Wiesbaden Administrative Court: Fingerprints must be included in the ID card

A bitter legal setback for Detlev Sieber from the civil rights organization Digitalcourage: the Wiesbaden Administrative Court has dismissed the lawsuit he filed three years ago in which the activist pressed for the issuing of an ID card without storing fingerprints on its radio chip. In Germany, the obligation questioned by Sieber, according to which German citizens must have their left and right index fingerprints taken with a scanner when applying for a new ID card, has been in force since August 2021 in accordance with a relevant EU regulation. This requirement is lawful, the judges have now ruled. The plaintiff's rights were therefore not violated.

The civil rights activist explained why he went to court: Having to give fingerprints "feels to me like being treated like a suspect for a crime". He felt that the creation of such files was a violation of human dignity.

At the beginning of 2022, the administrative court appealed to referred a number of critical questions about the case to the European Court of Justice (ECJ). It raised considerable doubts about the legality of the provisions. The German judges considered them to be incompatible with Articles 7 and 8 of the Charter of Fundamental Rights on the protection of privacy. However, in its ruling issued on December 18, the 6th Chamber of the Administrative Court has now decided not to follow the plaintiff's concerns (Ref.: 6 K 1563/21.WI). This was announced by the court on Monday. The reason given was that it was bound by the ECJ ruling that had been issued in the meantime and, in particular, by the statements contained therein regarding the substantive legality of the EU regulation.

ECJ ruling left administrative judges no choice

In March, the Luxembourg judges ruled that the Europe-wide regulation on the inclusion of two fingerprints in the ID card is compatible with the fundamental rights to respect for private life and the protection of personal data. It was justified by the objectives of combating the creation of forged ID cards and identity theft as well as ensuring the interoperability of verification systems. This would restrict key standards from the Charter of Fundamental Rights. However, the obligation serves the common good, for which it is suitable, necessary and at least "not disproportionate".

However, the ECJ also criticized that the EU regulation was based on the wrong legal basis and was therefore invalid. However, according to its ruling, it will continue to apply until December 31, 2026 at the latest, so that the European legislative bodies can enact a new law on the correct legal basis.

The Administrative Court did not feel compelled to wait for the expiry of the deadline for the continued validity of the regulation or the enactment of a new regulation. The matter was ready for a decision in view of the clear ECJ line. The question of whether the plaintiff's claim could possibly arise in the future as a result of a change in the legal situation had no relevance in the present proceedings.

Order from Hamburg now outdated

In the meantime, the Hamburg Administrative Court had issued a temporary injunction in February 2023, according to which the competent authority of the Hanseatic city had to issue an identity card to an applicant even without the fingerprints stored on the chip together with the biometric facial image. The sovereign document was initially to be valid for a limited period of one year until the legal situation had been clarified by the highest court.

In Germany, people over the age of 16 must have an identity card or passport. Otherwise, fines of up to 5,000 euros may be imposed. Digitalcourage had also argued against the controversial obligation on the grounds that the authorities issuing ID cards would be allowed to retain the biometric features for 90 days. This increases the risk that they could fall into the hands of criminals or foreign intelligence services in the event of cyberattacks.

(nie)