CJEU Case C-205/21 / Judgement

Criminal proceedings against V.S.
Policy area
Justice, freedom and security
Deciding body type
Court of Justice of the European Union
Deciding body
Court (Fifth Chamber)
Typ
Decision
Decision date
26/01/2023
ECLI (European case law identifier)
ECLI:EU:C:2023:49
  • CJEU Case C-205/21 / Judgement

    Key facts of the case:

    Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Principles relating to processing of personal data – Purpose limitation – Data minimisation – Article 6(a) – Clear distinction between personal data of different categories of data subjects – Article 8 – Lawfulness of processing – Article 10 – Transposition – Processing of biometric data and genetic data – Concept of ‘processing authorised by Member State law’ – Concept of ‘strictly necessary’ – Discretion – Charter of Fundamental Rights of the European Union – Articles 7, 8, 47, 48 and 52 – Right to effective judicial protection – Presumption of innocence – Limitation – Intentional criminal offence subject to public prosecution – Accused persons – Collection of photographic and dactyloscopic data in order for them to be entered in a record and taking of a biological sample for the purpose of creating a DNA profile – Procedure for enforcement of collection – Systematic nature of the collection

    Outcome of the case:

    On those grounds, the Court (Fifth Chamber) hereby rules:

    1. Article 10(a) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in the light of Article 52 of the Charter of Fundamental Rights of the European Union,

    must be interpreted as meaning that the processing of biometric and genetic data by the police authorities with a view to their investigative activities, for purposes of combating crime and maintaining law and order, is authorised by Member State law, within the meaning of Article 10(a) of Directive 2016/680, provided that the law of that Member State contains a sufficiently clear and precise legal basis to authorise that processing. The fact that the national legislative act containing such a legal basis refers, furthermore, to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and not to Directive 2016/680, is not capable, in itself, of calling the existence of such authorisation into question, provided that it is apparent, in a sufficiently clear, precise and unequivocal manner, from the interpretation of the set of applicable provisions of national law that the processing of biometric and genetic data at issue falls within the scope of that directive, and not of that regulation.

    2. Article 6(a) of Directive 2016/680 and Articles 47 and 48 of the Charter of Fundamental Rights of the European Union

    must be interpreted as not precluding national legislation which provides that, if the person accused of an intentional offence subject to public prosecution refuses to cooperate voluntarily in the collection of the biometric and genetic data concerning him or her in order for them to be entered in a record, the criminal court having jurisdiction must authorise a measure enforcing their collection, without having the power to assess whether there are serious grounds for believing that the person concerned has committed the offence of which he or she is accused, provided that national law subsequently guarantees effective judicial review of the conditions for that accusation, from which the authorisation to collect those data arises.

    3. Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof,

    must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority to verify whether and demonstrate that, first, their collection is strictly necessary for achieving the specific objectives pursued and, second, those objectives cannot be achieved by measures constituting a less serious interference with the rights and freedoms of the person concerned.

  • Paragraphs referring to EU Charter

    1 This request for a preliminary ruling concerns the interpretation of Article 4(1)(a) and (c), Article 6(a) and Articles 8 and 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89), and of Articles 3, 8, 48 and 52 of the Charter of Fundamental Rights of the European Union (‘the Charter’).

    ...

    6 Recitals 9 to 12, 14, 26, 27, 31 and 37 of Directive 2016/680 state:

    ...

    (31) It is inherent to the processing of personal data in the areas of judicial cooperation in criminal matters and police cooperation that personal data relating to different categories of data subjects are processed. Therefore, a clear distinction should, where applicable and as far as possible, be made between personal data of different categories of data subjects such as: suspects; persons convicted of a criminal offence; victims and other parties, such as witnesses; persons possessing relevant information or contacts; and associates of suspects and convicted criminals. This should not prevent the application of the right of presumption of innocence as guaranteed by the Charter and by the [Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (the ECHR)], as interpreted in the case-law of the Court of Justice and by the European Court of Human Rights respectively.

    ...

    45 In addition, the referring court states that Article 68 of the ZMVR does not provide that, in the context of the procedure for the mandatory creation of a police record, it must carry out any review as to the existence of serious grounds within the meaning of Article 6(a) of Directive 2016/680. On the contrary, under Article 68 of the ZMVR, it is sufficient for it to find that the person has been accused of an intentional offence subject to public prosecution. It thus has no jurisdiction to assess whether sufficient or solid evidence exists in support of such accusation, nor is it able, in practice, to carry out such an assessment since it has access not to the file but only to copies of the order accusing the person and of the declaration refusing consent to the collection of data by the police. Therefore, it is unsure whether, in those circumstances, the person who has refused to make available to the police the photographic, dactyloscopic and genetic data concerning him or her will enjoy effective judicial protection and observance of the right to be presumed innocent, guaranteed in Articles 47 and 48 of the Charter respectively.

