Key Benefits:
The Constitutional Council was seized by more than sixty members and more than sixty senators of two appeals against the law on protection of identity.
These appeals require the following comments from the Government.
*
*
A. ― The authors of the referrals argue that the collection of biometric data in the processing of personal data whose creation is provided for in section 5 of the referred law is not necessary to achieve the objective of combating identity fraud that the legislator has assigned, which could be achieved by the storage of these data in the only electronic component of identity and travel documents.
In addition, they believe that, by allowing to identify a person from his fingerprints, this treatment causes public freedoms to risk uncommonly with the benefits that can be expected.
They also argue that access to litigious treatment open to the judicial authority and the agents of the counter-terrorism services are insufficiently supervised by sections 5 and 10 of the law referred to.
They deduce that the legislator has, respect for privacy and individual freedom, a disproportionate breach of the objective pursued, subjected the persons concerned to a rigor that was not necessary and endangered the right of resistance to oppression proclaimed by Article 2 of the Declaration of Human and Citizen Rights.
B. ― The Government does not share this view.
As the authors of the referrals recall, the Constitutional Council, in the presence of a law providing for the creation of a processing of personal data, verifies that the legislator has ensured, between the respect for private life to which such treatment necessarily affects to a certain extent and other principles or objectives with constitutional value, in particular the safeguarding of public order, a conciliation that is not manifestly unbalanced (see, for example, 2003-4 27, n° 2004-492 DC of 2 March 2004, cons. 87, or n° 2010-25 QPC of 16 September 2010, cons. 16). It also ensures, with regard to the research of the perpetrators of offences, that the law does not subject the persons concerned, in ignorance of Article 9 of the Declaration of Human and Citizen Rights, to a rigour which is not necessary (see the above-mentioned decision No. 2010-25 QPC, cons. 22). On the other hand, the right of resistance to oppression proclaimed by Article 2 of the same Declaration cannot, in the Government's view, make a law that provides for the creation of a personal data processing on the sole ground that such treatment would be likely to be diverted, by a non-democratic regime, for purposes of attacking public freedoms.
In the case of a case, the processing of personal data whose section 5 of the referred law provides for the creation, under the second paragraph of paragraph I of this section, is the primary purpose of allowing "the establishment and verification of identity and travel titles" — that is, the national identity card and the passport — in conditions that prevent or detect what it has agreed to call the fraud". In this way, it is part of the continuity of existing treatments, with regard to the national identity card and the passport, according to, respectively, Decrees No. 55-1397 of 22 October 1955 (arts. 6 et seq.) and No. 2005-1726 of 30 December 2005 (arts. 18 et seq.).
But it also continues, in accordance with the legislator's desire to ensure effective protection of identity, a broader objective of combating fraud against identity, which in fact does not necessarily go through documentary fraud. This objective is translated by the possibility offered to the judicial authority, under conditions strictly defined by 2° of I and II to V of Article 5, to exploit the data of the treatment in order to identify a person suspected of having committed or attempted to commit certain offences constitutive of identity fraud.
The purposes assigned to the treatment provided for in section 5 of the referred law therefore fully participate in the objectives of constitutional value for the protection of public order and the search for offenders. In fact, it is a matter of protecting the rights and freedoms of others from the serious breaches that are brought to them by fraud of identity, for example, where the usurpation of the identity of a person hinders the issuance of an identity and travel document or attracts unjustified criminal prosecutions.
Under these conditions, neither the principle of collecting certain biometric data in the contentious treatment nor the possibility of using it, in some cases, for the purpose of identifying a person from his fingerprints, which are necessary to achieve the objectives assigned by the legislator, does not, in the light of the guarantees provided by law, affect excessive privacy (1 and 2).
The same is true of the right of access to treatment provided for in Article 10 in favour of service agents referred to inArticle 9 of Act No. 2006-64 of 23 January 2006 relating to the fight against terrorism and to various provisions relating to security and border controls, which does not deny the purposes of the treatment as recalled above and is strictly proportionate to the needs of the fulfilment by these services of their missions (3).
