Provisional text

delivered on 30 June 2022 (1)

third party:

Ministerstvo na vatreshnite raboti, Glavna direktsia za borba s organiziranata prestapnost

(Request for a preliminary ruling from the Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria))

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Accused person – Police record of personal data – Sensitive data – Biometric and genetic data – Mandatory creation – Objective of prevention and detection of criminal offences – Ongoing criminal proceedings – Comparison with personal data collected in previous investigations – Effective judicial protection – Data processing – Principles – Data minimisation – Strictly necessary)

1.Technological changes, when used in the service of criminal law enforcement, are both fascinating and threatening so far as concerns fundamental rights. (2) The present reference for a preliminary ruling once again provides the Court of Justice with the opportunity to interpret an instrument of EU law relating to the protection of personal data which was conceived as a safeguard for a criminal law policy aiming at complete effectiveness, whereas a democratic society governed by the rule of law should, paradoxically, find some virtue in the fallibility of such a policy. To a certain extent, this case constitutes an application, in the field of personal data protection, of the principle that it is better to risk sparing a guilty person than to condemn an innocent one. (3)

‘1. Member States shall provide for personal data to be:

(a) processed lawfully and fairly;

(b) collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;

(c) adequate, relevant and not excessive in relation to the purposes for which they are processed;

…’

‘Member States shall provide for the controller, where applicable and as far as possible, to make a clear distinction between personal data of different categories of data subjects, such as:

(a) persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence.’

‘1. Member States shall provide for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority for the purposes set out in Article 1(1) and that it is based on Union or Member State law.

‘Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be allowed only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:

(a) where authorised by Union or Member State law;

(b) to protect the vital interests of the data subject or of another natural person; or

(c) where such processing relates to data which are manifestly made public by the data subject.’

‘1. The police authorities shall create a police record of persons who are accused of an intentional criminal offence subject to public prosecution. The authorities responsible for pre-trial proceedings are required to take the measures necessary to ensure that the police authorities create the record.

(1) collect the personal data set out in Article 18 of the Zakon za balgaskite lichni dokumenti; [ (6) ]

(2) take a person’s fingerprints and photograph him or her;

(3) take samples to create a person’s DNA profile.

(1) the record was created in breach of the law;

(2) criminal proceedings have been discontinued, except in the cases referred to in Article 24(3) of the [nakazatelno-protsesualen kodeks (Code of Criminal Procedure, ‘the NPK’)];

(3) a final decision of acquittal has terminated the criminal proceedings;

(4) the person was not held criminally liable and an administrative penalty was imposed on him or her;

(5) the person is deceased, in which case the request may be made by his or her successors.

II. The dispute in the main proceedings, the questions referred for a preliminary ruling and the procedure before the Court

2.9. On 24 March 2021, the Deputy Director of the Glavna direktsiya za borba s organiziranata prestapnost (General-Directorate for Combating Organised Crime), in the Ministerstvo na vatreshnite raboti (Ministry of the Interior, Bulgaria) applied to the referring court, the Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria), requesting it to authorise the mandatory creation of the police record to which V.S. had refused to consent.

4.11. In the first place, the referring court asks whether Article 10 of Directive 2016/680, which authorises, under certain conditions, the processing of biometric and genetic data, has been correctly transposed into Bulgarian law. In that regard, the referring court notes that the provisions governing the creation of a police record refer only to Regulation (EU) 2016/679 (10) and not to Directive 2016/680. It points out that, under Article 2(2)(d) thereof, the GDPR does not apply to the processing of personal data by competent bodies for the purposes of the prevention, investigation, detection or prosecution of criminal offences, since it is the directive which, in accordance with Article 1(1) of Directive 2016/680, governs such processing.

5.12. In the second place, in the event that it is held that Article 10 of Directive 2016/680 has been correctly transposed into national law or that there is a valid legal basis in that law for the processing of biometric and genetic data, the referring court asks whether the requirement, referred to in Article 10(a) of that directive, that such processing must be authorised by EU or Member State law is satisfied, despite the fact that there is a contradiction between the applicable provisions of national law.

6.13. In the third place, the referring court notes that, under Article 6(a) of Directive 2016/680, the personal data of persons with regard to whom there are serious grounds for believing that they have committed a criminal offence may be processed for the purposes of combating crime. It also notes that the third sentence of recital 31 of that directive states that the processing of personal data of persons who are suspected of having committed an offence, but have not been convicted, should not prevent the application of the right of presumption of innocence. Article 48 of the Charter of Fundamental Rights of the European Union (‘the Charter’) therefore appears to be applicable.

7.14. On the one hand, the referring court notes that, under Article 219(1) of the NPK, it is necessary to collect ‘sufficient evidence of the guilt of a particular person’. It asks whether that criterion corresponds to the criterion of ‘serious grounds for believing that [persons] have committed … a criminal offence’ referred to in Article 6(a) of Directive 2016/680. It is of the view, rather, that, for the processing of biometric and genetic data, more valid evidence is necessary than that which is required under national law in order to accuse the person, since the purpose of accusing that person is to inform the person of the grounds for suspecting him or her, at which point he or she is offered the opportunity to defend him or herself.

8.15. On the other hand, the referring court notes that Article 68 of the ZMVR does not provide that, in the context of the procedure for the mandatory creation of a police record, the court seised should carry out any review as to the existence of serious grounds within the meaning of Article 6(a) of Directive 2016/680, since the sole finding that the person has been accused of an intentional criminal offence subject to public prosecution suffices. It therefore has no jurisdiction to assess whether sufficient or valid evidence exists in support of that accusation, and cannot, in practice, make such an assessment, since it has at its disposal only copies of the order accusing the person and the declaration concerning the refusal to allow the creation of a police record. The referring court asks whether, in such circumstances, the person who refused to consent to the creation of that police record can be regarded as enjoying effective judicial protection and respect for the presumption of innocence, as guaranteed by Article 47 and Article 48 of the Charter.

17.The referring court infers from those provisions of Directive 2016/680 that national law should confer on the competent authorities a certain discretion when they are creating a police record, a discretion which should relate both to whether the collection of the data concerned should take place and to whether that collection should cover all those data. Moreover, that court also considers that it should be inferred from the ‘strictly necessary’ requirement that the collection of such data can be authorised only where there is adequate justification for its necessity. However, the creation of a police record applies mandatorily to all persons who are accused of intentional criminal offences subject to public prosecution and to the three categories of personal data collection referred to by that article, namely the taking of photographs, fingerprints and DNA samples.