    ...

    50 It was in those circumstances that the Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

    ...

    (2) Is the requirement set in Article 10(a) of Directive 2016/680 in conjunction with Article 52 and with Articles 3 and 8 of the Charter, that any limitation on integrity and protection of personal data must be provided for by law, fulfilled if contradictory national provisions exist in relation to the permissibility of processing of genetic and biometric data for the purposes of creating a police record?

    (3) Is a national law, namely Article 68(4) of the [ZMVR], which provides for the obligation of the court of first instance to order the forced collection of personal data (taking photographs for the file, taking fingerprints, and taking samples in order to create a DNA profile), compatible with Article 6(a) of Directive 2016/680 in conjunction with Article 48 of the Charter, if a person who is accused of an intentional criminal offence requiring public prosecution refuses to voluntarily cooperate in the collection of these personal data, without the court being able to assess whether there are serious grounds for believing that the person has committed the criminal offence of which he or she is accused?

    ...

    52 By its first and second questions, which it is appropriate to examine together, the referring court seeks, in essence, to ascertain whether Article 10(a) of Directive 2016/680, read in the light of Articles 3, 8 and 52 of the Charter, must be interpreted as meaning that the collection of biometric and genetic data by the police authorities with a view to their investigative activities for purposes of combating crime and maintaining law and order is authorised by Member State law, within the meaning of Article 10(a) of Directive 2016/680, where, first, the national provisions forming the legal basis for that authorisation refer to Article 9 of the GDPR, while reproducing the content of Article 10 of Directive 2016/680, and, second, those national provisions appear to lay down contradictory requirements so far as concerns the permissibility of such collection.

    ...

    57 As the referring court states, in essence, in the request for a preliminary ruling, it is in that context that it seeks guidance from the Court regarding the interpretation of that condition. By its first question, it seeks to ascertain whether Article 10 of Directive 2016/680 may be regarded as having been correctly transposed by a provision of national law which refers only to Article 9 of the GDPR, but the content of which correspond to that of Article 10 of the directive. If the answer is in the affirmative, it also seeks to ascertain, by its second question, whether the collection of genetic and biometric data for the purpose of being entered in a record by the police may be regarded as being ‘authorised by Member State law’, within the meaning of Article 10(a) of the directive, that is to say, ‘provided for by law’, within the meaning of Article 52(1) of the Charter, where the provisions of national law which constitute the legal basis for that processing seem to lay down contradictory rules as to the permissibility of such processing.

    ...

    60 As a preliminary point, it should be observed that, whilst the second question refers to Articles 3, 8 and 52 of the Charter, it is clear from the request for a preliminary ruling that the referring court’s queries relate only to whether the national legislation at issue in the main proceedings complies with the requirement, in Article 52(1), that any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law. Consequently, the first and second questions must be examined in the light of only Article 52 of the Charter.

    ...

    64 Second, the scope of the requirement laid down in Article 10(a) of Directive 2016/680 that the processing of the personal data must have been ‘authorised by Union or Member State law’ must be determined in the light of the requirement enshrined in Article 52(1) of the Charter that any limitation on the exercise of a fundamental right must be ‘provided for by law’.

    ...

    76 In the light of the foregoing, the answer to the first and second questions is that Article 10(a) of Directive 2016/680, read in the light of Article 52 of the Charter, must be interpreted as meaning that the processing of biometric and genetic data by the police authorities with a view to their investigative activities, for purposes of combating crime and maintaining law and order, is authorised by Member State law, within the meaning of Article 10(a) of Directive 2016/680, provided that the law of that Member State contains a sufficiently clear and precise legal basis to authorise that processing. The fact that the national legislative act containing such a legal basis refers, furthermore, to the GDPR, and not to Directive 2016/680, is not capable, in itself, of calling the existence of such authorisation into question, provided that it is apparent, in a sufficiently clear, precise and unequivocal manner, from the interpretation of the set of applicable provisions of national law that the processing of biometric and genetic data at issue falls within the scope of that directive, and not of that regulation.

    77 By its third question, the referring court asks, in essence, whether Article 6(a) of Directive 2016/680 and Articles 47 and 48 of the Charter must be interpreted as precluding national legislation which provides that, if the person accused of an intentional offence subject to public prosecution refuses to cooperate voluntarily in the collection of the biometric and genetic data concerning him or her in order for them to be entered in a record, the criminal court having jurisdiction must authorise enforcement of their collection, without having the power to assess whether there are serious grounds for believing that the person concerned has committed the offence of which he or she is accused.

