The National Data Protection Commission (CNPD) has once again recommended that an impact study be carried out on the protection of personal data in the new generation of Citizen Cards, which will be issued on June 10.
The president of the CNPD, Paula Meira Lourenço, in an opinion dated March 21, reaffirms that she still does not have the necessary elements to carry out a legal and technical assessment of the computer system of the new identification system, maintaining the position expressed in an opinion in November.
The CNPD warns that requests for opinions on legal and regulatory provisions in preparation “must be submitted” by the holder of the body with legislative or regulatory power, accompanied by the respective impact study on the protection of personal data.
“This request for an opinion has been submitted without this study,” says Paula Meira Lourenço, pointing out that this omission could jeopardize a more complete assessment of the probable risks arising from the processing of personal data to be carried out.
“And, above all, it could hinder the considered decision of the holders of political-legislative power (…) in a matter where the understanding of such risks is essential to conclude, at the legislative level, on the admissibility and conditions of execution of the new processing” of personal data, he adds.
The new generation of the Citizen’s Card was announced by the outgoing government in March as being “more complete, more secure, more digital” and “very innovative in technological terms”, with contactless technology aimed at simplifying the reading of information and opening up new ways of using it.
In its opinion, the CNPD cites the criticisms of the European Data Protection Agency (EDPS) of the new ID card models in Europe, issued in 2018, and concludes by recommending a “reinforcement of the security standards applicable to the citizen’s card, in line with what was pointed out by the EDPS”.
This agency, the CNPD points out, finds it understandable that storing fingerprint images improves interoperability but, at the same time, increases the amount of biometric data processed and the risk of identity falsification in the event of a personal data breach.
“For this reason, the EDPS recommends limiting the fingerprint data stored on the ‘chip’ of documents to minutiae or patterns, to a subset of the characteristics extracted from the image of the print,” the opinion warns.
In an opinion dated March 15, the CNPD again wrote that “it does not have at the moment, because it has not been provided, the necessary elements to carry out a legal and technical evaluation of the computer system of this project”.
The outgoing Secretary of Justice, who requested this opinion, is said to have justified not presenting an impact study on the protection of personal data because the impact was included in the document that was the subject of the CNPD’s opinion when the law that created the citizen’s card was amended in 2007, pointing out that it remained current.
“The CNPD can only express its perplexity that an impact study of a 2007 legislative amendment is still relevant in 2024, as if nothing had been legislatively changed since then, which is not the case,” writes the president, recalling that she had already pointed out this shortcoming.
Thus, the commission concludes by recommending “the need to carry out the respective impact study on the protection of personal data” of the new card that will begin to be issued, as it expires, on June 10, Portugal Day.
