Provisional text
OPINION OF ADVOCATE GENERAL
SZPUNAR
delivered on 1 August 2025 (1)
Case C‑371/24 [Comdribus] (i)
HW
other party
Ministère public
(Request for a preliminary ruling from the cour d’appel de Paris (Court of Appeal, Paris, France))
( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive
(EU) 2016/680 – Article 10 – Processing of special categories of data – Strict necessity – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 49 )
I.      Introduction
1.        The taking of fingerprints and photographs is a standard method of identification as part of a criminal investigation. Nevertheless, those personal data uniquely identify a natural person and are therefore regarded as particularly sensitive.
2.        The delicate task which falls to the Court in the present case is to strike a balance between, on the one hand, practices often regarded as commonplace by the police authorities and, on the other hand, the protection of the data subjects’ data.
II.    Legal framework
A.      Directive (EU) 2016/680
3.        Article 1(1) of Directive (EU) 2016/680 (2) provides that ‘this Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’
4.        Article 4 of the directive reads as follows:
‘1.      Member States shall provide for personal data to be:
(a)      processed lawfully and fairly;
(b)      collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;
(c)      adequate, relevant and not excessive in relation to the purposes for which they are processed;
…
4.      The controller shall be responsible for, and be able to demonstrate compliance with, paragraphs 1, 2 and 3.’
5.        Under Article 6 of that directive:
‘Member States shall provide for the controller, where applicable and as far as possible, to make a clear distinction between personal data of different categories of data subjects, such as:
(a)      persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence;
(b)      persons convicted of a criminal offence;
(c)      victims of a criminal offence or persons with regard to whom certain facts give rise to reasons for believing that he or she could be the victim of a criminal offence; and
(d)      other parties to a criminal offence, such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings, persons who can provide information on criminal offences, or contacts or associates of one of the persons referred to in points
(a) and (b).’
6.        Article 8 of that directive provides:
‘1.      Member States shall provide for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority for the purposes set out in Article 1(1) and that it is based on Union or Member State law.
2.      Member State law regulating processing within the scope of this Directive shall specify at least the objectives of processing, the personal data to be processed and the purposes of the processing.’
7.        Article 10 of Directive 2016/680 provides:
‘Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be allowed only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:
(a)      where authorised by Union or Member State law;
(b)      to protect the vital interests of the data subject or of another natural person; or
(c)      where such processing relates to data which are manifestly made public by the data subject.’
8.        Article 13 of that directive reads as follows:
‘1.      Member States shall provide for the controller to make available to the data subject at least the following information:
(a)      the identity and the contact details of the controller;
(b)      the contact details of the data protection officer, where applicable;
(c)      the purposes of the processing for which the personal data are intended;
(d)      the right to lodge a complaint with a supervisory authority and the contact details of the supervisory authority;
(e)      the existence of the right to request from the controller access to and rectification or erasure of personal data and restriction of processing of the personal data concerning the data subject.
2.      In addition to the information referred to in paragraph 1, Member States shall provide by law for the controller to give to the data subject, in specific cases, the following further information to enable the exercise of his or her rights:
(a)      the legal basis for the processing;
(b)      the period for which the personal data will be stored, or, where that is not possible, the criteria used to determine that period;
(c)      where applicable, the categories of recipients of the personal data, including in third countries or international organisations;
(d)      where necessary, further information, in particular where the personal data are collected without the knowledge of the data subject.
3.      Member States may adopt legislative measures delaying, restricting or omitting the provision of the information to the data subject pursuant to paragraph 2 to the extent that, and for as long as, such a measure constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned, in order to:
(a)      avoid obstructing official or legal inquiries, investigations or procedures;
(b)      avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
(c)      protect public security;
(d)      protect national security;
(e)      protect the rights and freedoms of others.
…’
9.        Article 54 of that directive states:
‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 52, Member States shall provide for the right of a data subject to an effective judicial remedy where he or she considers that his or her rights laid down in provisions adopted pursuant to this Directive have been infringed as a result of the processing of his or her personal data in non-compliance with those provisions.’
B.      French law
10.      Article 55-1 of the code de procédure pénale (French Code of Criminal Procedure) provides:
‘A senior police officer may carry out, or supervise, the procedures for the taking of non-intimate samples from any person who is likely to provide information about the facts in question or from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, that are necessary for the purposes of conducting technical and scientific tests to compare them with traces or evidence obtained for the purposes of the investigation.
That officer shall carry out, or supervise, the procedures for the gathering of identification data, in particular the taking of fingerprints, palm prints or photographs, that are necessary for the purposes of entry into and consultation of police databases, in accordance with the rules applicable to each of those databases.
The refusal, by a person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, to consent to the procedures referred to in subparagraphs
1 and 2, ordered by a senior police officer, shall be punished by a year’s imprisonment and a fine of EUR 15 000.
Without prejudice to the application of the third subparagraph, where the taking of fingerprints, palm prints or a photograph constitutes the sole means of identifying a person who is being questioned pursuant to Articles 61-1 or 62-2 in respect of a crime or offence punishable by at least three years’ imprisonment and who refuses to prove his or her identity or who provides manifestly incorrect identity information, that process may be carried out without the consent of that person, with the written authorisation of the public prosecutor to whom the senior police officer has addressed a reasoned request. The senior police officer or, under the supervision of the former, a police officer shall use compulsion to the extent strictly necessary and in a proportionate manner. The officer shall take into account, where appropriate, the vulnerability of the person. A record of the process shall be made, stating the reasons why it is the sole means of identifying the person and the day and time at which it was carried out. The record shall be forwarded to the procureur de la République [(French public prosecutor)], a copy having been given to the person concerned.’
III. The dispute in the main proceedings, the questions referred and the procedure before the Court of Justice
11.      On 30 May 2020, more than a hundred climate activists occupied the Avenue des Champs-Élysées in Paris (France). Law enforcement officers intervened to disperse them and arrested several people, including HW, for organising a demonstration without giving notice and disobedience. HW was interviewed in police custody and gave his identity but refused to be fingerprinted and photographed for identification purposes, despite having been informed that that refusal constituted an offence punishable by imprisonment and a fine.
