62021CJ0205_RES
Case C‑205/21
V.S.
(Request for a preliminary ruling from the Spetsializiran nakazatelen sad)
Judgment of the Court (Fifth Chamber), 26 January 2023
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Principles relating to processing of personal data – Purpose limitation – Data minimisation – Article 6(a) – Clear distinction between personal data of different categories of data subjects – Article 8 – Lawfulness of processing – Article 10 – Transposition – Processing of biometric data and genetic data – Concept of ‘processing authorised by Member State law’ – Concept of ‘strictly necessary’ – Discretion – Charter of Fundamental Rights of the European Union – Articles 7, 8, 47, 48 and 52 – Right to effective judicial protection – Presumption of innocence – Limitation – Intentional criminal offence subject to public prosecution – Accused persons – Collection of photographic and dactyloscopic data in order for them to be entered in a record and taking of a biological sample for the purpose of creating a DNA profile – Procedure for enforcement of collection – Systematic nature of the collection)
Approximation of laws – Protection of natural persons with regard to the processing of personal data in criminal matters – Directive 2016/680 – Processing of special categories of data – Authorisation of such processing by Member State law – National legislation requiring the police authorities of a Member State to collect biometric and genetic data of accused persons, in order for the data to be entered in a record – National provisions referring to Regulation 2016/679, while reproducing the content of Directive 2016/680 – Whether permissible – Conditions
(Charter of Fundamental Rights of the European Union, Art. 52; European Parliament and Council Regulation 2016/679, Art. 9; European Parliament and Council Directive 2016/680, Arts 3(7) and 10(a))
(see paragraphs 62-67, 72-76, operative part 1)
Acts of the institutions – Directives – Implementation by Member States – Directive requiring, for its implementation, that reference be made to it in the national provisions transposing it – Effect – Obligation on the Member States to adopt a specific act transposing the directive – Requirement to mention the directive in national provisions authorising processing of data falling within the directive’s scope – No such requirement
(Art. 288, third para., TFEU; European Parliament and Council Directive 2016/680, Art. 63(1), second subpara.)
(see paragraphs 68-71)
Approximation of laws – Protection of natural persons with regard to the processing of personal data in criminal matters – Directive 2016/680 – Obligation to make a distinction between different categories of data subjects – Scope – National legislation requiring the police authorities of a Member State to collect biometric and genetic data of accused persons, in order for the data to be entered in a record – Legislation laying down a procedure for enforcement of collection – Power of the national court to assess whether serious grounds in relation to the guilt of the person concerned exist – No such power – Whether permissible – Conditions – Observance of the right to effective judicial protection and of the presumption of innocence
(Charter of Fundamental Rights of the European Union, Arts 47 and 48; European Parliament and Council Directive 2016/680, Arts 6(a) and 54)
(see paragraphs 82-110, operative part 2)
Approximation of laws – Protection of natural persons with regard to the processing of personal data in criminal matters – Directive 2016/680 – Processing of special categories of data – Processing allowed only where strictly necessary – Concept – Scope – Strengthened conditions for lawful processing – Purpose limitation – Data minimisation – National legislation providing for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record – Not permissible
(European Parliament and Council Directive 2016/680, recitals 26 and 37 and Arts 4(1)(a) to (c), 8(1) and (2) and 10)
(see paragraphs 116-135, operative part 3)
Résumé
The systematic collection of biometric and genetic data of any accused person in order for them to be entered in a police record is contrary to the requirement of ensuring enhanced protection with regard to the processing of sensitive personal data
In criminal proceedings for tax fraud instituted by the Bulgarian authorities, V.S. was accused of participation in a criminal organisation, formed with the aim of enrichment, with a view to committing offences in concert on Bulgarian territory. Following that accusation, the Bulgarian police requested V.S. to consent to the collection of her dactyloscopic and photographic data in order for them to be entered in a record and to the taking of a sample for the purpose of creating her DNA profile. V.S. opposed their collection.
