Text · Adopted text
Strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement
Document TA-10-2025-0056 · P10_TA(2025)0056 · PE766.606
- Kind
- Adopted text TA-10-2025-0056
- Date
- 2 April 2025
- Dossier
- 2024/0187(CNS)
More facts (3)
- Voted
- 2 Apr 2025 (adopted text) Passed 377 for, 279 against, 16 abstained
- Formats
- Official page Word
- Subject matter
- ELSJ, CIT, LCP
In short
A summary of the text written by AI; ¶ opens the paragraph it rests on.
AI: In short Written by AI from the official text — check the source · deepseek-v4-flash · 4 Sept 2026
Parliament's amended version of the proposed Council regulation on strengthening the security of identity cards and residence documents for EU citizens and their family members. It approves the proposal with amendments, focusing on data protection and access to biometric data. The amended text restricts access to facial images and fingerprints stored on documents to authorised staff of national authorities and Union agencies, with private entities needing consent for facial image access. It also sets rules on data retention, deletion, and reporting.
Key points
- The regulation does not provide a legal basis for setting up or maintaining national or centralised databases for storing biometric data; such databases would need to meet a strict necessity and proportionality test.
- Facial images stored on documents should be accessed only by duly authorised staff of competent national authorities, Union agencies, and private entities for verifying authenticity and identity, in compliance with Union data protection law.
- Facial images should not be retained longer than necessary and should be deleted as soon as purposes are achieved; they should not be transferred for other purposes.
- Verification of fingerprints should be carried out only by duly authorised staff of competent national authorities and Union agencies, and only when required by Union or national law.
- Member States may decide whether to include gender on documents; if included, they must use ICAO Document 9303 specifications 'F', 'M', or 'X' or corresponding single initials.
- Qualified staff should receive training on best practices for collecting biometric identifiers from children and vulnerable persons, respecting dignity and sensitivity.
- The Commission should promote Member States' cooperation to ensure interoperability of storage medium formats, including at automated border crossing points.
- The Commission must report on implementation two and eleven years after entry into force, and evaluate the regulation every six years, focusing on fundamental rights and data protection.
- Biometric identifiers collected for personalisation must be kept securely and erased or destroyed no later than 90 days from issue; processing for other purposes is subject to national or Union data protection law.
- Member States must ensure external service providers comply with data protection law and adopt measures to prevent unauthorised access or misuse of personal data.
- Private entities accessing facial images require the holder's consent, unless strictly necessary and provided for by Union or national law.
- The evaluation should also consider the necessity of introducing common security features for provisional identification documents and further harmonising residence document security features.
Who is affected
- Member states issuing identity cards and residence documents to EU citizens and their family members.
- Competent national authorities and Union agencies that access biometric data for verification.
- Private entities seeking to verify identity using facial images; they must obtain consent unless strictly necessary.
- External service providers involved in document personalisation; they must comply with data protection law.
Figures and deadlines
- 90 days from the date of issue for erasure or destruction of biometric identifiers.
- Two years and 11 years after entry into force for Commission reports on implementation.
- Six years after entry into force and every six years thereafter for evaluation.
Legal basis. Article 77(3) of the Treaty on the Functioning of the European Union
Text
The text as parsed from the official Word file. Every paragraph has a link (¶) and can be saved to a project as a passage.
Jump to an amendment (19)
European Parliament legislative resolution of 2 April 2025 on the proposal for a Council regulation on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement (COM(2024)0316 – C10-0112/2024 – 2024/0187(CNS))
–having regard to Article 77(3) of the Treaty on the Functioning of the European Union, pursuant to which the Council consulted Parliament (C100112/2024),
–having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A10-0041/2025),
2.Calls on the Commission to alter its proposal accordingly, in accordance with Article 293(2) of the Treaty on the Functioning of the European Union;
3.Calls on the Council to notify Parliament if it intends to depart from the text approved by Parliament;
4.Asks the Council to consult Parliament again if it intends to substantially amend the Commission proposal;
5.Instructs its President to forward its position to the Council, the Commission and the national parliaments.
