Judgment;Abstract — ECLI:EU:C:2023:49
Date: 2023-01-26
Language of the case: Bulgarian
Court formation: Fifth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Fundamental rights;Data protection;Charter of Fundamental Rights
Procedure: Reference for a preliminary ruling
Origin: Bulgaria

Summary C-205/21 – 1 
Case C-205/21 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
31 March 2021 
Referring court or tribunal: 
Spetsializiran nakazatelen sad (Bulgaria) 
Date of the decision to refer: 
31 March 2021 
Applicant: 
Ministerstvoto na vatreshnite raboti, Glavna direktsia za borba s 
organiziranata prestapnost (Ministry of Interior, General-Directorate 
for Combating Organised Crime) 
Accused: 
B. C. 
  
Subject matter of the main proceedings 
Mandatory creation of a criminal record of persons who are charged with a 
premeditated criminal offence requiring public prosecution or recording of their 
biometric and genetic data 
Subject matter and legal basis of the request 
The request for a preliminary ruling is made under Article 267(1)(b) TFEU. 
Questions referred for a preliminary ruling 
1. Is Article 10 of Directive 2016/680 effectively transposed into national 
law – Article 25(3) and Article 25a of Zakon za ministerstvo na vatreshnite raboti 
(Bulgarian Law on the Ministry of Interior) – by the inclusion of a reference to the 
similar provision in Article 9 of Regulation 2016/679? 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-205/21 
 
2  
2. Is the requirement set in Article 10(a) of Directive 2016/680 in conjunction 
with Article 52 and with Articles 3 and 8 of the Charter, that any limitation on 
integrity and protection of personal data must be provided for by law, fulfilled if 
contradictory national provisions exist in relation to the permissibility of 
processing of genetic and biometric data for the purposes of creating a police 
record? 
3. Is a national law, namely Article 68(4) of the Bulgarian Law on the Ministry 
of Interior, which provides for the obligation of the court of first instance to order 
the forced collection of personal data (taking photographs for the file, taking 
fingerprints, and taking samples in order to create a DNA profile), compatible 
with Article 6(a) of Directive 2016/680 in conjunction with Article 48 of the 
Charter, if a person who is charged with a premeditated criminal offence requiring 
public prosecution refuses to voluntarily cooperate in the collection of these 
personal data, without the court being able to assess whether there are serious 
grounds for believing that the person has committed the criminal offence with 
which he or she is charged? 
4. Is a national law, namely Article 68(1) to (3) of the Bulgarian Law on the 
Ministry of Interior, which provides, as a general rule, for the taking of 
photographs for the file, the taking of fingerprints, and the taking of samples in 
order to create a DNA profile for all persons who are charged with a premeditated 
criminal offence requiring public prosecution, compatible with Article 10, 
Article 4(1)(a) and (c), and Article 8(1) and (2) of Directive 2016/680? 
Legal provisions and case-law of the European Union 
Charter of Fundamental Rights of the European Union (OJ 2016 C 202, p. 389) 
(‘the Charter’). 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (OJ 2016 L 119, p. 1) (Regulation 2016/679) 
Directive (EU) 2016/680 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data by competent authorities for the purposes of the prevention, 
investigation, detection or prosecution of criminal offences or the execution of 
criminal penalties, and on the free movement of such data, and repealing Council 
Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89) (Directive 2016/680) 
Provisions of national law 
Nakazatelen kodeks (Bulgarian Criminal Code, ‘the NK’); 
B. C. 
 