Relying on national legislation which provides for the ‘creation of a police record’ for persons accused of an intentional criminal offence subject to public prosecution, the police authorities requested the Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria) to authorise enforcement of the collection of V.S.’s genetic and biometric data. Only copies of the order accusing her and of the declaration in which she refused to give her consent to the collection of her data accompanied the police authorities’ application.
That court had doubts as to whether the Bulgarian legislation applicable to such ‘creation of a police record’ is compatible with Directive 2016/680, (
1
) read in the light of the Charter of Fundamental Rights of the European Union (‘the Charter’), and therefore made a reference to the Court of Justice for a preliminary ruling.
In its judgment, the Court explains, first of all, the conditions under which the processing of biometric and genetic data by the police authorities may be regarded as authorised by Member State law, within the meaning of Directive 2016/680. It rules, next, on the implementation of the requirement, set out in that directive, concerning the processing of data of a category of persons with regard to whom there are serious grounds for believing that they are involved in a criminal offence, and on observance of the right to effective judicial protection and of the principle of the presumption of innocence where the national court having jurisdiction is permitted by national legislation to authorise the compulsory collection of those data, regarded as ‘sensitive’ by the EU legislature. It addresses, finally, the question whether national legislation providing for the systematic collection of those data is compatible with the provisions of Directive 2016/680 that relate to their processing, having regard to the principles applicable thereto.
Findings of the Court
First of all, the Court holds that Directive 2016/680, read in the light of the Charter, (
2
) must be must be interpreted as meaning that the processing of biometric and genetic data by the police authorities with a view to their investigative activities, for purposes of combating crime and maintaining law and order, is authorised by Member State law provided that the law of the Member State contains a sufficiently clear and precise legal basis to authorise that processing. The fact that the national legislative act containing such a legal basis refers, furthermore, to the General Data Protection Regulation, (
3
) and not to Directive 2016/680, is not capable, in itself, of calling the existence of such authorisation into question, provided that it is apparent, in a sufficiently clear, precise and unequivocal manner, from the interpretation of the set of applicable provisions of national law that the processing of biometric and genetic data at issue falls within the scope of that directive, and not of the GDPR.
In that context, in the light of the fact that the relevant national legislation referred to the provisions of the GDPR which govern the processing of sensitive data, while reproducing the content of the provisions of Directive 2016/680 which relate to the processing of the same data, (
4
) the Court observes that those provisions are not equivalent. Whereas processing of sensitive data by the competent authorities for inter alia the purposes, covered by Directive 2016/680, of the prevention and detection of criminal offences is capable of being allowed only where strictly necessary, and must be subject to appropriate safeguards and be provided for by EU or Member State law, the GDPR lays down a general prohibition of the processing of those data, coupled with a list of exceptions. Whilst the national legislature may provide, in the same legislative instrument, for the processing of personal data for purposes covered by Directive 2016/680 and for other purposes covered by the GDPR, it is obliged to make sure that there is no ambiguity as to the applicability of one or other of those two EU acts to the collection of sensitive data.
In addition, with regard to a possible incorrect transposition of Directive 2016/680, raised by the referring court, the Court points out that that directive does not require the national measures which authorise processing of data falling within its scope to contain a reference to the directive. It states that, where the national legislature provides for the processing by competent authorities of biometric and genetic data which are capable of falling either within the scope of that directive or within the scope of the GDPR, it may, for reasons of clarity and precision, refer explicitly, on the one hand, to the provisions of national law transposing that directive and, on the other, to the GDPR, but is not obliged to mention that directive. However, in the event of an apparent conflict between the national provisions authorising the data processing at issue and those seeming to preclude it, the national court must give the provisions an interpretation which safeguards the effectiveness of Directive 2016/680.
Next, the Court rules that Directive 2016/680 (
5
) and the Charter (
6
) do not preclude national legislation which provides that, if the person accused of an intentional offence subject to public prosecution refuses to cooperate voluntarily in the collection of the biometric and genetic data concerning him or her in order for them to be entered in a record, the criminal court having jurisdiction must authorise a measure enforcing their collection, without having the power to assess whether there are serious grounds for believing that the person concerned has committed the offence of which he or she is accused, provided that national law subsequently guarantees effective judicial review of the conditions for that accusation, from which the authorisation to collect those data arises.