12.      At the end of his police custody on 1 June 2020, HW was brought before the French public prosecutor and the juge des libertés et de la détention (liberties and detention judge, France), who placed him on bail and informed him that he would have to appear before the tribunal correctionnel de Paris (Criminal Court, Paris, France). HW was accused of:
–        first, having organised, in Paris, on 30 May 2020, a demonstration on the public highway without giving prior notice
under the conditions established by law, in the present case, in particular, by urging the participants, in giving them instructions not to show their identity documents, not to comply with the orders of law enforcement officers, by creating a human chain, instructions with which the other demonstrators immediately complied;
–        second, having refused, on 31 May 2020 in Paris, in full knowledge of a decryption key for a cryptographic device likely to have been used to prepare, facilitate or commit a crime or other offence, to reveal or activate that key further to a judicial request in the context of a preliminary, on-the-spot or judicial investigation, in the present case by refusing to reveal the codes of his telephone; and,
–        third, having refused, on 30 May 2020 in Paris, although he was reasonably suspected on one or more grounds of having committed or attempted to commit an offence, to consent to the taking of fingerprints, palm prints or photographs for the purposes of entry into and consultation of police databases, in accordance with the rules applicable to each of those databases.
13.      By judgment of 8 September 2021, the tribunal correctionnel de Paris (Criminal Court, Paris) acquitted HW of the first two charges, but found him guilty of the third offence and, accordingly, ordered HW to pay a fine of EUR 300.
14.      HW and the public prosecutor’s office brought appeals against that judgment before the cour d’appel de Paris (Court of Appeal, Paris, France), the referring court.
15.      The referring court considers that, notwithstanding the judgment in Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), (3) certain questions remain as regards the interpretation of Article 10 of Directive
2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof.
16.      In the first place, the findings of the Court of Justice in Ministerstvo na vatreshnite raboti I apply to criminal proceedings which provide for the systematic collection of biometric and genetic data from any person against whom there is sufficient evidence of the commission of an offence to justify his or her being charged. (4) However, the referring court submits that the Court has not yet ruled on a legal situation such as that set out in Article 55-1 of the French Code of Criminal Procedure, which provides for the systematic collection of the biometric data (5) of a person ‘reasonably suspected on one or more grounds of having committed or attempted to commit an offence’, in the context of an investigation, without any requirement for that person to have been charged. It is therefore necessary to ascertain whether that condition is sufficient to fulfil the requirements arising from Directive
2016/680.
17.      In the second place, the referring court asks whether Directive
2016/680 imposes an obligation on the competent authorities to state reasons as to why the processes which they carry out are strictly necessary.
18.      In the third place, the present case raises a novel issue as regards EU law: according to French legislation, a refusal to consent to the gathering of identification data is a stand-alone offence which may be prosecuted and result in a conviction even though the main offence on which the measure to gather identification data was based did not result in a conviction (‘the stand-alone conviction’). The question thus arises whether, in those circumstances, the requirement for the collection of biometric data to be ‘strictly necessary’ has been met and whether such a stand-alone conviction is justified.
19.      According to the referring court, the answer to those questions is essential to the resolution of the dispute in the main proceedings, since HW was prosecuted for and convicted solely of the offence of refusing to consent to the gathering of identification data, whereas he was acquitted of the main offence of organising a demonstration without giving notice, which formed the basis of the measure for gathering identification data, and at no stage in the proceedings did it appear that there was a sufficient statement of reasons as to why that measure was strictly necessary.
20.      In those circumstances, the cour d’appel de Paris (Court of Appeal, Paris) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1)      Is Article 10 of Directive
2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the French Code of Criminal Procedure, which provides for the systematic gathering of identification data (fingerprints and photographs) from persons who are suspected on one or more grounds of having committed or attempted to commit an offence?
(2)      Is Article 10 of Directive
2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the French Code of Criminal Procedure, which does not impose on the competent authority an obligation to provide, in each individual case, a sufficient statement of reasons as to why it is strictly necessary to gather identification data?
(3)      Is Article 10 of Directive
2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the French Code of Criminal Procedure, which allows the prosecution and conviction on a [stand-alone] basis of a person who has refused to consent to the gathering of identification data even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data?’
21.      The request for a preliminary ruling was registered at the Court of Justice on 24 May 2024. Written observations were submitted by HW, the French and Polish Governments, Ireland and the European Commission. The French and Czech Governments, Ireland and the Commission were present at the hearing, which took place on 30 April 2025.
IV.    Analysis
A.      The first question referred
1.      The wording
22.      As a reminder, the referring court asks, by its first question, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which provides for the systematic identification (dactyloscopic and photographic) of persons in respect of whom there is one or more reasons to suspect that they have committed or attempted to commit an offence.
23.      I wish to point out that a reading of the request for a preliminary ruling reveals that the main concern of the referring court appears to be the fact that Article 55-1 of the French Code of Criminal Procedure authorises the collection of biometric data of persons who have not been formally accused in criminal proceedings.
24.      As regards the wording of the first question, the use of the adjective ‘systematic’ by the referring court (6) was the subject of debate between the parties in their written observations.
25.      The French Government submits that it is incorrect to assert that the French legislation provides for the ‘systematic’ collection of those biometric data, since collection is not an obligation, but an option.
26.      The Commission agrees with the French Government, pointing out that the senior police officer has a ‘margin of discretion’ as regards the taking of samples. The Commission submits that the taking of such samples is not ‘systematic’, in so far as they are carried out not in respect of all persons suspected of having committed an offence, but solely in line with the needs of the investigation.
27.      HW submits that, in view of the practice of the police authorities, the collection of data at issue is systematic. (7)
28.      In that regard, it should be recalled that it is not for the Court of Justice to rule on the interpretation of provisions of national law or to decide whether the interpretation or application of those provisions by the national court is correct, since such a task falls within the exclusive jurisdiction of the national court. (8)
29.      That being so, the Court, which is called on to provide an answer that is of use to the national court, may provide it with guidance based on the file in the main proceedings and on the written and oral observations which have been submitted to it. (9)
30.      I am aware that there may be a fine line between providing an answer that is of use and interpreting national law.
31.      However, I must point out that the referring court’s use of the term ‘systematic collection’ of data stems from the judgment in Ministerstvo na vatreshnite raboti I, which appears to have prompted its questions. (10)
32.      It is apparent from paragraph 113 of that judgment that, according to the referring court in that case, Article 4(1)(a) to (c), Article 8(1) and (2) and Article 10 of Directive 2016/680 require that the competent authorities have discretion for the purpose of determining whether collection of biometric and genetic data is necessary. According to that court, the collection of data provided for by the national legislation applied mandatorily to all persons accused of intentional offences subject to public prosecution, without that legislation requiring the specific necessity to collect all those categories of data to be established. (11)
33.      In addition, the Court of Justice held, in paragraph 114 of the judgment in Ministerstvo na vatreshnite raboti I, that ‘the fourth question should be understood as seeking to establish, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority to determine and to demonstrate, first, that their collection is necessary for achieving the specific objectives pursued and, second, that those objectives cannot be achieved by collecting only a part of the data concerned’. (12)
34.      In the light of the two preceding points and the observations of the parties in the present case, (13) the concepts of ‘discretion’ and ‘systematic collection’ of data should be clarified.