3 
Nakazatelno protsesualen kodeks (Bulgarian Code of Criminal Procedure, ‘the 
NPK’); 
Zakon za Ministerstvoto na vatreshnite raboti (Bulgarian Law on the Ministry of 
Interior, ‘the ZMVR’); 
Zakon za balgarskite lichni dokumenti (Bulgarian Law on national identity 
documents, ‘the ZBLD’); 
Zakon za zashtita na lichnite danni (Bulgarian Law on data protection, ‘the 
ZZLD’); 
Naredba za reda za izvarshvane i snemane na politseyska registratsia (Bulgarian 
Regulation on the particulars of creating a police record, ‘the NRISPR’). 
Summary of the facts and proceedings 
1 On 24 March 2021, the referring court was called upon by the Zamestnik-direktor 
na Glavna direktsia za borba s organiziranata prestapnost kam Ministerstvoto na 
vatreshnite raboti (Deputy Director of the General-Directorate in the Ministry of 
Interior for Combating Organised Crime) to examine an application under 
Article 68(5) of the ZMVR and Article 11(4) of the NRISPR. The subject of this 
application was the mandatory creation of a police record for the accused B.C. 
2 There are criminal proceedings under way in connection with the avoidance of the 
setting and payment of tax obligations in accordance with the Zakon za danaka 
varhu dobavenata stoynost (Bulgarian Law on value-added tax) by two trading 
companies – a criminal offence under Article 255 of the NK. 
3 On 1 March 2021, an order [of the investigative authority] was issued, which 
formally charged the person B.C. Her actions were classed as participation in a 
criminal organisation together with three other individuals, who, with the wilful 
intention of enrichment, intended to commit coordinated criminal offences in the 
sense of Article 255 of the NK within Bulgaria, which was subsumed under the 
qualification of Article 321(3), 2nd case, no 2 in conjunction with Article 321(2) 
of the NK. She was made aware of this order on 15 March 2021. B.C. chose to 
defend herself and did not arrange to be represented by a lawyer. 
4 Immediately after she was formally charged, she was requested to cooperate in the 
creation of a police record, in other words, to have fingerprints taken, to be 
photographed, and to allow a sample to be taken for a DNA profile. As she 
refused, she filled in a pre-printed form on the same day, 15 March 2021, which 
took the form of a declaration that she had been informed of the existence of a 
statutory basis for the creation of her police record under the ZMVR. She declared 
officially therein that she did not agree to having her fingerprints taken, to being 
photographed, and to allowing samples to be taken from her for the DNA profile. 
She did not state any reasons as to why she did not agree to it. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-205/21 
 
4  
5 She was not subjected to these actions for the purpose of creating a police record, 
instead the police authority called upon the referring court. 
6 The application made reference to the ongoing criminal proceedings; it is claimed 
that there is sufficient evidence for the guilt of the accused including B.C.; it is 
stated that she was formally charged with committing a criminal offence in the 
sense of Article 321(3), 2nd case, no 2 in conjunction with Article 321(2) of the 
NK and that she refused to have her fingerprints taken, to be photographed, and to 
allow samples to be taken for the DNA profile; the legal provisions are mentioned 
(Article 68(1) of the ZMVR and Article 11(4) of the NPISPR); the application 
requests the power to force B.C. to subject herself to these actions (taking 
fingerprints, taking of photographs for the file, and taking of samples for the DNA 
profile). 
7 This application includes the following documents: a photocopy of the order to 
formally charge B.C. and a photocopy of the declaration in which B.C. refused to 
give consent to having fingerprints taken, to be photographed, and to allow 
samples to be taken for the DNA profile. The other documents contained in the 
file were not provided to the referring court. 
Summary of the grounds for the reference 
The first question 
8 The first question asks whether the nature of the wording of the national law can 
lead to a conclusion that is in keeping with the criteria that apply under EU law, 
namely that the national law in principle permits the processing of genetic and 
biometric data for police purposes. These doubts are based on the decision made 
by the national legislature in Article 25(3) and Article 25a of the ZMVR to make 
reference to Regulation 2016/679 and not Directive 2016/680. 
9 According to Article 2(2)(d) of Regulation 2016/679, this Regulation does not 
apply to the processing of personal data by the competent authorities for the 
purpose of preventing, investigating, detecting or prosecuting criminal offences. 
10 According to Article 1(1) of Directive 2016/680, the objective of this Directive is 
to lay down provisions on the protection of natural persons with regard to the 
processing of personal data for the purposes of preventing, investigating, detecting 
or prosecuting criminal offences. Consequently, Directive 2016/680 would 
actually have been the legislative act that should have been transposed in 
Article 22(3) and Article 25a of the ZMVR, rather than Regulation 2016/679. 
11 Similarly, Article 9(1) of Regulation 2016/679 expressly prohibits the processing 
of genetic and biometric data for the purpose of uniquely identifying a natural 
person, while paragraph (2) lists specific exceptions, which do not include 
combating crime ([under Article 2(2)(d), the Regulation expressly does not apply 
to this area]). 
B. C. 
 
