PURPOSE: to amend Council Regulation 1030/2002/EC and integrate biometric identifiers into the uniform format for residence permits for third country nationals.

LEGISLATIVE ACT: Council Regulation (EC) No 380/2008 amending Regulation (EC) No 1030/2002 laying down a uniform format for residence permits for third-country nationals

CONTENT: the purpose of this Regulation is solely to set the security features and biometric identifiers to be used by the Member States in a uniform format of residence permit for third-country nationals.

It is essential that the uniform format for residence permits should contain all the necessary information and meet very high technical standards, in particular as regards safeguards against counterfeiting and falsification and prevent and fight against illegal immigration and illegal residence.

Biometric identifiers : for the purposes of this Regulation, the biometric features in residence permits shall only be used for verifying:

(a) the authenticity of the document;

(b) the identity of the holder by means of directly available comparable features when the residence permit is required to be produced by national legislation.

The uniform format for residence permits will include a storage medium containing the facial image and two fingerprints images of the holder , both in interoperable formats. The data will be secured and stored, and the integrity, the authenticity and the confidentiality of the data will be guaranteed.

The capture of fingerprints is compulsory as of six years of age . Persons for whom fingerprinting is physically impossible shall be exempt from the requirement to give fingerprints.

Where Member States use the uniform format for purposes other than those covered by this Regulation, appropriate measures must be taken to ensure that confusion with the residence permit is not possible and the purpose is clearly indicated on the card.

Technical specifications : the technical specifications for the capture of biometric identifiers shall be set out in accordance with the procedure described in the text, and with International Civil Aviation Organisation (ICAO) standards and the technical specifications for passports issued by Member States to their nationals.

The Regulation notes that it only lays down specifications that are not secret. However, these specifications need to be supplemented by further specifications which may remain secret in order to prevent counterfeiting and falsifications and which may not include personal data or references to such data. In that case they shall be made available only to the bodies designated by the Member States as responsible for the printing and to persons duly authorised by a Member State or the Commission.

Powers to adopt such supplementary specifications should be conferred on the Commission, which should be assisted by the Committee established by Council Regulation (EC) No 1683/95 laying down a uniform format for visas.

It should also be noted that Member States may also store data for e-services such as e-government and e-business as well as additional provisions relating to the residence permit on a chip.

Treatment and data security : in accordance with Parliament’s wishes, the data shall be secured and the storage medium shall be of sufficient capacity and capability to guarantee the integrity, authenticity and confidentiality of the data. With regard to the personal data to be processed in the context of the uniform format for residence permits, Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data applies. It must be ensured that no further information is stored on the uniform format for residence permits unless provided for in Council Regulation (EC) No 1030/2002.

Territorial provisions: Denmark does not take part in the adoption of this Regulation, and is therefore not bound by it or subject to its application (it could however decide to adopt this Regulation at a later stage). Ireland gave notice, by letter of 19 December 2003, of its wish to take part in the adoption and application of this Regulation. Switzerland is also associated with this Regulation.

ENTRY INTO FORCE: 19.05.2008.

IMPLEMENTATION: the storage of the facial image as primary biometric identifier shall be implemented at the latest two years, and the storage of the two fingerprint images at the latest three years, after the adoption of the respective technical measures provided for in the Regulation.

However, the validity of residence permits already issued shall not be affected by the implementation of this Regulation, unless the Member State concerned decides otherwise.

For a transitional period of two years after the adoption of the technical specifications for the facial image, the residence permit may continue to be issued in sticker form.

SP(2007)3798/2

Results of vote in Parliament

The European Parliament adopted the resolution drafted by Carlos COELHO (EPP-ED, PT) and stressed that the introduction and processing of biometric data for identity documents needs to have particularly consistent and serious safeguards, especially regarding the way they are collected and used.

The main amendments were as follows:

- rigorous security standards equivalent to those laid down for national identity cards should be applied to the residence permit;

- the biometric features in the uniform residence permit should be used only for verifying the authenticity of the document and the identity of the holder by means of directly available comparable features when the residence permit is required to be produced by law;

- there should be a list of common obligations or requirements relating to the specificity of images, a common methodology and best practices for their implementation, and fallback procedures for persons who do not have readable fingerprints or who might be wrongly identified. There should also be appropriate procedures and specific rules for the protection of children whose biometric features are collected, especially where their fingerprints are taken;

