SP(2005)239

PURPOSE: To lay down standards for security features and biometrics in passports and travel documents issued by the Member States.

LEGISLATIVE ACT: Council Regulation 2252/2004/EC.

CONTENT: Minimum security standards for passports were introduced by a Resolution of the representatives of the Governments of the Member States, meeting within the Council, on 17 October 2000. It is now appropriate to upgrade this Resolution by a Community measure in order to achieve enhanced harmonised security standards for passports and travel documents to protect against falsification. At the same time biometric identifiers should be integrated in the passport or travel document in order to establish a reliable link between the genuine holder and the document.

This Regulation is limited to the harmonisation of the security features including biometric identifiers for the passports and travel documents of the Member States. The designation of the authorities and bodies authorized to have access to the data contained in the storage medium of documents is a matter of national legislation, subject to any relevant provisions of Community law, European Union law or international agreements.

This Regulation only lays down such specifications that are not secret. These specifications need to be supplemented by specifications which may remain secret in order to prevent the risk of counterfeiting and falsifications. Such additional technical specifications will be adopted in accordance with Council Decision 1999/468/EC of 28 June 1999 laying down the procedures for the exercise of implementing powers conferred on the Commission.

In order to ensure that the information referred to is not made available to more persons than necessary, each Member State will designate no more than one body having responsibility for producing passports and travel documents, with Member States remaining free to change the body, if need be. For security reasons, each Member State will communicate the name of the competent body to the Commission and the other Member States.

The minimum security standards with which passports and travel documents issued by Member States

shall comply are set out in the Annex.

Passports and travel documents shall include a storage medium which shall contain a facial image. Member States shall also include fingerprints in interoperable formats. The data shall be secured and the storage medium shall have sufficient capacity and capability to guarantee the integrity, the authenticity and the confidentiality of the data.

This Regulation applies to passports and travel documents issued by Member States. It does not apply to identity cards issued by Member States to their nationals or to temporary passports and travel documents having a validity of 12 months or less.

Additional technical specifications for passports and travel documents relating to the following shall be established in accordance with the procedure referred to in Article 5(2) of the Regulation:

- additional security features and requirements including enhanced anti-forgery, counterfeiting and falsification standards;

- technical specifications for the storage medium of the biometric features and their security, including prevention of unauthorised access;

- requirements for quality and common standards for the facial image and the fingerprints.

ENTRY INTO FORCE: 18/01/2005.

Regulation 2004/2252
OJ L 385 29.12.2004, p. 0001-0006

The European Parliament adopted the resolution drafted by Carlos COELHO (EPP-ED, PT) and made some amendments to the Commission's proposal. The resolution was adopted by 471 votes in favour to 118 against and 6 abstentions:

- a new clause states that the biometric data in passports should be used only for verifying the authenticity of the document as well as the identity of the holder by means of directly available comparable features

when the passport is required to be produced by law;

- Parliament specified that no central database of European Union passports and travel documents containing all EU passport holders' biometric and other data should be set up;

- the storage medium may be used only by the competent authorities of the Member States for reading, storing,

modifying and erasing data, and by authorised bodies entitled by law to read the data for reading the data;

- each Member State must maintain a register of the competent authorities and authorised bodies. It must communicate that register and, if necessary, regular updates to the Commission, which must maintain an up-to-date online compilation of the national registers.

With regard to the additional technical specifications referred to in the draft regulation, Parliament stated that the Commission must forward its draft decision on the additional technical specifications to the European Parliament which may, within a period of three months, adopt a resolution opposing that draft decision.

The application of the Regulation is contingent on the certification by national data protection authorities that they have adequate investigative powers and resources to enforce Directive 95/46/EC in relation to data collected under it.

Finally, Parliament wanted the deadline for implementing the regulation to be extended to 18 months (instead of one year) after the approval of the technical requirements for the passports at the latest.

T6-0073/2004
OJ C 208 25.08.2005, p. 0019-0050 E

Results of vote in Parliament

2626

The European Parliament adopted the resolution drafted by Carlos COELHO (EPP-ED, PT) and made some amendments to the Commission's proposal. The resolution was adopted by 471 votes in favour to 118 against and 6 abstentions:

- a new clause states that the biometric data in passports should be used only for verifying the authenticity of the document as well as the identity of the holder by means of directly available comparable features

when the passport is required to be produced by law;

- Parliament specified that no central database of European Union passports and travel documents containing all EU passport holders' biometric and other data should be set up;

- the storage medium may be used only by the competent authorities of the Member States for reading, storing,

modifying and erasing data, and by authorised bodies entitled by law to read the data for reading the data;

- each Member State must maintain a register of the competent authorities and authorised bodies. It must communicate that register and, if necessary, regular updates to the Commission, which must maintain an up-to-date online compilation of the national registers.

