Law & Politics

"Courts are investigating the legality of a European Union regulation requiring biometric passports in Europe. Last month, the Dutch Council of State (Raad van State, the highest Dutch administrative court) asked the European Court of Justice (ECJ) to decide if the regulation requiring fingerprints in passports and travel documents violates citizens’ right to privacy. The case entered the courts when three Dutch citizens were denied passports and another citizen was denied an ID card for refusing to provide their fingerprints. The ECJ ruling will play an important role in determining the legality of including biometrics in passports and travel documents in the European Union.

The Dutch Council referred the question of legality to the ECJ, arguing that the restrictions on privacy do not outweigh the ostensible aim of fraud prevention, and questioning the RFID technique. The Council also questioned whether fingerprints could be safeguarded so that they would only be used in passports or identity cards and not in databases for other purposes (known as function creep). The four cases that prompted this challenge to the biometric passport regulation are suspended pending the ECJ’s response.

The Netherlands has mandated fingerprints in passports and ID-cards since 2009. The Dutch biometric Passport Act is the misshapen offspring of the European Regulation compelling security features and biometrics in passports. The Regulation mandates that passports include two fingerprints taken flat in interoperable formats.

The Netherlands' storage of a biometric database was suspended in 2011, following privacy concerns as well as questions over the reliability of biometric technology. The Mayor of the City of Roermond reported that 21 percent of fingerprints collected in the city could not be used to identify any individuals. In April 2011, the Dutch Minister of Interior, in a letter to the Dutch House of Representatives, asserted that the number of false rejections was too high to warrant using fingerprints for verification and identification. Currently, only fingerprints stored in Radio Frequency Identification (RFID) chips embedded in ID documents are being collected.

The Amsterdam-based Privacy First Foundation (Stichting Privacy First) appreciates the critical stance on biometrics taken by the Dutch Council of State in line with the position taken by a German court: "We hope the ECJ will soon rule that the European Passport Regulation is invalid both in a formal, procedural sense (having been improperly adopted in 2004) and in a material sense (violating the human right to privacy and data protection). In the meantime, we hope the Dutch Parliament will scrap compulsory fingerprinting for Dutch ID cards as soon as possible."

A government proposal to this effect is currently before the Dutch House of Representatives.

The Dutch Council concerns echo questions raised by a German court earlier this year regarding the legality of the German biometric passports with RFID chips. The German court has questioned whether the EU regulation is compatible with the Charter of Fundamental Rights of the European Union (EU Charter) and the European Convention of Human Rights (ECHR). The German case was preempted when a German citizen, Michael Schwarz, refused to provide his fingerprints to obtain his new passport and the City of Bochum decided not to issue him one.

Mr. Schwarz argued that the regulation infringes privacy as protected under the ECHR and the EU Charter. In this case, the German court argued that the European Union has no legislative competence to enact rules on standards for security features and biometrics in passports as there is no direct relation of such rules to the protection and security of EU external frontiers.

The German court decided that the requirement of biometric data in passports is a “serious infringement” on privacy, arguing that the measure does not satisfy the proportionality test of being appropriate, necessary, or reasonable."

Read the entire article (including sources) on the website of the Electronic Frontier Foundation (EFF) HERE.

The appeal by Privacy First and 19 citizens against the Dutch government takes place today. Privacy First is of the opinion that the new Dutch Passport Act violates the right to privacy. Despite criticism from the Dutch House of Representatives, the Dutch government recently decided to push this controversial law ahead. The case of Privacy First primarily concentrates on the centralised storage of fingerprints. This lawsuit is the first of its kind.

Clarification
On February 2, 2011, the Privacy First Foundation and 21 co-plaintiffs (citizens) were declared inadmissible by the district court of The Hague in our civil case against the Netherlands regarding the 2009 Dutch Passport Act. A proposal by the Dutch Minister of the Interior, Ms. Liesbeth Spies, to revise the Passport Act has been presented to the House of Representatives on 17 October this year. However, in this legislative proposal the original provision (Article 4b) concerning a centralised database remains intact for the greater part. Under this provision, biometric data of every Dutch citizen will be used for criminal investigation and prosecution purposes as well as intelligence work, disaster control and counter-terrorism. This constitutes a flagrant violation of, among other things, European privacy law. Efforts by individual citizens to challenge this through individual administrative court cases have thus far not yielded any results, since the administrative courts proved unwilling to evaluate the provision in question. Nevertheless, the Dutch Council of State (Raad van State) has recently made a preliminary reference to the European Court of Justice in Luxembourg regarding the European Passport Regulation. In anticipation of the Court’s response, all Dutch administrative proceedings have been put on hold for at least one and a half years, which means that protesting citizens have to fend for themselves during that period without valid identity documents. Enough reason for Privacy First to again haul up the civil-law sails in the public interest and to appeal in our Passport Act lawsuit.

To that end we have today presented our Statement of Appeal to the Court of Appeal in The Hague. In this Statement Christiaan Alberdingk Thijm and Vita Zwaan (SOLV Attorneys) outline why Privacy First and co-plaintiffs have to be declared admissible. Subsequently, it will be possible for the Passport Act to be legally scrutinized in its entirety by the court and be measured up against higher law, including European privacy legislation. Our entire Statement of Appeal can be downloaded HERE (in Dutch). The Appeals Court of The Hague is expected to deliver its judgment before the summer.