35.      As is apparent from paragraphs 113 and 114 of the judgment in Ministerstvo na vatreshnite raboti I, first, ‘discretion’ refers to the possibility, provided for by national law, for the competent authority to determine and demonstrate that the data processing is strictly necessary. Second, collection is ‘systematic’ when it applies, in a mandatory manner, to every person falling within the scope of the national legislation at issue.
36.      It follows that, in order to give a useful answer to the referring court, the Court of Justice must first determine whether the collection at issue in the present case is ‘systematic’, within the meaning of the judgment in Ministerstvo na vatreshnite raboti I.
37.      It cannot be inferred from Article 55-1 of the French Code of Criminal Procedure that the collection of biometric data is ‘systematic’. Under the wording of that provision, the competent authority is not obliged to collect data from all persons reasonably suspected on one or more grounds of having committed or attempted to commit an offence. In addition, the second subparagraph of that provision states that the collection is to be carried out in accordance with the rules applicable to the police databases and in so far as the data in question are necessary for the purposes of entry into and consultation of those databases. (14)
38.      That said, as the debate between the parties demonstrates, in referring to the ‘systematic’ nature of the data collection the wording of the first question referred for a preliminary ruling is confusing, in so far as it appears to presume that collection which is not ‘systematic’ complies with Directive
2016/680. However, I do not consider that to be the case. As I shall explain in the context of the examination of the substance, where the collection of biometric data is not ‘systematic’, it must still, in order to comply with the requirements of Directive
2016/680, be ‘strictly necessary’.
39.      Accordingly, I propose that the Court of Justice rephrase the first question referred to the effect that, by that question, the referring court seeks to determine, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, precludes national legislation which allows biometric data to be collected from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence.
2.      Substance
(a)    General remarks on Article 10 of Directive 2016/680, as interpreted by the Court of Justice
40.      In the first place, it must be emphasised that Article 10 of Directive 2016/680 constitutes a specific provision governing the processing of special categories of personal data (‘sensitive data’), including biometric data. (15) As is clear from the case-law, the purpose of that provision is to ensure enhanced protection with regard to that processing, which, because of the particular sensitivity of the data at issue and the context in which they are processed, is liable, as is apparent from recital 37 of the directive, to create significant risks to fundamental rights and freedoms, such as the right to respect for private life and the right to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’). (16)
41.      In the second place, as follows from the very terms in which it is set out in Article 10 of Directive
2016/680, the requirement that the processing of such data be allowed ‘only where strictly necessary’ must be interpreted as establishing strengthened conditions for lawful processing of sensitive data, compared with those which follow from Article 4(1)(b) and (c) and Article 8(1) of that directive, which refer only to the ‘necessity’ of data processing that falls generally within the directive’s scope. (17)
42.      Thus, first, the use of the adverb ‘only’ before the words ‘where strictly necessary’ underlines that the processing of sensitive data can be regarded as ‘necessary’ solely in a limited number of cases. Second, the fact that the necessity for the processing of such data is an ‘absolute’ one signifies that that necessity is to be assessed with particular rigour. (18)
(b)    The criteria for determining whether processing is strictly necessary
43.      I note that Directive
2016/680 does not define the requirement of ‘strictly necessary’ laid down in Article 10 thereof.
44.      Some guidance may, however, be derived from other provisions of that directive. Thus, without prejudice to the strengthened conditions relating to the lawfulness of the processing of sensitive data laid down by that directive, the requirement that the processing be strictly necessary must be read in the light of the principles set out in Articles 4 and 8 thereof. (19)
45.      That means, inter alia, examining whether the collection of sensitive data is strictly necessary in the light of the purposes and objectives of their collection, in compliance with the principles of purpose limitation and data minimisation, (20) the latter giving expression to the principle of proportionality. (21)
46.      In that regard, first, as is apparent from recital 26 of Directive
2016/680, the requirement of necessity is met where the objective pursued by the data processing at issue cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter. In particular, in the light of the enhanced protection of persons with regard to the processing of sensitive data, the controller in respect of that processing should satisfy itself that that objective cannot be met by having recourse to categories of data other than those listed in Article 10 of that directive. (22)
47.      Second, having regard to the significant risks posed by the processing of sensitive data to the rights and freedoms of data subjects, in particular in the context of the tasks of the competent authorities for the purposes set out in Article 1(1) of Directive
2016/680, the ‘strictly necessary’ requirement means that account is to be taken of the specific importance of the objective that such processing is intended to achieve. Such importance may be assessed, inter alia, on the basis of the very nature of the objective pursued – in particular of the fact that the processing serves a specific objective connected with the prevention of criminal offences or threats to public security displaying a certain degree of seriousness, the punishment of such offences or protection against such threats – and in the light of the specific circumstances in which that processing is carried out. (23)
48.      Third, the Court has previously held that whether the processing of sensitive data is ‘strictly necessary’ can be determined only in the light of all the relevant factors, such as, in particular, the nature and gravity of the offence of which the data subject in the main proceedings is suspected, the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the person in question. (24)
49.      As regards the gravity of the offence, I note that account is also to be taken of the specific nature of the tasks of the police authorities. As the Court of Justice pointed out in the judgment in Bezirkshauptmannschaft Landeck, to consider that only combating serious crime may justify access to personal data would limit the investigative powers of the competent authorities, for the purposes of Directive
2016/680, in relation to criminal offences in general. According to the Court, that would increase the risk of impunity for such offences, given the importance that such data may have for criminal investigations. Accordingly, such a limitation would disregard the specific nature of the tasks performed by those authorities for the purposes set out in Article 1(1) of that directive, highlighted in recitals 10 and 11 thereof, and would undermine the objective of achieving an area of freedom, security and justice within the European Union pursued by that directive. (25)
50.      Thus, in principle, the fact that an offence
is not categorised as ‘serious’ cannot, by itself, justify excluding that the collection of biometric data is strictly necessary. In line with the nature of the offence, rather than its gravity, the collection of that type of data may be necessary to establish the offence or identify the perpetrator.