- each Member State shall send to the Commission a list of competent authorities which are authorised to access the data on biometric features contained in the residence permits in accordance with this Regulation and any changes thereto. That list shall specify, for each authority, which data it may search and for what purposes. The Commission shall ensure the annual publication of the list in the Official Journal of the European Union and keep an updated list of competent authorities on its website;

- the following phrase was deleted: “Member States may include in the residence permit an additional contact chip as set out in Part 16 of the annex to this Regulation for e-services such as e-government and e-business.”;

- the uniform format for residence permits shall include a storage medium containing the facial image and two fingerprint images of the holder;

- the storage medium will be used only by the authorities in the Member States, as listed, which have competence to read and store the biometric data.;

- the biometric data recorded on the storage medium may not be modified or erased by any authority. Where such a need arises, a new residence permit shall be issued;

- decisions having substantial data protection implications, such as decisions on entering and accessing data, on the quality of data, on the technical compliance of storage media and on security measures for the protection of the biometric features must be made by way of regulation with the full involvement of the European Parliament. The European Data Protection Supervisor will have an advisory role in all cases having data protection implications;

- Member States shall regularly forward to the Commission evaluations of the application of the Regulation based on commonly agreed standards, in particular as regards the rules limiting the purposes for which data may be used and the bodies which may have access to the data. They shall also communicate to the Commission all problems encountered in applying this Regulation and shall exchange best practices with the Commission and among themselves.

T6-0266/2007

2807

A6-0211/2007

A6-0211/2007

PE378.762

OPINION OF THE EUROPEAN DATA PROTECTION SUPERVISOR on the modified proposal for a Council Regulation amending Regulation (EC) No 1030/2002 laying down a uniform format for residence permits for third-country nationals.

On 13 June 2002, in an effort to harmonise the format of residence permits issued by Member States to third-country nationals, the Council adopted Regulation (EC) No 1030/2002 laying down a uniform format for residence permits for third-country nationals. In the sixth recital of the Regulation, Member States and the European Commission agreed to consider, at regular intervals and according to technological developments, what changes should be made in order to enhance the security features built into permits. Biometric features were given as an illustrative example.

On 24 September 2003, the European Commission proposed a Council Regulation amending Regulation (EC) No 1030/2002. This Regulation was proposed together with another proposal for a Council Regulation amending Regulation (EC) No 1683/95 laying down a uniform format for visas. The main goal of both proposals was to introduce biometric data (facial image and two fingerprint images of the holder) in these new uniform formats of residence permits and visas. Due to a number of technological uncertainties, the format of the residence permit (sticker or stand-alone card) was not defined. Following a consultation procedure, these proposals were submitted to the European Parliament.

On 10 March 2006, the European Commission submitted a modified proposal for a Council Regulation amending Regulation (EC) No 1030/2002. In this modified proposal, a stand-alone card was the format decided upon due to potential collisions between contact-less chips. A defined area (zone 16 according to the annex of the proposal) will also be offered to those Member States which intend to embed a contact chip in the residence permit dedicated to e-services.

The EDPS welcomes this proposal which aims at better harmonising the EU immigration policy in general and the development of a uniform format for residence permit in particular.

The EDPS recognises the fact that the use of biometric features may improve protection of resident permits as well as fighting illegal immigration and illegal residence. However, the insertion of biometric data will contribute to these goals only if stringent safeguards for their use are implemented and only if their imperfections are mitigated with proper fallback procedures.

The EDPS recommends postponing the insertion of an additional chip for e-services purposes until complete impact assessment and risks assessment studies have been conducted and their results have been properly analysed.

Considering that while a residence permit is not a travel document it will be used in the Schengen area as an ID related document, the EDPS stresses the need for adopting highest security standards in line with the security specifications adopted by the Members States which are developing an e-ID card.

Concerning the residence permit development and implementation, technological choices with consistent impact on data protection should preferably be made by way of regulation, in accordance with the co-decision procedure. In other cases with an impact on data protection, the EDPS shall be given an advisory role included in Article 7 of the Regulation on the choices made by the committee foreseen by the proposal.

OJ C 320 28.12.2006, p. 0021-0023
52006XX1228(01)

PURPOSE: to lay down a uniform format for residence permits for third-country nationals.

PROPOSED ACT: Council Regulation.

