I imagine what I want to write in my case, I write it in the search engine and I get exactly what I wanted. Thank you!
Valentina R., lawyer
Provisional text
delivered on 1 August 2025 (1)
(Request for a preliminary ruling from the cour d’appel de Paris (Court of Appeal, Paris, France))
( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 10 – Processing of special categories of data – Strict necessity – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 49 )
1.The taking of fingerprints and photographs is a standard method of identification as part of a criminal investigation. Nevertheless, those personal data uniquely identify a natural person and are therefore regarded as particularly sensitive.
2.The delicate task which falls to the Court in the present case is to strike a balance between, on the one hand, practices often regarded as commonplace by the police authorities and, on the other hand, the protection of the data subjects’ data.
3.Article 1(1) of Directive (EU) 2016/680 (2) provides that ‘this Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’
4.Article 4 of the directive reads as follows:
‘1. Member States shall provide for personal data to be:
(a)processed lawfully and fairly;
(b)collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;
(c)adequate, relevant and not excessive in relation to the purposes for which they are processed;
…
4.The controller shall be responsible for, and be able to demonstrate compliance with, paragraphs 1, 2 and 3.’
5.Under Article 6 of that directive:
‘Member States shall provide for the controller, where applicable and as far as possible, to make a clear distinction between personal data of different categories of data subjects, such as:
(a)persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence;
(b)persons convicted of a criminal offence;
(c)victims of a criminal offence or persons with regard to whom certain facts give rise to reasons for believing that he or she could be the victim of a criminal offence; and
(d)other parties to a criminal offence, such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings, persons who can provide information on criminal offences, or contacts or associates of one of the persons referred to in points (a) and (b).’
6.Article 8 of that directive provides:
‘1. Member States shall provide for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority for the purposes set out in Article 1(1) and that it is based on Union or Member State law.
7.Article 10 of Directive 2016/680 provides:
‘Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be allowed only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:
(a)where authorised by Union or Member State law;
(b)to protect the vital interests of the data subject or of another natural person; or
(c)where such processing relates to data which are manifestly made public by the data subject.’
8.Article 13 of that directive reads as follows:
‘1. Member States shall provide for the controller to make available to the data subject at least the following information:
(a)the identity and the contact details of the controller;
(b)the contact details of the data protection officer, where applicable;
(c)the purposes of the processing for which the personal data are intended;
(d)the right to lodge a complaint with a supervisory authority and the contact details of the supervisory authority;
(e)the existence of the right to request from the controller access to and rectification or erasure of personal data and restriction of processing of the personal data concerning the data subject.
2.In addition to the information referred to in paragraph 1, Member States shall provide by law for the controller to give to the data subject, in specific cases, the following further information to enable the exercise of his or her rights:
(a)the legal basis for the processing;
(b)the period for which the personal data will be stored, or, where that is not possible, the criteria used to determine that period;
(c)where applicable, the categories of recipients of the personal data, including in third countries or international organisations;
(d)where necessary, further information, in particular where the personal data are collected without the knowledge of the data subject.
3.Member States may adopt legislative measures delaying, restricting or omitting the provision of the information to the data subject pursuant to paragraph 2 to the extent that, and for as long as, such a measure constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned, in order to:
(a)avoid obstructing official or legal inquiries, investigations or procedures;
(b)avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
(c)protect public security;
(d)protect national security;
(e)protect the rights and freedoms of others.
…’
9.Article 54 of that directive states:
‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 52, Member States shall provide for the right of a data subject to an effective judicial remedy where he or she considers that his or her rights laid down in provisions adopted pursuant to this Directive have been infringed as a result of the processing of his or her personal data in non-compliance with those provisions.’
10.Article 55-1 of the code de procédure pénale (French Code of Criminal Procedure) provides:
‘A senior police officer may carry out, or supervise, the procedures for the taking of non-intimate samples from any person who is likely to provide information about the facts in question or from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, that are necessary for the purposes of conducting technical and scientific tests to compare them with traces or evidence obtained for the purposes of the investigation.
That officer shall carry out, or supervise, the procedures for the gathering of identification data, in particular the taking of fingerprints, palm prints or photographs, that are necessary for the purposes of entry into and consultation of police databases, in accordance with the rules applicable to each of those databases.