51.      However, if the requirement that the collection of biometric data be strictly necessary is not based on the nature of the offence, it must be based on other elements.
(c)    The relationship with the data collection at issue in the main proceedings
(1)    Objectives of the data collection
52.      In its written observations, the French Government stated that the purpose of the taking of the identification data at issue in the main proceedings is, inter alia, to compare the fingerprints with the traces collected during the ongoing investigation, to identify the accused person in the context of the ongoing investigation in order to avoid the risk of confusion with someone of the same name or the risk of impersonation, or to identify the person in the context of comparisons with other ongoing or future procedures, for example to enable fingerprints to be compared with traces collected in other investigations. (26)
53.      Those objectives relate, on the one hand, to the use of data collected in the context of specific criminal proceedings and, on the other hand, to processing for the purposes of other proceedings. The need to carry out such processing is expressly stated in recital 27 of Directive
2016/680. (27)
54.      It must therefore be held that the collection of biometric data is relevant and adequate in the light of the objectives set out. (28) However, the need for that collection depends, inter alia, on its scope as defined by the applicable legislation.
(2)    Scope of the data collection
55.      As is apparent from the order for reference and the observations of the French Government, there is disagreement as to the scope of the collection at issue in the main proceedings. According to the referring court, police officers may collect the biometric data of any person ‘reasonably suspected on one or more grounds of having committed or attempted to commit an offence’. (29) However, according to the French Government, such data may be collected from persons in respect of whom there are not mere suspicions but rather serious or consistent evidence pointing to the probability that they have participated, as perpetrators or accomplices, in the commission of a crime, or an offence punishable by imprisonment, and from persons in respect of whom a positive identification is required. (30)
56.      That disagreement leads me to examine two aspects of the national legislation at issue: the stage of the procedure at which the collection is carried out (in this case, without the person concerned having been formally accused) and the scope of that collection.
57.      In the first place, as regards the procedural stage, I am of the view that the objectives of the collection of biometric data mean that it may take place at an early stage of the criminal investigation. Limiting that possibility to the stage at which the person concerned is accused would run counter to certain purposes set out in Article 1 of Directive
2016/680.
58.      In fact, as the Court of Justice pointed out in the judgment in Ministerstvo na vatreshnite raboti I, where there are serious grounds for believing that the person in question has committed a criminal offence justifying his or her being accused, a situation which presupposes that sufficient evidence of that person’s involvement in the offence has already been gathered, it is possible that, in some cases, the collection of biometric data will not reflect any specific necessity for the purposes of the criminal procedure in progress. (31)
59.      I would also stress that criminal legislation is a matter for which the Member States are responsible. (32) In particular, the various stages of criminal proceedings, and the rights and safeguards associated with them for the data subject, may differ from one Member State to another. It follows that that factor cannot be decisive for the purposes of interpreting Article 10 of Directive
2016/680.
60.      That interpretation is not precluded by Article 6 of Directive
2016/680. That provision lays down an obligation to distinguish, where applicable and as far as possible, between the personal data of the different categories of data subjects, in such a way that they are not subject without distinction to the same degree of interference with their fundamental right to the protection of their personal data. (33) However, that provision does not seek to determine the categories of persons whose data may be collected. (34)
61.      In the second place, as regards the scope of the collection of biometric data at issue in the main proceedings, I would point out that, in the context of the preliminary ruling procedure, the Court of Justice can only define the conditions arising from EU law with which national law is required to comply, as the determination of the applicable provisions of domestic law and their interpretation fall within the exclusive jurisdiction of the national courts. (35)
62.      In any event, I take the view that the field of application of the legislation on the collection of biometric data referred to by the French Government, although limited to offences punishable by imprisonment, is broad in scope, (36) allowing, inter alia, the collection of data from any person whose positive identification is necessary, irrespective of the nature and gravity of the offence at issue.
(3)    The obligation for the competent authority to assess whether the data collection is strictly necessary
63.      Despite that broad scope, unlike the Bulgarian legislation at issue in the case which gave rise to the judgment in Ministerstvo na vatreshnite raboti I, it is apparent from the French legislation that the police authorities are under no obligation to collect data from any person falling within the scope of that legislation and that, on the contrary, that collection is a matter for the assessment of those authorities on a case-by-case basis. (37)
64.      However, in order for that discretion to comply with the requirements of Directive
2016/680, the French legislation must lay down an obligation for the competent authorities to assess the strict necessity to collect the biometric data of the persons concerned. (38)
65.      The Court of Justice has previously held that it is for the competent authorities alone to ensure compliance with that criterion. (39)
66.      In the present case, it is apparent from the observations of the French Government that Articles 6 and 88 of loi no 78-17 relative à l’informatique, aux fichiers et aux libertés (Law No 78-17 on information technology, data files and freedoms) of 6 January 1978 (40) transpose Article 10 of Directive
2016/680, expressly reiterating the criterion of strict necessity set out in the latter. The French Government adds that the collection of biometric data on the basis of Article 55-1 of the French Code of Criminal Procedure cannot infringe those legislative provisions.
67.      If that were the case, that national legal framework could be interpreted as requiring the competent authority to assess whether the data collection it carries out is ‘strictly necessary’.
68.      Nevertheless, in view of the division of responsibilities between the Court of Justice and the referring court, it will be for the latter to satisfy itself that that is indeed the case, in particular by complying with its obligation to interpret national law, so far as possible, in conformity with the wording and purpose of Directive
2016/680. (41)
69.      Having regard to the circumstances of the dispute in the main proceedings concerning the collection of the biometric data of a person held in custody for having organised and participated in an unauthorised demonstration, the referring court must also ensure that the application of the law by the competent authority remains consistent with the requirements of Directive 2016/680. (42)
70.      In the light of the foregoing, I propose that the answer to the first question should be that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as not precluding national legislation which allows the collection of biometric data from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, provided that that legislation imposes an obligation on the competent authority to assess whether each collection is strictly necessary.
B.      The second question referred
71.      By its second question, the referring court seeks, in essence, to ascertain whether the competent authority is required to state reasons for the decision to collect biometric data, in the light of the requirement of strict necessity arising from Article 10 of Directive
2016/680.
72.      In my view, such an obligation follows from the judgments in Ministerstvo na vatreshnite raboti II and Bezirkshauptmannschaft Landeck, and I see no reason to depart from that case-law.