5 
12 Article 10 of Directive 2016/680, on the other hand, expressly permits the 
processing of genetic and biometric data subject to fulfilment of certain 
requirements. 
13 In so far as the objective of Article 25(3) and Article 25a of the ZMVR is to 
permit, rather than prohibit, the processing of these data, this also favours the 
conclusion that Directive 2016/680 is the legislative act that should have been 
transposed in Article 22(3) and Article 25a of the ZMVR, and not Regulation 
2016/679. 
14 In accordance with Article 25a of the ZMVR, the processing of biometric and 
genetic data is only permissible under Article 9 of Regulation 2016/679 or 
Article 51 of the ZZLD. 
15 At the same time, the regulation as a whole does not apply to prosecution of a 
criminal offence – see Article 2(2)(d). Independently of this, Article 9 of the 
regulation expressly prohibits the processing of genetic and biometric data; the 
exceptions in the sense of paragraph (2) do not relate to the creation of a police 
record. 
16 In addition, Article 51 of the ZZLD by itself cannot form the basis for 
permissibility of the processing of genetic and biometric data. In so far as 
processing is allowed by this provision, it is only permissible if it is permitted 
under national law or EU law. 
17 In respect of the question of whether it is provided for in national law, the task of 
the referring court is to weigh up Article 25a and Article 68 of the ZMVR against 
one another. To this end, it is required to first of all establish the exact meaning of 
Article 25a of the ZMVR – and in particular, whether it can be assumed that it 
does not transpose Regulation 2016/679, as it expressly states, but rather Directive 
2016/680, which would actually have to be the case. 
18 The question of whether it is provided for under EU law is undoubtedly to be 
answered in the affirmative, in view of the provision in Article 10 of Directive 
2016/680; however, this provision does not have any direct effect, but must be 
transposed. This therefore raises the question, in turn, of whether or not it can be 
assumed that it has been effectively transposed by Article 25(3) and Article 25a of 
the ZMVR. 
19 The referring court therefore requires clarification from the Court of Justice 
regarding the legal meaning of this incorrect citation of an EU legal act in a 
national transposing law. In other words, can the reference in a national law to 
Article 9 of Regulation 2016/679, which is not applicable to the creation of the 
police record and prohibits the processing of genetic and biometric data for the 
purposes of prosecuting a criminal offence, lead to the conclusion that such 
processing is nevertheless permissible, in so far as a different legislative act of EU 
law, specifically Article 10 of Directive 2016/680, unequivocally does permit such 
processing, even though this provision is not cited in the national law? 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-205/21 
 
6  
20 It must be taken into consideration that Article 10 of the Directive does not have 
any direct effect in so far as this provision concerns natural persons. It must be 
transposed in a national law. Can it be assumed that the necessary transposition 
has taken place if this national law makes reference to Article 9 of Regulation 
2016/679 and not to Article 10 of Directive 2016/680? 
21 It must be noted that it is undoubtedly the intention of the Bulgarian legislature to 
respect EU law. From this perspective, an accidental error has been made. In 
terms of content, the transposed wording actually corresponds to Article 10 of 
Directive 2016/680 (or would have to at least correspond to it, which is the subject 
of the third and fourth questions), even if this provision is not expressly cited. In 
view of this content, and irrespective of the reference to Article 9 of Regulation 
2016/679, can it be nonetheless assumed that Article 10 of Directive 2016/680 
was effectively transposed? 
The second question 
22 The second question is closely related to the first one. In other words, even if, 
following clarification from the Court of Justice on the first question, the national 
court interprets Article 25(3) and Article 25a of the ZMVR in such a way that the 
proper transposition of Article 10 of Directive 2016/680 and the existence of an 
effective national legal basis for the processing of genetic and biometric data can 
be assumed, this raises the question of whether this fulfils the requirement 
according to Article 10(a) of Directive 2016/680 that such processing must be 
permissible under the law of the Member State. 
23 In accordance with Article 3(1) of Directive 2016/680, data relating to the 
physiological and genetic identity of a specific natural person constitute personal 
data. In accordance with Article 3(2) of Directive 2016/680, processing is also 
understood to mean the collection of data. Consequently, by taking photographs 
for the file, taking fingerprints, and taking a DNA sample, personal data belonging 
to a natural person are being processed. 
24 In accordance with Article 10 of Directive 2016/680, special protection is given to 
a category of data that are obtained by taking photographs for the file, taking 
fingerprints, and taking a DNA sample, namely ‘genetic data, biometric data’. 
This special protection has a number of dimensions, whereby one of them, under 
letter (a), is a requirement that the processing is ‘authorised by […] Member State 
law’. 
25 The nature of processing of especially sensitive personal data, such as those under 
Article 10 of Directive 2016/680, already constitutes an encroachment into the 
legal sphere of a natural person, in other words, an impingement on his or her 
right to integrity under Article 3 of the Charter. Consequently, forcing someone to 
have his or her photograph taken for the file, to have fingerprints taken, and to 
have DNA samples taken, violates Article 3 of the Charter. The right to protection 
of personal data is protected in Article 8 of the Charter. Any limitation placed on 
B. C. 
 
