Provisional text

delivered on 27 February 2025 (1)

Case C-57/23

JH

Policejní prezidium

(Request for a preliminary ruling from the Nejvyšší správní soud (Supreme Administrative Court, Czech Republic))

( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data in criminal matters – Directive (EU) 2016/680 – National legislation permitting the collection of genetic data in respect of all persons accused or suspected of having committed an intentional criminal offence – Assessment of the necessity of continued retention of a DNA profile by the police on the basis of internal regulations – Whether national case-law may be classified as ‘Member State law’ )

1.This request for a preliminary ruling concerns the interpretation of Article 4(1)(c) and (e), Article 6, Article 8(2) and Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA. (2)

2.The request has been made in the context of a dispute between JH, a natural person, and the policejní prezidium (Police Directorate, Czech Republic) concerning in particular the collection of JH’s biometric and genetic data in the context of criminal proceedings and the retention of such data by the Policie České republiky (Police of the Czech Republic) (‘the Czech Police’).

3.As regards the first question referred for a preliminary ruling by the Nejvyšší správní soud (Supreme Administrative Court, Czech Republic), the present case follows on from the judgments of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), (3) and of 28 November 2024, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data II), (4) in which the Court held that national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a police record conflicted with the requirement to give greater protection to persons in respect of the processing of sensitive personal data. The referring court requests the Court of Justice to clarify its case-law, asking it whether Paragraph 65(1) of zákon č. 273/2008 Sb., o Policii České republiky (Law No 273/2008 on the Police of the Czech Republic), (5) by limiting its application solely to intentional criminal offences, adequately reflects at a structural level the need to assess the proportionality of the collection of biometric and genetic data of data subjects or whether, on the contrary, an additional distinction should be made between such persons based on the seriousness of the criminal offence.

4.As regards the referring court’s second question, the present case follows on from the judgment of 30 January 2024, Direktor na Glavna direktsia ‘Natsionalna politsia’ pri MVR – Sofia, (6) in which the Court of Justice ruled for the first time on the time limits for the retention, for the purpose of combating crime, of personal data of persons who have been convicted by final judgment, in the light of Directive 2016/680. In that judgment, the Court held that that directive establishes a general framework to ensure that the storage of personal data and, more specifically, the period of storage, are limited to what is necessary for the purposes for which those data are stored. (7) The referring court asks the Court of Justice to state whether that case-law is relevant when personal data are retained for the purpose of the prevention, investigation and detection of criminal activity, a purpose which is, by its nature, prospective and unlimited in time. Such a purpose in fact needs such data to be retained for as long as possible.

5.Thus, in the present case, the Court will be required to clarify, first, the concepts of ‘substantive minimisation’ and ‘temporal minimisation’ of biometric and genetic data falling within the scope of Directive 2016/680 when they are collected and retained in that context.

6.Secondly, as regards the third question referred, the Court is called upon for the first time to interpret the concept of ‘Member State law’, within the meaning of Article 8(2) in conjunction with Article 10 of that directive. Specifically, the referring court questions whether national case-law laying down the criteria for obtaining and retaining biometric and genetic data falls within that concept, and to what extent the minimum substantive and procedural conditions for obtaining, retaining and deleting such data must be laid down in Member State law by a provision of general application.

II. Czech law

7.Paragraph 11 of the Law on the Czech Police provides as follows:

‘Police officers and other persons employed by the Police shall:

…

(c) act in such a way that any interference with the rights and freedoms of persons who are the subject of the procedure, or of persons not involved, does not exceed what is necessary in order to attain the objective of that procedure.’

8.According to Paragraph 65 of that law:

‘(1) In performing their tasks, the Police may, for the purpose of future identification of

(a) a person accused of having committed an intentional criminal offence or a person who has been informed that he or she is suspected of having committed such a criminal offence,

(b) a person serving a custodial sentence for committing an intentional criminal offence,

(c) a person subject to coercive medical measures or in preventive detention, or

(d) a wanted person who has been found and whose legal capacity is limited,

take fingerprints, identify physical features, perform measurements of the body, obtain visual, audio, and similar recordings, and take biological samples that make it possible to obtain information about his or her genetic make-up.

(2) If a procedure provided for in subparagraph (1) cannot be performed because the person objects, the police officer shall be entitled to overrule that objection after unsuccessfully requesting the person to submit to it. The way in which the police officer overrules that objection must be proportionate to the strength of the objection. The police officer may not overrule a person’s objection in the case of taking a blood sample or any other similar procedure violating his or her physical integrity.

(3) If a procedure provided for in subparagraph (1) cannot be performed on the spot, the police officer shall be entitled to present the person in order for the procedure to be performed. The police officer shall release the person once the procedure has been performed.

(4) The police officer shall draw up a report on the procedures performed.

(5) The Police shall delete the personal data obtained pursuant to subparagraph (1) as soon as their processing is no longer required for purposes of the prevention, investigation or detection of criminal activity or for the prosecution of criminal offences, or ensuring the safety of the Czech Republic, public order or domestic security.’