73.      In the case which gave rise to the judgment in Ministerstvo na vatreshnite raboti II, the question that arose was whether, where national legislation does not lay down an obligation on the competent authority to verify and demonstrate that the collection of sensitive data is strictly necessary, in accordance with Article 10 of Directive
2016/680, compliance with such an obligation may be ensured by the court seised by that competent authority for the purposes of the enforcement of that collection. (43)
74.      In response, the Court of Justice ruled that, in the absence of an obligation imposed on the competent authority, under national law, to assess whether the processing which it has carried out or which it intends to carry out is ‘strictly necessary’, a court asked to rule on such processing of personal data by that competent authority cannot ensure, in place of that authority, compliance with that authority’s obligation under Article 10 of Directive
2016/680. (44)
75.      Even though the Court did not expressly mention the obligation to state reasons, such an obligation follows, in my view, from that judgment.
76.      In the first place, under Article 54 of Directive
2016/680, which gives expression to Article 47 of the Charter, Member States are to provide for the right of a data subject to an effective judicial remedy where he or she considers that his or her rights laid down in provisions adopted pursuant to that directive have been infringed as a result of the processing of his or her personal data in non-compliance with those provisions.
77.      In the second place, according to the case-law, the right to an effective judicial remedy, guaranteed in Article 47 of the Charter, requires, in principle, that the person concerned be able to ascertain the reasons upon which the decision taken in relation to him or her is based, either by reading the decision itself or by communication of those reasons, so as to enable him or her to defend his or her rights in the best possible conditions and to decide with full knowledge of the relevant facts, whether there is any point in his or her applying to the court with jurisdiction, and in order to put the latter fully in a position to carry out the review of the lawfulness of that decision. (45)
78.      That necessarily presupposes, in so far as the Court of Justice has held that a court cannot substitute itself for the competent authority as regards the examination of whether it is strictly necessary to collect the data, the right to have that examination assessed subsequently by a court.
79.      Although that right is not an absolute right and, in accordance with Article 52(1) of the Charter, limitations may be placed upon it, that is on condition that those limitations are provided for by law, they respect the essence of the rights and freedoms at issue and, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. (46)
80.      The governments which participated in the hearing assert that to impose on the competent authorities the obligation to state reasons for each decision taken under Article 10 of Directive
2016/680 would affect the proper conduct of criminal investigations and the fight against crime. Even though this is a question of objectives of general interest, I consider that the restriction of the right to an effective judicial remedy at issue is not limited to what is strictly necessary.
81.      In the first place, in so far as the collection of data at issue is not systematic, the obligation to state reasons does not seem to me to constitute an excessive burden for the competent authorities. Furthermore, if the competent authorities are to have a degree of discretion in achieving the objectives set out in Article 1(1) of Directive
2016/680, the obligation to state reasons for their decisions, laid down in Article 10 of the directive, becomes even more essential.
82.      In the second place, as the Court of Justice observed, in essence, in the judgment in Bezirkshauptmannschaft Landeck, Article 13(1) and (2) of Directive
2016/680, read in conjunction with Article 54 thereof, imposes an obligation to inform the data subject. Although Article 13(3) of that directive allows Member States to adopt legislative measures to delay, restrict or even omit the provision of information to the data subject, national legal rules which exclude as a general rule any right to information are not consistent with EU law. (47)
83.      In that regard, in response to a question put by the Court of Justice at the hearing, the French and Czech Governments maintained that the judgment in Bezirkshauptmannschaft Landeck does not apply to the present case, because that judgment concerns the prior review, by a court or by an independent administrative body, of access by the police authorities to the data contained in the mobile telephone of the data subject.
84.      However, I have doubts as to the relevance of those arguments. First of all, in my view, the obligation to state reasons is all the more necessary where the collection of data is not subject to prior review. Next, I note that, while a mobile telephone may, of course, contain sensitive data within the meaning of Article 10 of Directive
2016/680, (48) the judgment in Bezirkshauptmannschaft Landeck does not specifically concern that type of data. It follows that the obligation to state reasons arising from that judgment applies a fortiori to the circumstances of the present case, concerning the collection of sensitive data.
85.      Lastly, as the Commission rightly pointed out in replying to the same question put by the Court, it follows from Article 4(4) of Directive
2016/680 that the competent authority must be able to demonstrate, inter alia, the need for the data processing which it carries out. That principle of accountability, which is also laid down in Article 5(2) of Regulation (EU) 2016/679, (49) must be interpreted in the light of Article 54 of that directive. It follows that the obligation to state reasons arises from the general scheme of the directive.
86.      In the third place, as is apparent from settled case-law, the extent of the obligation to state reasons depends on the specific circumstances of each situation. (50) While a more detailed statement of reasons may be necessary, in particular, for less serious offences, it may be succinct in the case of serious crime. Moreover, as regards offences in respect of which it is clearly necessary to identify the perpetrator, such as burglary, I do not rule out the possibility that it may be inferred from the elements on file, taken as a whole, that it is strictly necessary to collect the biometric data. The data subject can easily understand the reasons for that interference with his or her rights to respect for private life and to the protection of personal data.
87.      By contrast, the reason why the collection of biometric data of a person suspected of having participated in an unauthorised demonstration is strictly necessary, in particular where his or her identity is beyond doubt, is not obvious, at least for the purposes of that specific procedure. In such a situation, the competent authority must therefore give adequate reasons for its decision, so that the person concerned is able to understand the reasons for that collection. The mere reference to the elements on file, taken as a whole, cannot, in principle, suffice. (51)
88.      Consequently, I propose that the answer to the second question should be that Article 10 of Directive
2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which does not impose on the competent authority an obligation to provide, in each individual case, a sufficient statement of reasons as to why it is strictly necessary to gather identification data.
C.      The third question referred
1.      Admissibility
89.      By its third question, the referring court asks, in essence, whether Article 10 of Directive
2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which allows the prosecution and conviction on a stand-alone basis of a person who has refused to consent to the gathering of identification data, even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data.
90.      According to the French Government, that question is inadmissible in so far as Directive
2016/680 does not contain any rules relating to an offence for refusal to consent to the collection of personal data. It follows, in its view, that such a conviction does not fall within the scope of that directive or, consequently, of EU law.
91.      In addition, the French Government and the Commission submit that the referring court does not state the reasons why the provisions of Directive
2016/680 could have an impact on the stand-alone conviction.
