Skip to content
Adopted text

Strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement

TA-10-2025-0056 · P10_TA(2025)0056 · PE766.606

Official HTML ↗ DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 4 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the proposed Council regulation on strengthening the security of identity cards and residence documents for EU citizens and their family members. It approves the proposal with amendments, focusing on data protection and access to biometric data. The amended text restricts access to facial images and fingerprints stored on documents to authorised staff of national authorities and Union agencies, with private entities needing consent for facial image access. It also sets rules on data retention, deletion, and reporting.

Key points

  1. The regulation does not provide a legal basis for setting up or maintaining national or centralised databases for storing biometric data; such databases would need to meet a strict necessity and proportionality test.
  2. Facial images stored on documents should be accessed only by duly authorised staff of competent national authorities, Union agencies, and private entities for verifying authenticity and identity, in compliance with Union data protection law.
  3. Facial images should not be retained longer than necessary and should be deleted as soon as purposes are achieved; they should not be transferred for other purposes.
  4. Verification of fingerprints should be carried out only by duly authorised staff of competent national authorities and Union agencies, and only when required by Union or national law.
  5. Member States may decide whether to include gender on documents; if included, they must use ICAO Document 9303 specifications 'F', 'M', or 'X' or corresponding single initials.
  6. Qualified staff should receive training on best practices for collecting biometric identifiers from children and vulnerable persons, respecting dignity and sensitivity.
  7. The Commission should promote Member States' cooperation to ensure interoperability of storage medium formats, including at automated border crossing points.
  8. The Commission must report on implementation two and eleven years after entry into force, and evaluate the regulation every six years, focusing on fundamental rights and data protection.
  9. Biometric identifiers collected for personalisation must be kept securely and erased or destroyed no later than 90 days from issue; processing for other purposes is subject to national or Union data protection law.
  10. Member States must ensure external service providers comply with data protection law and adopt measures to prevent unauthorised access or misuse of personal data.
  11. Private entities accessing facial images require the holder's consent, unless strictly necessary and provided for by Union or national law.
  12. The evaluation should also consider the necessity of introducing common security features for provisional identification documents and further harmonising residence document security features.

Who is affected

  • Member states issuing identity cards and residence documents to EU citizens and their family members.
  • Competent national authorities and Union agencies that access biometric data for verification.
  • Private entities seeking to verify identity using facial images; they must obtain consent unless strictly necessary.
  • External service providers involved in document personalisation; they must comply with data protection law.

Figures and deadlines

  • 90 days from the date of issue for erasure or destruction of biometric identifiers.
  • Two years and 11 years after entry into force for Commission reports on implementation.
  • Six years after entry into force and every six years thereafter for evaluation.

Legal basis: Article 77(3) of the Treaty on the Functioning of the European Union