9.Paragraph 79 of that law, entitled ‘Basic provisions concerning the processing of personal data in the context of carrying out certain Police tasks’, provides, in subparagraphs (1) and (2) thereof:

‘(1) Subparagraphs 2 to 6 and Articles 79a to 88 shall apply to the processing of personal data for purposes of the prevention, investigation, detection or prosecution of criminal offences, or ensuring the safety of the Czech Republic, public order or domestic security, including for the purposes of tracing people and items.

(2) The Police may process personal data where necessary in order to attain the objectives mentioned in subparagraph (1). The Police may also process personal data in order to protect important interests of a data subject that are linked to the objectives mentioned in subparagraph (1).’

10.Paragraph 82 of the same law reads as follows:

‘(1) The Police shall verify at least once every three years that personal data processed for the purposes mentioned in Paragraph 79(1) are still necessary for the performance of its tasks in that sphere.

(2) For the purposes of the verification referred to in subparagraph (1) the Police are authorised to require production of an extract from a judicial record.

(3) The law enforcement and judicial authorities, the Ministerstvo spravedlnosti [Ministry of Justice, Czech Republic], the Ustavní soud [Constitutional Court, Czech Republic] and the Kancelář prezidenta republiky [Office of the President of the Republic, Czech Republic] shall keep the Police continuously informed, within the limits of their competences, for purposes of the verification referred to in subparagraph (1), of their final decisions, of the statute of limitations for criminal proceedings, of the enforcement of a sentence or of decisions of the President of the Republic relating to criminal proceedings, to sentences or to an amnesty or pardon granted.’

III. <b>Facts of the case and questions referred for a preliminary ruling</b>

11.By decision of 11 December 2015, the Czech Police launched criminal proceedings against JH for the offence of breach of trust.

12.On 13 January 2016, the Czech Police questioned JH in the context of the criminal proceedings and ordered various identification procedures to be performed. Despite JH’s objections, the Czech Police proceeded to take his fingerprints, perform a buccal smear on him from which it created a DNA profile, take photos of him, and draw up a description of him. It then recorded that information in the relevant Czech Police databases.

13.By judgment of the Městský soud v Praze (Prague City Court, Czech Republic) of 15 March 2017, JH was convicted both of the offence of breach of trust and of the crime of misconduct in public office. He was given a suspended custodial sentence of three years, a four-year ban on exercising managerial functions in the public service, including the management of moveable and immoveable assets, and was ordered to pay compensation within the limits of his means.

14.On 8 March 2016, JH applied to the Městský soud v Praze (Prague City Court) for a declaration that the performance of identification procedures under Paragraph 65 of the Law on the Czech Police, the retention of the information and samples obtained thereby, and the creation of an entry in the Czech Police databases constituted unlawful interference.

15.By judgment of 23 June 2022, that court granted JH’s application and ruled that the identification procedures performed by the Czech Police and the retention of those personal data in the Czech Police databases constituted unlawful interference with the fundamental right to privacy. That court consequently ordered the Czech Police to delete from its databases all the personal data obtained as a result of those procedures, with the exception of the buccal smear, which had been destroyed in the meantime.

16.The Městský soud v Praze (Prague City Court) noted that the collection of genetic material represents considerable interference with the fundamental right to privacy, which is protected in particular under Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms. (8) Yet paragraph 65 of the Law on the Czech Police does not provide sufficient guidance for assessing whether that interference is proportionate. In fact, the only verification carried out by the Czech Police before undertaking such collections relates to the intentional nature of the offence committed within the meaning of that provision, and that condition may be regarded as satisfied in the main proceedings.

17.As a result, the Městský soud v Praze (Prague City Court) held that the identification procedures performed by the Czech Police did not satisfy the proportionality requirement and, therefore, constituted unlawful interference. That court stated in that regard that JH was accused only of wrongful conduct, which is a minor criminal offence, that he had no previous convictions and that he was not likely to reoffend. That court also pointed to the fact that, under Paragraph 65(5) of the Law on the Czech Police, the Czech Police must themselves examine internally when the retention of personal data ‘is no longer required for the prevention, investigation or detection of criminal activity’. The same court holds that that legislation gives the Police unlimited time for reflection and tends to give rise to the retention of personal data for an unlimited period of time being overused.

18.The Police Directorate lodged an appeal on a point of law against that judgment before the Nejvyšší správní soud (Supreme Administrative Court).

19.In support of its appeal, the Police Directorate pointed out that the purpose of the processing of personal data was clearly stated in Paragraph 65 of the Law on the Czech Police. It also stated that it had assessed the proportionality of the collection and storing of JH’s personal data, taking into consideration the recidivism factor, the potential escalation of the actions and the fact that JH had committed several offences in the past. As regards the allegedly inadequate publication of the internal regulations applied by the Czech Police when deciding whether to continue to retain personal data, the Police Directorate stated that it had communicated those rules to the public in the context of the right to information.