The refusal, by a person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, to consent to the procedures referred to in subparagraphs 1 and 2, ordered by a senior police officer, shall be punished by a year’s imprisonment and a fine of EUR 15 000.
Without prejudice to the application of the third subparagraph, where the taking of fingerprints, palm prints or a photograph constitutes the sole means of identifying a person who is being questioned pursuant to Articles 61-1 or 62-2 in respect of a crime or offence punishable by at least three years’ imprisonment and who refuses to prove his or her identity or who provides manifestly incorrect identity information, that process may be carried out without the consent of that person, with the written authorisation of the public prosecutor to whom the senior police officer has addressed a reasoned request. The senior police officer or, under the supervision of the former, a police officer shall use compulsion to the extent strictly necessary and in a proportionate manner. The officer shall take into account, where appropriate, the vulnerability of the person. A record of the process shall be made, stating the reasons why it is the sole means of identifying the person and the day and time at which it was carried out. The record shall be forwarded to the procureur de la République [(French public prosecutor)], a copy having been given to the person concerned.’
11.On 30 May 2020, more than a hundred climate activists occupied the Avenue des Champs-Élysées in Paris (France). Law enforcement officers intervened to disperse them and arrested several people, including HW, for organising a demonstration without giving notice and disobedience. HW was interviewed in police custody and gave his identity but refused to be fingerprinted and photographed for identification purposes, despite having been informed that that refusal constituted an offence punishable by imprisonment and a fine.
12.At the end of his police custody on 1 June 2020, HW was brought before the French public prosecutor and the juge des libertés et de la détention (liberties and detention judge, France), who placed him on bail and informed him that he would have to appear before the tribunal correctionnel de Paris (Criminal Court, Paris, France). HW was accused of:
–first, having organised, in Paris, on 30 May 2020, a demonstration on the public highway without giving prior notice under the conditions established by law, in the present case, in particular, by urging the participants, in giving them instructions not to show their identity documents, not to comply with the orders of law enforcement officers, by creating a human chain, instructions with which the other demonstrators immediately complied;
–second, having refused, on 31 May 2020 in Paris, in full knowledge of a decryption key for a cryptographic device likely to have been used to prepare, facilitate or commit a crime or other offence, to reveal or activate that key further to a judicial request in the context of a preliminary, on-the-spot or judicial investigation, in the present case by refusing to reveal the codes of his telephone; and,
–third, having refused, on 30 May 2020 in Paris, although he was reasonably suspected on one or more grounds of having committed or attempted to commit an offence, to consent to the taking of fingerprints, palm prints or photographs for the purposes of entry into and consultation of police databases, in accordance with the rules applicable to each of those databases.
13.By judgment of 8 September 2021, the tribunal correctionnel de Paris (Criminal Court, Paris) acquitted HW of the first two charges, but found him guilty of the third offence and, accordingly, ordered HW to pay a fine of EUR 300.
14.HW and the public prosecutor’s office brought appeals against that judgment before the cour d’appel de Paris (Court of Appeal, Paris, France), the referring court.
15.The referring court considers that, notwithstanding the judgment in Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (3) certain questions remain as regards the interpretation of Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof.
16.In the first place, the findings of the Court of Justice in Ministerstvo na vatreshnite raboti I apply to criminal proceedings which provide for the systematic collection of biometric and genetic data from any person against whom there is sufficient evidence of the commission of an offence to justify his or her being charged. (4) However, the referring court submits that the Court has not yet ruled on a legal situation such as that set out in Article 55-1 of the French Code of Criminal Procedure, which provides for the systematic collection of the biometric data (5) of a person ‘reasonably suspected on one or more grounds of having committed or attempted to commit an offence’, in the context of an investigation, without any requirement for that person to have been charged. It is therefore necessary to ascertain whether that condition is sufficient to fulfil the requirements arising from Directive 2016/680.
17.In the second place, the referring court asks whether Directive 2016/680 imposes an obligation on the competent authorities to state reasons as to why the processes which they carry out are strictly necessary.
18.In the third place, the present case raises a novel issue as regards EU law: according to French legislation, a refusal to consent to the gathering of identification data is a stand-alone offence which may be prosecuted and result in a conviction even though the main offence on which the measure to gather identification data was based did not result in a conviction (‘the stand-alone conviction’). The question thus arises whether, in those circumstances, the requirement for the collection of biometric data to be ‘strictly necessary’ has been met and whether such a stand-alone conviction is justified.
