CJEU Case C-371/24 / Judgment
-
CJEU Case C-371/24 / Judgment
key facts of the case:
Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data for the purpose of combating criminal offences – Directive (EU) 2016/680 – Article 10 – Processing of special categories of personal data – Collection of biometric data – Taking of fingerprints and of photographs – Person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence – Whether strictly necessary – Discretion – Obligation to state reasons – Refusal of the data subject to consent to the collection of his or her biometric data – National legislation allowing a person to be prosecuted for and convicted of a specific criminal offence penalising such a refusal, even in the absence of any prosecution or conviction in respect of the criminal offence that formed the basis of the envisaged collection of those data
Outcome of the case:
On those grounds, the Court (Fifth Chamber) hereby rules:
-
Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Article 4(1)(a) to (c) and Article 8 of that directive,
must be interpreted as precluding national legislation which provides for the systematic collection of the biometric data of any person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence, unless it is established, first, that the national law defines the specific and concrete purposes pursued by that collection in an appropriate and sufficiently precise manner, and second, that the competent authority is required, in each individual case, to assess whether that collection is strictly necessary for achieving those purposes, so that that collection is not systematic.
-
Article 10 of Directive 2016/680, read in conjunction with Article 4(4) and Article 54 of that directive and in the light of Article 47 of the Charter of Fundamental Rights of the European Union,
must be interpreted as precluding national legislation which does not lay down an obligation on the part of the competent authority to provide a sufficient statement of reasons, in each individual case, as to why it is ‘strictly necessary’, within the meaning of that provision, to collect the biometric data of a person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence.
-
Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 of that directive and in the light of Article 49(3) of the Charter of Fundamental Rights,
must be interpreted as not precluding national legislation which allows a person to be prosecuted for and convicted of a specific criminal offence penalising that person’s refusal to allow the collection of his or her biometric data, even though that person has not been prosecuted for or convicted of the criminal offence that formed the basis of the envisaged collection of those data, provided that that collection satisfies the ‘strictly necessary’ condition within the meaning of Article 10 of the directive and that the criminal penalty imposed in that respect observes the principle of proportionality.
-
-
Paragraphs referring to EU Charter
41. The mere fact that a person is reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence cannot be regarded as a factor that in itself enables it to be presumed that the collection of his or her biometric data is strictly necessary in the light of the specific and concrete purposes that that collection pursues and given the resulting interferences with the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’) (see, to that effect, judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), C‑205/21, EU:C:2023:49, paragraph 130).
...
65. As regards that latter condition, it must be noted that Article 54 of that directive, which gives expression to Article 47 of the Charter, expressly requires Member States to provide that, where a person considers that his or her rights laid down in the provisions adopted pursuant to that directive have been infringed as a result of the processing of his or her personal data in breach of those provisions, that person has the right to an effective judicial remedy (judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 117).
66. In that regard, it is clear also from the Court’s case-law that the right to an effective judicial remedy, guaranteed in Article 47 of the Charter, requires, in principle, that the person concerned must be able to ascertain the reasons forming the basis of a decision taken in relation to him or her, either by reading that decision or by being informed of those reasons, so as to enable him or her to defend his or her rights in the best possible conditions and to decide in full knowledge of the facts whether or not it is useful to refer the matter to the court with jurisdiction and so as fully to enable that court to review the lawfulness of that decision (judgment of 13 June 2024, HYA and Others II, C‑229/23, EU:C:2024:505, paragraph 52 and the case-law cited).
67. Although that right is not an absolute right and, in accordance with Article 52(1) of the Charter, limitations may be placed upon it, that is on condition that those limitations are provided for by law, they respect the essence of the rights and freedoms at issue and, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others (judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 119 and the case-law cited).
68. It is therefore for the competent authority, authorised by national law to collect biometric data where it is ‘strictly necessary’, within the meaning of Article 10 of Directive 2016/680, to provide data subjects, in the context of the applicable national procedures, with the grounds on which that processing is ‘strictly necessary’, since those grounds are necessary to enable those persons to exercise, inter alia, the right to a remedy expressly provided for in Article 54 of that directive, in accordance with Article 47 of the Charter (see, to that effect, judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 120 and the case-law cited).
...
75. Consequently, the answer to the second question is that Article 10 of Directive 2016/680, read in conjunction with Article 4(4) and Article 54 of that directive and in the light of Article 47 of the Charter, must be interpreted as precluding national legislation which does not lay down an obligation on the part of the competent authority to provide a sufficient statement of reasons, in each individual case, as to why it is ‘strictly necessary’, within the meaning of that provision, to collect the biometric data of a person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence.
...
88. That said, it is important to point out that, since such a criminal penalty, for a specific offence penalising a person’s refusal to allow the collection of his or her biometric data, falls within the scope of EU law, it must observe the general principles of EU law, which include the principle of proportionality, enshrined, in particular, in Article 49(3) of the Charter, according to which the severity of penalties must not be disproportionate to the offence (see, to that effect, judgment of 8 March 2022, Bezirkshauptmannschaft Hartberg-Fürstenfeld (Direct effect), C‑205/20, EU:C:2022:168, paragraph 31 and the case-law cited).
...
91. Consequently, the answer to the third question is that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 thereof and in the light of Article 49(3) of the Charter, must be interpreted as not precluding national legislation which allows a person to be prosecuted for and convicted of a specific criminal offence penalising that person’s refusal to allow the collection of his or her biometric data, even though that person has not been prosecuted for or convicted of the criminal offence that formed the basis of the envisaged collection of those data, provided that that collection satisfies the ‘strictly necessary’ condition within the meaning of Article 10 of the directive and that the criminal penalty imposed in that respect observes the principle of proportionality.
-
Paragraphs referring to EU Charter (original language)