1. With respect to, first of all, the use of the treatment provided for in section 5 of the law referred to for the establishment and verification of identity and travel documents, the Government observes that the authors of the referrals do not contest the interest attached, in principle, to the existence of a centralized management system.
Indeed, the development of national files of national identity cards and passports has been a significant step forward in relation to the previous situation, both with regard to the service rendered to the administrators and the fight against fraud, as well as the dissemination of information. In this regard, an additional course has been taken with the digitization of all parts of the application file, planned, with regard to the issue of passports, by the aforementioned decree of 30 December 2005, which, in addition to better protection of the information collected, has enabled, by facilitating the verifications involving the competent services, to simplify the steps to be taken by the administrators (including by allowing them to submit their requests in any respect of the territory) and to accelerate the process
On the other hand, the authors challenge the collection, in the treatment provided for in section 5 of the referred law, of the biometric data of the applicant for an identity or travel document, and in particular his fingerprints. They believe, in fact, that the objective of combating the documentary fraud pursued by the legislator could have been achieved by the recording of this data on the only secure electronic component of the titles, provided for in Article 2. And, assuming that such a collection is allowed, they consider that it should not be possible in any case to identify a person by means of the comparison between his fingerprints and those of all persons registered in the treatment.
(a) Both the collection of biometric data in the national file and the existence of a possibility of identification from the fingerprints, however, appear necessary to ensure the proper operation of the device and to effectively combat fraud.
Indeed, within the framework recommended by the authors of the referrals, biometric data could only be used to ensure that the holder of an identity or travel document is the person to whom that title was issued. It would not, however, be possible, for lack of a collection in the national treatment, to take advantage of it in order to avoid, for example, an attempt to usurp an identity at the time of filing a title application.
In addition, in spite of its security, the electronic component of the securities is likely to be altered, voluntarily or involuntary, either to eliminate the information it contains, or, as part of an attempt to fraud, to replace them with others: in such a case, only the registration of biometric data in the national processing, which guarantees its integrity, allows, by comparing them with the characteristics of the last biometric data
In particular, it is in consideration of these justifications that the Assembly of the Disputes of the Council of State, by a decision of 26 October 2011, Association for the Promotion of Image and Others (no. 317827, 317952, 318013, 318051), found that the collection of the biometric data of the holder, in the current file of the passports, did not pursue the right of the persons concerned to respect their privacy, protected by the convention The interest of such a device has also led other European countries, particularly Spain, Portugal and Lithuania, to rely on a centralized database, including the digitized image of the holder's fingerprints, to ensure the issuance of electronic identity cards.
Indeed, although it is evidently ill-advised to undertake an encrypted evaluation, the passport management system as a result of the aforementioned decree of 30 December 2005 demonstrated its effectiveness, a 50% decrease in the number of false passports seized by the air and border police services having been found between 2009 and 2010, whereas at the same time, frauds concerning the national identity card were less likely to be used in the first half of 2011.
This management system, however, does not allow, in the state, to achieve the objective of effective protection of the identity pursued by the legislator, because of the absolute impossibility of using it to identify a person from his fingerprints, the questioning of the file cannot take place, from a perspective of authentication, only with the help of the civil status data of the aforementioned decree.
In fact, if the system so designed allows us to fail the attempts to usurp a person's identity before entering the file, it is powerless to detect the fraud that, for a person, involves multiple requests under different identities. It is not possible, in fact, to ensure that the applicant's fingerprints are not already associated, in the file, with another identity, or, a fortiori, to determine that other identity.
It is to this concern that the possibility, opened by the 1st of section 5 of the referred law, of identifying the applicant for an identity or travel document, at the time of the establishment of the identity document, by means of fingerprints collected in the treatment provided for in this section. In fact, and as the progress report on the application to the collection and processing of biometric data of the principles of Council of Europe Convention No. 108 for the protection of persons with respect to the automated processing of personal data, made public in 2005 by the advisory committee of this Convention, "the issue of a passport, identity card or visa has the aim of establishing that coupled with the Civil Status Data Verification procedure provided for in Article 4, which aims to ensure the authenticity of the civil status documents produced in support of the application, the implementation of such an identification device should make it extremely difficult, in the future, to obtain the issuance of an identity or travel document under a false identity.
