(AGENPARL) - Roma, 26 Gennaio 2023

(AGENPARL) – gio 26 gennaio 2023 Dear All,
Please find attached press release in respect of Case C-205/21:
The systematic collection of biometric and genetic data of any accused person in order for them to be entered in a police record is contrary to the requirement of ensuring enhanced protection with regard to the processing of sensitive personal data.
Kind regards,
Georgios Georgopoulos
Trainee
Press and Information Unit
Communication Department
[cid:image002.jpg@01D5E282.B6DDC230]
[logo-en]
Rue du Fort Niedergrünewald
L-2925 Luxembourg
[curia.europa.eu](https://www.curia.europa.eu/)

Testo Allegato:

Communications Directorate

Press and Information Unit

curia.europa.eu

PRESS RELEASE No 16
/23

Luxembourg, 26 January 2023

Judgment of the Court in Case C
–
205/21 | Ministerstvo na vatreshnite raboti (
Recording of
biom
etric and
genetic data by the
police)

person in order for them to be entered in a police record is contrary to the
requirement of ensuring enhanced protection with regard to the
processing of sensitive personal data

In criminal proceedings for tax fraud in
stitu
ted by the Bulgarian authorities, V. S. was accused of participation in a
criminal organisation, formed with the aim of enrichment, with a view to committing offences in concert on
Bulgarian territory. Followi
ng that accusation, the Bulgarian police requested V. S. to consent to the collection of her
dactyloscopic and photographic data in order for them to be entered in a record and to the taking of a sample for
the purpose of creating her DNA profile. V. S. op
posed their collection.

Relying on national legislation which provides for the â??creation of a police recordâ?? for persons accused of an
intentional criminal offence subject to public prosecution, the police authorities requested the Spetsializiran
nakazatel
en sad (Specialised Criminal Court, Bulgaria) to authorise enforcement of the collection of V. S.â??s genetic
consent to the collection of her d
ata accompanied the police authoritiesâ?? application.

That court had doubts as to whether the Bulgarian legislation applicable to such â??creation of a police recordâ?? is
comp
atible with Directive 2016/680,

1

read in the light of the Charter of Fundamental Rig
hts of the European Union
(â??the Charterâ??), and therefore made a reference to the Court of Justice for a preliminary ruling.

a by the police authorities may be regarded as authorised by
national law
,
for the purpose of

Directive
processing of data of a category of person
s with regard to whom there are serious grounds for believing that they
are involved in a criminal offence
,

and on observance of the right to effective judicial protection and of the principle
of the presumption of innocence where

the national court having

jurisdiction is permitted by national legislation to
authorise

the compulsory collection of those data, regarded as â??sensitiveâ?? by the EU legislature. It addresses, finally,

of those data is compatible with the
provisions of Directive 2016/680 that relate to their processing,
having regard to

Findings of the Court

1

Directive (EU) 2016/680 of the European Parliament and of the Council of 27

April 2016 on the protection of natural persons with regard to the
processing of personal data by competent authorities for the purposes of the prevention,
investigation, detection or prosecution of criminal offences
or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/
977/JHA (OJ 2016
L

119, p.

89)
.

Communications Directorate

Press and Information Unit

curia.europa.eu

First of all, the Court holds that Directive 2016/680, read in the light of th
e Charter,

2

meaning that
the processing of biometric and genetic data by the police authorities

with a view to their
investigative activities, for purposes of combating crime and maintaining law and order,
is authorised

by
n
ational
law provided that national law

contains a
sufficiently clear and precise legal basis

to authorise that processing.
The fact that the national legislative act containing such a legal basis refers, furthermore, to the General Data
Protection Regulati
on,

3

and not to Directive 2016/680, is not capable, in itself, of calling the existence of such
authorisation into question, provided that it is apparent, in a sufficiently clear, precise and unequivocal manner,

In that context, in the light of the fact that the relevant national legislation referred to the prov
isions of the GDPR
which govern the processing of sensitive data, while reproducing the content of the provisions of Directive 2016/680
which relate to the processing of the same data,
4

the Court observes that
those provisions are not equivalent
.
Whereas

for inter alia the purposes
, covered by
Directive 2016/680,
of the prevention and detection of criminal offences

is capable of being allowed
only where
strictly necessary, and must be subject to ap
propriate safeguards and be provided for by EU or
national

law
,
the GDPR lays down a general prohibition of the processing of those data, coupled with a list of exceptions. Whilst
the national legislature may provide, in the same legislative instrument, fo
r the processing of personal data for
purposes covered by Directive 2016/680 and for other purposes covered by the GDPR, it is obliged to make sure
that there is no ambiguity as to the applicability of one or other of those two EU acts to the collection of

sensitive
data.

In addition, with regard to a possible incorrect transposition of Directive 2016/680,
raised
by the referring court, the
Court points out that that directive
does not require

the national measures which

authorise processing of data
falling within its scope to contain a
reference to the directive
. It states that, where the national legislature provides
ither within
the scope of that directive or within the scope of the GDPR, it may, for reasons of clarity and precision, refer
explicitly, on the one hand, to the provisions of national law transposing that directive and, on the other, to the
GDPR, but is n
ot obliged to mention that directive. However,
in the event of an apparent conflict

national provisions authorising the data processing at issue and those seeming to preclude it,
the national court
must give the provisions an interpretation whi
ch safeguards the effectiveness of Directive 2016/680
.