19.According to the referring court, the answer to those questions is essential to the resolution of the dispute in the main proceedings, since HW was prosecuted for and convicted solely of the offence of refusing to consent to the gathering of identification data, whereas he was acquitted of the main offence of organising a demonstration without giving notice, which formed the basis of the measure for gathering identification data, and at no stage in the proceedings did it appear that there was a sufficient statement of reasons as to why that measure was strictly necessary.
20.In those circumstances, the cour d’appel de Paris (Court of Appeal, Paris) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
(1)‘(1) Is Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the French Code of Criminal Procedure, which provides for the systematic gathering of identification data (fingerprints and photographs) from persons who are suspected on one or more grounds of having committed or attempted to commit an offence?
(2)Is Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the French Code of Criminal Procedure, which does not impose on the competent authority an obligation to provide, in each individual case, a sufficient statement of reasons as to why it is strictly necessary to gather identification data?
(3)Is Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the French Code of Criminal Procedure, which allows the prosecution and conviction on a [stand-alone] basis of a person who has refused to consent to the gathering of identification data even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data?’
21.The request for a preliminary ruling was registered at the Court of Justice on 24 May 2024. Written observations were submitted by HW, the French and Polish Governments, Ireland and the European Commission. The French and Czech Governments, Ireland and the Commission were present at the hearing, which took place on 30 April 2025.
As a reminder, the referring court asks, by its first question, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which provides for the systematic identification (dactyloscopic and photographic) of persons in respect of whom there is one or more reasons to suspect that they have committed or attempted to commit an offence.
23.I wish to point out that a reading of the request for a preliminary ruling reveals that the main concern of the referring court appears to be the fact that Article 55-1 of the French Code of Criminal Procedure authorises the collection of biometric data of persons who have not been formally accused in criminal proceedings.
24.As regards the wording of the first question, the use of the adjective ‘systematic’ by the referring court (6) was the subject of debate between the parties in their written observations.
25.The French Government submits that it is incorrect to assert that the French legislation provides for the ‘systematic’ collection of those biometric data, since collection is not an obligation, but an option.
26.The Commission agrees with the French Government, pointing out that the senior police officer has a ‘margin of discretion’ as regards the taking of samples. The Commission submits that the taking of such samples is not ‘systematic’, in so far as they are carried out not in respect of all persons suspected of having committed an offence, but solely in line with the needs of the investigation.
27.HW submits that, in view of the practice of the police authorities, the collection of data at issue is systematic. (7)
28.In that regard, it should be recalled that it is not for the Court of Justice to rule on the interpretation of provisions of national law or to decide whether the interpretation or application of those provisions by the national court is correct, since such a task falls within the exclusive jurisdiction of the national court. (8)
29.That being so, the Court, which is called on to provide an answer that is of use to the national court, may provide it with guidance based on the file in the main proceedings and on the written and oral observations which have been submitted to it. (9)
30.I am aware that there may be a fine line between providing an answer that is of use and interpreting national law.
31.However, I must point out that the referring court’s use of the term ‘systematic collection’ of data stems from the judgment in Ministerstvo na vatreshnite raboti I, which appears to have prompted its questions. (10)
32.It is apparent from paragraph 113 of that judgment that, according to the referring court in that case, Article 4(1)(a) to (c), Article 8(1) and (2) and Article 10 of Directive 2016/680 require that the competent authorities have discretion for the purpose of determining whether collection of biometric and genetic data is necessary. According to that court, the collection of data provided for by the national legislation applied mandatorily to all persons accused of intentional offences subject to public prosecution, without that legislation requiring the specific necessity to collect all those categories of data to be established. (11)
33.In addition, the Court of Justice held, in paragraph 114 of the judgment in Ministerstvo na vatreshnite raboti I, that ‘the fourth question should be understood as seeking to establish, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority to determine and to demonstrate, first, that their collection is necessary for achieving the specific objectives pursued and, second, that those objectives cannot be achieved by collecting only a part of the data concerned’. (12)
34.In the light of the two preceding points and the observations of the parties in the present case, (13) the concepts of ‘discretion’ and ‘systematic collection’ of data should be clarified.
