13.3.2023

Official Journal of the European Union

C 94/4

(Case C-205/21, (<span class="oj-super oj-note-tag">1</span>) Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police))

(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Directive (EU) 2016/680 - Article 4(1)(a) to (c) - Principles relating to processing of personal data - Purpose limitation - Data minimisation - Article 6(a) - Clear distinction between personal data of different categories of data subjects - Article 8 - Lawfulness of processing - Article 10 - Transposition - Processing of biometric data and genetic data - Concept of ‘processing authorised by Member State law’ - Concept of ‘strictly necessary’ - Discretion - Charter of Fundamental Rights of the European Union - Articles 7, 8, 47, 48 and 52 - Right to effective judicial protection - Presumption of innocence - Limitation - Intentional criminal offence subject to public prosecution - Accused persons - Collection of photographic and dactyloscopic data in order for them to be entered in a record and taking of a biological sample for the purpose of creating a DNA profile - Procedure for enforcement of collection - Systematic nature of the collection)

(2023/C 94/03)

Language of the case: Bulgarian

Referring court

Third party:

Ministerstvo na vatreshnite raboti, Glavna direktsia za borba s organiziranata prestapnost

Operative part of the judgment

Article 10(a) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in the light of Article 52 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that the processing of biometric and genetic data by the police authorities with a view to their investigative activities, for purposes of combating crime and maintaining law and order, is authorised by Member State law, within the meaning of Article 10(a) of Directive 2016/680, provided that the law of that Member State contains a sufficiently clear and precise legal basis to authorise that processing. The fact that the national legislative act containing such a legal basis refers, furthermore, to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and not to Directive 2016/680, is not capable, in itself, of calling the existence of such authorisation into question, provided that it is apparent, in a sufficiently clear, precise and unequivocal manner, from the interpretation of the set of applicable provisions of national law that the processing of biometric and genetic data at issue falls within the scope of that directive, and not of that regulation.

Article 6(a) of Directive 2016/680 and Articles 47 and 48 of the Charter of Fundamental Rights of the European Union must be interpreted as not precluding national legislation which provides that, if the person accused of an intentional offence subject to public prosecution refuses to cooperate voluntarily in the collection of the biometric and genetic data concerning him or her in order for them to be entered in a record, the criminal court having jurisdiction must authorise a measure enforcing their collection, without having the power to assess whether there are serious grounds for believing that the person concerned has committed the offence of which he or she is accused, provided that national law subsequently guarantees effective judicial review of the conditions for that accusation, from which the authorisation to collect those data arises.

Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority to verify whether and demonstrate that, first, their collection is strictly necessary for achieving the specific objectives pursued and, second, those objectives cannot be achieved by measures constituting a less serious interference with the rights and freedoms of the person concerned.

Language of the case: Bulgarian.

ECLI:EU:C:2023:140