18.Furthermore, the referring court notes that only the objectives of that processing are referred to by the ZMVR, namely the exercise of an information activity, including safeguarding national security, combating crime and protecting public order. However, the national legislation does not require any assessment of the specific necessity for the collection of all the biometric and genetic data concerned or, where appropriate, of only some of them. The referring court therefore asks whether the condition laid down by national law for the creation of a police record – that is to say, the fact that a person has been accused of an intentional criminal offence subject to public prosecution – is sufficient to meet the requirements of Directive 2016/680.

19.In those circumstances, the Spetsializiran nakazatelen sad (Specialised Criminal Court) decided to stay the proceedings and, by decision received at the Court of Justice Registry on 31 March 2021, to refer the following questions to the Court of Justice for a preliminary ruling:

1.‘1. Is Article 10 of Directive 2016/680 effectively transposed into national law … by the inclusion of a reference to the similar provision in Article 9 of [the GDPR]?

2.Is the requirement set in Article 10(a) of Directive 2016/680 in conjunction with Articles [3, 8 and 52] of the Charter, that any limitation on integrity and protection of personal data must be provided for by law, fulfilled if contradictory national provisions exist in relation to the permissibility of processing of genetic and biometric data for the purposes of creating a police record?

3.Is a national law, namely Article 68(4) of [the ZMVR], which provides for the obligation of the court of first instance to order the forced collection of personal data (taking photographs for the file, taking fingerprints, and taking samples in order to create a DNA profile), compatible with Article 6(a) of Directive 2016/680 in conjunction with Article 48 of the Charter, if a person who is accused of an intentional criminal offence requiring public prosecution refuses to voluntarily cooperate in the collection of these personal data, without the court being able to assess whether there are serious grounds for believing that the person has committed the criminal offence of which he or she is accused?

4.Is a national law, namely Article 68(1) to (3) of [the ZMVR], which provides, as a general rule, for the taking of photographs for the file, the taking of fingerprints, and the taking of samples in order to create a DNA profile for all persons who are accused of an intentional criminal offence requiring public prosecution compatible with Article 10, Article 4(1)(a) and (c), and Article 8(1) and (2) of Directive 2016/680?’

20.The Bulgarian and French Governments and the European Commission have lodged written observations with the Court of Justice. The Ministry of the Interior, the Bulgarian and French Governments and the Commission have also sent the Court answers to the written questions which it had put to those parties.

21.As requested by the Court, this Opinion will focus on the third and fourth questions referred for a preliminary ruling.

III. Analysis

22.As a preliminary point, I would like to recall the following.

23.With regard to the classification of the data collected and processed during the creation of a police record, it is clear that a sample taken in order to create a data subject’s DNA profile is genetic data, within the meaning of Article 3(12) of Directive 2016/680. Fingerprints are biometric data, as is confirmed by Article 3(13) of that directive. Photographs may also constitute biometric data, as also provided for in Article 3(13) of Directive 2016/680. The creation of a police record therefore concerns two categories of personal data: data that are, so to speak, ‘traditional’, such as civil status, which are subject to the general rules established by Directive 2016/680, and so-called ‘special’, not to say, sensitive data, such as photographs, fingerprints and the taking of samples in order to create the DNA profile of a data subject. I would note, however, that the referring court refers, in the wording of its questions, only to those ‘special’ data. In the context of measures compelling the collection and processing of data, including sensitive data, by investigating authorities, such measures clearly constitute, without prejudice to their possible justification, an interference with the data subject’s right to respect for his or her private life and to the protection of his or her personal data. That interference is particularly serious since the data are sensitive. However, despite the risks of infringement and abuse, which are well known to the EU legislature, the processing of that particular category of data by the police authorities, in particular for the purposes of record keeping, is not prohibited because the effectiveness of such processing for the accomplishment of the tasks of those authorities has been proven. In this case, therefore, a fair balance must be struck between requirements relating to the proper conduct of the criminal investigation and the no-less-essential requirement to ensure an enhanced level of protection for that particular type of personal data.

24.By its third question, the referring court seeks, in essence, to ascertain whether Article 6(a) of Directive 2016/680, read in the light of Article 47 and Article 48 of the Charter, must be interpreted as precluding national legislation which provides that, in the event of a refusal by the person accused of an intentional criminal offence subject to public prosecution to cooperate with the procedure for recording his or her personal data (that is to say, at least a photograph, fingerprints and a DNA profile created using a physical sample), the court seised for that purpose is required to order the compulsory collection of those data without being able to assess whether there are serious grounds for believing that the data subject in fact committed the offence of which he or she has been accused.

25.The national legislative and regulatory context is characterised by the following elements. The referring court states that almost all offences under the Bulgarian Criminal Code involve public prosecution, that is to say that charges be brought by the prosecutor. The NPK, for its part, provides that, where sufficient evidence has been gathered that a particular person is guilty of an offence subject to public prosecution, that person is to be accused. A police record, as governed, inter alia, by Article 68 of the ZMVR, is created in respect of persons accused of that type of offence. That record is created by the police authorities, and not by the authorities bringing criminal proceedings. The personal data recorded are as follows: information on the person’s civil status (name, date and place of birth, sex, nationality), contact details and administrative identification number, as well as physical characteristics (height, eye colour). The record will also include at least one photograph of the data subject and his or her fingerprints and DNA profile, which is created after a sample has been taken. The accused person is required to cooperate and not to hinder the collection of his or her personal data. The accused person becomes a defendant only after the prosecutor has filed the indictment with the court, at which point the criminal proceedings enter the trial stage.

26.In the event of refusal, since the accused person cannot be required to consent to the processing of personal data relating to combating crime, that person may sign a written declaration expressing his or her disagreement. The police authority responsible for creating the police record then applies for authorisation to proceed with the mandatory creation of that record to the court which will have jurisdiction if the criminal proceedings relating to the offence in question enter the trial stage. The court’s discretion is limited, since it has to verify only that the person has indeed been accused of an intentional criminal offence subject to public prosecution and that he or she has in fact refused to consent to the creation of a police record. The file relating to the procedure concerning the request for the mandatory creation of the police record therefore comprises only a copy of the order accusing that person and the declaration concerning the refusal to allow the recording of the data. Once it has verified that the data subject has been accused and that he or she has indeed objected to the creation of the police record, the court is required to authorise the mandatory creation of that record.