Urgent appeal
Privacy First makes an urgent appeal to all Dutch citizens to contribute to the financing of this lawsuit. This can be done by donating on account number 49.55.27.521 attn. Stichting Privacy First in Amsterdam, mentioning the following reference: ‘Paspoortproces’. We kindly thank you for your support!

The Privacy First Foundation has, with pleasure, just taken cognisance of 1) the announcement earlier today of a Dutch legislative proposal to abrogate fingerprints in ID cards and 2) the decision by the Dutch Council of State (Raad van State) to make a request for a preliminary ruling to the European Court of Justice in Luxembourg on the legality and interpretation of the European Passport Regulation in four administrative cases of individual Dutch citizens. The Privacy First Foundation hereby makes an appeal to Dutch Parliament to adopt the legislative proposal to abrogate fingerprints in ID cards as soon as possible. In anticipation of the expected adoption of this legislative proposal, taking people's fingerprints for ID cards must be halted immediately or at least become voluntary as a temporary solution. Privacy First also hopes that the European Court of Justice will swiftly deal with the preliminary reference and conclude that taking fingerprints for passports and ID cards is unlawful because it violates the right to privacy. Further comments by Privacy First will follow.    

Update 18.00h: listen to the interview (in Dutch) with Privacy First on Radio 1.

Update 29 September 2012: see also our reaction in the Dutch regional press.

On this page you can find up-to-date information and documents relating to the civil lawsuit (Passport Trial, 'Paspoortproces') that Privacy First has lodged against the Dutch government which, in this case, is being represented by the Dutch Ministry of the Interior and Kingdom Relations.

trial documents (in Dutch)

- Response letter ('Borgersbrief') from Privacy First and co-plaintiffs dated 6 March 2015, by Barbara van Dorp (Alt Kam Boer Attorneys; click HERE (pdf in Dutch).

- Advice from the Advocate General of the Supreme Court Jaap Spier dated 20 February 2015; click HERE (pdf in Dutch, 7 MB).

- Rejoinder from Privacy First and co-plaintiffs dated 5 December 2014, by Barbara van Dorp (Alt Kam Boer Attorneys); click HERE (pdf in Dutch).

- Reply from the State Attorneys Hans van Wijk and Gijsbrecht Nieuwland dated 5 December 2014; click HERE (pdf in Dutch).

- Written explanation to the appeal summons from the State Attorneys Hans van Wijk and Gijsbrecht Nieuwland dated 21 November 2014; click HERE (pdf in Dutch).

- Statement of Defence (written explanation) from Privacy First and co-plaintiffs dated 21 November 2014, by Barbara van Dorp (Alt Kam Boer Attorneys); click HERE (pdf in Dutch).

- Appeal Summons from State Attorneys Hans van Wijk en Gijsbrecht Nieuwland dated 19 May 2014; click HERE (pdf in Dutch).

- Ruling of the Hague Court of Appeal dated 18 February 2014; click HERE (pdf in Dutch), which was also published on rechtspraak.nl and in Jurisprudentie Bestuursrecht 2014/76, with annotation by professor R. Schutgens.

- Reply to the Statement of Appeal by the State Attorney Cécile Bitter dated 26 March 2013: click HERE (pdf in Dutch).

- Statement of Appeal by the Privacy First Foundation and co-plaintiffs, dated 18 December 2012 click HERE.
- Judgement by the district court of The Hague dated 2 February 2011:  click HERE. LJN: BP2860. Annotations: JB 2011/78 by Prof. R. Schutgens , NJB 2011, No 15 (Kroniek Bestuursrecht, 'Chronicle of Administrative Law'), p. 939; NJB 2012/11 (Prof. T. Barkhuysen, Ruim baan voor belangenorganisaties, 'Make way for interest groups').

- Brief by Christiaan Alberdingk Thijm (SOLV Attorneys): click HERE.
- Brief by State Attorney Cécile Bitter: click HERE. 
- Statement of Defence by State Attorney Cécile Bitter: click HERE.
- Summons of the State by the Privacy First Foundation, by Christiaan Alberdingk Thijm (SOLV Attorneys): click HERE.
- Pre-advice by Judith van Schie (Bousie Attorneys): click HERE. 

Background: LegAL grounds

The source for our current passport: EU Council Regulation (EC) No 2252/2004 of 13 December 2004 on standards for security features and biometrics in passports and travel documents issued by Member States: click HERE.

The EU rules for dealing with passport data: Directive 95/46/EC dated 24 October 1995 (European Privacy Directive): click HERE.

Jurisprudence: the famous Marper case. Is it lawful to store the fingerprints of someone who isn't being accused of anything? According to the European Court of Human Rights (ECHR), it isn't. For the judgment by the ECHR in Strasbourg in the case of S. and Marper vs. United Kingdom dated December 4, 2008, click HERE.

The Dutch Passport Act of 15 July 2009, in force as of 21 September 2009, click HERE. For the 2008 Explanatory Memorandum to the new Passport Act click HERE.