Such a goal, it should be pointed out, could not be achieved by the so-called "low link" technique, referred to in the medium term during parliamentary debates. In addition to the robustness of this technique, which is based on the establishment of an indirect and non-univocal link between biometric data and civil status data, has never been proven in practice, its use would inevitably lead to situations in which the applicant of a title would be suspected of being the author of an attempted fraud – the system indicating, with the risk of error inherent in this type of automatic comparison,
(b) The collection of biometric data from holders of identity or travel titles in the treatment provided for in section 5 of the referred law and the possibility of using this treatment in order to identify a person using his fingerprints thus appear necessary in the context of the primary purpose assigned by the legislator to this treatment. However, given the guarantees provided by law, these characteristics cannot be viewed as excessively harming the privacy of the persons concerned.
It should first be recalled, in this regard, that, as expressly a result of the first paragraph of the I of Article 5 of the referred law, the litigious treatment will be created, by decree in the Council of State taken after the reasoned and published opinion of the National Commission of Informatics and Freedoms (see Article 8), "in the conditions provided by the State Council Act No. 78-17 of 6 January 1978 related to computing, files and freedoms." All the guarantees provided by this Act with respect to, inter alia, the terms and conditions for the collection of data, the prohibition of the use of data for purposes other than those for which they have been collected, the retention period or the exercise of the right of access and rectification will therefore be applicable. However, this circumstance has been frequently taken into account by the Constitutional Council to admit compliance with the Constitution of personal data processing (see, for example, Decision No. 2003-484 DC of 20 November 2003, cons. 23).
The Government would then point out that the bill referred to itself provided for guarantees to ensure adequate conciliation between the constitutional principles in the presence.
Thus, the biometric data that will be collected have, in accordance with the principle of proportionality that must preside over any personal data collection, been reduced to the minimum necessary to ensure the proper operation of the device. In particular, only two fingerprints may be collected in the treatment provided for in section 5 of the referred law, as reflected in the fourth paragraph I of this article (which implies, moreover, even if the 5th of section 2 does not expressly specify it, that the secure electronic component of the titles will not contain more). However, the limitation of the number of fingerprints collected greatly reduces the risks, evoked by the authors of the referrals, of diversion of the purpose of the file for the purpose of, inter alia, identification of the fingerprint author (see also, in this regard, the observations presented below in part 2).
In addition, the law referred, without prejudice to the additional clarifications and restrictions that may be made on this matter by the regulatory authority, in accordance with the Act of 6 January 1978 referred to above, defines precisely the assumptions in which the processing data provided for in section 5, including biometric data, may be consulted. Abstracted, at this stage, from consultations on the initiative of the judicial authority and by the services referred to in Article 9 of the Act of 23 January 2006 referred to above, the scope of which will be examined below (2 and 3), this consultation may only take place:
- on the one hand, during the establishment of the titles, by the agents responsible for this institution, which will be defined by the decree in the Council of State taken for the application of the law;
―on the other hand, for the exclusive needs of verifying the authenticity of the titles, on the occasion of identity checks. It is important to note, however, that, if all officials in charge of research and identity control missions and verification of the validity and authenticity of passports and national electronic identity cards will in principle have access, as part of an application for justification of identity within the meaning of identityArticle 78-2 of the Code of Criminal Procedure, to the fingerprints contained in the electronic component of the titles, as provided in the second paragraph of section 6 of the deferred law, the consultation of the data retained in the processing provided for in section 5 will only be possible, under the third paragraph of section 6, within the framework of the proper verification of identity, and therefore must be viewed as reserved, in accordance with theArticle 78-3 of the Code of Criminal Procedureonly to judicial police officers.
