Fingerprinting for ID cards – what can be done? #NoFingerprintIDs

Until now, fingerprinting for ID cards has been voluntary in Germany. It is, however, already mandatory for passports. Citizens can still choose whether their new ID should contain fingerprints or not. In practice, people are rarely informed about the voluntary nature and consequences of fingerprinting. Instead, they are encouraged to submit their fingerprints in the application process without proper clarification.

From August 2, 2021, fingerprinting will become compulsory: fingerprints will be stored locally on a chip on the ID cards themselves. The EU regulation 2019/1157, which contains the fingerprint obligation, was passed in 2019 with votes from Germany. With the law to strengthen security in passports, identity cards and documents issued to non-German citizens, the German ID card law will be adapted accordingly (for more information see bmi.bund.de, German only). Anyone who currently owns a valid ID card can use it until its expiration date - there is no obligation to carry an ID card with fingerprints from 2 August 2021. We therefore recommend applying for an ID card without fingerprints before August 2, 2021, in order to be able to use it for 10 years. For more info: take action now. The issue is on the Bundestag agenda for 10 September 2020, see bundestag.de. This may however be changed at short notice.

Note: If no fingerprints can be taken due to wear of the fingertips or injuries, identity cards without fingerprints will be issued for 12 months at a time:

Article 4: (3) "Member states shall issue an identity card for a period of validity of 12 months or less when, temporarily and for physical reasons, no fingerprints can be taken."

In our view, mandatory fingerprinting is a mistake, as it entails political, technical, fundamental and ethical threats, but does not solve any problems.

• Traceable for life: A fingerprint is a biometric feature that makes a person indentifiable for life. If necessary, people can change their name and place of residence to protect themselves from persecution or threats. Biometric data such as fingerprints do not allow for that.

• Overreach instead of Protection: Groundless collection of biometric data such as fingerprints on a massive scale is a useless and dangerous attack by the state on its population. Democracies and constitutional states have a duty to protect citizens from such attacks.

• Freedom is gradually being abolished: Surveillance and control measures are constantly being expanded and tightened but hardly ever rolled back. Without a change in policy, more and more sensitive biometric data will be collected, stored and used for all kinds of purposes in the future.

• The risk of access extension: In Germany, police and secret services have been allowed to automatically access biometric passport photos off of ID cards since 2017. There has been little supervision by regulatory authorities. An expansion of that practice, to include the access to fingerprints, seems only a matter of time.

• Loss of control through third country access: Through "global interoperability including in relation to machine readability and use of visual inspection" (recital 23), the biometric data can be accessed by authorities in countries where civil liberties are not protected. At this point, control over citizens’ biometric data is definitely lost.

• Loss of control through companies: When "cooperating with an external service provider" (recital 42), private companies may also have access to the data.

• Loss of control through secret services: After Edward Snowden's revelations, EU governments have failed to effectively limit the reach of secret services. During the NSU scandal, the so-called German "Verfassungsschutz" (literally “Federal Office for the Protection of the Constitution”), who received our lifetime-acheivement BigBrotherAward, even obstructed the investigation of terrorism. Secret services continue to work unchecked and in violation of fundamental rights. Consequently, it must be assumed that they will also be able to gain uncontrolled access to the biometric data of EU citizens.

• Risks of data networking: Politicians are already working on an EU-wide interconnected database structure for fingerprints, facial images and other biometric data, see netzpolitik.org vom 17. Juli 2020 and our own article on the matter in German. The databases of administrative authorities, police, secret services and companies are constantly growing. (See: Next Generation Prüm, Polizei 2020, Expansion of the Visa Information System or the Schengen Information System SIS II.)

• Children are affected: According to the EU regulation, all children aged 6 and over will be registered. Individual member states can exempt children aged 12 and under from mandatory fingerprinting.

• Illegitimate in democracies: In his German article „Zur Geschichte der Fingerabdrücke in Ausweisen“ Ralf Bendrath explains: "Identity cards in Germany go back to the "Kennkarte" introduced by the Nazis in 1938, which Jewish citizens were obliged to carry. (...) In Spain, fingerprinting for the national identity card, which is still in use today, was introduced in 1940 during the Franco dictatorship. What is now imposed on all citizens is thus clearly in the tradition of criminal regimes ." Beginning in 1942, the Vichy regime in France used the reference Jew on ID cards to deport 76,000 people in the Holocaust. (for more information in German visit: lto.de from 22 July 2018: 80 Jahre Ausweispflicht: Wie ein Nazi-Minister den Über­wa­chungs­staat durch­setzte)

• Data security: The new ID cards containing the fingerprints are read out contactlessly. Even a storage medium that cannot be cracked today could possibly be cracked in 10 years.