20.In response, JH noted inter alia that the Czech Police authorities had carried out identification procedures without first examining the proportionality of the interference. JH also criticised the lack of publication of the Czech Police’s guidelines pertaining to the performance of identification procedures.

21.In that context, the referring court wonders, in the first place, whether the requirements laid down in Directive 2016/680 preclude the indiscriminate collection of biometric and genetic data in respect of any person suspected of committing an intentional criminal offence; in the second place, whether the requirements laid down in that directive preclude the storage of such data without a time limit being expressly laid down, and, in the third place, whether the case-law of national administrative courts may qualify as ‘Member State law’ within the meaning of Article 8 of that directive, which lays down the conditions for the lawful processing of personal data.

In those circumstances, the Nejvyšší správní soud (Supreme Administrative Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1) What degree of distinction between individual data subjects is required by Article 4(1)(c) or Article 6 [of Directive 2016/680] in conjunction with Article 10 [of that directive]? Is it compliant with the obligation to minimise personal data processing, and with the obligation to distinguish between various categories of data subjects, for national law to permit the collection of genetic data in respect of all persons suspected or accused of having committed an intentional criminal offence?

(2) Is it in accordance with Article 4(1)(e) of Directive 2016/680 if the necessity of continued retention of a DNA profile is assessed, with a reference to the general prevention, investigation, and detection of criminal activity, by Police authorities on the basis of their internal regulations, which frequently means in practice that sensitive personal data is retained for an unspecified period without a maximum limit for the duration of the retention of that personal data being set? If not, by what criteria should the proportionality of the period of the retention of the personal data collected and retained for that purpose be assessed?

(3) In the case of particularly sensitive personal data falling under Article 10 of Directive 2016/680, what is the minimal scope of the substantive or procedural conditions for obtaining, retaining, and deleting such data that must be regulated by a ‘provision of general application’ in the law of a Member State? Can judicial case-law qualify as ‘Member State law’ within the meaning of Article 8(2) in conjunction with Article 10 of [that directive]?’

23.

JH, the Czech Government, Ireland, the Polish Government and the European Commission submitted written observations.

24.

At the hearing held on 28 November 2024, JH, the Czech Government, Ireland, the Polish Government and the European Commission presented oral argument and were requested, inter alia, to answer questions for an oral answer put by the Court.

As a preliminary point, it should be recalled that the questions referred for a preliminary ruling by the referring court concern the collection and retention of biometric and genetic data, which are particular categories of personal data, the processing of which is governed by Article 10 of Directive 2016/680.

26.

The purpose of that provision is to ensure enhanced protection of the data subject, since the data in question, because of their particular sensitivity and the context in which they are processed, are liable, as is apparent from recital 37 of that directive, to create significant risks to fundamental rights and freedoms, such as the right to respect for one’s private life and the right to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. (9)

More specifically, Article 10 of Directive 2016/680 lays down the requirement that the processing of sensitive data be allowed ‘only where strictly necessary’, which constitutes a strengthened condition for the lawful processing of such data and entails, inter alia, a particularly strict review of compliance with the principle of ‘data minimisation’, as derived from Article 4(1)(c) of Directive 2016/680. That requirement constitutes a specific application of that principle to those sensitive data. (10)

28.

In the light of those considerations, I will propose in this Opinion that the Court should answer the referring court by seeking to determine whether the national legislation at issue in the main proceedings satisfies the requirement that the collection and retention of data subjects’ biometric and genetic data should be allowed only where ‘strictly necessary’, within the meaning of Article 10 of Directive 2016/680.

29.

By its first question, the referring court asks in essence whether Article 4(1)(c) or Article 6, in conjunction with Article 10 of Directive 2016/680, should be interpreted as precluding national legislation which permits the collection of biometric and genetic data in respect of all persons accused or suspected of having committed an intentional criminal offence.

1. Admissibility

30.

In its written observations, the Commission contended that the first question was inadmissible on the grounds that, in the case in the main proceedings, the collection of JH’s biometric and genetic data by the Czech Police took place on 13 January 2016, that is to say, before the entry into force of Directive 2016/680 on 5 May 2016, and before the expiry of the transposition period, set as 6 May 2018 by Article 63(1) of that directive.

31.

While it is true that Directive 2016/680 does not contain any transitional provisions concerning data collected before 5 May 2016, it seems to me relevant to refer to recital 96 of that directive, which states that ‘processing already under way on that date should be brought into conformity with [that] Directive within the period of two years after which [the] Directive enters into force’. (11)

32.

According to Article 3(2) of Directive 2016/680, ‘processing’ means ‘any operation or set of operations which is performed on personal data or on sets of personal data … such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction’. (12)

33.

With the exception of the buccal smear that was destroyed in the meantime, JH’s personal data collected before 5 May 2016 continue to be stored in the Czech Police databases. Those data therefore have continued to be processed after that date, that is to say, after the entry into force of Directive 2016/680.

34.