It should be added that the system should, in accordance with the second paragraph of Article 5, paragraph I, of the referred Act, ensure the "trackability of consultations and modifications made by persons with access to them".
In addition, the completeness of such consultation cases is guaranteed by the last paragraph of Article 5 of the referred Act, which excludes that an interconnection, within the meaning of Article 30 of the Act of 6 January 1978 referred to above, between the treatment provided for in this section and any other processing may relate to biometric data (picture and fingerprints). Indeed, any form of automatic linking of these data with those contained in other treatments is thus prohibited.
Finally, cases in which it will be possible to identify a person using its biometric characteristics are strictly defined.
On the one hand, in fact, the third paragraph of section 5 of the referred law cannot be read, taking into account, in particular, the following provisions, and contrary to what the authors of the referrals suggest, that as an absolute prohibition, regardless of the circumstances and the author of the consultation, the identification of a person by means of the comparison of his photograph with all those contained in the treatment. As a result, the latter will not contain more than the current passport file (see the last paragraph of Article 19 of the aforementioned Decree of 30 December 2005) of the facial recognition device.
On the other hand, the identification of a person by means of his or her fingerprints will not be possible, apart from requests from the judicial authority (see Part 2), that in the case provided for in 1° of Article 5 of the referred law, that is, when establishing identity or travel documents, by the services responsible for that institution, in order to prevent frauds on the subject of identity. On the other hand, and in view of the expressly limiting character of the enumeration contained in Article 5 I, it will not be possible to carry out such identification on the occasion of an identity check (the interrogation of the file referred to in the third paragraph of Article 6 can only be used to verify whether the person concerned has the identity that it claims by means of an identity or occasional travel document),
In these circumstances, and taking into account all of these guarantees, the Government considers that the referred law ensures a fair balance between respect for privacy and the objective, contributing to the satisfaction of constitutional value requirements, namely to ensure the establishment and verification of identity and travel titles in conditions appropriate to combat documentary fraud.
2. With respect to, then, the objective of combating identity fraud, as stated above, is to be translated into the open faculty of the judicial authority, in some cases, not only to access the processing data provided for in section 5 of the referred law, as it could in any event under the conditions provided for by the said law. Code of Criminal Procedure, but also to identify a person using his fingerprints.
However, this new faculty has been supervised by the legislator in strict conditions to prevent excessive privacy of the persons concerned.
In this way, the identification of a person by means of his or her fingerprints can only be done when required by the investigation of a series of offences limited to listed, which in common, in accordance with the purpose pursued by the legislator, represent varieties of identity fraud. Assumed, it is often difficult to establish the actual identity of the person suspected of committing or attempting to commit any of these offences. And, contrary to what the authors of the referrals suggest, the limitation of the nature of the offence concerned will not only apply when the request for identification is formed within the framework of the articles 55-1, 76-2 or 154-1 of the Code of Criminal Procedure, but also when it intervenes on the basis of section 99-5 new to the same code, the latter expressly states that the identification cannot be requested by the judicial police officer, with the express authorization of the investigating judge, that "if the need for information relating to one of the offences referred to in the last paragraph of section 55-1 require it."
Secondly, there is no ambiguity, contrary to what the authors of the referrals support, as to the articulation between these provisions and those, in general, providing access to personal data processing by the judicial authority. Consultation of the file on the basis of civil status data will continue to be possible, as it is today, under the conditions set out in the general provisions of Code of Criminal Procedurebut it is clear that, except to deprive of any useful effect of the special provisions of section 5 of the law referred to limiting the cases in which a person may be identified through his or her fingerprints, it may only be used in the cases and conditions provided for in sections 55-1, 76-2, 99-5 and 154-1 of the same code.
In addition, the identification of a person using his or her fingerprints may not take place, regardless of the circumstances, except with the authorization, as the case may be, of the public prosecutor or the investigating judge. The data subject will have to be informed of this and the use of the data in the file will have to be mentioned and specifically motivated in the minutes.