92.      In that regard, I would point out that, pursuant to Article 94(c) of the Rules of Procedure of the Court of Justice, a request for a preliminary ruling must contain a statement of the reasons which prompted the referring court or tribunal to inquire about the interpretation or validity of certain provisions of EU law, and the relationship between those provisions and the national legislation applicable to the main proceedings. That statement must be of such a kind as to enable the Court to ascertain, not only whether the request for a preliminary ruling is admissible, but also whether it has jurisdiction to answer the question referred. (52)
93.      Although I agree with the finding that the referring court does not explain how the abovementioned provisions of Directive
2016/680 could have an impact on the stand-alone conviction, I consider that such a link may be inferred from all the elements in the file before the Court of Justice, as well as from the case-law, as I shall set out below.
94.      In addition, I note that, according to settled case-law, where it is not obvious that the interpretation of an act of EU law bears no relation to the facts of the dispute in the main proceedings or its purpose, as is the case with Directive
2016/680 in the present case, the objection alleging that that act is inapplicable to the case in the main proceedings concerns the substance of the question raised. (53)
2.      Substance
(a)    Application of Directive 2016/680 to the stand-alone conviction
95.      First of all, I would point out that the stand-alone conviction does not result from the transposition into French law of Article 10 of Directive
2016/680. As the French Government rightly points out, the directive does not contain any provision in that regard.
96.      However, that does not necessarily mean that the stand-alone conviction for falls outside the scope of EU law. (54) In order for a national provision to fall within the scope of EU law, it is not necessary for the national legislature to have intended to implement it; it follows, instead, from the actual application of the national measure. (55)
97.      Next, the scope of Directive
2016/680 is defined in Article 2(1) thereof, which provides that the directive ‘applies to the processing of personal data by competent authorities for the purposes set out in Article 1(1)’, namely, inter alia, for the purposes of ‘the prevention, investigation, detection or prosecution of criminal offences’.
98.      Consequently, that means that HW was convicted on the ground that he objected to an act which falls within the scope of Directive
2016/680. It may thus be considered that there was an ‘attempt’ by police officers to process personal data and that that attempt failed as a result of HW’s refusal, the attempt falling within the scope of the directive in question. (56)
99.      Lastly, I would point out that a stand-alone conviction may be authorised only if the collection envisaged by the competent authorities, to which the data subject objects, complies with the requirements of Article 10 of Directive 2016/680, in particular the requirement that collection be ‘strictly necessary’. The requirements which that
directive imposes on the processing of data falling within its scope must therefore be met in order for a stand-alone conviction to be lawful. (57)
(b)    Does Directive 2016/680 preclude a stand-alone conviction?
100. The fact I have mentioned above is also, in my view, the only criterion in Directive
2016/680 which has an impact on the stand-alone conviction: before finding a defendant guilty of the offence of refusing to consent to the gathering of his or her identification data, a national court must satisfy itself that such collection, if it had taken place, would have complied with Article 10 of that directive, read in conjunction with Article 4(1)(a) to (c) (58) and Article 8(1) and (2) thereof.
101. On the other hand, it is my opinion that, from the point of view of the wording of those provisions of Directive
2016/680, and of its objectives, (59) there is nothing to prevent the national legislature from providing for the conviction of a person who has refused to consent to the gathering of identification data, even if that person is not prosecuted for or convicted of the offence which formed the basis of the gathering of identification data. As all the participants in the hearing pointed out, the requirement of strict necessity must be assessed at the time when the authorities envisaged gathering the data. That said, I consider that two further clarifications must be made.
102. First, the competent authority remains obliged to assess whether any subsequent processing of the data is strictly necessary. The fact that the data subject has not been prosecuted, in particular, is a relevant criterion for determining whether the retention of his or her data is strictly necessary. (60)
103. Second, I consider that the stand-alone conviction must be examined in the light of Articles 7 and 8 and Article 49(3) of the Charter.
(c)    Articles 7 and 8 and Article 49(3) of the Charter
104. According to the explanations given by the French Government, the offence of refusing to consent to procedures for the gathering of identification data is specifically intended to criminalise conduct constituting an obstacle to the proper conduct of a criminal investigation.
105. Although this is an
objective of general interest recognised by EU law, the fact remains that the stand-alone conviction also constitutes an interference with the rights guaranteed by Articles 7 and 8 of the Charter. (61) Under Article 52(1) of the Charter, such a conviction must comply with the principle of proportionality.
106. Furthermore, in so far as the stand-alone conviction is a criminal conviction, account must also be taken of Article 49(3) of the Charter, which provides that the severity of penalties must not be disproportionate to the criminal offence.
107. Member States are required to observe the principle of proportionality when they implement EU law, including in the absence of harmonisation of EU legislation in the field of sanctions applicable, and specifically where they adopt penalties of a criminal nature. (62)
108. The principle of proportionality requires, first, that the penalty imposed corresponds to the seriousness of the offence and, second, that the individual circumstances of the particular case are taken into account in determining the penalty and fixing the amount of the fine. (63)
109. In my view, those circumstances should include, in particular, the conduct and profile of the person concerned, his or her criminal record, the seriousness of the offence which formed the basis of the collection of his or her data and the context of the stand-alone conviction.
110. As regards the latter aspect, as the French Government confirmed at the hearing, a decision is taken on the offence of refusing to consent to the gathering of identification data, if established, at the same time as the ‘main’ offence. In the case in the main proceedings, it appears that the acquittal for participation in an unauthorised demonstration and the conviction for refusal to consent to the gathering of identification data were handed down simultaneously at the time of the judgment of the tribunal correctionnel de Paris (Criminal Court, Paris) of 8 September 2021.
111. In those circumstances, it must be observed that while a conviction for refusal to consent to the gathering of identification data may contribute to the proper conduct of future procedures, particularly in the event of a repeat offence, it does not contribute to the proper conduct of the ongoing procedure.
112. Lastly, the fact that the person concerned has not been convicted of the main offence must also be taken into account in determining the severity of the penalty for refusing to consent to the gathering of identification data. In that regard, I note that, according to the explanations provided by the French Government, when a decision that there is insufficient evidence to convict or an acquittal has become final, the fingerprints and information in question are erased.
113. Consequently, I propose that the answer to the third question should be that Article 10 of Directive
2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as not precluding a national provision which allows the prosecution and conviction on a stand-alone basis of a person who has refused to consent to the gathering of identification data even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data, provided that gathering that identification data, if it had taken place, would have complied with the requirements arising from those articles.