That is why it appears to me that the personal data that was collected lawfully under Framework Decision 2008/977/JHA, (13) but which would have been collected in infringement of the principles laid down in Directive 2016/680 if they had been collected after the date of the entry into force of that directive, should not have continued to be processed and, therefore, retained under that directive.

35.

In those circumstances, the referring court’s first question is, in my view, admissible.

36.

The referring court is uncertain whether Paragraph 65(1) of the Law on the Czech Police is compatible with the obligation placed on Member States by Article 6 of Directive 2016/680 to make a distinction between different categories of data subject, and with the principle of minimising the processing of personal data set out in Article 4(1)(c) of that directive.

37.

More specifically, that court is uncertain whether the sole condition laid down by the national legislation for authorising the collection of biometric and genetic data from a natural person, namely the existence of an intentional criminal offence, establishes a sufficient distinction between the various data subjects, or whether an additional degree of individualisation is required, with the result that a distinction would need to be made on the basis of the seriousness of the intentional criminal offences in respect of which such data could be collected automatically.

38.

In order to answer that question, it is necessary, first, to point out that although Article 6 of Directive 2016/680 requires Member States to make a clear distinction between the data of the different categories of data subjects, in such a way that they are not subject without distinction to the same degree of interference with their fundamental right to protection of their personal data, (14) the expression ‘where applicable and as far as possible’, used in that article, clearly indicates that it is not necessarily possible to draw that distinction between such data. (15)

39.

The obligation which Article 6 of Directive 2016/680 imposes on the Member States is therefore not absolute and the words ‘such as’, which it contains, indicate that the categories of persons listed there are not exhaustive. (16)

40.

Secondly, it is important to revisit the conclusions that must be drawn from the judgment in Recording of biometric and genetic data I, in so far as in that judgment the Court interpreted Article 4(1)(c) of Directive 2016/680, under which the personal data processed must be adequate, relevant and not excessive in relation to the purposes for which they are processed.

41.

In that judgment, the Court held that national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution (17) is, in principle, contrary to the requirement laid down in Article 10 of Directive 2016/680 that processing of the special categories of data referred to in that article is to be allowed ‘only where strictly necessary’. (18) Such legislation is liable to lead, in an indiscriminate and generalised manner, to collection of the biometric and genetic data of most accused persons, since the concept of ‘intentional criminal offence subject to public prosecution’ is particularly general and is liable to apply to a large number of criminal offences, irrespective of their nature and gravity. (19)

42.

In the present case, Paragraph 65(1) of the Law on the Czech Police provides that a person’s biometric and genetic data may be collected not only where that person is accused of having committed an intentional criminal offence but also where he or she is suspected of having committed such an offence. That provision does not therefore relate only to a small number of situations but covers, again too broadly, a majority of criminal offences in respect of which such data may be collected.

43.

I note that, admittedly, that provision merely gives the Police authorities the option to collect such data, whereas the creation of a police record provided for by the Bulgarian legislation at issue in the case giving rise to Recording of biometric and genetic data I applied mandatorily to all persons accused of intentional offences subject to public prosecution. (20) That might give the impression that the Czech legislation, by giving greater discretion to the Police authorities, makes it easier to limit the cases in which the biometric and genetic data of data subjects can be collected.

44.

However, I note that neither Paragraph 65(1) of the Law on the Czech Police nor Paragraph 11 of that law – under which the Police authorities must merely carry out a simple proportionality test – lays down an obligation for those authorities to assess the strict necessity to collect the biometric and genetic data of the persons concerned. That creates a problem on two counts.

45.

First, the mere fact that a person has committed or is suspected of committing an intentional criminal offence cannot in all cases be regarded as a factor that in itself enables it to be presumed that the collection of his or her biometric and genetic data is strictly necessary in the light of the purposes that it pursues. (21)

46.

The Court has already held that such ‘strict necessity’ can be determined only in the light of all the relevant factors, such as, in particular, the nature and gravity of the presumed offence of which a person is accused, the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the person in issue. (22)

47.

Limiting the collection of biometric and genetic data solely to cases of offences with an intentional element is therefore not sufficient to satisfy the requirement laid down in Article 10 of Directive 2016/680, which states that processing of the special categories of data referred to in that article is to be allowed ‘only where strictly necessary’.

48.

Secondly, I note that the Court has held that, in the absence of an obligation on the competent authority, under national law, to assess whether the processing of personal data which it has carried out or which it intends to carry out is ‘strictly necessary’, a court asked to rule on such processing by that competent authority cannot ensure, in place of that authority, compliance with that authority’s obligation under Article 10 of Directive 2016/680. (23)

49.

The current legal framework in the Czech Republic leads to situations in which, first, the police authorities do not carry out a review of strict proportionality before collecting biometric and genetic data of data subjects and, secondly, the administrative courts must take the place of the police authorities in carrying out such a review.

50.

Therefore, in the absence of any obligation laid down in the Czech legislation for the national police authorities to assess the strict necessity, within the meaning of Article 10 of Directive 2016/680, of collecting the biometric and genetic data of data subjects in each specific case, that legislation does not comply with the principle of the minimisation of the processing of personal data laid down in that provision.

51.

It follows from the above considerations that Article 4(1)(c) and Article 6 of Directive 2016/680, in conjunction with Article 10 of that directive, must be interpreted as precluding national legislation which allows the collection of biometric and genetic data in respect of all persons suspected or accused of having committed an intentional criminal offence where that legislation does not provide for an obligation on the part of the competent authority to assess, in each specific case, the ‘strict necessity’ of the processing it has performed or is contemplating performing.

52.

By its second question, the referring court asks, in essence, whether Article 4(1)(e) of Directive 2016/680 must be interpreted as precluding national legislation under which the need for continued storage of biometric and genetic data, with reference to the prevention and detection of criminal offences, is assessed by police authorities on the basis of their internal regulations without that legislation laying down a maximum period of retention, with the result that such data are, in the majority of cases, retained for an unspecified period. That court also asks on the basis of what criteria should the proportionality of the period of retention of the personal data collected and retained for that purpose be assessed.

53.

The Court asked the referring court if it considered it necessary to continue with this question in view of the DGPN judgment, delivered after its request for a preliminary ruling was lodged. The referring court, having requested the parties to the main proceedings to express their views, sought to continue with its questions and expressed doubts as to whether the findings reached by the Court in that judgment could be fully transposed to the second question referred.

54.

In that judgment, the Court ruled for the first time on time limits for the storage – for the purposes of combating crime – of personal data of persons who have been convicted by final judgment of a criminal offence, in the light of Directive 2016/680, with regard to national legislation providing for the storage, until the death of those persons, of such data, including sensitive data, without any possibility of reassessing that period in the light of circumstances.

With regard to the proportionality of the period for which the personal data will be stored, the Court stated that recital 26 of Directive 2016/680 and Article 4(1)(e) and Article 5 of that directive establish a general framework requiring the Member States, first, to provide that those data are to be stored for no longer than is necessary for the purposes for which the data are processed (24) and, secondly, to provide for the setting of appropriate time limits for the erasure of those data or for the periodic review of the need for the storage of those data and procedural measures to ensure that those time limits are observed, (25) while leaving it to the Member States to determine, in compliance with that framework, the specific situations in which the protection of the fundamental rights of the data subject requires the erasure of those data and the time at which those data must be erased. (26)

Regarding more specifically biometric and genetic data, as I noted in particular in point 27 of this Opinion, Article 10 of Directive 2016/680 lays down the requirement that the processing of sensitive data is allowed ‘only where strictly necessary’. (27)

Furthermore, the Court has stated that those provisions do not require the Member States to define absolute time limits for the storage of personal data, beyond which those data must be automatically erased. (28)

Despite those findings, the referring court points out that, unlike the question referred in the case giving rise to the judgment in DGPN, its second question was formulated in the light of an objective and purpose of processing consisting in the general prevention of criminal offences.

That court is therefore uncertain how to reconcile, on the one hand, the principle of temporal minimisation of the processing of personal data and, on the other hand, such an objective, which is, by its nature, prospective and unlimited in time, and which presupposes retaining for as long as possible the personal data of a maximum number of people.

It is true that in the case giving rise to the judgment in DGPN, the Court was asked about a situation in which the personal data, including the biometric and genetic data, of a person convicted by final judgment of an intentional criminal offence subject to public prosecution were stored in Police records without any time limit other than the death of that person, even after that person was legally rehabilitated. (29)

However, those circumstances do not, in my view, prevent the same findings being applied to a situation such as that in the main proceedings, in which the personal data are stored for the purposes of the general prevention of criminal offences.

The Court recognises that the storage of personal data may contribute to the objective of general interest set out in recital 27 of Directive 2016/680, which states that, for the prevention, investigation and prosecution of criminal offences, it is necessary for competent authorities to process such data collected in the context of the prevention, investigation, detection or prosecution of specific criminal offences beyond that context in order to develop an understanding of criminal activities and to make links between different criminal offences detected. (30)

That means that the national authorities are entitled to store personal data for future purposes without specifying a maximum period for the storage of such data. The existence and functioning of certain procedural safeguards are, however, all the more necessary in such a situation.

Thus, although Directive 2016/680 does not require Member States to lay down absolute time limits for the storage of personal data, beyond which the data should be automatically deleted, periodic review of the need to retain such data seems to me to be of crucial importance.

I note in that regard that, first, Paragraph 65(5) of the Law on the Czech Police provides for the deletion of the personal data obtained as soon as their processing is no longer required for the purpose of the prevention, investigation, detection or prosecution of criminal offences and, secondly, Paragraph 82 of that law requires the Police authorities to verify every three years the need to continue the processing of personal data of data subjects.

That legislation, which provides for the deletion of such data and a review at regular intervals of the need to retain them should, however, be subject to strict safeguards making it possible to protect data subjects effectively against the risk of abuse.

First, as recalled in recital 33 of Directive 2016/680, Member State law regulating the collection and retention of personal data should specify at least the procedures laid down for the destruction of those data.