27.For its part, Article 6 of Directive 2016/680, which is at the heart of this third question, obliges Member States, ‘where applicable and as far as possible’, to make a clear distinction between the data of different categories of data subjects, such as ‘persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence’. The purpose of that provision, as the Commission has recalled, is to ensure that the fundamental right to the protection of personal data of victims of criminal offences is not interfered with in the same way as that of persons suspected of having committed such offences, for example.

28.It follows from the wording of that provision alone that the strength of the obligation imposed on the Member States is rather moderate and not fully defined, in so far as the list of categories of persons is not exhaustive and the directive leaves it to the Member States to give due effect to the clear distinction which they are required to make. From a strictly literal point of view, I consider from the outset that it is perfectly permissible in the light of that provision for a Member State to establish, as a ‘clear category’, the category of persons who have been accused, that is to say persons in respect of whom sufficient evidence that they have committed an offence has been gathered.

29.As regards the court-authorised, mandatory creation of the police record, I would note, first, that Directive 2016/680 does not aim to organise the procedural requirements for the collection of the personal data of persons covered by Article 6(a) of that directive and, secondly and in any event, as the French Government has pointed out, that the competent authorities may order natural persons to comply with requests made to them, and the consent of the data subject is therefore not a legal basis for the processing of the data by those authorities. This is also true as regards sensitive personal data.

30.In those circumstances, since Directive 2016/680 does not preclude national legislation which provides that, as regards persons who have been accused, the competent authorities may order the collection of biometric and genetic data in the event of a refusal by those persons, but nevertheless does not lay down procedural rules for the mandatory collection of those data, it is clear, as stated by the French Government, that Member States may indeed decide to introduce a mandatory procedure, whether legal or administrative in nature, and provide for the power to decide on the mandatory collection of data to be entrusted to either a judicial or an administrative authority.

31.Directive 2016/680 sets out, in Chapter VIII thereof, the remedies which must be available to persons whose data have been processed. Those remedies include the possibility of lodging a complaint before a single supervisory authority, the possibility of an effective judicial remedy against any legally binding decision of a supervisory authority concerning them, as well as the possibility of an effective judicial remedy where the data subject is of the view that his or her rights under Directive 2016/680, as implemented at national level, have been infringed as a result of the processing of his or her personal data in non-compliance with those rights. The situation which forms the subject matter of the third question referred, however, is one which arises at an earlier stage than those various scenarios.

32.Nevertheless, since Article 68 of the ZMVR, which lays down the conditions governing the mandatory creation of a police record for the specific category of persons accused of an intentional criminal offence subject to public prosecution, constitutes an implementation of EU law for the purposes of Article 51(1) of the Charter, it is necessary to ensure that it respects the right to effective judicial protection as enshrined in Article 47 of the Charter.

33.Article 47 of the Charter states that everyone whose rights and freedoms guaranteed by EU law are violated has the right to an effective remedy in compliance with the conditions laid down in that article. Articles 7 and 8 of the Charter enshrine the right to respect for private life and to the protection of personal data. As the Court of Justice recently recalled, ‘none of those three fundamental rights constitutes an unfettered prerogative, as each of them must be considered in relation to its function in society’. Furthermore, Article 52(1) of the Charter provides that limitations may be placed on the exercise of rights and freedoms guaranteed by the Charter on condition that (i) those limitations are provided for by law, (ii) they respect the essence of the rights and freedoms at issue, and (iii) in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. Accordingly, a limitation may be placed on the exercise of the right to an effective remedy, enshrined in Article 47 of the Charter, by the EU legislature or, where no relevant EU legislation exists, by the Member States, if the conditions laid down in Article 52(1) of the Charter are satisfied.

34.With regard to the first condition, it is actually the ZMVR, as specified by the NRISPR, which lays down the obligation, whether willingly or by force, for persons accused of an intentional criminal offence subject to public prosecution to cooperate in the creation of a police record, if necessary as ordered by the court of first instance having jurisdiction over that offence. That court’s circumscribed powers and the impossibility of verifying, at that stage of the proceedings, the sufficiency of the evidence that the person has committed the offence of which he or she has been accused, when the procedure for ordering the mandatory creation of a police record is characterised by a need to make a decision as a matter of some urgency and is non-adversarial in nature, are indeed provided for by law within the meaning of Article 52(1) of the Charter.

As regards the second condition, the Court has repeatedly held that the essence of the right to an effective judicial remedy enshrined in Article 47 of the Charter includes, inter alia, the possibility, for the person who holds that right, of accessing a court or tribunal with the power to ensure respect for the rights guaranteed to that person by EU law and, to that end, to consider all the issues of fact and of law that are relevant for resolving the case before it. However, the requirement that the essence of the right to an effective remedy should be respected does not mean that the holder of that right must have a direct remedy the primary object of which is to call into question a given measure, provided that one or more legal remedies also exist, before the various national courts having jurisdiction, enabling that rightholder to obtain, indirectly, judicial review of that measure ensuring respect for the rights and freedoms guaranteed to that rightholder by EU law.

In that regard, I would note, as the Bulgarian Government has explained, that the order to create a police record is made during the pre-trial stage of the criminal proceedings, which is the stage during which investigative and evidence-gathering activities are carried out, following which it is necessary to determine whether an offence has been committed, who the perpetrator is and whether the perpetrator is criminally liable. Once the criminal investigation has been completed and the evidence submitted, the prosecutor must decide to close the criminal proceedings, to stay them, to propose immunity from criminal prosecution together with an administrative penalty, to propose an agreement settling the dispute or to bring charges by way of indictment. It is the filing of that indictment with the court which initiates the trial stage of the criminal proceedings.

It must be possible to verify the evidence against the person who has been compelled to consent to the creation of a police record when the criminal proceedings enter the trial stage, in the course of which the court hearing the case must have the opportunity to consider all the relevant issues of fact and of law, in particular, to verify whether the evidence on which the indictment is based has been obtained or used in breach of the rights and freedoms guaranteed to the person concerned by EU law.