35.As is apparent from paragraphs 113 and 114 of the judgment in Ministerstvo na vatreshnite raboti I, first, ‘discretion’ refers to the possibility, provided for by national law, for the competent authority to determine and demonstrate that the data processing is strictly necessary. Second, collection is ‘systematic’ when it applies, in a mandatory manner, to every person falling within the scope of the national legislation at issue.
36.It follows that, in order to give a useful answer to the referring court, the Court of Justice must first determine whether the collection at issue in the present case is ‘systematic’, within the meaning of the judgment in Ministerstvo na vatreshnite raboti I.
37.It cannot be inferred from Article 55-1 of the French Code of Criminal Procedure that the collection of biometric data is ‘systematic’. Under the wording of that provision, the competent authority is not obliged to collect data from all persons reasonably suspected on one or more grounds of having committed or attempted to commit an offence. In addition, the second subparagraph of that provision states that the collection is to be carried out in accordance with the rules applicable to the police databases and in so far as the data in question are necessary for the purposes of entry into and consultation of those databases. (14)
38.That said, as the debate between the parties demonstrates, in referring to the ‘systematic’ nature of the data collection the wording of the first question referred for a preliminary ruling is confusing, in so far as it appears to presume that collection which is not ‘systematic’ complies with Directive 2016/680. However, I do not consider that to be the case. As I shall explain in the context of the examination of the substance, where the collection of biometric data is not ‘systematic’, it must still, in order to comply with the requirements of Directive 2016/680, be ‘strictly necessary’.
39.Accordingly, I propose that the Court of Justice rephrase the first question referred to the effect that, by that question, the referring court seeks to determine, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, precludes national legislation which allows biometric data to be collected from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence.
40.In the first place, it must be emphasised that Article 10 of Directive 2016/680 constitutes a specific provision governing the processing of special categories of personal data (‘sensitive data’), including biometric data. (15) As is clear from the case-law, the purpose of that provision is to ensure enhanced protection with regard to that processing, which, because of the particular sensitivity of the data at issue and the context in which they are processed, is liable, as is apparent from recital 37 of the directive, to create significant risks to fundamental rights and freedoms, such as the right to respect for private life and the right to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’). (16)
41.In the second place, as follows from the very terms in which it is set out in Article 10 of Directive 2016/680, the requirement that the processing of such data be allowed ‘only where strictly necessary’ must be interpreted as establishing strengthened conditions for lawful processing of sensitive data, compared with those which follow from Article 4(1)(b) and (c) and Article 8(1) of that directive, which refer only to the ‘necessity’ of data processing that falls generally within the directive’s scope. (17)
42.Thus, first, the use of the adverb ‘only’ before the words ‘where strictly necessary’ underlines that the processing of sensitive data can be regarded as ‘necessary’ solely in a limited number of cases. Second, the fact that the necessity for the processing of such data is an ‘absolute’ one signifies that that necessity is to be assessed with particular rigour. (18)
43.I note that Directive 2016/680 does not define the requirement of ‘strictly necessary’ laid down in Article 10 thereof.
44.Some guidance may, however, be derived from other provisions of that directive. Thus, without prejudice to the strengthened conditions relating to the lawfulness of the processing of sensitive data laid down by that directive, the requirement that the processing be strictly necessary must be read in the light of the principles set out in Articles 4 and 8 thereof. (19)
45.That means, inter alia, examining whether the collection of sensitive data is strictly necessary in the light of the purposes and objectives of their collection, in compliance with the principles of purpose limitation and data minimisation, (20) the latter giving expression to the principle of proportionality. (21)
46.In that regard, first, as is apparent from recital 26 of Directive 2016/680, the requirement of necessity is met where the objective pursued by the data processing at issue cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter. In particular, in the light of the enhanced protection of persons with regard to the processing of sensitive data, the controller in respect of that processing should satisfy itself that that objective cannot be met by having recourse to categories of data other than those listed in Article 10 of that directive. (22)
47.Second, having regard to the significant risks posed by the processing of sensitive data to the rights and freedoms of data subjects, in particular in the context of the tasks of the competent authorities for the purposes set out in Article 1(1) of Directive 2016/680, the ‘strictly necessary’ requirement means that account is to be taken of the specific importance of the objective that such processing is intended to achieve. Such importance may be assessed, inter alia, on the basis of the very nature of the objective pursued – in particular of the fact that the processing serves a specific objective connected with the prevention of criminal offences or threats to public security displaying a certain degree of seriousness, the punishment of such offences or protection against such threats – and in the light of the specific circumstances in which that processing is carried out. (23)