| Text proposed by the Commission | Amendment |
|---|---|
| (19) This Regulation does not provide a legal basis for setting up or maintaining databases at national level for the storage of biometric data in Member States, which is a matter of national law that needs to comply with Union law regarding data protection, including its necessity and proportionality requirements. Moreover, this Regulation does not provide a legal basis for setting up or maintaining a centralised database at Union level. | (19) This Regulation does not provide a legal basis for setting up or maintaining databases at national level for the storage of biometric data in Member States. Moreover, this Regulation does not provide a legal basis for setting up or maintaining a centralised database at Union level. As recalled by the European Data Protection Supervisor in his opinion 21/2024, setting up or maintaining databases at national level for storing biometric data in Member States, or similarly, setting up or maintaining a centralised database at Union level, along with the potential use of such data for other purposes, would need to meet a strict necessity and proportionality test under the Charter, as interpreted by the relevant case law of the Court of Justice. |
| Text proposed by the Commission | Amendment |
|---|---|
| (20) Biometric identifiers should be collected and stored in the storage medium of identity cards and residence documents for the purposes of verifying the authenticity of the document and the identity of the holder. Given the electronic signature on the storage medium of identity cards, identifying the holder by means of the storage medium, which contains the same biographic data as printed on the document, is more reliable than a visual check of the document. Union citizens should thus be allowed to use the data stored in the storage medium of their identity card to identify themselves towards private entities. However, the verification of the fingerprints stored on the storage medium should only be carried out by duly authorised staff and only when the document is required to be produced by law. | (20) Facial images stored in the storage medium of identity cards and residence documents should be accessed only by duly authorised staff of competent national authorities, Union agencies and private entities for the purposes of verifying the authenticity of the document and the identity of the holder. Such access should comply with Union data protection law. Facial images should not be retained for longer than is necessary for those purposes, should be deleted as soon as those purposes are achieved and should not be transferred to third countries or international organisations unless permitted by Union data protection law. Those safeguards are intended to ensure appropriate protection of the facial image while not prohibiting its use. |
| Text proposed by the Commission | Amendment |
|---|---|
| (20a) The verification of the fingerprints stored on the storage medium should be carried out only by duly authorised staff of competent national authorities and Union agencies and only when the document is required to be produced by Union or national law. |
| Text proposed by the Commission | Amendment |
|---|---|
| (23) Member States should be able to decide whether to include a person’s gender on a document covered by this Regulation. Where a Member State includes a person’s gender on such a document, the specifications of ICAO Document 9303 ‘F’, ‘M’ or ‘X’ or the corresponding single initial used in the language or languages of that Member State should be used, as appropriate. | (23) Without prejudice to the case law of the Court of Justice1a, Member States should be able to decide whether to include a person’s gender on a document covered by this Regulation. Where a Member State includes a person’s gender on such a document, the specifications of ICAO Document 9303 ‘F’, ‘M’ or ‘X’ or the corresponding single initial used in the language or languages of that Member State should be used, as appropriate. |
| 1a Judgment of the Court of Justice of 4 October 2024, Mirin, C-4/23, ECLI:EU:C:2024:845 |
| Text proposed by the Commission | Amendment |
|---|---|
| (26) Where difficulties are encountered in the collection of biometric identifiers, Member States should ensure that appropriate procedures are in place to respect the dignity of the person concerned. Therefore, specific considerations relating to gender and to the specific needs of children and of vulnerable persons should be taken into account. | (26) Where difficulties are encountered in the collection of biometric identifiers, Member States should ensure that appropriate procedures are in place to respect the dignity of the person concerned. Therefore, specific considerations relating to gender and to the specific needs of children and of vulnerable persons should be taken into account. Qualified staff should receive training on best practices for collecting biometric identifiers from children and vulnerable persons, ensuring sensitivity to gender and age-specific needs while respecting the dignity of all individuals. |
| Text proposed by the Commission | Amendment |
|---|---|