7 
these rights enshrined in Articles 3 and 8 of the Charter is only permitted under 
the conditions laid down in Article 52 of the Charter (recital 104 of Directive 
2016/680), whereby certain conditions must be observed. The first of these 
conditions is that the limitation must be provided for by law. 
26 Consequently, both Article 10(a) of Directive 2016/680 and Article 52 of the 
Charter require that the collection of biometric and genetic data must be provided 
for by law. That assumes the existence of a valid and clearly formulated national 
law. The question arises as to whether this requirement has been fulfilled if a 
contradiction exists between Article 25a of the ZMVR, which, at first glance, 
prohibits the collection of biometric and genetic data, in so far as it makes 
reference to Article 9 of Regulation 2016/679, and Article 68 of the ZMVR, 
which certainly permits the collection of biometric and genetic data. 
27 From this perspective, even if the referring court takes the view within the scope 
of a corrective interpretation that the contradiction in national law could be 
overcome, that the conclusion is drawn that national law permits the processing of 
biometric and genetic data for the purposes of creating a police record, this 
undoubtedly changes nothing about the fact, however, that this conclusion does 
not arise from the clear and unequivocal legal provision, but rather from a 
complex corrective interpretation that was reached by means of a reference for a 
preliminary ruling. Does this lack of clarity in national law fulfil the requirement 
of Article 52 of the Charter, in accordance with which the limitation on the rights 
enshrined in Articles 3 and 8 of the Charter must be provided for by law? 
The third question 
28 In accordance with Article 6(a) of Directive 2016/680, personal data may only be 
processed for the purposes of combating crime in relation to persons with regard 
to whom there are serious grounds for believing that they have committed a 
criminal offence. The third sentence of recital 31 states that the processing of 
personal data of persons who are suspected of having committed an offence, but 
have not been convicted, should not prevent the application of the presumption of 
innocence. Consequently, Article 48 of the Charter applies, under which 
‘everyone who has been charged shall be presumed innocent until proved guilty 
according to law’. 
29 At the same time, the national law – Article 68 of the ZMVR – does not provide 
for the court of first instance to examine in any manner whether such serious 
grounds exist for believing that someone has committed a criminal offence. 
Rather, it is sufficient for the public prosecution service or another prosecution 
authority to have formally charged the person. 
30 In the national law regarding formally charging a person – Article 219(1) of the 
NPK – this means it is necessary to collect ‘sufficient evidence for the guilt of a 
particular person’. It is not certain that the criterion of ‘sufficient evidence’ under 
Article 219(1) of the NPK corresponds to the criterion of ‘serious grounds for 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-205/21 
 
