.2018, p. 
1, ELI: http://data.europa.eu/eli/reg/2018/1724/oj). 

EN 

19 

  EN 

 
 
applications  submitted  to  the  diplomatic  and  consular  authorities  of  the  Member 
State. 

With a view to ensuring the consistency of biometric identifiers with the identity of 
the applicant,  the applicant  shall appear in  person at  least  once during the issuance 
process for each application. 

Member  States  shall  ensure  that  appropriate  and  effective  procedures  for  the 
collection of biometric identifiers are in place and that those procedures comply with 
the rights and principles set out in the Charter, the Convention for the Protection of 
Human  Rights  and  Fundamental  Freedoms  and  the  United  Nations  Convention  on 
the Rights of the Child. 

Where difficulties are encountered in the collection of biometric identifiers, Member 
States shall ensure that appropriate procedures are in place to respect the dignity of 
the person concerned. 

Other  than  where  required  for  the  purpose  of  processing  in  accordance  with  Union 
and  national  law,  biometric  identifiers  stored  for  the  purpose  of  personalisation  of 
identity  cards  or  residence  documents  shall  be  kept  in  a  highly  secure  manner  and 
only until the date of collection of the document and, in any case, no longer than 90 
days  from  the  date  of  issue.  After  this  period,  these  biometric  identifiers  shall  be 
immediately erased or destroyed. 

Article 11 
Protection of personal data and liability 

Without  prejudice  to  Regulation  (EU)  2016/679,  Member  States  shall  ensure  the 
security, integrity, authenticity and confidentiality of the data collected and stored for 
the purpose of this Regulation. 

For  the  purpose  of  this  Regulation,  the  authorities  responsible  for  issuing  identity 
cards  and  residence  documents  shall  be  considered  as  the  controller  referred  to  in 
Article  4(7)  of  Regulation  (EU)  2016/679  and  shall  have  responsibility  for  the 
processing of personal data. 

Member States shall ensure that supervisory authorities can fully exercise their tasks 
as referred to in Regulation (EU) 2016/679, including access to all personal data and 
all  necessary  information  as  well  as  access  to  any  premises  or  data  processing 
equipment of the competent authorities. 

Cooperation with external service providers shall not exclude any liability on the part 
of  a  Member  State  which  may  arise  under  Union  or  national  law  in  respect  of 
breaches of obligations with regard to personal data. 

Information  in  machine-readable  form  shall  only  be  included  in  an  identity  card  or 
residence  document  in  accordance  with  this  Regulation  and  the  national  law  of  the 
issuing Member State. 

Biometric  data  stored  in  the  storage  medium  of  identity  cards  and  residence 
documents  shall  only  be  used  in  accordance  with  Union  and  national  law  for  the 
purpose of verifying: 

(a) 

the authenticity of the identity card or residence document; 

2. 

3. 

1. 

2. 

3. 

4. 

5. 

6. 

EN 

20 

  EN 

1. 

2. 

3. 

1. 

2. 

1. 

(b) 

the  identity  of  the  holder  by  means  of  directly  available  comparable  features 
where  the  identity  card  or  residence  document  is  required  to  be  produced  by 
law. 

The  two  fingerprints  stored  in  the  storage  medium  shall  only  be  accessed  by  duly 
authorised staff of competent national authorities and Union agencies. 

Article 12 
Monitoring 

By  [one  year  after  the  entry  into  force  of  this  Regulation],  the  Commission  shall 
establish a detailed programme for monitoring the outputs, results and impact of this 
Regulation, including its impact on fundamental rights. 

The  monitoring  programme  shall  set  out  the  means  by  which  and  the  intervals  at 
which the data and other necessary evidence are to be collected. It shall specify the 
action  to  be  taken  by  the  Commission  and  by  Member  States  in  collecting  and 
analysing the data and other evidence. 

Member  States  shall  provide  the  Commission  with  the  data  and  other  evidence 
necessary for such monitoring. 

Article 13 
Evaluation 

No  sooner  than  [six  years  after  the  entry  into  force  of  this  Regulation],  the 
Commission shall carry out an evaluation of this Regulation and present a report on 
the  main  findings  to  the  European  Parliament,  to  the  Council  and  to  the  European 
Economic and Social Committee. The report shall in particular focus on: 

(a) 

the impact of this Regulation on fundamental rights; 

(b) 

the mobility of Union citizens; 

(c) 

the  effectiveness  of  biometric  verification  in  ensuring  the  security  of  travel 
documents; 

(d) 

a possible further visual harmonisation of identity cards. 

Member States and relevant Union agencies shall provide the Commission with the 
information necessary for the preparation of these reports. 

Article 14 
Additional technical specifications 

In  order  to  ensure,  where  appropriate,  that  identity  cards  and  residence  documents 
referred  to  in  Article  2,  points  (a)  and  (c),  comply  with  future  minimum  security 
standards, the Commission shall establish, by means of implementing acts, additional 
technical specifications, relating to the following: 

(a) 

(b) 

additional security features and requirements, including enhanced anti-forgery, 
counterfeiting and falsification standards; 

technical  specifications  for  the  storage  medium  of  the  biometric  features 
referred  to  in  Article  3(5)  and  their  security,  including  prevention  of 
unauthorised access and facilitation of validation; 

EN 

21 

  EN 

(c) 

requirements for quality and common technical standards for the facial image 
and the fingerprints. 

Those  implementing  acts  shall  be  adopted  in  accordance  with  the  examination 
procedure referred to in Article 15(2). 

In accordance with the procedure referred to in Article 15(2), it may be decided that 
the  specifications  referred  to  in  this  Article  are  to  be  secret  and  are  not  to  be 
published. In such a case, they shall be made available only to the bodies designated 
by the Member States as responsible for printing and to persons duly authorised by a 
Member State or by the Commission. 

Each  Member  State  shall  designate  one  body  having  responsibility  for  printing 
identity  cards,  and  one  body  having  responsibility  for  printing  residence  cards  of 
family members of Union citizens, and shall communicate the names of such bodies 
to the Commission and to the other Member States. Member States shall be entitled 
to  change  such  designated  bodies  and  shall  inform  the  Commission  and  the  other 
Member States accordingly. 

Member States may also decide to designate a single body having responsibility for 
printing both identity cards and residence cards of family members of Union citizens 
and  shall  communicate  the  name  of  this  body  to  the  Commission  and  to  the  other 
Member States. 

Two  or  more  Member  States  may  also  decide  to  designate  a  single  body  for  those 
purposes and shall inform the Commission and the other Member States accordingly. 

Article 15 
Committee procedure 

The  Commission  shall  be  assisted  by  the  Committee  established  by  Article  6  of 
Regulation  (EC)  No  1683/95.  That  committee  shall  be  a  committee  within  the 
meaning of Regulation (EU) No 182/2011. 

Where  reference  is  made  to  this  paragraph,  Article  5  of  Regulation  (EU)  No 
182/2011  shall  apply.  Where  the  committee  does  not  deliver  an  opinion,  the 
Commission  shall  not  adopt  the  draft  implementing  act  and  Article  5(4),  third 
subparagraph, of Regulation (EU) No 182/2011 shall apply. 

2. 

3. 

1. 

2. 

Article 16 
Entry into force 

This Regulation shall enter into force on the twentieth day following that of its publication in 
the Official Journal of the European Union. 

This Regulation shall be binding in its entirety and directly applicable in the Member States in 
accordance with the Treaties. 

Done at Brussels, 

EN 

For the Council 
The President 

22 

  EN