"It was a really creepy feeling," says data protection activist Leena Simon, describing the moment when she last visited the citizens' service center at her local town hall and they wanted to take her fingerprints.   

She was instructed to press the index fingers of both hands on the glass surface of a scanner. The idea was that the resulting fingerprints would be included in her new passport. However, she used a trick that she's not willing to share to spoil the scan. Leena is a member of a German organization called Digitalcourage, which is committed to privacy and digital rights.  

So, did it work? Leena says she can't be sure. But what she does know: "For the rest of the day, I felt awful." She says it is "invasive" when the state forces law-abiding citizens to allow their fingerprints to be taken. After all, she says, it's a tool ordinarily used by the police in criminal investigations: "I don't understand why I should have to give the state access to my prints when I haven't broken the law."

Fingerprinting mandatory for ID cards

There's a pressing reason why data protection activists like Leena Simon are raising the alarm: From August 2, authorities in Germany are planning to massively extend requirements for fingerprints to be registered. From that day on, all German citizens applying for a new government-issued ID will be obliged to permit their fingerprints to be stored electronically on the card. So far, this was a voluntary procedure for ID cards and obligatory only for separate passport documents.

More than 62 million Germans have an ID card. They have the same dimensions as a credit card and are valid for 10 years. Most people use them for everyday movements within the country, although they can also be used for traveling around the EU.

Two biometric characteristics

ID cards used in Germany and elsewhere in Europe include an integrated chip with the same biometric photo that is also visible on the front of the card. In the future, a second biometric characteristic will be registered: Fingerprints.

According to Josef Oster, internal affairs expert for Germany's governing Christian Democrats (CDU), the new measure will make ID cards more secure: "It enables us to determine clearly and quickly whether person and card go together," he tells DW. Oster specializes in digital security as a member of the German parliament's Internal Affairs Committee. "We've imposed extremely high-security standards," he says, referring to the new ID cards with fingerprints. And, he says, there has been little resistance to the proposal.

Uniform standards across Europa

The new regulation won't apply only in Germany. Beginning on August 2, travel documents with a combination of photos and fingerprints will be issued across the European Union — as agreed in 2019 following a tight vote in the European Parliament. The main aim is to protect against counterfeiting.

If there is suspicion that a document has been forged or is being used illegally, the fingerprints stored in the chip can be used to establish whether the rightful holder is in possession of the document. For this purpose, special reading devices are available to the police, border guards and customs officials. In cases of uncertain identity, they have the authority to call up and read encrypted data on the chip.

Forgery rare

But will new ID cards with digital fingerprinting really guarantee more security? Critics are not convinced. German ID cards without fingerprinting "already enjoy such a high level of validity that they are only rarely forged or end up in the wrong hands," argues the lawyer and data protection specialist Thilo Weichert.

And that claim was confirmed by Interior Ministry data made available to DW, according to which, in the year 2020, only 34 forged versions of German ID cards were confiscated during border controls. In 2019, that figure was even lower, totaling just 26 cases. Given these figures, Thilo Weichert questions the necessity of registering the fingerprints of more than 60 million Germans. He calls it "a disproportionate violation of people's rights" that he believes is also unconstitutional.

Immutable data

For data protection activists, there is another serious concern: A growing number of digital systems are using fingerprinting because of the immutable biometric characteristics that it provides. It's a technology that is employed, for example, to unlock smartphones or open office doors. And it involves the kind of fingerprinting that will shortly be mandatory in ID cards.

Maja Smoltczyk, Berlin's commissioner for data protection, says the damage is especially serious in cases of document theft or misuse, as "biometric characteristics can't simply be replaced like a password." This explains why activists have been calling for printing only one little finger instead of both index fingers. So far, however, their calls have been in vain.

Central storage?

It is true that the proposed new legislation permits fingerprints to be stored only on the ID card's own chip and nowhere else. What's more, only a limited number of people have access to this data, such as officials at the relevant government agencies and members of the police. Still, Thilo Weichert warns: "I'm sure things are not going to stay that way." Hindsight shows that the state always tends to seek access to more and more sensitive private data.

Weichert fears that sooner or later fingerprints will be stored in a central data bank and used to crosscheck with other data sources or fuel larger surveillance systems. "In China and many other authoritarian states, we've already begun to see how biometrics can be used to keep an entire population under control," he says.  

Skepticism in many citizens' service centers

Through to August 2, providing fingerprints is voluntary. So, how have people who applied for a new ID card between the beginning of January and mid-June responded to the transition? DW asked that question at service centers in 20 German towns and cities.

The answer was surprising. In Nuremberg, Düsseldorf and Bochum, for instance, there was strong resistance: "There is minimal willingness to allow fingerprints to be included in ID cards. The attitude is one of suspicion," Bochum city representatives told DW.

In Düsseldorf meanwhile, only 15% of all applicants said that they accepted the integration of fingerprints. In Hamburg, Leipzig, Essen, and Dortmund, skepticism prevailed and between 54% and 60% of applications made since the beginning of the year did not include fingerprints.

Opinions were evenly divided in three other cities: In Münster, Hannover and Bremen, support for and opposition to fingerprinting was more or less fifty-fifty. And only one German city gave broad backing to the proposed new regulation. That was Frankfurt, where nearly two-thirds of people said they would voluntarily support fingerprinting.

No rush for IDs without fingerprints

There was no perceptible rush to apply for "old-style" ID cards without fingerprints. On the contrary, many people were apparently unaware that a practice that is still voluntary will soon be compulsory.

What is for sure is that the relevant authorities had a lot of questions to answer. Why are fingerprints so important? Who has access to the data? And how is it protected? Officials in Essen said the public response, however, had been largely positive, "especially since the fingerprints are an additional security measure and taking them free of charge!"

Legal challenge

Even when August 2 comes around, activist Leena Simon doesn't expect people to come out in huge numbers to protest. But she does herself plan to take legal action against fingerprinting. "I have to admit," she says," that when it comes to the sensitive issue of data protection, I simply don't trust the state."

Other opponents of fingerprinting have adopted a different strategy. Sources have let it be known to DW that they have been destroying their still-valid "old" ID cards by, for instance, "accidentally" leaving them in their microwave ovens. That enabled them to apply for a new document without fingerprints: an ID card valid, after all, for another 10 years. Quite a long time — even in a rapidly changing world.