Biometrics and secure travel documents

The EU is seeking to improve the security of travel documents in the fight against terrorism and illegal immigration. From 2005, EU countries will begin to introduce biometric data into newly-issued passports. Similar proposals for visas and residence permits are being hampered by technical difficulties.

The delivery of more secure travel documents has been a key part of the fight against organised crime and illegal immigration. Following the 11 September attacks, the United States began to press for the inclusion of 'biometric identifiers' in travel documentation. The EU is currently implementing  proposals concerning both passports for EU citizens and visas and residence permits for non-EU nationals.

Biometric identifiers are observable biological characteristics which can be used to identify an individual (e.g. facial patterns, fingerprints and iris/retina patterns). In May 2003, the International Civil Aviation Organization (ICAO) adopted a blueprint for the integration of biometric identification information into passports and other Machine Readable Travel Documents (MRTDs). Facial recognition was selected as the globally interoperable biometric for machine-assisted identity confirmation.

In November 2003, the Council agreed to aim towards  the inclusion of biometric data in visas and residence permits that EU countries issue to non-EU citizens. Technical difficulties, however, have delayed these proposals and the Luxembourg Presidency has put forward two possible solutions for consideration in a Note of 22 Dec 2004. A Commission proposal on the storage of biometric data on the Visa Information System (VIS) and its exchange between member states was put forward in Dec 2004.

In 18 February 2004, the Commission adopted a proposal for a Regulation harmonising security standards, including biometrics, for EU citizens' passports. 

In December 2004, following Parliamentary approval, the Regulation on EU passports was adopted by the Council. It provides that newly-issued passports must include digital facial images (within 18 months) and fingerprints (within 3 years). Passports must also be 'machine-readable', i.e. they must contain a bar code enabling the personal details (name, date and place of birth, etc.) to be called up on a computer screen (see Euractiv 15 Dec 2004).

Legal basis of the Regulation on biometrics in passports 

Doubts were raised initially as to the legal basis of the proposal under Article 18 of the EU Nice Treaty. This specifically rules out EU harmonised passports, saying that the Commission's powers to act to promote freedom of movement "shall not apply to provisions on passports, identity cards, residence permits".

The Regulation is an extension of the Schengen agreement and therefore does not include the UK, Ireland, Iceland, Norway or Switzerland. These countries, however, are to introduce their own rules which will follow those of the EU. The UK, excluded on the grounds that it has not signed the border controls aspect of the Schengen acquis, argued that under the Schengen Protocol it should have the right to "opt in" to the Regulation. 

Choice of biometrics 

The Commission initially selected the facial image as the mandatory biometric identifier in EU passports and made fingerprints an optional identifier. However, the Council regulation states that fingerprints should also be mandatory, while giving member states longer to implement this requirement. 

Some member states are in favour of using iris scans as an indentifier but the Commission considers that the technology is not yet reliable enough.

Storage of biometrics data and privacy issues 

Biometric identifiers are due to be stored on a chip in travel documents and on a European database, currently under development, called the Schengen Information System II (SIS II).

In addition, a  Visa Information System (VIS) is to be set up, scheduled to be operational by 2007. Data on visa applicants (including biometric data) will be collected on a national basis by consulates outside the EU and thereafter transferred to a central EU database. 

Privacy watchdogs and certain politicians argue that there must be strict safeguards  to ensure that biometric identifiers are solely used for identification purposes and not as a means of tracking or controlling individuals. The proposal is to put in place a system whereby citizens can complain to a data protection authority if they feel they are victims of a breach of privacy.

Stopping counterfeiting of documents

The EU passport regulation provides for certain anti-counterfeiting and copying measures such as printing techniques and requirements on paper quality. In addition, a European image archiving system, FADO, is to be established to facilitate the fast and simple exchange between member states of information concerning genuine and false documents. The FADO database will contain images of false and forged documents and summaries of information on forgery and security techniques.  

The system will only replace ordinary paper-based exchanges when all member states are in a position to use computerised systems. 

Moreover, the EU and the US will pass on information to Interpol to create an international database of lost and stolen passports.

Visas and residence permits

The proposal for the inclusion of biometric data chips in visas and residence permits for non-EU nationals has been delayed due to technical problems. It was found that if more than one chip were introduced into a single document, the chips would "fight" and therefore the data would not be readable. If, therefore, third countries were to include biometric chips in the passports of their citizens, any EU biometric visa chip would cancel out the working of both. There have been suggestions that separate residence cards and visa "smartcards" containing biometric data should be issued. Otherwise, biometric data (photographs and fingerprints) could be included not in the visa itself but only in the central VIS database. Critics have pointed out that, to function fully, such a solution would require taking the fingerprints and/or facial scan of individuals seeking to enter the EU at the border and crosschecking them with the VIS and that the delays and costs involved would be very considerable.