As regards the third condition, the national legislation subject to review by the Court must, in compliance with the principle of proportionality, be necessary and genuinely meet an objective of general interest recognised by the European Union. Article 68 of the ZMVR organises the collection and processing of special data for a specific category of persons and falls, in that regard, within the scope of Directive 2016/680, which introduces special rules in relation to personal data and their processing by the competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences. Accordingly, the objective pursued by the national legislation at issue in the main proceedings necessarily constitutes an objective of general interest recognised by the European Union. Moreover, the needs of the investigation may also explain the choice made by the national legislature to exclude the procedure for applying for the mandatory creation of a police record, in spite of the serious interferences with the rights guaranteed by Article 7 and Article 8 of the Charter, from the court’s powers of review of compliance with the scope ratione personae of that record and to postpone that examination until a later stage of the proceedings. The national legislation clearly seems appropriate to achieve the objective pursued and does not appear to be disproportionate, provided that the accused person indeed has the possibility of challenging the creation of the police record at a later stage, whether before the court which ordered its mandatory creation or before another court.

No verification of the sufficiency of the evidence and respect for the presumption of innocence

Finally, the referring court expresses a number of concerns relating to respect for the presumption of innocence as enshrined in Article 48 of the Charter. In particular, it asks whether the impossibility of reviewing the sufficiency of the evidence forming the basis of the accusation, at the time when the court having jurisdiction must order the creation of a police record, undermines the presumption of innocence of the accused person.

Related to Article 6(a) of Directive 2016/680, recital 31 thereof, which clarifies the meaning of that provision, states that the establishment of different categories of data subjects, whose personal data must be processed differently, ‘should not prevent the application of the right of presumption of innocence as guaranteed by the Charter and by the ECHR’.

As set out above, the referring court is concerned that the decision by which the court having jurisdiction must order the creation of a police record is made in accordance with a procedure allowing that court to assess only whether the data subject has actually been accused and whether he or she has in fact objected to the creation of a police record. As regards criminal proceedings, Article 48 of the Charter has been implemented in EU law by Directive (EU) 2016/343 of the European Parliament and of the Council of 9 March 2016 on the strengthening of certain aspects of the presumption of innocence and of the right to be present at the trial in criminal proceedings. That directive applies ‘to natural persons who are suspects’ and ‘at all stages of the criminal proceedings, from the moment when a person is suspected … of having committed a criminal offence … until the decision on the final determination of whether that person has committed the criminal offence concerned has become definitive’. Article 4(1) of Directive 2016/343 requires Member States to ‘take the necessary measures to ensure that, for as long as a suspect or an accused person has not been proved guilty according to law, public statements made by public authorities, and judicial decisions, other than those on guilt, do not refer to that person as being guilty’. That provision is, however, to be ‘without prejudice to acts of the prosecution which aim to prove the guilt of the suspect or accused person, and to preliminary decisions of a procedural nature, which are taken by judicial or other competent authorities and which are based on suspicion or incriminating evidence’. Moreover, Article 7(3) of Directive 2016/343 provides that ‘the exercise of the right not to incriminate oneself shall not prevent the competent authorities from gathering evidence which may be lawfully obtained through the use of legal powers of compulsion and which has an existence independent of the will of the suspects or accused persons’.

In those circumstances, it is, in my opinion, possible to take the view that the decision by which the court having jurisdiction – after having simply taken note, first, of the accusation presumed, at that stage, to be based on sufficient evidence of the data subject’s participation in the commission of the criminal offence subject to public prosecution and, second, of the refusal of that person to consent to the creation of a police record – authorises the police authorities to proceed with the mandatory creation of that record cannot be interpreted as a decision on the guilt of that person or, consequently, as undermining the presumption of innocence of the data subject.

By contrast, given that the court which must order the creation of a police record is the same as that before which the trial stage of any criminal proceedings will be brought, the fact that that court cannot, at that stage of the criminal proceedings, which, moreover, appear to be non-adversarial, assess the sufficiency of the evidence seems to guarantee to the accused person that the court, in accordance with the presumption of innocence, will be ‘free of any bias and any prejudice when examining the criminal liability of the accused’. In any event, ‘in order to review compliance with the presumption of innocence, it is necessary to always analyse a judicial decision and its reasoning as a whole and in light of the particular circumstances in which it has been adopted’.

It therefore follows from the foregoing analysis that Article 6(a) of Directive 2016/680, read in the light of Article 47 and Article 48 of the Charter, must be interpreted as not precluding national legislation, such as that at issue in the main proceedings, which provides that the review of the criminal court having jurisdiction, before which an application has been made to authorise the mandatory creation of a police record which comprises personal data, in particular biometric and genetic data, and to the creation of which the person accused of an intentional criminal offence subject to public prosecution has refused to consent, is limited to a finding that a decision has been made to accuse the data subject and that he or she has refused to consent, without that court being able to assess the sufficiency of the evidence which led to the decision to accuse that person, provided that it will be possible effectively to raise the question of the sufficiency of the evidence forming the basis of the accusation before the court, where appropriate at a later stage of the criminal proceedings.

The fourth question referred for a preliminary ruling

By its fourth question, the referring court asks the Court of Justice to interpret Article 4(1)(b) and (c), Article 8 and Article 10 of Directive 2016/680, so that it can, ultimately, assess the compatibility with those provisions of Article 68 of the ZMVR, from which it follows that photographs, fingerprints and samples for the creation of a DNA profile are to be taken and processed as a matter of course, where a person is accused of an intentional criminal offence subject to public prosecution.

Directive 2016/680 contains a specific provision on the processing of special categories of personal data, such as those referred to in the wording of the fourth question referred, namely Article 10 of that directive, which provides, in essence, that the processing of biometric and genetic data for the purpose of uniquely identifying a natural person ‘shall be allowed only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only … where authorised by Union or Member State law’.

The application of Article 10 does not prevent the processing of those special data from being subject, moreover and a fortiori, to the other requirements laid down by Directive 2016/680, so that the processing of special categories of personal data must, inter alia, comply with Article 4(1)(b) and (c) and Article 8 of that directive. However, an examination of those provisions in turn would result in redundancy, so that it seems to me possible to integrate the requirements of those provisions in the analysis carried out on the basis of Article 10 of Directive 2016/680.

Accordingly, I consider that it must be established, first, that the processing of data falling within the scope of Article 10 of Directive 2016/680 is absolutely necessary. This implies, on the one hand, a definition of the level of necessity required and, on the other hand, the inclusion also in the necessity test of the principle of personal data minimisation set out in Article 4(1)(c) of that directive. The review of the correlation between the means employed and the purpose pursued, which must be specified, explicit and legitimate within the meaning of Article 4(1)(b) and Article 8(1) of Directive 2016/680, can also be carried out at this stage of the analysis. Second, it is necessary to ascertain whether the processing is actually authorised by the law of a Member State, which, as I shall show, concerns the status of the law in the light of the requirements, in particular, of Article 8(2) of Directive 2016/680. Third, it will be necessary to assess whether the processing governed by Article 10 of that directive meets the requirement of providing appropriate safeguards for the rights and freedoms of the data subject.

