National foreword

This Published Document is the UK implementation of CEN/TS 18139:2025.

The UK participation in its preparation was entrusted to Technical Committee IST/17, Cards and security devices for personal identification.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

This publication is not to be regarded as a British Standard.

Compliance with a Published Document cannot confer immunity from legal obligations.

This Published Document was published under the authority of the Standards Policy and Strategy Committee on 31 May 2025.

This Technical Specification (CEN/TS) was approved by CEN on 7 March 2025 for provisional application.

The period of validity of this CEN/TS is limited initially to three years. After two years the members of CEN will be requested to submit their comments, particularly on the question whether the CEN/TS can be converted into a European Standard.

CEN members are required to announce the existence of this CEN/TS in the same way as for an EN and to make the CEN/TS available promptly at national level in an appropriate form. It is permissible to keep conflicting national standards in force (in parallel to the CEN/TS) until the final decision about the possible conversion of the CEN/TS into an EN is reached.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.

European foreword

This document (CEN/TS 18139:2025) has been prepared by Technical Committee CEN/TC 224 “Personal identification, electronic signature and cards and their related systems and operations”, the secretariat of which is held by AFNOR.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN shall not be held responsible for identifying any or all such patent rights.

Any feedback and questions on this document should be directed to the users’ national standards body. A complete listing of these bodies can be found on the CEN website.

According to the CEN/CENELEC Internal Regulations, the national standards organisations of the following countries are bound to announce this Technical Specification: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the United Kingdom.

Introduction

Biometric reference data for ID documents meanwhile are highly standardized by ISO, ICAO, and CEN. Within CEN, this work is done by TC 224/WG 18 in close cooperation with the Article 6 Technical Subgroup and FRONTEX. Several International Standards, in particular ISO/IEC 19794 series and ISO/IEC 39794 series, achieve technical interoperability of biometric data.

With CEN/TS 17661 [1] the enrolment of biometric data for identity documents has been profiled specifically for European needs. However, biometric data is captured in many other situations as well, even in the context of ID documents, in particular for verification applications like automated or manual border control, or temporary enrolment into entry/exit systems. This gap shall be addressed by this TS.

During the development of the TS, a close cooperation between WG18 and the EU has been maintained to ensure that the needs of the Member States are exactly met.

The document gives recommendations for

Capturing of facial images for verification applications mainly using reference data stored in identity documents or traveller/visa databases, covering data quality and interoperability, data authenticity, morphing and presentation attack detection in several environments,
Capturing of fingerprint images for verification applications mainly using reference data stored in identity documents or traveller/visa databases, covering data quality and interoperability, data authenticity, and presentation attack detection in several environments, and
Processes handling such biometric data for verification and identification purposes considering security as well as privacy aspects.

This document covers biometric recognition applications based on ID documents. Biometric recognition applications within the frame of this document are corresponding to the definition of biometric recognition systems in ISO/IEC 2382‑37:2022 encompassing identification and verification systems. This means that biometric recognition applications should be considered as a subsystem of a complete identity verification system. Identity verification systems can be ABC gates, inspection systems, mobile phones etc.

1 Scope

This document defines requirements and provides guidance on:

capturing of facial images to be used for verification or identification purposes in applications based on reference images in identity or similar documents and traveller or visa databases;
capturing of fingerprint images to be used for verification or identification purposes in applications based on reference images in identity or similar documents and traveller or visa databases;
data quality maintenance for biometric data captured by/for verification or identification applications;
data authenticity maintenance for biometric data captured by/for verification or identification applications.

This document addresses the following aspects which are specific for biometric data capturing:

biometric data quality and interoperability assurance;
data authenticity assurance;
morphing and other presentation attacks and biometric data injection attacks;
accessibility and usability;
recognition algorithms and their evaluation;
privacy and data protection;
optimal process design.

The following aspects are out of scope:

other aspects of IT security;
data capturing for ID document enrolment purposes, e.g. passport or ID card enrolment.

2 Normative references

3 Terms and definitions

4 Abbreviated terms

5 Overview of biometric recognition systems

5.1 Concept

5.2 Biometric references

5.3 Types of identity documents

5.4 Topologies of identity recognition systems

6 Data protection and privacy

6.1 General

6.2 Obligation to provide information about data processing

6.3 Right of access and right to erasure

6.4 Sharing data with third countries and international organizations

6.5 Saving data for statistical reasons

7 Biometric systems used for recognition

7.1 General requirements and recommendations

7.2 Recommendations for biometric systems

7.3 Contexts for recognition via biometrics

Bibliography

PD CEN/TS 18139:2025

Personal identification. European guide for biometric recognition applications based on ID documents (ERG)

Current

Published:

31 May 2025