| (32) Member States should exchange with each other such information as is necessary to access, authenticate and verify the information contained on the secure storage medium. The formats used for the secure storage medium should be interoperable, including in respect of automated border crossing points. | (32) Member States should exchange with each other such information as is necessary to access, authenticate and verify the information contained on the secure storage medium. The formats used for the secure storage medium should be interoperable, including in respect of automated border crossing points. The Commission should promote Member States’ cooperation in support of such objectives. |
| Text proposed by the Commission | Amendment |
|---|---|
| (43) In accordance with the Interinstitutional Agreement of 13 April 2016 on Better Law-Making9 , the Commission should, no sooner than six years after the date of application of this Regulation carry out an evaluation of this Regulation, including on the basis of information gathered through specific monitoring arrangements, in order to assess the actual effects of this Regulation and the need for any further action. For the purpose of monitoring, Member States should collect statistics on the number of identity cards and residence documents which they issued. | (43) The Commission should report on the implementation of this Regulation two years, and 11 years, after the date of its entry into force, including on the appropriateness of the level of security, taking into account its impact on fundamental rights and data protection principles. In accordance with the Interinstitutional Agreement of 13 April 2016 on Better Law-Making9 , the Commission should, six years after the date of entry into force of this Regulation, and every six years thereafter, carry out an evaluation of this Regulation, including on the basis of information gathered through specific monitoring arrangements, in order to assess the actual effects of this Regulation and the need for any further action. For the purpose of monitoring, Member States should collect statistics on the number of identity cards and residence documents which they issued. |
| 9 OJ L 123, 12.5.2016, p. 1, ELI: http://data.europa.eu/eli/agree_interinstit/2016/512/oj. | 9 OJ L 123, 12.5.2016, p. 1, ELI: http://data.europa.eu/eli/agree_interinstit/2016/512/oj. |
| Text proposed by the Commission | Amendment |
|---|---|
| By way of derogation from the first subparagraph, the document number may be inserted in zone I and the designation of a person’s gender shall be optional. | By way of derogation from the first subparagraph, the document number may be inserted in zone I and the designation of a person’s gender shall be optional. Where a Member State includes a person’s gender on a document covered by this Regulation, the specifications of ICAO Document 9303 ‘F’, ‘M’ or ‘X’ or the corresponding single initial used in the official language or languages of that Member State shall be used, as appropriate. |
| Text proposed by the Commission | Amendment |
|---|---|
| 5. Identity cards shall include a highly secure storage medium which shall contain a facial image of the holder of the card and two fingerprints in interoperable digital formats. For the capture of biometric identifiers, Member States shall apply the technical specifications as established by Commission Implementing Decision C(2018) 776712 as amended by Commission Implementing Decision C(2021) 372613 . | 5. Identity cards shall include a highly secure storage medium which shall contain a facial image of the holder of the card and two fingerprints in interoperable digital formats. For the capture of those two types of biometric identifiers, Member States shall apply the technical specifications as established by Commission Implementing Decision C(2018) 776712 as amended by Commission Implementing Decision C(2021) 372613 . |
| 12 Commission Implementing Decision C(2018) 7767 of 30 November 2018 laying down the technical specifications for the uniform format for residence permits for third country nationals and repealing Decision C(2002) 3069. | 12 Commission Implementing Decision C(2018) 7767 of 30 November 2018 laying down the technical specifications for the uniform format for residence permits for third country nationals and repealing Decision C(2002) 3069. |
| 13 Commission Implementing Decision C(2021) 3726 of 4 June 2021 amending Annex III to Implementing Decision C(2018) 7767 as regards the list of normative references. | 13 Commission Implementing Decision C(2021) 3726 of 4 June 2021 amending Annex III to Implementing Decision C(2018) 7767 as regards the list of normative references. |
| Text proposed by the Commission | Amendment |
|---|---|
| 3. Other than where required for the purpose of processing in accordance with Union and national law, biometric identifiers stored for the purpose of personalisation of identity cards or residence documents shall be kept in a highly secure manner and only until the date of collection of the document and, in any case, no longer than 90 days from the date of issue. After this period, these biometric identifiers shall be immediately erased or destroyed. | 3. Biometric identifiers stored for the purpose of personalisation of identity cards or residence documents shall be kept in a highly secure manner and only until the date of collection of the document and, in any case, no longer than 90 days from the date of issue. After this period, those biometric identifiers shall be immediately erased or destroyed. Processing of those data for other purposes shall be subject to the limitations and conditions provided for in national law or Union data protection law. |
