The European Court of Justice ruled having fingerprints on ID cards was legal under EU privacy laws. The benefits of having such a system were key to preventing identity theft, it said.
A “database of fingerprints” would only contain checksums. They can be used to verify the result of a reading but not to get the whole print.
Most of the time they don’t even contain that. The primary checksum is stored only on the ID, which outputs a secondary one, which is matched against a verification checksum produced independently by a reader.
The national database doesn’t need any of those, it holds the person ID numbers and their civil status and stuff like that not how they are verified.
But does that also apply to prints collected for government ID cards?
Most probably, for several reasons:
If the government or a goverment organization wants to fake the fact you’ve presented your fingerprints somewhere they can just fake the results of the checkup itself. And if they’re up to this level of fuckery it’s probably a short distance to where they just imprison or kill you, so having your prints faked is the least of your problems.
If the goverment is well-meaning they don’t want to store fingerprints because they’re not needed and they’d just be storing highly sensitive personal information that, if ever breached, could be used for all kinds of shenanigans. The best way to protect data is to not have it in the first place.
The goal of these systems is to log and attest the checks, not the fingerprints. They document the fact that at a certain time and location the checksums for a set of biometrics did or did not match some reference checksums. They don’t care what those biometrics mean, or what the result of the check being passed or failed means, or what the actual biometrics are (we’re talking about fingerprints here but there’s lots of biometrics that can be used).
Storing actual biometrics would take a lot more space and add complexity. The checksums are much smaller and simpler.
A “database of fingerprints” would only contain checksums. They can be used to verify the result of a reading but not to get the whole print.
Most of the time they don’t even contain that. The primary checksum is stored only on the ID, which outputs a secondary one, which is matched against a verification checksum produced independently by a reader.
The national database doesn’t need any of those, it holds the person ID numbers and their civil status and stuff like that not how they are verified.
that’s the case for fingerprint readers in phones/laptops
But does that also apply to prints collected for government ID cards?
Most probably, for several reasons: