CJEU Case C-371/24 / Opinion
Key facts of the case:

Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 10 – Processing of special categories of data – Strict necessity – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 49

Outcome of the case:

In the light of all the foregoing considerations, I propose that the Court of Justice answer the questions referred for a preliminary ruling by the cour d’appel de Paris (Court of Appeal, Paris, France) as follows:

Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof,

must be interpreted as:

not precluding national legislation which allows the collection of biometric data from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, provided that that legislation imposes an obligation on the competent authority to assess whether each collection is strictly necessary;

precluding national legislation which does not impose on the competent authority an obligation to provide, in each individual case, a sufficient statement of reasons as to why it is strictly necessary to gather the identification data;

not precluding a national provision which allows the prosecution and conviction on a stand-alone basis of a person who has refused to consent to the gathering of identification data even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data, provided that the gathering of that identification data, if it had taken place, would have complied with the requirements arising from those articles of Directive 2016/680.
Paragraphs referring to EU Charter

40. In the first place, it must be emphasised that Article 10 of Directive 2016/680 constitutes a specific provision governing the processing of special categories of personal data (‘sensitive data’), including biometric data. (15) As is clear from the case-law, the purpose of that provision is to ensure enhanced protection with regard to that processing, which, because of the particular sensitivity of the data at issue and the context in which they are processed, is liable, as is apparent from recital 37 of the directive, to create significant risks to fundamental rights and freedoms, such as the right to respect for private life and the right to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’). (16)

...

46. In that regard, first, as is apparent from recital 26 of Directive 2016/680, the requirement of necessity is met where the objective pursued by the data processing at issue cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter. In particular, in the light of the enhanced protection of persons with regard to the processing of sensitive data, the controller in respect of that processing should satisfy itself that that objective cannot be met by having recourse to categories of data other than those listed in Article 10 of that directive. (22)

...

76. In the first place, under Article 54 of Directive 2016/680, which gives expression to Article 47 of the Charter, Member States are to provide for the right of a data subject to an effective judicial remedy where he or she considers that his or her rights laid down in provisions adopted pursuant to that directive have been infringed as a result of the processing of his or her personal data in non-compliance with those provisions.

77. In the second place, according to the case-law, the right to an effective judicial remedy, guaranteed in Article 47 of the Charter, requires, in principle, that the person concerned be able to ascertain the reasons upon which the decision taken in relation to him or her is based, either by reading the decision itself or by communication of those reasons, so as to enable him or her to defend his or her rights in the best possible conditions and to decide with full knowledge of the relevant facts, whether there is any point in his or her applying to the court with jurisdiction, and in order to put the latter fully in a position to carry out the review of the lawfulness of that decision. (45)

...

79. Although that right is not an absolute right and, in accordance with Article 52(1) of the Charter, limitations may be placed upon it, that is on condition that those limitations are provided for by law, they respect the essence of the rights and freedoms at issue and, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. (46)

...

103. Second, I consider that the stand-alone conviction must be examined in the light of Articles 7 and 8 and Article 49(3) of the Charter

...

105. Although this is an objective of general interest recognised by EU law, the fact remains that the stand-alone conviction also constitutes an interference with the rights guaranteed by Articles 7 and 8 of the Charter. (61) Under Article 52(1) of the Charter, such a conviction must comply with the principle of proportionality.

106. Furthermore, in so far as the stand-alone conviction is a criminal conviction, account must also be taken of Article 49(3) of the Charter, which provides that the severity of penalties must not be disproportionate to the criminal offence.
Paragraphs referring to EU Charter (original language)