Whether the processing of the data collected during the creation of the police record is absolutely essential

The first requirement is therefore that the processing of biometric and genetic data must be absolutely essential. In my view, there is no doubt that this is an enhanced requirement, since Article 8(1) of Directive 2016/680 refers solely to the necessity of the processing as a condition for its lawfulness. I note, however, without claiming to be exhaustive, that the Spanish, German, English, Italian, Polish, Portuguese, and Romanian language versions set a threshold in Article 10 of the directive which is worded differently, since they refer to processing which is strictly necessary. Although there is an, albeit subtle, nuance, I am of the view that it does not really have any consequences on the nature of the resulting test. On the other hand, Article 10 of Directive 2016/680 clearly imposes a more stringent requirement, necessary where there is a serious interference with the right to protection of personal data, than that which is allowed under the general rules applied to data which is not in a special category. The idea of strict necessity must therefore be constantly borne in mind.

In order to make the latter more coherent, I shall start by examining purposes. Personal data must be collected for specified, explicit and legitimate purposes and not be processed in a manner that is incompatible with those purposes, which requires an examination of the national law comprising, in its various sources, the legal rules governing the creation of a police record – an examination which it will be for the referring court to carry out. The mere reliance on a purpose pursued in Article 1(1) of Directive 2016/680 cannot suffice to establish that the requirement laid down in Article 4(1)(b) of that directive is fulfilled. Although Directive 2016/680 recognises that it is necessary for competent authorities to process personal data collected in the context of the prevention, investigation, detection or prosecution of specific criminal offences beyond that context in order to develop an understanding of criminal activities and to make links between different criminal offences detected, the national law governing that activity must identify the purposes of the processing, which must be clearly stated. Moreover, as regards the objective of preventing, investigating, detecting and prosecuting criminal offences, ‘only action to combat serious crime and measures to prevent serious threats to public security are capable of justifying serious interference with the fundamental rights enshrined in Article 7 and Article 8 of the Charter … Accordingly, only non-serious interference with those fundamental rights may be justified by the objective of preventing, investigating, detecting and prosecuting criminal offences in general’.

The national provisions must be clear and precise, so that data subjects can be made aware of risks, rules, safeguards and rights in relation to the intended processing. In my opinion, the review of the legitimacy of the purpose pursued cannot be limited solely to an examination of a reference, by national law, to a purpose shared with those of Directive 2016/680, since the purpose is also justified by the conditions of its pursuit. Moreover, the purpose pursued, although legitimate, cannot be regarded as being either explicit or specified, again within the meaning of Article 4(b) of Directive 2016/680, if it is insufficiently detailed as to the conditions of its practical implementation. Making the purposes explicit and specifying them are essential steps in order to ensure that the examination of absolute necessity can be carried out.

The principle according to which personal data collected and processed are to be adequate, relevant and not excessive in relation to the purposes for which they are processed is the principle of data minimisation, as expressed in Article 4(c) of Directive 2016/680.

The adequacy and relevance of the data do not, on the face of it, appear to pose a problem, since photographs, fingerprints and DNA are known unique identifiers which can be used to establish, on the basis of a comparison, the presumed participation of the data subject in the commission of the offence, either in the context of the ongoing criminal proceedings or based on a comparison with evidence collected in past proceedings.

54.Recital 26 of Directive 2016/680 includes, in the principle of data minimisation, verification of the period necessary for keeping the data concerned and states that data ‘should be processed only if the purpose of the processing could not reasonably be fulfilled by other means’. Moreover, since they are derogations from and restrictions on the fundamental right to the protection of personal data, those derogations and restrictions must apply only in so far as is strictly necessary. A reasonable relationship must be established between the data to be retained and the purpose pursued. While this does not call into question the effective contribution made by data files, which are consulted by national authorities, to the prosecution and punishment of certain offences, sometimes the most serious, the European Court of Human Rights has nevertheless already ruled that such facilities cannot be implemented as part of an abusive drive to maximise the information stored in them and the length of time for which they are kept. Indeed, without respect for the requisite proportionality vis-à-vis the legitimate aims assigned to such mechanisms, their advantages would be outweighed by the serious breaches which they would cause to the rights and freedoms which States must guarantee.

55.The Court of Justice recently recalled, in the context of the GDPR and in relation to the principle of minimisation, that in order to satisfy the requirement of proportionality expressed in the provision setting out that principle, ‘the legislation on which the processing is based must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, so that the persons whose personal data are affected have sufficient guarantees that data will be effectively protected against the risk of abuse. That legislation must be legally binding under domestic law and, in particular, must indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, ensuring that the interference is limited to what is strictly necessary’.

The requirement that the processing must be authorised by national law

56.Article 10 provides, as one of the conditions for authorisation of the processing of special categories of personal data, that that processing must be authorised by EU or national law. Recital 33 of Directive 2016/680 specifies what is meant by ‘national law’ and the qualities it must have. Thus, national law must be clear and precise and its application must be foreseeable. Its content is determined in Article 8(2) of that directive, which provides that national law regulating the processing of personal data within the scope of that directive is to specify ‘at least the objectives of processing, the personal data to be processed and the purposes of the processing’. Distinguishing between the objectives of the processing and its purposes does not, at first sight, appear obvious. It seems to me, however, that while the purpose may be formulated in a somewhat general manner, the objectives should specify the practical and immediate usefulness of the intended processing. Thus, national law must adequately demonstrate the reasons why the processing of that particular category of data has been authorised.

The existence of appropriate safeguards for the rights and freedoms of the data subject

57.In view of the risks involved in the processing of so-called sensitive personal data, it must be subject to appropriate safeguards for the rights and freedoms of the data subject. To be appropriate, those safeguards must, unsurprisingly, be provided for by law. Assessing whether those safeguards exist necessitates an overview of all the conditions in order to be in a position to assess the exact scope of the processing operation in question and to ensure effective protection against improper or abusive processing. Recital 37 of Directive 2016/680 mentions as examples of such safeguards ‘the possibility to collect those data only in connection with other data on the natural person concerned, the possibility to secure the data collected adequately, stricter rules on the access of staff of the competent authority to the data and the prohibition of transmission of those data’. As regards the processing of sensitive data, because of the seriousness of the interference and in view of the risks of abuse associated with the intrinsic quality of those data, the issues of the duration of storage and of access by competent authorities are fundamental. The assessment of whether the intended processing complies with the requirements of Article 10 of Directive 2016/680 therefore also implies a rigorous examination of all aspects of the intended processing, and, accordingly, those aspects must be clearly set out in national law.