V.      Conclusion
114. In the light of all
the foregoing considerations, I propose that the Court of Justice answer the questions referred for a preliminary ruling by the cour d’appel de Paris (Court of Appeal, Paris,
France) as follows:
Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof,
must be interpreted as:
–        not precluding national legislation which allows the collection of biometric data from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, provided that that legislation imposes an obligation on the competent authority to assess whether each collection is strictly necessary;
–        precluding national legislation which does not impose on the competent authority an obligation to provide, in each individual case, a sufficient statement of reasons as to why it is strictly necessary to gather the identification data;
–        not precluding a national provision which allows the prosecution and conviction on a stand-alone basis of a person who has refused to consent to the gathering of identification data even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data, provided that the gathering of that identification data, if it had taken place, would have complied with the requirements arising from those articles of Directive
2016/680.
1      Original language: French.
i      The name of the present case is a fictitious name. It does not correspond to the real name of any party to the proceedings.
2      Directive of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89).
3      Judgment of 26 January 2023 (C‑205/21, ‘the judgment in Ministerstvo na vatreshnite raboti I’,
EU:C:2023:49).
4      The Court concluded, in paragraph 135 of the judgment in Ministerstvo na vatreshnite raboti I, that the provisions of Directive
2016/680 at issue preclude such systematic collection.
5      Under Article 3(13) of Directive
2016/680, facial images and dactyloscopic data are biometric data.
6      The referring court uses that term not only in the first question, but also in the reasoning set out in the order for reference (see point 16 of the present Opinion). However, it does not provide any explanation regarding the use of that word.
7      Before the referring court, HW argues that, on 1 January 2020, the fingerprints of more than 6.5 million people were stored in the fichier automatisé des empreintes digitales (Automated Fingerprint Identification System; ‘the FAED’).
8      Judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone) (C‑548/21, ‘the judgment in Bezirkshauptmannschaft Landeck’, EU:C:2024:830, paragraph 53 and the case-law cited).
9      See, inter alia, judgment of 28 November 2023, Commune d’Ans (C‑148/22, EU:C:2023:924, paragraph 31).
10      See point 15 of the present Opinion.
11      The referring court in that case stated (paragraph 78 of the judgment in Ministerstvo na vatreshnite raboti I) that ‘the vast majority of the offences provided for by the [Bulgarian Criminal Code] are intentional and almost all involve public prosecution’ and that ‘under the rules of Bulgarian criminal procedure, a person is accused when sufficient evidence that he or she is guilty of an offence subject to public prosecution is gathered.’
12      My emphasis.
13      See points 22 and 24 of the present Opinion.
14      Although those ‘rules applicable to each of those [police] databases’ do not appear in the order for reference, the French Government provided a detailed explanation of them in its written observations.
15      The sensitive data provided for in Article 10 of Directive 2016/680 include, inter alia, ‘biometric data for the purpose of uniquely identifying a natural person’.
16      The judgment in Ministerstvo na vatreshnite raboti I, paragraph 116 and the case-law cited.
17      The judgment in Ministerstvo na vatreshnite raboti I, paragraph 117.
18      The judgment in Ministerstvo na vatreshnite raboti I, paragraph 118.
19      The judgment in Ministerstvo na vatreshnite raboti I, paragraph 121.
20      See, to that effect, the judgment in Ministerstvo na vatreshnite raboti I, paragraphs 122 to 125.
21      See judgment of 30 January 2024, Direktor na Glavna direktsia ‘Natsionalna politsia’ pri MVR – Sofia (C‑118/22, EU:C:2024:97, paragraph 41 and the case-law cited).
22      The judgment in Ministerstvo na vatreshnite raboti I, paragraph 126.
23      The judgment in Ministerstvo na vatreshnite raboti I, paragraph 127.
24      The judgment in Ministerstvo na vatreshnite raboti I, paragraph 132.
25      The judgment in Bezirkshauptmannschaft Landeck, paragraph 97.
26      I note that Directive
2016/680 uses the terms ‘purposes’ (in particular, in Article 1(1), Article 4(1) and Article 8) and ‘objectives’ (in Article 8(2)). As Advocate General Pitruzzella observed in his Opinion in Ministerstvo na vatreshnite raboti I (EU:C:2022:507, point 56), the distinction between ‘purposes’ and ‘objectives’ is not obvious. That said, the purposes of collection are, in his view, those set out in Article 1(1) of the directive (see also, to the same effect, judgment of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation), C‑180/21, EU:C:2022:967, paragraphs 43 and 44). The objectives referred to in Article 8(2) of the directive are more specific and should be specified by the national legislation falling within its scope.
27      See, also, judgment of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation) (C‑180/21, EU:C:2022:967, paragraph 55).
28      See, as regards the processing of biometric data in the context of other procedures, judgment of 30 January 2024, Direktor na Glavna direktsia ‘Natsionalna politsia’ pri MVR – Sofia (C‑118/22, EU:C:2024:97, paragraph 56).
29      See point 16 of the present Opinion.
30      The French Government relies on provisions of French law which do not appear in the order for reference but which appear to relate to the ‘rules applicable to each of those databases’, referred to in the second paragraph of Article 55-1 of the French Code of Criminal Procedure (see footnote 14
to the present Opinion).
31      The judgment in Ministerstvo na vatreshnite raboti I, paragraph 131.
32      Judgment of 8 July 2010, Sjöberg and Gerdin (C‑447/08 and C‑448/08, EU:C:2010:415, paragraph 49).
33      See, to that effect, the judgments in Ministerstvo na vatreshnite raboti I, paragraph 83, and Bezirkshauptmannschaft Landeck, paragraph 100.
34      See, to that effect, the judgment in Ministerstvo na vatreshnite raboti I, paragraph 84.
35      Judgments of 16 March 1978, Oehlschläger (104/77, EU:C:1978:69, paragraph 4), and of 7 November 2024, ERB New Europe Funding II (C‑178/23, EU:C:2024:943, paragraph 21 and the case-law cited).
36      See, to that effect, ECtHR, 18 April 2013, M.K. v. France
(CE:ECHR:2013:0418JUD001952209, § 41). The French legislation at issue in that case is equivalent to Article
R. 40-38-2(3) of the French Code of Criminal Procedure, which is relevant, according to the French Government,
to the present case (see footnote 14 to the present Opinion).
37      See point 37 of the present Opinion. See, also, Opinion of Advocate General Richard de la Tour in Policejní prezidium (Retention of biometric and genetic data) (C‑57/23, EU:C:2025:132, point 43), in which he compared the Czech legislation at issue in that case, which provides that the police authorities only have the option to collect data, to the Bulgarian legislation at issue in the case which gave rise to the judgment in
Ministerstvo na vatreshnite raboti I.