    ...

    81 Against that background, the referring court’s third question should, as the Bulgarian Government and the Commission suggest, be regarded as divided into three parts. First, the referring court is uncertain whether Article 6(a) of Directive 2016/680, which refers to the category consisting of persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence, precludes national legislation which provides for the compulsory collection, in order to be entered in a record, of biometric and genetic data concerning a natural person in respect of whom sufficient evidence is gathered that he or she is guilty of an intentional offence subject to public prosecution, enabling, under national law, him or her to be accused. Second, it raises the question whether, having regard to the limits on the discretion of the court called upon to rule on the enforcement of such collection, that court is in a position to ensure the person concerned effective judicial protection, in accordance with Article 47 of the Charter. Third, it is uncertain whether, despite those limits, observance of the right to be presumed innocent which is referred to in Article 48 of the Charter can be ensured.

    ...

    87 First, it should be noted that the right to effective judicial protection, enshrined in Article 47 of the Charter, must be accorded to any person relying on rights or freedoms guaranteed by EU law against a decision adversely affecting him or her which is such as to undermine those rights or freedoms (see, to that effect, judgment of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters), C‑245/19 and C‑246/19, EU:C:2020:795, paragraphs 55, 57 and 58 and the case-law cited).

    88 Consequently, any accused person who has opposed the collection of photographic, dactyloscopic and genetic data concerning him or her in the context of a procedure such as the creation of a police record, a procedure which has to comply with the requirements of Article 10 of Directive 2016/680, must, as Article 47 of the Charter requires, be able to enjoy the right to an effective remedy before a tribunal against the decision to authorise enforcement of their collection, for the purpose of relying on the rights which he or she derives from the safeguards laid down by that provision and, in particular, from the safeguard under Article 10(a) of the directive that collection of the biometric and genetic data must be carried out in compliance with the national legislation that authorises collection. In particular, that safeguard entails the court with jurisdiction having the ability to verify that the measure accusing the person concerned that constitutes the legal basis for the creation of the police record has been adopted – in accordance with the rules of national criminal procedure – in the light of sufficient evidence that he or she is guilty of an intentional offence subject to public prosecution.

    89 In that regard, it must be borne in mind that the right to effective judicial protection is not an absolute right and that, in accordance with Article 52(1) of the Charter, limitations may be placed upon it, on condition that (i) those limitations are provided for by law, (ii) they respect the essence of the rights and freedoms at issue, and (iii) in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others (see, to that effect, judgment of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters), C‑245/19 and C‑246/19, EU:C:2020:795, paragraphs 49 and 51 and the case-law cited).

    90 In addition, it should be noted that Article 54 of Directive 2016/680 imposes an obligation on the Member States to provide that a person who considers that his or her rights laid down in provisions adopted pursuant to that directive have been infringed as a result of the processing of his or her personal data in non-compliance with those provisions has the right to an effective judicial remedy. It follows that the EU legislature did not itself limit the exercise of the right to an effective remedy enshrined in Article 47 of the Charter and that it is open to the Member States to limit its exercise, provided that they meet the requirements laid down in Article 52(1) of the Charter (see, to that effect, judgment of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters), C‑245/19 and C‑246/19, EU:C:2020:795, paragraphs 63 and 64).

    91 Consequently, it should be determined whether, without prejudice to the judicial remedy provided for by national law pursuant to Article 54 of Directive 2016/680, the fact that the court having jurisdiction, with a view to authorising a measure enforcing the collection of biometric and genetic data concerning accused persons, cannot review, on the merits, the conditions for the accusation on which that enforcement measure is founded constitutes a permitted limitation of the right to effective judicial protection enshrined in Article 47 of the Charter.

    ...

    101 It follows from all the foregoing that Article 47 of the Charter does not preclude a national court, when it rules on an application for authorisation of enforcement of the collection of biometric and genetic data of an accused person in order for them to be entered in a record, from being unable to assess the evidence on which the accusation of that person is based, provided that national law subsequently guarantees effective judicial review of the conditions for that accusation, from which the authorisation to collect those data arises.

    ...

    102 First of all, it should be noted that, under Article 48(1) of the Charter, the content of which corresponds to that of Article 6(2) of the Convention for the Protection of Human Rights and Fundamental Freedoms, everyone who has been charged is to be presumed innocent until proved guilty according to law.

    ...