8  
believing that they have committed […] a criminal offence’ under Article 6(a) of 
Directive 2016/680. Rather, it is to be assumed that, in order to process biometric 
and genetic data, more valid evidence is necessary than that which is required in 
order to formally charge the person – in so far as the purpose of charging this 
person is to inform the person of the grounds for suspecting him or her, at which 
point he or she is offered the opportunity to defend him or herself. 
31 Similarly, in accordance with Article 68 of the ZMVR, only the public prosecutor 
(or the investigating authority – investigator, investigating police officer) is able to 
assess whether evidence (‘sufficient evidence’ in the sense of Article 219 of the 
NPK and ‘serious grounds’ in the sense of Article 6(a) of Directive 2016/680) 
actually exists. The court of first instance does not have the means to do this. This 
means that, in accordance with Article 68 of the ZMVR, it is sufficient for the 
court to establish that the person has been formally charged with a premeditated 
criminal offence requiring public prosecution. The court is not authorised to assess 
whether sufficient or valid evidence exists; it also does not have the factual means 
to undertake this assessment, since it actually has no access to the file – after all, it 
has only received a photocopy of the order formally charging the person and a 
declaration concerning the refusal to allow data to be collected. 
32 The court’s task – once it has satisfied itself that the person was formally charged 
with a pre-meditated criminal offence requiring public prosecution and that this 
person refused to voluntarily make available biometric and genetic data (to be 
photographed, to have fingerprints taken and to allow a DNA sample to be 
taken) – is to order that this person be forced to undergo these actions. 
33 This raises the question of whether the national standard in accordance with 
Article 219(1) of the NPK for ‘sufficient evidence’ corresponds to the standard in 
accordance with Article 6(a) of Directive 2016/680, namely ‘serious grounds for 
believing that they have committed […] a criminal offence’. 
34 This raises the question of whether the referring court would observe Article 47 
and 48 of the Charter, should it rule on the application made in accordance with 
Article 68(5) of the NPK. Put another way, the question is raised as to whether the 
person who refused to voluntarily make personal data available (to have 
photographs taken for the file, to have fingerprints taken, to allow a DNA sample 
to be taken), will enjoy the protection required under Article 47 of the Charter, in 
the form of effective legal remedies; the question is also raised as to whether the 
presumption of innocence in accordance with Article 48 of the Charter will 
continue to be preserved. These questions are raised because the court of first 
instance does not possess the file and is unable to assess whether ‘sufficient 
evidence’ in the sense of Article 219 of the NPK or ‘serious grounds’ in the sense 
of Article 6(a) of Directive 2016/680 exist. 
The fourth question 
B. C. 
 
9 
35 In accordance with Article 4(1)(b) of Directive 2016/680, personal data must be 
collected for specified, explicit and legitimate purposes. Article 8(2) clearly states 
that the law of the Member State must specify the objectives and the purposes of 
the processing. The sixth sentence of recital 26 states that the special purposes for 
which the personal data are processed should be defined, legitimate and 
determined at the time of collection of the personal data. 
36 Article 4(1)(c) and Article 8(1) of Directive 2016/680 stipulate that the collection 
of personal data must not be excessive. The eighth and ninth sentences of 
recital 26 also contain something similar. Article 10 of Directive 2016/680 states 
specifically in relation to biometric and genetic data that processing of such data is 
allowed only where ‘strictly necessary’. 
37 It may be gathered from these provisions that the requirement for a certain degree 
of assessment absolutely must be laid down in national law before biometric and 
genetic data are collected by means of taking photographs for a file, taking 
fingerprints, and taking a DNA sample. Such an assessment must concern itself 
with the questions of whether the collection is necessary and whether it extends to 
all of these actions. At the same time, the creation of a police record in accordance 
with Article 68 of the ZMVR applies mandatorily without exception for all 
persons who are charged with premeditated criminal offences requiring public 
prosecution, and all three types of personal data collection – taking of photographs 
for the file, taking fingerprints, taking DNA sample – are also used mandatorily. 
38 Only the general purposes of this processing are mentioned – the exercise of an 
information activity (Article 18(1) and Article 20(1) of the ZMVR), with the 
objective of conducting the activities of the Bulgarian Ministry of Interior 
(Article 25(1) in conjunction with Article 6), including safeguarding national 
security, combating crime, and protecting the public order. The law does not 
require there to be a specific necessity for the collection of biometric and genetic 
data. The law does not require any assessment of whether all of these data are 
necessary or whether some of them would suffice. 
39 It may be inferred from the provision in Article 10 of Directive 2016/680 that the 
collection of biometric and genetic data must be the exception, which is allowed 
following proper justification of the need, since the provision states that it must be 
‘strictly necessary’. At the same time, the national law assumes that the collection 
of these data forms the general rule, which applies for all persons who are charged 
with a premeditated criminal offence requiring public prosecution. 
40 This then raises the question as to whether this requirement – being charged with a 
premeditated criminal offence requiring public prosecution – is sufficient in order 
to consider the requirements of Article 10, Article 4(1)(a) and (c), and Article 8(1) 
and (2) of Directive 2016/680 as being fulfilled.