With regard to the additional technical specifications referred to in the draft regulation, Parliament stated that the Commission must forward its draft decision on the additional technical specifications to the European Parliament which may, within a period of three months, adopt a resolution opposing that draft decision.

The application of the Regulation is contingent on the certification by national data protection authorities that they have adequate investigative powers and resources to enforce Directive 95/46/EC in relation to data collected under it.

Finally, Parliament wanted the deadline for implementing the regulation to be extended to 18 months (instead of one year) after the approval of the technical requirements for the passports at the latest.

T6-0073/2004

Debate in Parliament

This Council Regulation is being proposed in response to a call from the Council of Thessaloniki seeking a coherent approach to EU biometric identifiers or biometric data for documents for third country nationals, EU citizens passports and information systems (VIS and SIS II). The Council recalls that minimum security standards for passports were introduced by a Resolution of the Member States in October 2000. The Resolution, however, needs to be updated and the most appropriate step would be through a Community measure. At the same time as updating the Resolution, the Council is seeking the introduction of biometric elements in passports in order to establish a reliable link between the genuine holder and the document. In accordance with the Schengen Agreement, this Regulation will apply neither to the United Kingdom nor Ireland. Denmark will decide within six months whether or not is wishes to participate in the programme.

The main elements of the proposal include the following features and provisions:

- The Regulation is limited to the harmonisation of security features, including biometric identifiers for the passports and travel documents of the Member States.

- The Regulation will only lay down specifications that are not secret.

- Member States will designate one authority responsible for producing passports and travel documents.

- The passports and travel documents will include a storage medium containing a facial image as well as fingerprints in interoperable formats.

- The Regulation will only apply to passports and travel documents issued by the Member States. It will not apply to ID cards or temporary passports.

- The new documents must have additional security features which include anti-forgery, counterfeiting and falsification standards; technical specifications for the storage of medium biometric information and its security including the prevention of unauthorised access and requirements for quality and common standards for the facial image and fingerprints.

- The biometric features used in the passports and travel documents may only be used for verifying the authenticity of the document and the identity of the holder by means of directly available comparable features.

- The Commission will be assisted by a Committee. The Regulation must be applied by the Member States at the latest 18 months following its adoption as regards the facial image and at the latest 36 months as regards fingerprints. The validity of passports and travel documents already issued shall not be affected.

- Lastly, an Annex is attached to the proposal which lays down the minimum level of security that Member States' passports and travel documents are required to provide.

15139/2004

A6-0028/2004

A6-0028/2004

The committee adopted the report by Carlos COELHO (EPP-ED, PT) broadly approving the proposal under the consultation procedure, subject to a number of amendments aimed at clarifying the purpose of the regulation and upholding citizens' privacy and data protection rights. The main amendments were as follows:

- no central database of EU passports and travel documents containing all EU passport-holders' biometric and other data should be set up, as this would violate the purpose and the principle of proportionality and increase the risk of data being used for purposes other than originally envisaged ("function creep");

- it should be clearly stated in the legal text which authorities will have access to the data, namely, the Member State authorities which are competent to read, store, modify and erase data (i.e. passport-issuing authorities) and authorised bodies entitled to read the data (i.e. border-patrolling authorities). To guarantee the necessary transparency, the committee also proposed that each Member State should maintain a register of these authorities and bodies and that the Commission should maintain an updated on-line register. Moreover, the passport-holder should always be entitled to verify the information, and to rectify or erase it where necessary free of charge;

- the purpose of the regulation should also be made more clear in the legal text: the committee specified that biometric features would be incorporated into passports only for the purpose of verifying the authenticity of the document and the identity of the holder;

- as the technical specifications are of crucial importance for data protection, the committee proposed that experts assessing these specifications from a data-protection viewpoint should be able to take part in the work of the technical committee;

- lastly, MEPs wanted the regulation to come into effect only once the national data protection authorities had adequate investigative powers and resources to enforce the 1995 Data Protection Directive in relation to data collected under the regulation. The deadline for implementing the regulation should therefore be extended to 18 months, rather than one year as originally proposed, after the approval of the technical specifications. The rapporteur hoped that the USA would respect this compromise by extending the deadline beyond 26 October 2005 for holding a biometric passport for visa-free travel.

2588

COM(2004)0116
EUR-Lex

COM(2004)0116
EUR-Lex