Finally, in no case will it be possible to use the file to identify digital traces of unknown persons, as specified in the last sentence of the paragraph added to theArticle 55-1 of the Code of Criminal Procedure by the second of section 5 of the law referred. Even if the new section 99-5 of the same code does not contain such precision, this restriction necessarily results from its very terms, which refer to "the person whose fingerprints are collected". Thus, the authors of the referrals cannot seriously argue that, "as long as on the scene of a crime or offence will be found fingerprints, it will be sufficient for the prosecutor or the investigating judge to open in his preliminary investigation or his information a fraudulent aspect of identity" to be able to identify the perpetrator of these traces by means of the treatment provided for in section 5 of the law referred to.
It is important to point out that, in view of the limited number of prints it will contain and the fact that these prints will be collected flatly (as required, with regard to passports, Council Regulation No. 2252/2004 of 13 December 2004 establishing standards for security elements and biometric elements integrated in passports and travel documents issued by the Member States) and not rolled out, as it is a matter of legal use, as it is
With regard to all of these guarantees, the Government therefore considers that the open faculty for the judicial authority to use in some cases the treatment provided for in section 5 of the law referred for identification does not break the balance provided by the legislator between respect for privacy and the objectives of constitutional value pursued by the establishment of this treatment, nor does it subject the persons concerned to a necessary rigor.
3. Finally, with regard to article 10 of the law referred to, it should be recalled that article 9 of the law of 23 January 2006 referred to above provides, in its drafting from the Act No. 2011-267 of 14 March 2011that there may be access to a number of automated treatments individually designated and duly authorized officers of the national police and gendarmerie specially responsible for the missions to prevent and punish violations of the fundamental interests of the Nation and of terrorist acts, as well as, for the purposes of the prevention of terrorist acts, individually designated and specially authorized officials of the intelligence services of the Ministry of Defence. In doing so, the legislator has heard a legal basis for an old and necessary practice, while instructing it.
Among the treatments referred to in Article 9 of the Act of 23 January 2006 are currently the system for the management of national identity cards and passports, the latter having already, under the decree of 30 December 2005, biometric data. The only purpose of section 10 of the bill referred to is to expressly specify, in order to avoid ambiguity, that the right of access so recognized to the services concerned will also be applicable to the common system of management of passports and national identity cards established by this law. The consultation of passport and national identity card data is often of great use for these services, for example, to determine the full identity of a person whose identity they have only a parcel identity, to identify without risk of error a person whose name they have, to verify whether an identity or travel document is authentic or not, or to know whether a passport is available to a foreigner or not.
In the light of these requirements, and in the light of the guarantees to which it is granted, this right of access cannot be viewed as an excessive violation of the privacy of the persons concerned.
Indeed, access is reserved for agents of certain services that are limited by the legislator and specified by order (see the decision of 3 August 2011 taken for the application of theArticle 9 of Act No. 2006-64 of 23 January 2006 on counter-terrorism and various provisions relating to security and border controls, and within these services only individually designated and duly authorized officers.
In addition, and in accordance with the provisions of the second paragraph I of Article 5 of the Act referred to, the system will maintain a record of the consultations carried out by these officers, which will therefore not be held in a subreptic manner.
Finally, and as previously stated, the agents concerned will in no way be able to use the file to identify a person by means of his or her fingerprints, not more, since this process is absolutely prohibited, than by means of his or her photograph, if it is expressly provided for by the limiting provisions of section 5 of the law referred to above. It is therefore at the price of a clearly erroneous reading of the disputed provisions that the authors of the referrals state that "the counter-terrorism services will find themselves in the possibility, and without any legal constraints, of identifying anyone on the basis of his fingerprints or by facial recognition."
Under these circumstances, the grievance arising from the provisions of section 10 of the Act referred to above would result in excessive breaches of privacy and individual freedom may only be excluded by the Constitutional Council.
*
*
For these reasons, the Government is of the opinion that the grievances articulated in the referrals are not likely to lead to the censorship of the referred law.
He therefore considered that the Constitutional Council should reject the appeals before it.