Conclusion and provisional application

58.Accordingly, it follows from the foregoing that Article 10 of Directive 2016/680, read in conjunction with Articles 4(b) and (c) and Article 8 of that directive and interpreted in the light of Article 7, Article 8 and Article 52(1) of the Charter, must be interpreted as meaning that the collection and processing of biometric and genetic data, such as photographs, fingerprints and samples in order to create a DNA profile, in so far as they constitute a serious interference with the right to the protection of personal data, are permitted only where strictly necessary for the pursuit of objectives linked to serious crime, which national law must clearly identify. The nature and amount of personal data processed must be strictly appropriate and consistent with the objective and purpose pursued. In that regard, national law must be compatible with one of the purposes pursued by Directive 2016/680. It must also indicate which are the specific objectives pursued that are likely to contribute to the achievement of that purpose. It is also necessary to state the specific reasons why, despite the fact that it constitutes a serious interference, processing those data, and in particular genetic data, appears strictly necessary for that purpose. National law must, moreover, clearly set out the conditions of all aspects of the processing, that is to say from the conditions of collection to the conditions of access to and deletion of the data, including a precise and necessarily strictly limited definition of the personal scope of the collection and processing measure. Each of those conditions must be limited to what is strictly necessary. The rules thus defined must prove to be capable of actually protecting persons against the risks of abuse posed, in particular, by the processing of genetic data. It will be for the referring court to ensure that all those requirements are scrupulously fulfilled.

59.The Court does not appear to me, in fact, to have sufficient information on the present state of national law governing the creation of a police record to rule on whether the creation of such a record is compatible with EU law. However, it must be said that certain elements inherent in the creation of a police record already raise a number of questions and even concerns.

60.In its order for reference, the referring court states that the purpose of the processing is an information activity and that that activity is one of those carried out by the Ministry of the Interior. It is also clear from Article 27 of the ZMVR that the data recorded by the police under Article 68 of the ZMVR are used ‘only’ in the context of safeguarding national security, combating crime and protecting public order. The data collected during the creation of the police record will be processed for the purposes of the criminal proceedings in which the data subject has been accused but also ‘for other purposes related to combating crime’, according to the Bulgarian Government’s pleadings, and where appropriate based on a comparison. On the face of it, those purposes appear to correspond to those referred to in Article 1(1) of Directive 2016/680, in particular the purposes of detection of criminal offences and investigations. However, the absence of a precise definition of the purpose pursued, or of the plurality of purposes relied on, and the lack of explanation of the reasons why such a purpose justifies and/or such purposes justify those means (namely, I would recall, the mandatory and systematic collection and processing of three types of personal data – falling within the special categories which must benefit from enhanced protection under Article 10 of Directive 2016/680, including the DNA profile – of persons accused of an intentional criminal offence subject to public prosecution) seem clear and are likely to hinder the other stages of the test to be applied. In particular, as regards the inclusion in an automated file of the data subject’s DNA profile, the national law must make a particularly sustained effort to explain the need to resort to such processing, in order to demonstrate that the result reached is the outcome of a carefully conducted balancing of the interests involved.

61.Even if the purposes allegedly pursued by the creation of a police record appeared to be consistent with those referred to in Article 1(1) of Directive 2016/680, national law neither established nor specified the links between the scope of the collection – either in terms of the number of data subjects or the amount of data collected and processed – and the purposes pursued.

62.Since the Court has already held that the effectiveness of criminal proceedings generally depends not on a single means of investigation but on all the means of investigation available to the competent national authorities for those purposes, when a Member State authorises those authorities to collect and process personal data as sensitive as a DNA profile, the reasons why those data must be processed for the purposes of the ongoing investigation should be specifically stated.

63.I would also note that all persons accused of an intentional criminal offence subject to public prosecution must consent to the creation of a police record. The referring court states that almost all offences provided for in the Criminal Code fall within those categories (intentional offence/offence subject to public prosecution). All data are collected at the accusation stage, when, as required by Bulgarian criminal procedural law, sufficient evidence of the guilt of the accused person has already been gathered. In relation to the creation of a police record, persons who are actually found guilty at the end of the proceedings are nevertheless treated no differently than those who are not, except, it seems, for a right to erase the processed data once a person is ultimately acquitted. However, as this case concerns a serious interference and sensitive data requiring enhanced protection, I wonder why that logic is not reversed, that is to say why not wait for a person to be convicted for the alleged offences before proceeding with the creation of a police record, which would at least have the merit of enhancing the selectivity of the measure. However, the Court has no information on the reasons underlying the choice made by the national legislature.

64.Nor is the nature of the offence in respect of which the accusation was made taken into account. Put very simply, one could argue that a person accused of a traffic offence will be treated in the same way as a person accused of murder. The legislation does not appear to provide for situations in which the creation of the police record does not require the inclusion of all the data in question. However, ongoing criminal proceedings, at least, will not all require the creation of a DNA profile to establish the guilt of the data subject. Although, because the measure is ‘limited’ to persons who have been accused, it does not in itself apply generally, its indiscriminate application to the broad category of such persons nonetheless clearly raises questions. Moreover, in failing to make any distinction on the basis of the seriousness of the offence, national law already appears, on that point alone, difficult to reconcile with the case-law referred to in point 50 of this Opinion.

65.Particular attention should also be paid to the conditions of data storage and access, regarding which the Court has little information.

66.Finally, the issue of the comparison of the data thus collected prompts me to make two sets of comments. First, as regards the comparison with evidence gathered during previous investigations, a strictly necessary interpretation of that objective could justify only an immediate comparison of data traces, without it being necessary to retain, more or less long-term, the data of persons who have been accused. Second, if the idea is to establish a database to facilitate solving future offences, in the event of reoffending, it clearly does not seem justified to include in that database the sensitive personal data of persons who are to be made subject to measures to combat the entirely hypothetical risk of reoffending which they represent, although they have not yet been found guilty.