Next, the Court

rules that Directive 2016/680

5

and the Charter

6

do not preclude national legislation which
provides that
, if the person accused of an intentional offence subject to public prosecution

refuses to cooperate
in a record,
the criminal court having jurisdiction must authorise a measure enforcing their collection,
without hav
ing the power to assess whether there are serious grounds
for believing that the person concerned
has committed the offence of which he or she is accused, provided that national law
subsequently guarantees
effective judicial review of the conditions for th
at accusation
, from which the authorisation to collect those data
arises.

In that regard
,

the Court notes that,
pursuant to Directive 2016/680,

7

the Member States must ensure that a
clear distinction is made between the data of the different categories of

data subjects

in such a way that they
are not subject without distinction
â??

whatever the category to which they belong
â??

to same degree of interference
with their fundamental right to the protection of their personal data. However, that obligation is not
absolute.
Furthermore, in so far as that directive refers to the category of persons with regard to whom there are serious
grounds for believing that they have committed a criminal offence, the Court states that
the existence of sufficient
items of evidenc
e pointing to a personâ??s guilt constitutes, in principle, a serious ground for believing that he

2

Article

10
(a) of Directive 2016/680,

read in the light of
Article

52

of the
Charte
r
.

3

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27

April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016
L

119, p.

1; â??the GDPRâ??
)
.

4

Article

9

of the GDPR and
Article

10

of Directive 2016/680

respectively
.

5

Article

6(a) of Directive 2016/680
.

6

Articles

47

and 48 of the Charter, enshrining respectively the right to
effective judicial
protection and
the

princip
l
e

of the
pr
esu
mption
of i
nnocence
.

7

Article

6 of Directive 2016/680
.

Communications Directorate

Press and Information Unit

curia.europa.eu

or she has committed the offence at issue
. Thus
,

Directive 2016/680
does not preclude national legislation
which provides for the compulsory collection of data

of persons in respect of whom sufficient evidence is
gathered that they are guilty of an intentional offence subject to public prosecution and who have been
accused for that reason
.

So far as concerns observance of the right to effective judicial protecti
on, where the national court having
jurisdiction, with a view to authorising a measure enforcing the collection of sensitive data of an accused person,
cannot review, on the merits, the conditions for his or her accusation, the Court points out, in particu
lar, that it may
prove justified, during the preliminary stage of the criminal procedure, to shield temporarily from judicial review the
assessment of the evidence on which accusation of the person concerned is founded. Such review, at th
is

stage,
might im
pede the conduct of the criminal investigation in the course of which those data are being collected and
excessively limit the investigatorsâ?? ability to clear up other offences on the basis of a comparison of those data with
data gathered during other inve
stigations. That limitation of effective judicial protection
is therefore not
disproportionate, provided that national law subsequently guarantees effective judicial review
.

As regards observance, by a judicial decision authorising the collection of the da
ta at issue, of the right to be
presumed innocent, the Court observes, first, that, in so far as
, in the present instance, the

collection

of such data

is
limited to the category of persons whose criminal liability has not yet been established,
their collec
tion

cannot be
regarded as being such as to reflect the feeling of the authorities that those persons are guilty. Second, the fact that
the court which
will have to
rule on the guilt of the person concerned cannot assess, at th
is

stage of the criminal
proc
guarantee of observance of his or her right to be presumed innocent.

Finally, the Court co
ncludes that Directive 2016/680

8

precludes national legislati
on which provides for the
systematic collection of biometric and genetic data of any person accused of an intentional offence subject
to public prosecution in order for them to be entered in a record, without laying down an obligation on the
competent auth
ority to verify whether and demonstrate that, first, their collection is strictly necessary for
achieving the specific objectives pursued and, second, those objectives cannot be achieved by measures
constituting a less serious interference with the rights
and freedoms of the person concerned
.

In that regard, the Court points out that Directive 2016/680 is intended to ensure, inter alia,
enhanced protection
with regard to the processing of sensitive data

â??

â??

since it
is liable to
create significant risks to fundamental rights and freedoms. The requirement set out therein, that that processing is
allowed
â??only where strictly necessaryâ??
strengthened conditions

for lawful
processing of

such sensitiv
e data.

9

Furthermore, the scope of that requirement must also be determined in the light
of the principles relating to data processing, such as
purpose limitation and data minimisation
.

any person accused of an intentional offence subject to public prosecution in order for them to be entered in a
record is, in principle,

contrary to that requirement
. It is liable to lead, in an indiscriminate and generalised
manner, to collection of the data of most accused persons since the concept of â??intentional criminal offence subject
to public prosecutionâ?? is particularly general an
d is
liable to apply to a large number of criminal offences,
irrespective of their nature and gravity, their particular circumstances, any link between them and other
procedures in progress, the criminal record of the person concerned or his or her individ
ual profile
.

NOTE:

A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which
Union law or the
validity of a European Union act. The Court of Justice does not decide the dispute itself. It is for the
national court or tribunal to dispose of the case in accordance with the Courtâ??s decision, which is similarly binding on
other national courts or tribu
nals before which a similar issue is raised.

Unofficial document for media use, not binding on the Court of Justice.

The
full text

of the judgment
is

published on the CURIA website on

the day of delivery.

8

Article

10

of Directive 2016/680, read in conjunction with
Article

4
(1)(a) to

(c) and
Article

8(1) and (2) thereof
.

9

Compared with the conditions following from Article

4(1)(b) and (c) and Article

8(1) of
D
irective 2016/680
.

Communications Directorate

Press and Information Unit

curia.europa.eu

Stay Connected
!

Press contact: Jacques René Zammit
â??
(+352) 4303 3355
.