In that regard, the Court notes that, pursuant to Directive 2016/680, (
7
) the Member States must ensure that a clear distinction is made between the data of the different categories of data subjects in such a way that they are not subject without distinction – whatever the category to which they belong – to same degree of interference with their fundamental right to the protection of their personal data. However, that obligation is not absolute. Furthermore, in so far as that directive refers to the category of persons with regard to whom there are serious grounds for believing that they have committed a criminal offence, the Court states that the existence of sufficient items of evidence pointing to a person’s guilt constitutes, in principle, a serious ground for believing that he or she has committed the offence at issue. Thus, Directive 2016/680 does not preclude national legislation which provides for the compulsory collection of data of persons in respect of whom sufficient evidence is gathered that they are guilty of an intentional offence subject to public prosecution and who have been accused for that reason.
So far as concerns observance of the right to effective judicial protection, where the national court having jurisdiction, with a view to authorising a measure enforcing the collection of sensitive data of an accused person, cannot review, on the merits, the conditions for his or her accusation, the Court points out, in particular, that it may prove justified, during the preliminary stage of the criminal procedure, to shield temporarily from judicial review the assessment of the evidence on which accusation of the person concerned is founded. Such review, at this stage, might impede the conduct of the criminal investigation in the course of which those data are being collected and excessively limit the investigators’ ability to clear up other offences on the basis of a comparison of those data with data gathered during other investigations. That limitation of effective judicial protection is therefore not disproportionate, provided that national law subsequently guarantees effective judicial review.
As regards observance, by a judicial decision authorising the collection of the data at issue, of the right to be presumed innocent, the Court observes, first, that, in so far as, in the present instance, the collection of such data is limited to the category of persons whose criminal liability has not yet been established, their collection cannot be regarded as being such as to reflect the feeling of the authorities that those persons are guilty. Second, the fact that the court which will have to rule on the guilt of the person concerned cannot assess, at this stage of the criminal procedure, whether the evidence on which the accusation of that person is based is sufficient constitutes a guarantee of observance of his or her right to be presumed innocent.
Finally, the Court concludes that Directive 2016/680 (
8
) precludes national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority to verify whether and demonstrate that, first, their collection is strictly necessary for achieving the specific objectives pursued and, second, those objectives cannot be achieved by measures constituting a less serious interference with the rights and freedoms of the person concerned.
In that regard, the Court points out that Directive 2016/680 is intended to ensure, inter alia, enhanced protection with regard to the processing of sensitive data – which include biometric and genetic data – since it is liable to create significant risks to fundamental rights and freedoms. The requirement set out therein, that that processing is allowed ‘only where strictly necessary’, must be interpreted as establishing strengthened conditions for lawful processing of such sensitive data. (
9
) Furthermore, the scope of that requirement must also be determined in the light of the principles relating to data processing, such as purpose limitation and data minimisation.
In that context, national legislation which provides for the systematic collection of the biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record is, in principle, contrary to that requirement. It is liable to lead, in an indiscriminate and generalised manner, to collection of the data of most accused persons since the concept of ‘intentional criminal offence subject to public prosecution’ is particularly general and is liable to apply to a large number of criminal offences, irrespective of their nature and gravity, their particular circumstances, any link between them and other procedures in progress, the criminal record of the person concerned or his or her individual profile.
(
1
)	Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89).
(
2
)	Article 10(a) of Directive 2016/680, read in the light of Article 52 of the Charter.
(
3
)	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
(
4
)	Article 9 of the GDPR and Article 10 of Directive 2016/680 respectively.
(
5
)	Article 6(a) of Directive 2016/680.
(
6
)	Articles 47 and 48 of the Charter, enshrining respectively the right to effective judicial protection and the principle of the presumption of innocence.
(
7
)	Article 6 of Directive 2016/680.
(
8
)	Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof.
(
9
)	Compared with the conditions following from Article 4(1)(b) and (c) and Article 8(1) of Directive 2016/680.