CONTENT: the European Commission is presenting a new proposal regarding a common format for residence permits for third-country national on the basis that it has proven technically impossible to incorporate biometrics onto a visa or residence permit in the form of a “sticker” The problems identified by the technical committee relate to the durability of the chip and the interference between several chips on one passport. Tacking these technical challenges into account the Council invited the European Commission in February 2005 to propose (within 24 months) alternatives such as incorporating biometric identifies into residence permits in the form of a separate card. In presenting this proposal the European Commission is withdrawing its initial proposal to amend Regulation 1030/2002/EC, which was first tabled in 2003.

In the proposed Annex it is stated that the residence permit will be produced as a stand-alone document and must be machine readable. The residence permit in sticker form may only be issued up to two years after the adoption of the technical specifications.

Whilst this matter was being discussed in Council, the Estonian delegation tabled a declaration stating that the Commission should take account of national developments in the field of authentication, certification, digital signature and e-Government services for third country national living legally on the territory. In response to the Estonian Declaration the Commission is proposing a new “point 16” in the Regulation’s Annex, which effectively allows for the integration of a “contact chip” into the residence permit. The use of this contact chip is dependant on it being in line with related data protection rules and is optional. Its use should not interfere with the common format of the card. In essence, the latest draft amendment includes a new prototype of uniform residence permit, which includes a box for the possible insertion of a contact chip – the so-called box (Nr. 16).

Lastly, a further feature of the new proposed Regulation is its alignment with Regulation 2252/2004/EC on common security features and biometrics for passports and other documents. The biometric identifiers will only be stored in the Visa Information System.

COM(2006)0110
EUR-Lex

PURPOSE: to lay down a uniform format for residence permits for third-country nationals.

PROPOSED ACT: Council Regulation.

CONTENT: the European Commission is presenting a new proposal regarding a common format for residence permits for third-country national on the basis that it has proven technically impossible to incorporate biometrics onto a visa or residence permit in the form of a “sticker” The problems identified by the technical committee relate to the durability of the chip and the interference between several chips on one passport. Tacking these technical challenges into account the Council invited the European Commission in February 2005 to propose (within 24 months) alternatives such as incorporating biometric identifies into residence permits in the form of a separate card. In presenting this proposal the European Commission is withdrawing its initial proposal to amend Regulation 1030/2002/EC, which was first tabled in 2003.

In the proposed Annex it is stated that the residence permit will be produced as a stand-alone document and must be machine readable. The residence permit in sticker form may only be issued up to two years after the adoption of the technical specifications.

Whilst this matter was being discussed in Council, the Estonian delegation tabled a declaration stating that the Commission should take account of national developments in the field of authentication, certification, digital signature and e-Government services for third country national living legally on the territory. In response to the Estonian Declaration the Commission is proposing a new “point 16” in the Regulation’s Annex, which effectively allows for the integration of a “contact chip” into the residence permit. The use of this contact chip is dependant on it being in line with related data protection rules and is optional. Its use should not interfere with the common format of the card. In essence, the latest draft amendment includes a new prototype of uniform residence permit, which includes a box for the possible insertion of a contact chip – the so-called box (Nr. 16).

Lastly, a further feature of the new proposed Regulation is its alignment with Regulation 2252/2004/EC on common security features and biometrics for passports and other documents. The biometric identifiers will only be stored in the Visa Information System.

COM(2006)0110
EUR-Lex

Subject to a parliamentary scrutiny reservation by the Polish delegation, the Council adopted the conclusions in which it invites the Commission to make every effort, including with respect to budgetary programming, to bring the activation of biometric identifiers in the development of the central part of the VIS forward to 2006.

Lastly, it invites the Commission to amend its proposal for a Council Regulation amending Regulation 1030/2002/EC laying down a uniform format for residence permits for third-country nationals to take account of the consensus reached by the Council on incorporating biometric identifiers into residence permits in the form of a separate card within a period of 24 months, and to take account of the Council's desire to discontinue the use of residence permits in the form of stickers.

A6-0029/2004

A6-0029/2004

The Council, pending two scrutiny reservations, agreed on the inclusion of a second mandatory identifier (fingerprints) in passports and other travel documents issued by Member States.

It should be noted that at its meeting on 8 June 2004, the Council agreed that facial image should be the first mandatory biometric identifier and that fingerprints should be the second done but optional.

The Council also agreed to include fingerprints as a mandatory identifier. The appropriate date of application of these biometric identifiers was also agreed by the Council.