Conclusion

67.In the light of all the foregoing considerations, I suggest that the Court answer the third and fourth questions referred by the Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria) as follows:

Article 6(a) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in the light of Articles 47 and 48 of the Charter of Fundamental Rights of the European Union,

must be interpreted as not precluding national legislation, such as that at issue in the main proceedings, which provides that the review of the criminal court having jurisdiction, before which an application has been made to authorise the mandatory creation of a police record which comprises personal data, in particular biometric and genetic data, and to the creation of which the person accused of an intentional criminal offence subject to public prosecution has refused to consent, is limited to a finding that a decision has been made to accuse the data subject and that he or she has refused to consent, without that court being able to assess the sufficiency of the evidence which led to the decision to accuse that person, provided that it will be possible effectively to raise the question of the sufficiency of the evidence forming the basis of the accusation before the court, where appropriate at a later stage of the criminal proceedings.

Article 10 of Directive 2016/680, read in conjunction with Article 4(b) and (c) and Article 8 of that directive and interpreted in the light of Articles 7, 8 and 52(1) of the Charter of Fundamental Rights,

must be interpreted as meaning that the collection and processing of biometric and genetic data, such as photographs, fingerprints and samples in order to create a DNA profile, in so far as they constitute a serious interference with the right to the protection of personal data, are permitted only where strictly necessary for the pursuit of objectives linked to serious crime, which national law must clearly identify. The nature and amount of personal data processed must be strictly appropriate and consistent with the objective and purpose pursued. In that regard, national law must be compatible with one of the purposes pursued by Directive 2016/680. It must also indicate which are the specific objectives pursued that are likely to contribute to the achievement of that purpose. It is also necessary to state the specific reasons why, despite the fact that it constitutes a serious interference, processing those data, and in particular genetic data, appears strictly necessary for that purpose. National law must, moreover, clearly set out the conditions of all aspects of the processing, that is to say from the conditions of collection to the conditions of access to and deletion of the data, including a precise and necessarily strictly limited definition of the personal scope of the collection and processing measure. Each of those conditions must be limited to what is strictly necessary. The rules thus defined must prove to be capable of actually protecting persons against the risks of abuse posed, in particular, by the processing of genetic data. It will be for the referring court to ensure that all those requirements are scrupulously fulfilled.

* * *

(1) Original language: French.

ECLI:EU:C:2025:140

See also my Opinion in Ligue des droits humains (C‑817/19, EU:C:2022:65, paragraph 2).

3According to the ‘great principle’ by which Zadig, who had become the king’s prime minister, had exercised his office (in Voltaire, Zadig or the Book of Fate, Éditions Pocket, Paris, 2020, p. 41).

4OJ 2016 L 119, p. 89.

5DV No 53, of 27 June 2014, last amended and supplemented by CV No 85, of 2 October 2020, supplemented by DV No 20 of 9 March 2021.

6Law on Bulgarian identity documents.

7DV No 90 of 31 October 2014, last amended by DV No 57 of 28 July 2015.

8The number of fingerprints taken is not specified in the file before the Court of Justice.

9It is clear from the file before the Court that the content of the police record is described as including a photograph or photographs, without the number or content of the photograph or photographs being further specified.

10Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), ‘the GDPR’.

11The recording, by the authorities competent for that purpose, in a Member State’s criminal files of personal data such as those used in the creation of a police record constitutes the processing of those data for the purposes of Directive 2016/680: see Article 3(2) and (7) of the directive. See also, by analogy, judgment of 12 May 2021, Bundesrepublik Deutschland (Interpol red notice) (C‑505/19, EU:C:2021:376, paragraph 111).

12I would note that the number of fingerprints taken is not specified.

13Again, the number and content are not specified.

14See, by analogy, judgments of 16 July 2020, Facebook Ireland and Schrems (C‑311/18, EU:C:2020:559, paragraph 171), and of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters) (C‑245/19 and C‑246/19, EU:C:2020:795, paragraph 73).

15On the relationship between the sensitive nature of data and the seriousness of the interference, see in particular judgments of 24 September 2019, GC and Others (De-referencing of sensitive data) (C‑136/17, EU:C:2019:773, paragraph 44), and of 6 October 2020, La Quadrature du Net and Others (C‑511/18, C‑512/18 and C‑520/18, EU:C:2020:791, paragraph 142).

16This is confirmed by the statistics provided by the French Government in its written observations.

17Article 219(1) of the NPK.

18Article 6(a) of Directive 2016/680. Emphasis added. The other categories covered by that provision are persons convicted of a criminal offence (Article 6(b)), victims (Article 6(c)) and other parties such as witnesses (Article 6(c)).

19It is indeed clear from Article 1 of Directive 2016/680 that the purpose of the latter is to lay down ‘rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties …’.

20See recital 35 of Directive 2016/680.

21See recital 37 of Directive 2016/680.

22See Article 52 of Directive 2016/680.

23See Article 53 of Directive 2016/680.

24See Article 54 of Directive 2016/680.

25See Article 6(a) of Directive 2016/680.

26In particular Article 6(a) of Directive 2016/680.

27Judgment of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters) (C‑245/19 and C‑246/19, EU:C:2020:795, paragraph 49).

28See judgment of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters) (C‑245/19 and C‑246/19, EU:C:2020:795, paragraph 60).

29See judgment of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters) (C‑245/19 and C‑246/19, EU:C:2020:795, paragraph 66).

30See judgment of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters) (C‑245/19 and C‑246/19, EU:C:2020:795, paragraph 79).

31See, by analogy, judgment of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters) (C‑245/19 and C‑246/19, EU:C:2020:795, paragraph 82 and the case-law cited). The issue of the appropriate conclusions to be drawn from any finding of illegality of evidence obtained in breach of EU law on the protection of personal data is a subsequent issue.

32See judgments of 2 October 2018, Ministerio Fiscal (C‑207/16, EU:C:2018:788, paragraph 57), and of 2 March 2021, Prokuratuur (Conditions of access to data relating to electronic communications) (C‑746/18, EU:C:2021:152, paragraph 33).

33It will be recalled that that article of the Charter is directly based on Article 6(2) and (3) of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’), as is clear from the explanations to the Charter. Article 48 of the Charter operates as a minimum threshold of protection and must be interpreted in the light of Article 6(2) and (3) of the ECHR, as well as the relevant case-law of the European Court of Human Rights: see judgment of 5 September 2019, AH and Others (Presumption of innocence) (C‑377/18, EU:C:2019:670, paragraph 41).

34OJ 2016 L 65, p. 1.

35Article 2 of Directive 2016/343.

