France plans to create a single, unified database holding the biometric data from the passports and identity cards of 60 million citizens.

The measure wasn't debated in the French National Assembly as it was brought in on a national holiday by government decree.

The new database will hold an individual's name, date and place of birth, gender, eye colour, height, address, photograph, fingerprints, e-mail address, and the names, nationalities, dates and places of birth of parents, according to L'Express. The idea is to make it easier to obtain and renew identity documents, and to aid in the fight against identity fraud.

It is not the first time France has sought to set up such a huge, centralised biometric database.

In 2012, Nicholas Sarkozy's right-wing government tried to do the same. However, key sections of that law were thrown out by France's constitutional council on the grounds that the scope of the database was too broad, and that the police would be allowed to use it to identify individuals from biometric data.

The French government apparently believes that the new decree will not suffer the same fate. It insists that the new database will only be used to authenticate individuals, not to identify them. That is, it will be used to check that they are who they claim to be, not to discover whose biometrics have been found at the scene of a crime, for example.

However, there is a big loophole in the legal framework. France's intelligence services and police will be able to use the database to identify suspects provided "violations of the fundamental interests of the Nation and acts of terrorism" are involved.

Moreover, as an article in NextInpact points out, once the database exists, it is highly likely that there will be calls to use it for identification purposes "because it is there," for example in the wake of a major terrorist attack on French soil. That possibility may be enough for the constitutional council to block the new decree just as it rejected the previous law.

Questions have also been raised over whether the government's use of a decree rather than a law to bring about the creation of the new database was appropriate for a sensitive measure that will affect nearly every French citizen. Only children under 12 will be exempt from a requirement to provide the necessary biometrics.

The other concern with the new unified database is the risk that it will be compromised, which would potentially put the biometric data of 60 million people at risk. Unlike passwords, biometrics cannot be changed, which would make the loss of them a serious long-term problem.

As French computer expert Francois Pellegrini pointed out in a blog post on the decree, the aim of allowing identity documents to be authenticated could have been achieved using an embedded chip in identity cards and passports. The French government chose not to take that route, which suggests that it does indeed wish to use the database for identification as well as authentication.

The dangers of a centralised biometric database were spelled out by left-wing politician Jean-Jacques Urvoas, who wrote in 2012: "No computer system is impenetrable. All databases can be hacked. It's always just a matter of time."

Back then, Urvoas was one of the most vocal opponents of Sarkozy's biometric database law, and played a key role in bringing a challenge before the constitutional council that ultimately saw key parts of the law nullified. Today, Urvoas is justice minister in the French government, and therefore one of those most directly involved in drawing up the new decree. Maybe he should re-read his blog post—if he's not eating his words.