    104 In addition, as is apparent from recital 31 of Directive 2016/680, the establishment of different categories of persons, the processing of whose personal data is to differ correspondingly, pursuant to Article 6 of that directive, should not prevent the application of the right of presumption of innocence as guaranteed by the Charter and by the Convention for the Protection of Human Rights and Fundamental Freedoms.

    ...

    109 It follows from the foregoing that the right to be presumed innocent, enshrined in Article 48 of the Charter, does not preclude accused persons, at the preliminary stage of the criminal procedure, from being the subject of a measure by which the biometric and genetic data concerning them are collected in order to be entered in a record and which is authorised by a court that does not have the power to assess, at that stage, the evidence upon which such accusation is based.

    110 It follows from all the foregoing that the answer to the third question is that Article 6(a) of Directive 2016/680 and Articles 47 and 48 of the Charter must be interpreted as not precluding national legislation which provides that, if the person accused of an intentional offence subject to public prosecution refuses to cooperate voluntarily in the collection of the biometric and genetic data concerning him or her in order for them to be entered in a record, the criminal court having jurisdiction must authorise a measure enforcing their collection, without having the power to assess whether there are serious grounds for believing that the person concerned has committed the offence of which he or she is accused, provided that national law subsequently guarantees effective judicial review of the conditions for that accusation, from which the authorisation to collect those data arises.

    ...

    116 In that regard, in the first place, it should be noted that, as has been stated in paragraphs 62 and 63 of the present judgment, Article 10 of Directive 2016/680 constitutes a specific provision governing processing of the special categories of personal data, including biometric and genetic data. As is clear from the case-law, the purpose of that article is to ensure enhanced protection with regard to that processing, which, because of the particular sensitivity of the data at issue and the context in which they are processed, is liable, as is apparent from recital 37 of the directive, to create significant risks to fundamental rights and freedoms, such as the right to respect for private life and the right to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter (see, by analogy, judgment of 24 September 2019, GC and Others (De-referencing of sensitive data), C‑136/17, EU:C:2019:773, paragraph 44).

    ...

    126 In that regard, first, it must be borne in mind, as is apparent from recital 26 of Directive 2016/680, that the requirement of necessity is met where the objective pursued by the data processing at issue cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter (see, to that effect, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20, EU:C:2022:601, paragraph 85 and the case-law cited). In particular, in the light of the enhanced protection of persons with regard to the processing of sensitive data, the controller in respect of that processing should satisfy itself that that objective cannot be met by having recourse to categories of data other than those listed in Article 10 of Directive 2016/680.

    ...

    130 It is true that such legislation restricts the scope of the collection of biometric and genetic data to persons accused at the investigation stage of a criminal procedure, that is to say, to persons with regard to whom there are serious grounds for believing that they have committed a criminal offence, within the meaning of Article 6(a) of Directive 2016/680. However, the mere fact that a person is accused of an intentional criminal offence subject to public prosecution cannot be regarded as a factor that in itself enables it to be presumed that the collection of his or her biometric and genetic data is strictly necessary in the light of the purposes that it pursues and given the resulting interference with fundamental rights, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter.

    ...

    On those grounds, the Court (Fifth Chamber) hereby rules:

    1. Article 10(a) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in the light of Article 52 of the Charter of Fundamental Rights of the European Union,

    must be interpreted as meaning that the processing of biometric and genetic data by the police authorities with a view to their investigative activities, for purposes of combating crime and maintaining law and order, is authorised by Member State law, within the meaning of Article 10(a) of Directive 2016/680, provided that the law of that Member State contains a sufficiently clear and precise legal basis to authorise that processing. The fact that the national legislative act containing such a legal basis refers, furthermore, to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and not to Directive 2016/680, is not capable, in itself, of calling the existence of such authorisation into question, provided that it is apparent, in a sufficiently clear, precise and unequivocal manner, from the interpretation of the set of applicable provisions of national law that the processing of biometric and genetic data at issue falls within the scope of that directive, and not of that regulation.

    2. Article 6(a) of Directive 2016/680 and Articles 47 and 48 of the Charter of Fundamental Rights of the European Union

    must be interpreted as not precluding national legislation which provides that, if the person accused of an intentional offence subject to public prosecution refuses to cooperate voluntarily in the collection of the biometric and genetic data concerning him or her in order for them to be entered in a record, the criminal court having jurisdiction must authorise a measure enforcing their collection, without having the power to assess whether there are serious grounds for believing that the person concerned has committed the offence of which he or she is accused, provided that national law subsequently guarantees effective judicial review of the conditions for that accusation, from which the authorisation to collect those data arises.

  • Paragraphs referring to EU Charter (original language)