EDPS Opinion on biometrics in passports: exemptions welcomed but unsatisfactory

The European Data Protection Supervisor (EDPS) adopted an Opinion on the Commission's proposal aiming at revising the 2004 Council Regulation that sets out minimum standards for security features and biometrics in passports and travel documents.

The EDPS welcomes the introduction of exemptions from giving fingerprints based on the age of the person or his/her inability to provide fingerprints. These exemptions are part of the fallback procedures that should be implemented. However, the EDPS still considers these exemptions as insufficient to remedy the imperfections of biometrics, such as the impact of misidentification or failure to enrol.

Peter Hustinx, EDPS, says: "The fact that the Commission took into account the need for fallback procedures, stated in previous opinions, is more than welcomed. These exemptions are however still unsatisfactory. They fail to address all the possible and relevant issues triggered by the inherent imperfections of biometric systems, and more specifically those related to children and elderly."

With a view to ensure stringent safeguards to the proposed system, the EDPS' Opinion includes the following recommendations:

• fingerprints from children: the proposed six-year age limit should be considered as a provisional one, or brought in line with international practice (14 years). After three years, the age limit should be reviewed and defined by an in-depth study which is to identify the accuracy of the systems obtained under real conditions;
• fingerprints from the elderly: an age limit for elderly, based on similar experiences already in place (79 years), should be introduced as an additional exemption;
• principle of "one person-one passport": this principle should be applied only to children above the relevant age limit;
• "breeder" documents: additional measures should be proposed to harmonise the production and the use of documents required in Member States to issue passports (“breeder” documents);
• better harmonisation for the implementation of Regulation 2252/2004: only decentralised storage of biometric data collected for Member States’ passports and common error rates for the enrolment and matching process should be implemented.

The EDPS recalls that exemptions should in no way stigmatize or discriminate individuals who will be exempt, because of their age as a precautionary principle or because they present obviously unreadable fingerprints.