The cost of biometrics and industry perspectives

The Commission, although it is encouraging member states to share equipment and set up shared consular offices to save money,  is facing criticism from MEPs for not fully costing the exercise.

The biometric industry is booming and under pressure to meet tight deadlines for the issuance of biometric identification documents. However, technological enhancements in travel  documents will only be seen as partial solutions if they are not adapted on a  global scale. International standardisation for new technologies is  necessary, otherwise there may well be delays in their deployment.  

Co-operation with the US 

All EU member states (except Greece) are included in a list of 27 countries (including Slovenia and the EU-15 without Greece) whose citizens do not need visas to enter the United States. However, after the September 11 attacks, the US exerted pressure for biometric data to be included in passports by announcing the closure of the visa waiver programme. The programme has been extended several times and EU member states were given a further year to include full biometric details in passports  in June 2005. The US will therefore require visas from all those wishing to enter the country from 26 October 2006 unless they have biometric data in their passports. A machine readable digital photograph will be required from 26 October 2005.

The US authorities are building a database to store the biometric identifiers included in travel documents (digitised photographs and fingerprints on visas for most of the world countries and digitised photographs on passports for countries participating in the US visa waiver programme).

Former EU Justice and Home Affairs Commissioner Antonio Vitorino stressed that the introduction of biometric data into travel documents follows a request from the International Civil Aviation Organisation - not a demand from Washington. He said that the inclusion of biometric identifiers on EU passports will improve the accuracy of identification and make travel documents more secure against counterfeiting. He insisted that the EU has nothing to fear from the technology. He said: "I recognise that it is the use you make of technology that might endanger fundamental rights. (...) We have to take our political responsibilities and provide the legal framework that defines clearly the context in which biometric data should be used." 

According to the Council, “the harmonisation of security features and the integration of biometric identifiers is an important step towards the use of new elements in the perspective of future developments at European level, which render passports and other travel documents more secure and establish a more reliable link between them and the holder. It is an important contribution to ensuring that passports and other travel documents are protected against fraudulent use”. 

The UK Government disputed its exclusion from the passport regulation and issued a unilateral statement in which it "regretted" that it had been denied the right to take part in the adoption of the measure. The UK is going ahead with its own plans to use biometric identifiers in passports and its proposed ID cards. However, a trial carried out by the UK Passport Service, which included three types of identifier, fingerprints, iris scan and facial recognition has uncovered serious problems with the available technology. 

A report published in March 2005 by the EU's Joint Research Centre, carried out at the request of Parliament's Civil Liberties Committee, foresees biometrics as "diffusing" from their use in passports to play an increasingly large part in daily life. It sees biometric identifiers of various types - iris scans, fingerprint recognition and facial imaging - being used for financial transactions, entry to workplaces, schools and leisure facilities and in household appliances to ensure safety and security. The report identifies four key issues:

  • technology: systems are in their infancy with problems of reliability, security and interoperability. There is a need for data on how the proposed large scale biometrics systems could work in practice;
  • legality: new legislation to clarify permitted collection and use of biometric data, data protection and privacy will be required as technology advances;
  • acceptability: work will be needed to obtain the trust of citizens in biometric technology and to avoid social exclusion of those with disabilities;
  • economics: the report concludes that Europe could benefit greatly from being at the forefront of biometric technology.

For privacy organisations like the UK's Statewatch, the flaws of biometric identification are real. Tony Bunyan, Director of Statewatch, said: "These proposals are yet another result of the 'war on terrorism', which show that the EU is just as keen as the USA to introduce systems of mass surveillance which have much more to do with political and social control than fighting terrorism."

Statewatch also criticises the Joint Research Centre report (above) for dodging the real issues as it comments neither on the anti-terrorism led push for increased surveillance, which is driving the progression of biometrics, nor on the opposition of the European Parliament. Statewatch accuses the EU of minimising the technological and data protection problems in a rush towards the perceived economic benefits of the new technology.

  • From 2005 EU member states will introduce into newly-issued passports:
    • digital facial images (within 18 months) and 
    • fingerprints (within 3 years). A Committee is to be set up of member state representatives to decide on the details of the fingerprinting process.
  • The current proposal on visas and residence permits is to be amended by the Commission in the light of  technical difficulties (see below).
  • EU citizens will require full biometric passports for visa-free entry into the US from 26 October 2006. 

Subscribe to our newsletters