Referral C-660/26 (International Card Services, 16 Jun 2026)

1. Can the recording and storage of a photograph showing a person’s face, for the purpose of using it for identification, be regarded as the processing of biometric data within the meaning of Article 9(1) of Regulation (EU) 2016/679 (General Data Protection Regulation; ‘GDPR’), in conjunction with Article 4(14) of the GDPR, and, if so, under what conditions?
2. Should Article 40(1)(a) of Directive (EU) 2015/849 of 20 May 2015 (the (amended) Fourth European Anti-Money Laundering Directive), read in conjunction with Article 6(3) of the GDPR, the principle of data minimisation set out in Article 5(1)(c) of the GDPR, Articles 7, 8 and 52 of the Charter of Fundamental Rights of the European Union, and Article 8 of the European Convention of Human Rights, be interpreted as meaning that Member States must require obliged entities to retain a copy of the identity document used to verify a customer’s identity in the context of customer due diligence?
3. If question 2 must be answered in the affirmative: does the retention obligation to be implemented by the Member States in respect of obliged entities include a full copy of the relevant pages of an identity document, including the photograph affixed to that identity document?
4. Can photographs in which a person is recognisably depicted be regarded as personal data revealing racial or ethnic origin within the meaning of Article 9(1) of the GDPR, and, if so, under what conditions?
a. Is it relevant in that regard whether the photograph in question is processed for the purpose or with the intention of making a distinction on the basis of racial or ethnic origin?
b. Is it relevant in this regard whether information about racial or ethnic origin can be inferred from the photograph in question with a sufficient degree of certainty?