For the facial image identifier, 18 months will be required after the date of adoption of technical specifications to implement the Regulation, while 36 months will be required for fingerprints. The harmonisation of security features and the integration of biometric identifiers is an important step towards the use of new elements in the perspective of future developments at European level, which render passports and other travel documents more secure and establish a more reliable link between them and the holder. It is an important contribution to ensuring that passports and other travel documents are protected against fraudulent use. The Regulation does not apply to identity cards issued by Member States to their nationals. The biometric features in passports and other travel documents will be used for verifying:

- the authenticity of the document;

- the identity of the holder by means of directly available comparable features when the passport or other travel documents are required to be produced by law.

2613

The committee adopted the report by Carlos COELHO (EPP-ED, PT) broadly approving the proposal under the consultation procedure, subject to a number of amendments aimed at clarifying the purpose of the amended regulation and upholding citizens' privacy and data protection rights:

- it should be clearly stated in the legal text which authorities will have access to the biometric data in residence permits, namely, the Member State authorities which are competent to read, store, modify and erase data, and authorised bodies entitled to read the data;

- the purpose of including biometric data in the uniform format for residence permits should be made more clear in the legal text: the committee specified that the biometric features should be used only for the purpose of verifying the authenticity of the document and the identity of the holder. No provision should be made for further information to be stored in the resident permit;

- the Member States should regularly forward to the Commission audits of the application of the regulation, in particular regarding the rules limiting the purposes for which data may be used and the bodies which may have access to the data. They should also inform the Commission of any problems encountered in applying the regulation;

- as the technical specifications are of crucial importance for data protection, the committee proposed that experts assessing these specifications from a data-protection viewpoint should be able to take part in the work of the technical committee. And, to ensure democratic accountability, it wanted the European Parliament to be given the possibility of opposing the adoption of the technical specifications.

2561

The Council, pending the opinion of the European Parliament, reached a general approach on the two draft proposals laying down a uniform format for visas and for residence permits for third country nationals. The Council:

§ confirms that the specifications for the enrolment of biometric identifiers in the Visa Information System (VIS) will be coherent and therefore in line with the specifications laid down for biometric data in the Regulation concerning a uniform format for visas;

§ considers in agreement with the Commission that the implementation of the proposal on a uniform format for visas requires an additional legal instrument, creating the obligation and specifying the exceptions to the recording of fingerprints on the storage medium of the uniform format for visas;

§ invites the Commission to present the relevant proposal on the amendment of the Common Consular Instructions;

§ invites the Commission assisted by the Committee created under Article 6 of Regulation 1683/95 laying down a uniform format for visas to start as soon as possible with the development of the technical specifications necessary for the implementation of the measures.

The Council took note of the Commission’s intention to present a proposal for biometric identifiers in passports before the end of the year. It is recalled that the Commission had been requested to prepare these two proposals by the Thessaloniki European Council in June 2003. The main objectives of the proposals are to bring forward the final date for implementation of the photograph from 2007 to 2005 and to require Member States' harmonised integration of biometric identifiers into the visa and the residence permit for third-country nationals in order to ensure interoperability.

In October 2003, the Brussels European Council called upon the JHA Council to reach political agreement by the end of 2003 on the two proposals.

2548

2538

PURPOSE: to amend Council Regulation 1030/2002/EC and integrate biometric identifiers into the uniform format for residence permits for third country nationals.

PROPOSED ACT : Council Regulation.

CONTENT : Due to concerns about security in the aftermath of 11 September 2001, Member States stated that they would like to see further enhancement of the security standards of the uniform format for visas and travel documents in general. Member States are already required to incorporate a photograph into these travel documents by 2007. They have indicated that they are in favour of including biometric identifiers in the visa and the residence permit for third country nationals in order to establish a more reliable link between holder, passport and visa. This proposal is linked to the proposal to amend Regulation 1683/95/EC on the uniform format for visas. (See CNS/2003/0217.) The aim of these two proposals is:

- to bring forward the final date for the implementation of the photograph from 2007 to 2005 and at the same time;

- require Member States to integrate biometric identifiers into the visa and the residence permit for third country nationals in a harmonised way, thus ensuring interoperability.

It must be added that these proposals will have a decisive impact on the choice of biometric identifiers to be used in the VIS (Visa Information System), as they should be the same in order to ensure coherence. Furthermore, the enrolment of the biometric identifiers must be in line with the requirements of the VIS in order to enable identification (one-to-many searches).

The digital photograph will be integrated into the visa and used for the integration of the facial image as the primary interoperable biometric identifier, to be stored among other information on a storage medium with sufficient capacity. The bringing forward of the final date of implementation is a logical consequence. Some Member States have already anticipated the final date by implementing the Regulations early i.e. before 2007.