48.Third, the Court has previously held that whether the processing of sensitive data is ‘strictly necessary’ can be determined only in the light of all the relevant factors, such as, in particular, the nature and gravity of the offence of which the data subject in the main proceedings is suspected, the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the person in question. (24)
49.As regards the gravity of the offence, I note that account is also to be taken of the specific nature of the tasks of the police authorities. As the Court of Justice pointed out in the judgment in Bezirkshauptmannschaft Landeck, to consider that only combating serious crime may justify access to personal data would limit the investigative powers of the competent authorities, for the purposes of Directive 2016/680, in relation to criminal offences in general. According to the Court, that would increase the risk of impunity for such offences, given the importance that such data may have for criminal investigations. Accordingly, such a limitation would disregard the specific nature of the tasks performed by those authorities for the purposes set out in Article 1(1) of that directive, highlighted in recitals 10 and 11 thereof, and would undermine the objective of achieving an area of freedom, security and justice within the European Union pursued by that directive. (25)
50.Thus, in principle, the fact that an offence is not categorised as ‘serious’ cannot, by itself, justify excluding that the collection of biometric data is strictly necessary. In line with the nature of the offence, rather than its gravity, the collection of that type of data may be necessary to establish the offence or identify the perpetrator.
51.However, if the requirement that the collection of biometric data be strictly necessary is not based on the nature of the offence, it must be based on other elements.
52.In its written observations, the French Government stated that the purpose of the taking of the identification data at issue in the main proceedings is, inter alia, to compare the fingerprints with the traces collected during the ongoing investigation, to identify the accused person in the context of the ongoing investigation in order to avoid the risk of confusion with someone of the same name or the risk of impersonation, or to identify the person in the context of comparisons with other ongoing or future procedures, for example to enable fingerprints to be compared with traces collected in other investigations. (26)
53.Those objectives relate, on the one hand, to the use of data collected in the context of specific criminal proceedings and, on the other hand, to processing for the purposes of other proceedings. The need to carry out such processing is expressly stated in recital 27 of Directive 2016/680. (27)
54.It must therefore be held that the collection of biometric data is relevant and adequate in the light of the objectives set out. (28) However, the need for that collection depends, inter alia, on its scope as defined by the applicable legislation.
55.As is apparent from the order for reference and the observations of the French Government, there is disagreement as to the scope of the collection at issue in the main proceedings. According to the referring court, police officers may collect the biometric data of any person ‘reasonably suspected on one or more grounds of having committed or attempted to commit an offence’. (29) However, according to the French Government, such data may be collected from persons in respect of whom there are not mere suspicions but rather serious or consistent evidence pointing to the probability that they have participated, as perpetrators or accomplices, in the commission of a crime, or an offence punishable by imprisonment, and from persons in respect of whom a positive identification is required. (30)
56.That disagreement leads me to examine two aspects of the national legislation at issue: the stage of the procedure at which the collection is carried out (in this case, without the person concerned having been formally accused) and the scope of that collection.
57.In the first place, as regards the procedural stage, I am of the view that the objectives of the collection of biometric data mean that it may take place at an early stage of the criminal investigation. Limiting that possibility to the stage at which the person concerned is accused would run counter to certain purposes set out in Article 1 of Directive 2016/680.
58.In fact, as the Court of Justice pointed out in the judgment in Ministerstvo na vatreshnite raboti I, where there are serious grounds for believing that the person in question has committed a criminal offence justifying his or her being accused, a situation which presupposes that sufficient evidence of that person’s involvement in the offence has already been gathered, it is possible that, in some cases, the collection of biometric data will not reflect any specific necessity for the purposes of the criminal procedure in progress. (31)
59.I would also stress that criminal legislation is a matter for which the Member States are responsible. (32) In particular, the various stages of criminal proceedings, and the rights and safeguards associated with them for the data subject, may differ from one Member State to another. It follows that that factor cannot be decisive for the purposes of interpreting Article 10 of Directive 2016/680.
60.That interpretation is not precluded by Article 6 of Directive 2016/680. That provision lays down an obligation to distinguish, where applicable and as far as possible, between the personal data of the different categories of data subjects, in such a way that they are not subject without distinction to the same degree of interference with their fundamental right to the protection of their personal data. (33)