Secondly, under Article 13(2)(b) and Article 14(d) of that directive, every data subject is entitled to know the period for which his or her personal data will be stored or, where that is not possible, what criteria are used to determine that period. Such information is needed to enable data subjects to exercise their rights under Articles 7 and 8 of the Charter, to request access to their personal data being processed and, where appropriate, the rectification or removal of those data, and to seek an effective remedy before a tribunal under the first paragraph of Article 47 of the Charter.

Thirdly, as regards the need to store biometric and genetic data in particular, the national legislation should lay down provisions stating clearly and precisely that such storage must be limited to what is strictly necessary to achieve the objective it pursues in order to comply with the requirements of Article 10 of Directive 2016/680.

The assessment of the period of retention of such data should take into account various criteria, such as the nature and seriousness of the offences established, the length of time that has elapsed since the offences, the remaining legal retention period and the likelihood that the data subject might be involved in other criminal offences, (31) or other circumstances, such as the particular context in which that offence was committed, its potential connection with other current proceedings, or the background or profile of that person.

It is not apparent either from the order for reference or from the observations submitted to the Court by the participants in the present proceedings that the Czech legislation on the retention of biometric and genetic data provides adequate safeguards relating to the procedures for the destruction of such data, for informing data subjects or for assessing why the retention of such data is ‘strictly necessary’ within the meaning of Article 10 of Directive 2016/680.

It follows from the above considerations that Article 4(1)(e), read in the light of Article 10, of Directive 2016/680 should be interpreted as not precluding national legislation that does not provide for a maximum period for the retention of biometric and genetic data, as long as that legislation provides for the review, at regular intervals, of the need to retain such data. Those provisions require, however, that such a review should be subject to strict procedural safeguards and ensure that such retention does not exceed a period that is strictly necessary in the light of the purposes for which those data are processed.

By its third question, the referring court asks, in essence, first, whether Article 8(2) and Article 10 of Directive 2016/680 must be interpreted as meaning that a provision of general application should lay down certain minimum substantive or procedural conditions for obtaining, retaining and deleting biometric and genetic data, and, secondly, whether national case-law which lays down the conditions for obtaining, retaining and deleting such data can qualify as ‘Member State law’ within the meaning of those provisions.

The Court is requested to answer that question in the context of the legal system at issue in the main proceedings, regulated by Paragraph 65 of the Law on the Czech Police, which has the following characteristics.

First, Paragraph 65 is implemented by means of internal procedural measures of the Czech Police in the form of Guidelines set by the Police President. It is common ground that those guidelines cannot qualify as ‘Member State law’ within the meaning of Article 8(2) of Directive 2016/680.

Next, while there is no doubt that Paragraph 65 of the Law on the Czech Police qualifies as ‘Member State law’, it does not lay down the specific conditions for obtaining, retaining and deleting biometric and genetic data relating to data subjects.

Lastly, that legislation is supplemented by the case-law of the administrative courts, according to which the Police authorities must apply the proportionality test in each specific case, taking into account principally the data subject’s criminal record, the particular seriousness of the type of criminal offence in respect of which that person has been detained for the purpose of carrying out identification procedures, the personality of the perpetrator and, in the context of an ex post deletion request, the length of time that has elapsed since the criminal offence was committed and any other conduct of the perpetrator. (32) The criteria on which that case-law is based are published and available to the public.

In the light of these considerations, I propose that the Court’s answer should be that, even though case-law can qualify as ‘Member State law’ within the meaning of Directive 2016/680, such case-law cannot, however, be a substitute for the safeguards that a provision of general application is required to lay down with regard to obtaining, retaining and deleting biometric and genetic data.

Consequently, it is true that several considerations support the idea that case-law meets the condition of ‘Member State law’, within the meaning of Article 8(2) of that directive.

First, recital 33 of Directive 2016/680 states that ‘where [that] Directive refers to Member State law, a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament’, provided ‘such a Member State law, legal basis or legislative measure [is] clear and precise and its application [is] foreseeable for those subject to it, as required by the case-law of the Court of Justice and the European Court of Human Rights’.

Secondly, the European Court of Human Rights acknowledged in its judgment of 16 April 2002, Société Colas Est and Others v. France, (33) that the term ‘law’ within the meaning of Article 8(2) of the ECHR is to be understood in its ‘substantive’ sense, not in its ‘formal’ sense. Therefore, in a sphere covered by the written law, the ‘law’ is the provision in force as the competent courts have interpreted it.