| Text proposed by the Commission | Amendment |
|---|---|
| 4. Cooperation with external service providers shall not exclude any liability on the part of a Member State which may arise under Union or national law in respect of breaches of obligations with regard to personal data. | 4. Cooperation with external service providers shall not exclude any liability on the part of a Member State which may arise under Union or national law in respect of breaches of obligations with regard to personal data. Member States shall ensure that all external providers comply with Union and national data protection law, and appropriate measures shall be adopted to prevent any unauthorised access or misuse of personal data during outsourced processes. |
| Text proposed by the Commission | Amendment |
|---|---|
| Biometric data stored in the storage medium of identity cards and residence documents shall only be used in accordance with Union and national law for the purpose of verifying: | The facial image of the holder stored in the storage medium of identity cards and residence documents shall only be accessed by duly authorised staff of competent national authorities, Union agencies and private entities in accordance with Union data protection law for the purposes of verifying: |
| Text proposed by the Commission | Amendment |
|---|---|
| Access to the facial image by private entities shall also require the consent of the holder, unless access regardless of consent is strictly necessary for the purposes set out in the first subparagraph and provided for by Union or national law in compliance with Union data protection law. |
| Text proposed by the Commission | Amendment |
|---|---|
| The two fingerprints stored in the storage medium shall only be accessed by duly authorised staff of competent national authorities and Union agencies. | The two fingerprints of the holder stored in the storage medium shall only be accessed by duly authorised staff of competent national authorities and Union agencies for the purposes set out in the first subparagraph in accordance with Union and national data protection law. |
| Text proposed by the Commission | Amendment |
|---|---|
| Evaluation | Reporting and evaluation |
| Text proposed by the Commission | Amendment |
|---|---|
| -1. By [two years after the date of entry into force of this Regulation] and by [11 years after the date of entry into force of this Regulation] the Commission shall report to the European Parliament, to the Council and to the European Economic and Social Committee on the implementation of this Regulation, in particular on the protection of fundamental rights and personal data. |
| Text proposed by the Commission | Amendment |
|---|---|
| 1. No sooner than [six years after the entry into force of this Regulation], the Commission shall carry out an evaluation of this Regulation and present a report on the main findings to the European Parliament, to the Council and to the European Economic and Social Committee. The report shall in particular focus on: | 1. No later than [six years after the entry into force of this Regulation], and every six years thereafter, the Commission shall carry out an evaluation of this Regulation and present a report on the main findings to the European Parliament, to the Council and to the European Economic and Social Committee. The report shall in particular focus on: |
| Text proposed by the Commission | Amendment |
|---|---|
| (da) the necessity of introducing common security features of identification documents used on a provisional basis in view of their better recognition; |
Connections
The dossier, the decisions on this text and its other versions.
No connections found for this item.
Sources & citation
Where the facts on this page come from, and how to cite it.
- Official source
- Data source
- Licensed CC BY 4.0.
- Retrieved
- 25 September 2026
Cite as
European Parliament (2025). “Strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement”. Text, 2 April 2025. docId TA-10-2025-0056, reference TA10-0056/2025. EU Parl Watch Research. https://news.eu-parl.st-solutions.dev/texts/TA-10-2025-0056 (retrieved 25 September 2026). Official source: The text on the European Parliament’s website, https://www.europarl.europa.eu/doceo/document/TA-10-2025-0056_EN.html. Data: EP Open Data API: document record, https://data.europarl.europa.eu/api/v2/documents/TA-10-2025-0056 (CC BY 4.0).
BibTeX
@misc{epw-text-ta-10-2025-0056,
author = {{European Parliament}},
title = {{Strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement}},
year = {2025},
date = {2025-04-02},
howpublished = {\url{https://news.eu-parl.st-solutions.dev/texts/TA-10-2025-0056}},
url = {https://news.eu-parl.st-solutions.dev/texts/TA-10-2025-0056},
urldate = {2026-09-25},
publisher = {EU Parl Watch Research},
note = {Text. docId TA-10-2025-0056, reference TA10-0056/2025. Official source: https://www.europarl.europa.eu/doceo/document/TA-10-2025-0056\_EN.html. Data: EP Open Data API: document record (CC BY 4.0)}
}