The proposals provide for the mandatory storage of the facial image as a primary biometric identifier in order to ensure interoperability. A secondary biometric identifier is added. The fingerprint provides the best solution for "background checks", the identification (one-to-many searches) in databases. The number of fingerprint images stored is limited to two. The fingerprint images will be taken from flat fingers and not be 'rolled'.

The main purpose of the chosen identifiers is to achieve a solution, which guarantees a very high level of security and the best technical results. The choice of technology is left to Member States. The two Regulations provide only for the legal basis for Member States to store biometric data on the uniform format for visas and the residence permit for third country nationals. The implementation of such action is left to the Member States in accordance with the technical specifications set out by the Committee created by Article 6 of Regulation 1683/95/EC. Member States will carry out the processing of the biometric data. Directive 95/46/EC on data protection applies to the processing of personal data, including biometric data.

It must be added that the proposals have impact on the Schengen acquis, and Denmark will not take part in the proposal on the uniform format for residence permits.

Financial implications: this is uncertain as the exact requirements are not yet known and will be established by the Committee created by Article 6 of Regulation 1683/95/EC. In any event, it should be recalled that the necessary technical equipment has to be installed for the integration of the photograph according to high security standards into the visa and the residence permit for third country nationals and for the VIS system. The following technical requirements seem to be necessary:

- storage medium;

- enrolment equipment;

- verification systems;

- data management.

COM(2003)0558
EUR-Lex

PURPOSE: to amend Council Regulation 1030/2002/EC and integrate biometric identifiers into the uniform format for residence permits for third country nationals.

PROPOSED ACT : Council Regulation.

CONTENT : Due to concerns about security in the aftermath of 11 September 2001, Member States stated that they would like to see further enhancement of the security standards of the uniform format for visas and travel documents in general. Member States are already required to incorporate a photograph into these travel documents by 2007. They have indicated that they are in favour of including biometric identifiers in the visa and the residence permit for third country nationals in order to establish a more reliable link between holder, passport and visa. This proposal is linked to the proposal to amend Regulation 1683/95/EC on the uniform format for visas. (See CNS/2003/0217.) The aim of these two proposals is:

- to bring forward the final date for the implementation of the photograph from 2007 to 2005 and at the same time;

- require Member States to integrate biometric identifiers into the visa and the residence permit for third country nationals in a harmonised way, thus ensuring interoperability.

It must be added that these proposals will have a decisive impact on the choice of biometric identifiers to be used in the VIS (Visa Information System), as they should be the same in order to ensure coherence. Furthermore, the enrolment of the biometric identifiers must be in line with the requirements of the VIS in order to enable identification (one-to-many searches).

The digital photograph will be integrated into the visa and used for the integration of the facial image as the primary interoperable biometric identifier, to be stored among other information on a storage medium with sufficient capacity. The bringing forward of the final date of implementation is a logical consequence. Some Member States have already anticipated the final date by implementing the Regulations early i.e. before 2007.

The proposals provide for the mandatory storage of the facial image as a primary biometric identifier in order to ensure interoperability. A secondary biometric identifier is added. The fingerprint provides the best solution for "background checks", the identification (one-to-many searches) in databases. The number of fingerprint images stored is limited to two. The fingerprint images will be taken from flat fingers and not be 'rolled'.

The main purpose of the chosen identifiers is to achieve a solution, which guarantees a very high level of security and the best technical results. The choice of technology is left to Member States. The two Regulations provide only for the legal basis for Member States to store biometric data on the uniform format for visas and the residence permit for third country nationals. The implementation of such action is left to the Member States in accordance with the technical specifications set out by the Committee created by Article 6 of Regulation 1683/95/EC. Member States will carry out the processing of the biometric data. Directive 95/46/EC on data protection applies to the processing of personal data, including biometric data.

It must be added that the proposals have impact on the Schengen acquis, and Denmark will not take part in the proposal on the uniform format for residence permits.

Financial implications: this is uncertain as the exact requirements are not yet known and will be established by the Committee created by Article 6 of Regulation 1683/95/EC. In any event, it should be recalled that the necessary technical equipment has to be installed for the integration of the photograph according to high security standards into the visa and the residence permit for third country nationals and for the VIS system. The following technical requirements seem to be necessary:

- storage medium;

- enrolment equipment;

- verification systems;

- data management.

COM(2003)0558
EUR-Lex