The Court of Justice itself has moreover confirmed that the term ‘law’, used in the expression ‘in accordance with the law’ in Article 8(2) of the ECHR and in the expression ‘legitimate basis laid down by law’ in Article 8(2) of the Charter, must be understood in its substantive sense and not in its formal sense. (34)

Thirdly, the Court, in its judgment of 21 June 2022, Ligue des droits humains, (35) held that the requirement that any limitation on the exercise of fundamental rights must be provided for by law implies that the act which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned, bearing in mind, on the one hand, that that requirement does not preclude the limitation in question from being formulated in terms which are sufficiently open to be able to adapt to different scenarios and keep pace with changing circumstances and, on the other hand, that the Court may, where appropriate, specify, by means of interpretation, the actual scope of the limitation in the light of the very wording of the EU legislation in question as well as its general scheme and the objectives it pursues, as interpreted in view of the fundamental rights guaranteed by the Charter. (36)

Therefore, provided there exists a legal basis in domestic law, case-law that is, first, accessible and predictable and, secondly, settled and has not been routinely called into question, provides sufficient substantive characteristics to come within the concept of ‘Member State law’, within the meaning of Article 8(2) of Directive 2016/680. (37)

However, I note that in certain cases, in particular where the right to the freedom enshrined in Article 6 of the Charter is at issue, settled case-law confirming a consistent administrative practice on the part of the Police cannot suffice (38) and that only the adoption of rules of general application (and thus of rules complying with the formal characteristics of a law) provides the necessary guarantees in so far as such wording sets out the limits of the flexibility of those authorities in the assessment of the circumstances of each specific case in a manner that is binding and known in advance. (39)

The European Court of Human Rights also states that any interference by a public authority with an individual’s right to respect for private life must be ‘in accordance with the law’. (40) That expression relates to the ‘quality of the law’ in question, which, in the context of the protection of sensitive personal data, must comply with the requirement of foreseeability. This implies that the law must give a clear definition of the discretion of the public authorities (41) and use terms that are clear enough to give individuals an adequate indication as to the circumstances in which and the conditions on which the authorities are entitled to resort to measures affecting their rights under the ECHR. (42)

Consequently, the European Court of Human Rights acknowledged that legal provisions which allowed the processing of biometric personal data, to the extent that they were broadly formulated and appeared to allow the processing of such data in connection with any judicial proceedings, did not meet the ‘quality of law’ requirement. Indeed, it is essential to have detailed rules governing the scope and application of measures as well as strong safeguards against the risk of abuse and arbitrariness. (43)

So far as the present case is concerned, having noted, first, that biometric and genetic data, because of their particular sensitivity, are liable to give rise to significant risks to the fundamental rights and freedoms of data subjects, (44)

and, secondly, that the processing of such data should be allowed ‘only where strictly necessary’, I consider that it is particularly questionable to protect the rights of data subjects only by means of national case-law, where the law in its formal sense provides for an inadequate proportionality test, which does not correspond to the standard of protection required by Article 10 of Directive 2016/680.

89.

The provisions of the Law on the Czech Police, in particular Paragraph 65 of that law, are formulated too broadly and do not impose adequate predetermined limits on the discretion enjoyed by the Police authorities in relation to obtaining, retaining and deleting biometric and genetic data. In the absence of such limits, the conditions governing the processing of such data, which derive solely from the case-law of the Czech administrative courts, cannot meet the requirement of sufficiently strict safeguards, set out in an act that is binding and foreseeable in its application, which must apply when it comes to the processing of such data.

90.

Furthermore, while the transposition of a directive does not necessarily require legislative action in each Member State, even where the settled case-law interprets the provisions of national law in a manner deemed to satisfy the requirements of a directive, that cannot achieve the clarity and precision needed to meet the requirement of legal certainty. (45) Therefore, national case-law, even where it lays down a list of criteria for assessing the proportionality of the processing of biometric and genetic data of data subjects in each specific case, cannot make up for the absence of a strict proportionality test laid down by a law in the formal sense of the word.

91.

It follows from the above considerations that Article 8(2) and Article 10 of Directive 2016/680 must be interpreted as precluding national case-law, even where it may qualify as ‘Member State law’ within the meaning of that directive, from being a substitute for a provision of general application that does not provide for a strict test in each specific case, conducted by the Police authorities, of the need to collect and to retain the biometric and genetic data of data subjects.

92.

In the light of all the foregoing considerations, I propose that the Court answer the questions referred for a preliminary ruling by the Nejvyšší správní soud (Supreme Administrative Court, Czech Republic) as follows:

Article 4(1)(c) and (e), Article 6, Article 8(2) and Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA,

must be interpreted as:

–precluding national legislation which allows the collection of biometric and genetic data in respect of all persons suspected or accused of having committed an intentional criminal offence where that legislation does not provide for an obligation on the part of the competent authority to assess in each specific case the ‘strict necessity’ of the processing it has performed, or is contemplating performing;

–not precluding national legislation that does not provide for a maximum period for the retention of biometric and genetic data, as long as that legislation provides for the review, at regular intervals, of the need to retain such data. Those provisions require, however, that such a review should be subject to strict procedural safeguards and ensure that such retention does not exceed a period that is strictly necessary in the light of the purposes for which those data are processed;

–precluding national case-law, even where it may qualify as ‘Member State law’ within the meaning of Directive 2016/680, from being a substitute for a provision of general application that does not provide for a strict test in each specific case, conducted by the Police authorities, of the need to collect and to retain the biometric and genetic data of data subjects.

