Case C-660/26, International Card Services – a selfie, a passport photo and the GDPR
Online identity checks with a photo of an identity document and a selfie have become routine for banks and card issuers. The Hoge Raad asks whether the anti-money laundering rules require the photographs to be kept, and whether the GDPR allows it.
Facts
RR has held a credit card from International Card Services BV, a card issuer based in Diemen, since 2008. In July 2020 ICS asked RR to identify again online, as it said the Dutch anti-money laundering act (Wwft) required: using a smartphone or tablet, RR was to photograph the identity document, take a selfie and press “save and send”. RR objected in principle to that method of identification, and in particular to ICS storing the photographs, and did not respond to repeated requests. In August 2020 ICS blocked the card and gave notice of termination; it postponed the termination while the first-instance proceedings ran and then put it into effect. RR asked the courts to order the card reactivated and to declare that requesting, storing and processing a photograph in any form was unlawful. The kantonrechter dismissed the claims and the court of appeal upheld that decision, holding among other things that storing a photograph is not processing of biometric data. In an interim ruling of 13 March 2026 the Hoge Raad agreed on that point and saw no need to ask the Court of Justice about it. In its referral judgment of 12 June 2026 (ECLI:NL:HR:2026:921) it decided to ask after all: the Court of Justice had meanwhile decided Comdribus (C‑371/24, 19 March 2026), a case on police data under Directive 2016/680, from which, the Hoge Raad accepted, the opposite conclusion might be drawn. It now asks four questions.
Questions Referred
1. Can the recording and storage of a photograph showing a person’s face, for the purpose of using it for identification, be regarded as the processing of biometric data within the meaning of Article 9(1) of Regulation (EU) 2016/679 (General Data Protection Regulation; ‘GDPR’), in conjunction with Article 4(14) of the GDPR, and, if so, under what conditions?
2. Should Article 40(1)(a) of Directive (EU) 2015/849 of 20 May 2015 (the (amended) Fourth European Anti-Money Laundering Directive), read in conjunction with Article 6(3) of the GDPR, the principle of data minimisation set out in Article 5(1)(c) of the GDPR, Articles 7, 8 and 52 of the Charter of Fundamental Rights of the European Union, and Article 8 of the European Convention of Human Rights, be interpreted as meaning that Member States must require obliged entities to retain a copy of the identity document used to verify a customer’s identity in the context of customer due diligence?
3. If question 2 must be answered in the affirmative: does the retention obligation to be implemented by the Member States in respect of obliged entities include a full copy of the relevant pages of an identity document, including the photograph affixed to that identity document?
4. Can photographs in which a person is recognisably depicted be regarded as personal data revealing racial or ethnic origin within the meaning of Article 9(1) of the GDPR, and, if so, under what conditions?
a. Is it relevant in that regard whether the photograph in question is processed for the purpose or with the intention of making a distinction on the basis of racial or ethnic origin?
b. Is it relevant in this regard whether information about racial or ethnic origin can be inferred from the photograph in question with a sufficient degree of certainty?
Sources
OJ notice C/2026/4865 (EUR‑Lex) · Case file on CURIA · Hoge Raad, 12 June 2026 (ECLI:NL:HR:2026:921) · Regulation (EU) 2016/679 · Directive (EU) 2015/849 · Comdribus, C‑371/24 (ECLI:EU:C:2026:219) · OT, C‑184/20 (ECLI:EU:C:2022:601) · Meta Platforms v Bundeskartellamt, C‑252/21 (ECLI:EU:C:2023:537)
Comment
The first question turns on two texts that do not quite fit together. Article 4(14) defines biometric data as personal data “resulting from specific technical processing” of a person’s physical characteristics “which allow or confirm the unique identification” of that person, “such as facial images”. Recital 51 adds that photographs are covered “only when processed through a specific technical means allowing the unique identification or authentication of a natural person”. On that reading, which the Hoge Raad itself set out, a stored photograph is the source from which biometric data can be derived, not biometric data in itself. But Article 9(1) prohibits processing biometric data “for the purpose of uniquely identifying a natural person”, and the question concerns a photograph recorded and stored precisely “for the purpose of using it for identification”. In Comdribus the Court treated the taking of photographs by the police to identify suspects as the processing of biometric data. The Court will have to say whether the purpose is enough, or whether the technical step must actually have been taken.
The second and third questions may matter more in practice. Article 40(1)(a) of the Fourth Anti-Money Laundering Directive requires obliged entities to retain “a copy of the documents and information which are necessary to comply with the customer due diligence requirements”. Whether that means a copy of the identity document itself, photograph included, or only the information needed to identify the customer, the Court has not yet decided. The Hoge Raad is openly doubtful. When an institution reports an unusual transaction under Dutch law it must give the customer’s identity and the type and number of the identity document, not a copy, and the Hoge Raad said it could not readily see which objective of general interest keeping a copy serves. If Member States are not required to impose that obligation, institutions that keep full copies will need another basis for doing so under Article 6 of the GDPR. The Hoge Raad noted that the new Anti-Money Laundering Regulation does not apply to this case, and left it to the Court whether to take it into account.
The fourth question reopens an old Dutch answer. Under the former Dutch data protection act the Hoge Raad held in 2010 that a photograph of a person can reveal that person’s race and is therefore sensitive data, whether or not anyone intends to draw that inference. Recital 51 deals only with whether photographs are biometric data; it says nothing about racial or ethnic origin. The Court’s case law points towards a broad reading. In OT (C‑184/20) it held that data “liable to disclose indirectly” sensitive information fall within Article 9(1), and in Meta Platforms v Bundeskartellamt (C‑252/21) that the prohibition applies whether or not the information revealed is correct and whether or not the controller is trying to obtain it. Applied without limit, that reasoning would make almost every photograph of a person special-category data, which is why the Hoge Raad asks whether purpose and the certainty of the inference make a difference.