38      See Opinion of Advocate General Richard de la Tour in Policejní prezidium (Retention of biometric and genetic data) (C‑57/23, EU:C:2025:132, point 44). In contrast to the French legislation at issue in the present case (see points 66 and 67 of the present Opinion), Advocate General Richard de la Tour pointed out that the Czech legislation does not lay down an obligation for the competent authorities to assess the strict necessity to collect biometric data of the persons concerned.
39      See judgment of 28 November 2024, Ministerstvo na vatreshnite raboti (Registration of biometric and genetic data II) (C‑80/23, ‘the judgment in Ministerstvo na vatreshnite raboti II’,
EU:C:2024:991, paragraph 57).
40      Those provisions were adopted by ordonnance no 2018-1125 (Order No 2018-1125) of 12 December 2018 (Article 1). I note, however, that those provisions are not reproduced in the order for reference.
41      Judgments of 10 April 1984, von Colson and Kamann (14/83, EU:C:1984:153, paragraph 26), and of 30 April 2025, Nastolo (C‑370/24, EU:C:2025:300, paragraph 43 and the case-law cited). See also, with regard to Directive
2016/680, the judgment in Ministerstvo na vatreshnite raboti I, paragraph 133.
42      See, to that effect, Opinion of Advocate General Richard de la Tour in Ministerstvo na vatreshnite raboti (Registration of biometric and genetic data II) (C‑80/23, EU:C:2024:513, point 49). See also, in relation to the conditions for application and to the effective implementation of provisions of domestic law, judgment of 23 April 2009, Angelidaki and Others (C‑378/07 to C‑380/07, EU:C:2009:250, paragraph 164 and the case-law cited).
43      The judgment in Ministerstvo na vatreshnite raboti II, paragraph 52.
44      The judgment in Ministerstvo na vatreshnite raboti II, paragraph 57.
45      Judgment of 8 May 2019, PI (C‑230/18, EU:C:2019:383, paragraph 78 and the case-law cited). See also the judgment in Bezirkshauptmannschaft Landeck, paragraph 118.
46      The judgment in Bezirkshauptmannschaft Landeck, paragraph 119 and the case-law cited. See also, to that effect, recital 104 of Directive
2016/680.
47      The judgment in Bezirkshauptmannschaft Landeck, paragraphs 120
and 121 and the case-law cited.
48      The judgment in Bezirkshauptmannschaft Landeck, paragraph 94.
49      Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1). See, with regard to Article 5(2) of that regulation, inter alia, judgment of 27 February 2025, Amt der Tiroler Landesregierung (C‑638/23, EU:C:2025:127, paragraph 33).
50      Judgment of 28 July 2011, Agrana Zucker (C‑309/10, EU:C:2011:531, paragraph 35 and the case-law cited).
51      See, to that effect, judgments of 8 May 2019, PI (C‑230/18, EU:C:2019:383, paragraphs 78 and 91 and the case-law cited), and of 16 February 2023, HYA and Others (Grounds for authorising telephone tapping) (C‑349/21, EU:C:2023:102, paragraphs 59 to 61).
52      Judgment of 6 March 2014, Siragusa (C‑206/13, EU:C:2014:126, paragraph 19). See also the judgment in Ministerstvo na vatreshnite raboti I, paragraph 55.
53      See the judgment in Bezirkshauptmannschaft Landeck, paragraph 67 and the case-law cited.
54      See, with regard to the transposition as such of directives and the implementation of EU law, judgment of 26 February 2013, Åkerberg Fransson (C‑617/10, EU:C:2013:105, paragraph 28).
55      See Safjan, M., Düsterhaus, D. and Guérin, A., ‘La Charte des droits fondamentaux de l’Union européenne et les ordres juridiques nationaux, de la mise en œuvre à la mise en balance’, Revue trimestrielle de droit européen, 2016, p. 221.
56      See, to that effect, the judgment in Bezirkshauptmannschaft Landeck, paragraph 77. The Court of Justice held that an attempt by the police
authorities to access the data contained in a mobile telephone for the purposes of a criminal investigation falls within the scope of Directive
2016/680. See also the judgment of ECtHR of 22 June 2017, Aycaguer v. France (CE:ECHR:2017:0622JUD000880612), in which that court held, in paragraph 35, that ‘the applicant has not so far been included in the [police record] because he refused to undergo DNA profiling as required by law. He was nonetheless convicted on that basis. It is not contested that that conviction amounted to an interference with the applicant’s right to respect for private life within the meaning of Article 8[§ 1] of the [Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (“the ECHR”)].’ Although I am aware that the scope of EU law (or even, that of the Charter) is distinct from that of the ECHR, it follows from that judgment that there is a close link between the collection of data and conviction for refusal to consent to such collection.
57      See, by analogy, judgment of 16 May 2017, Berlioz Investment Fund (C‑682/15, EU:C:2017:373, paragraphs 41, 63 and 74).
58      See, with regard to Article 4(1)(b) of Directive
2016/680, the judgment in Bezirkshauptmannschaft Landeck, paragraph 73.
59      Namely, to ensure a high level of protection of the personal data of natural persons and to contribute to the accomplishment of an area of freedom, security and justice within the European Union; see, to that effect, inter alia, recitals 2, 4, 7 and 15 of Directive
2016/680.
60      See, to that effect, judgment of 30 January 2024, Direktor na Glavna direktsia ‘Natsionalna politsia’ pri MVR – Sofia (C‑118/22, EU:C:2024:97, paragraph 65 and the ECtHR case-law cited). See also the concept of ‘processing’, in Article 3(2) of Directive 2016/680, which includes, inter alia, both the collection and the storage of data.
61      See, to that effect, the judgment in Bezirkshauptmannschaft Landeck, paragraphs 77 and 95, and ECtHR, 22 June 2017, Aycaguer v. France
(CE:ECHR:2017:0622JUD000880612, § 35).
62      Judgment of 8 March 2022, Bezirkshauptmannschaft Hartberg-Fürstenfeld (Direct effect) (C‑205/20, EU:C:2022:168, paragraph 31). See also judgment of 4 May 2023, Agenția Națională de Integritate (C‑40/21, EU:C:2023:367, paragraph 49 and the case-law cited).
63      Judgment of 4 October 2018, Link Logistik N&N (C‑384/17, EU:C:2018:810, paragraphs 40 to 42 and 45).