—

1

Original language: French.

OJ 2016 L 119, p. 89.

3

C‑205/21, ‘Recording of biometric and genetic data I’, EU:C:2023:49.

4

C‑80/23, EU:C:2024:991.

In the version applicable to the dispute in the main proceedings (‘the Law on the Czech Police’).

6

C‑118/22, ‘DGPN’, EU:C:2024:97.

See DGPN (paragraph 52).

8

Signed at Rome on 4 November 1950, ‘the ECHR’.

9

The ‘Charter’. See judgment of 28 November 2024, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data II) (C‑80/23, EU:C:2024:991, paragraph 53 and the case-law cited).

10

See DGPN (paragraph 48).

11

Recital 96 of Directive 2016/680 also states that ‘the requirements of [that] Directive concerning the prior consultation of the supervisory authority should not apply to the processing operations already under way on that date’.

12

Italics added.

13

Council Framework Decision of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (OJ 2008 L 350, p. 60).

14

See Recording of biometric and genetic data I (paragraph 83).

15

See judgment of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation) (C‑180/21, EU:C:2022:967, paragraph 48).

16

See Recording of biometric and genetic data I (paragraph 84).

17

The Bulgarian legislation at issue provided for the compulsory collection, in order for them to be entered in a record, of biometric and genetic data concerning a natural person in respect of whom sufficient evidence of his or her guilt as regards an intentional offence subject to public prosecution has been gathered, enabling, under national law, him or her to be accused.

18

See Recording of biometric and genetic data I (paragraph 128).

19

See Recording of biometric and genetic data I (paragraph 129).

See Recording of biometric and genetic data I (paragraph 113).

21

See Recording of biometric and genetic data I (paragraph 130).

22

See Recording of biometric and genetic data I (paragraph 132).

23

See judgment of 28 November 2024, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data II) (C‑80/23, EU:C:2024:991, paragraph 57).

24

See DGPN (paragraphs 43 and 45).

See DGPN (paragraph 44).

26

See DGPN (paragraph 52).

See DGPN (paragraph 48).

28

See DGPN (paragraph 52).

29

See DGPN (paragraph 32).

30

See DGPN (paragraph 55).

31

See, to that effect, Opinion of Advocate General Szpunar in TC (C‑492/18 PPU, EU:C:2018:875, point 46).

32

The referring court makes reference to the most recent decisions such as judgments of the Nejvyšší správní soud (Supreme Administrative Court) 5 As 254/2019-49 of 18 May 2022 (paragraphs 17 and 18), and 5 As 241/2019-46 of 18 May 2022 (paragraphs 18 and 19).

33

CE:ECHR:2002:0416JUD003797197, § 43.

34

See judgment of 16 November 2023, Roos and Others v Parliament (C‑458/22 P, EU:C:2023:871, paragraphs 60 and 61).

35

C‑817/19, EU:C:2022:491.

36

See judgment of 21 June 2022, Ligue des droits humains (C‑817/19, EU:C:2022:491, paragraph 114).

37

See, to that effect, Opinion of Advocate General Szpunar in TC (C‑492/18 PPU, EU:C:2018:875, point 46).

38

See judgment of 15 March 2017, Al Chodor (C‑528/15, EU:C:2017:213, paragraph 45). The Court reached that conclusion in the context of the interpretation of Regulation (EU) No 604/2013 of the European Parliament and of the Council of 26 June 2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (OJ 2013 L 180, p. 31). The Court was being asked whether the criteria defining the existence of a risk of a foreigner absconding should be laid down by law and whether the word ‘law’ included settled case-law which confirms a consistent administrative practice.

39

See judgment of 15 March 2017, Al Chodor (C‑528/15, EU:C:2017:213, paragraph 44). In order to reach that solution, the Court states that it is essential that the criteria which define the existence of a risk of absconding, which constitutes the basis for detention, are defined clearly by an act which is binding and foreseeable in its application (paragraph 42). Taking account of the purpose of the provisions concerned, and in the light of the high level of protection which follows from their context, only a provision of general application could meet the requirements of clarity, predictability, accessibility and, in particular, protection against arbitrariness (paragraph 43).

40

See Guide on Article 8 of the European Convention on Human Rights, updated on 31 August 2023, available at https://ks.echr.coe.int/documents/d/echr-ks/guide_art_8_eng (paragraph 17).

41

See the guide cited in footnote 40 of the present Opinion (paragraph 19).

42

See judgment of the ECtHR, 12 June 2014, Fernández Martínez v. Spain (CE:ECHR:2014:0612JUD005603007, § 117).

43

See judgment of the ECtHR, 4 July 2023, Glukhin v. Russia (CE:ECHR:2023:0704JUD001151920, §§ 82 and 83).

44

See point 26 above.

45

See, inter alia, judgment of 23 April 2009, Commission v Belgium (C‑292/07, EU:C:2009:246, paragraphs 120 and 122).