36I note, however, that, without being translated into a specific requirement in the body of Directive 2016/343, the issue of the sufficiency of the evidence is touched upon in recital 16 thereof, the final sentence of which states that ‘before taking a preliminary decision of a procedural nature the competent authority might first have to verify that there are sufficient elements of incriminating evidence against the suspect or accused person to justify the decision concerned, and the decision could contain reference to those elements’ (emphasis added).

37As the Court held concerning a judicial decision having as its sole purpose the potential continued detention on remand pending trial of an accused person, a decision which, according to the Court, seeks only to resolve the question whether that person must be released or not, in the light of all the relevant circumstances, without establishing whether the person is guilty of having committed the offence with which he is charged: see judgment of 28 November 2019, Spetsializirana prokuratura (C‑653/19 PPU, EU:C:2019:1024, paragraph 35).

38Judgment of 16 November 2021, Prokuratura Rejonowa w Mińsku Mazowieckim and Others (C‑748/19 to C‑754/19, EU:C:2021:931, paragraph 88).

39Judgment of 5 September 2019, AH and Others (Presumption of innocence) (C‑377/18, EU:C:2019:670, paragraph 46).

40In the light of the grounds of the order for reference (see in particular paragraph 57 thereof), the wording of that fourth question must be reformulated so as to concern the interpretation of Article 4(1)(b), and not (a), of Directive 2016/680.

41For the purposes of the analysis, I note that the creation of a police record falls within the scope of Article 10(a) of Directive 2016/680. It would appear from the file that the photographs are taken by the competent authorities which create the police record, and that those authorities therefore do not use photographs which might have been manifestly made public by the data subject, for example on social networks, thus excluding the application of Article 10(c) of that directive.

42On the relationship between the principles of the necessity of processing and data minimisation, see, by analogy, judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA (C‑708/18, EU:C:2019:1064, paragraph 48).

43Which is generally required by the Court in the event of derogations from and restrictions on the principle of the protection of personal data: see, inter alia, judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA (C‑708/18, EU:C:2019:1064, paragraph 46 and the case-law cited). That formulation of the threshold set out in Article 10 of Directive 2016/680 appears to be consistent with what is required by the Court where so-called sensitive data is concerned: see in particular judgment of 6 October 2020, Privacy International (C‑623/17, EU:C:2020:790, paragraph 68 and the case-law cited).

44See footnote 15 of this Opinion.

45See recital 27 of Directive 2016/680.

46See judgment of 24 February 2022, Commissioner of An Garda Síochána and Others (C‑140/20, EU:C:2022:258, paragraph 59).

47Judgment of 6 October 2020, La Quadrature du Net and Others (C‑511/18, C‑512/18 and C‑520/18, EU:C:2020:791, paragraph 140 and the case-law cited). Emphasis added. See also judgment of 5 April 2022, Commissioner of An Garda Síochána and Others (C‑140/20, EU:C:2022:258, paragraph 59).

48See, by analogy, judgment of 21 December 2016, Tele2 Sverige and Watson and Others (C‑203/15 and C‑698/15, EU:C:2016:970, paragraph 118).

49 See recital 26 of Directive 2016/680.

50 According to the case-law, that principle of minimisation gives substance to the principle of proportionality: see, in the context of the GDPR, judgment of 22 June 2021, <i>Latvijas Republikas Saeima (Penalty points)</i> (C‑439/19, EU:C:2021:504, paragraph 98 and the case-law cited).

51 For an illustration of that relationship, albeit in the context of the GDPR, see judgment of 24 February 2022, <i>Valsts ieņēmumu dienests (Processing of personal data for tax purposes)</i> (C‑175/20, EU:C:2022:124, paragraph 79).

52 For an expression in the case-law of that requirement, see judgment of 11 December 2019, <i>Asociaţia de Proprietari bloc M5A-ScaraA</i> (C‑708/18, EU:C:2019:1064, paragraph 47).

53 See judgment of 24 February 2022, <i>Valsts ieņēmumu dienests (Processing of personal data for tax purposes)</i> (C‑175/20, EU:C:2022:124, paragraph 73 and the case-law cited).

54 Concerning the distinction between purpose and objective, see point 56 of this Opinion.

55 See ECtHR, 22 June 2017, <i>Aycaguer</i> v.<i> France</i> (EC:ECHR:2017:0622JUD000880612, § 34 and the case-law cited).

56 Judgment of 24 February 2022, <i>Valsts ieņēmumu dienests (Processing of personal data for tax purposes)</i> (C‑175/20, EU:C:2022:124, paragraph 83 and the case-law cited). Emphasis added.

57 Judgment of 24 February 2022, <i>Valsts ieņēmumu dienests (Processing of personal data for tax purposes)</i> (C‑175/20, EU:C:2022:124, paragraph 84).

58 The objective pursued may be compared to the tasks of the competent authorities which are referred to in Article 8(1) of Directive 2016/680.

59 See recital 37 of Directive 2016/680.

60 That requirement is also imposed on the EU legislature: see judgment of 17 October 2013, <i>Schwarz</i> (C‑291/12, EU:C:2013:670).

61 As regards access to data, the Court has held that national law cannot be limited to requiring that the authorities’ access to the data be consistent with the objective pursued, but must also lay down the substantive and procedural conditions governing that use (see judgment of 5 April 2022, <i>Commissioner of An Garda Síochána and Others</i> (C‑140/20, EU:C:2022:258, paragraph 104)).

62 This was confirmed by the Bulgarian Government in its reply to a written question from the Court. However, those objectives, set out in the Bulgarian legislation in a general and cumulative manner, are not, taken individually, capable of justifying the same interferences with the right to protection of personal data: see judgment of 5 April 2022, <i>Commissioner of An Garda Síochána and Others</i> (C‑140/20, EU:C:2022:258, paragraph 57 and the case-law cited).

63 In the context of combating serious crime, the Court has already held, inter alia, after acknowledging that the legitimacy of that objective, and the fact that its effectiveness could depend to a great extent on the use of modern investigation techniques, that objective of general interest, ‘however fundamental it may be, does not, in itself, justify that a measure providing for the general and indiscriminate retention of all traffic and location data … should be considered to be necessary.’ (judgment of 5 April 2022, <i>Commissioner of An Garda Síochána and Others</i> (C‑140/20, EU:C:2022:258, paragraph 94).

64 Judgment of 5 April 2022, <i>Commissioner of An Garda Síochána and Others</i> (C‑140/20, EU:C:2022:258, paragraph 69).