CJEU Case C-57/23 / Judgment

JH v Policejní prezidium
Deciding body type
Court of Justice of the European Union
Deciding body
Court (Fifth Chamber)
Type
Decision
Decision date
20/11/2025
ECLI (European case law identifier)
ECLI:EU:C:2025:905
  • CJEU Case C-57/23 / Judgment

    Key facts of the case:

    Reference for a preliminary ruling – Protection of natural persons with regard to the processing of their personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data – Directive (EU) 2016/680 – Article 4(1)(c) and (e) – Minimisation of data processing – Storage limitation of personal data – Article 10 – Collection and storage of biometric and genetic data – Strict necessity – Article 6(a) – Obligation to make a distinction between personal data of different categories of persons – National legislation which provides for the collection of biometric and genetic data of any person suspected or accused of having committed an intentional criminal offence – Article 5 – Appropriate time limits for erasure or for a periodic review of the need for the storage of those data – No maximum time limit for storage – Assessment of the need for the storage of biometric and genetic data by the police on the basis of internal rules – Article 8(2) – Lawfulness of the processing of those data – Concept of ‘Member State law’ – Whether national case-law may be classified as ‘Member State law’

    Outcome of the case:

    On those grounds, the Court (Fifth Chamber) hereby rules:

    1. Articles 8 and 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA

      must be interpreted as meaning that, as regards the collection, storage and erasure of biometric and genetic data, the concept of ‘Member State law’, within the meaning of those articles, must be understood as referring to a provision of general application laying down the minimum conditions for collection, storage and erasure of those data, as interpreted by the case-law of the national courts, in so far as that case-law is accessible and sufficiently foreseeable.

    2. Article 6 and Article 4(1)(c) of Directive 2016/680, read in conjunction with Article 10 of that directive

      must be interpreted as not precluding national legislation which permits the indiscriminate collection of biometric and genetic data of any person accused or suspected of having committed an intentional criminal offence, in so far as, first, the purposes of that collection do not require a distinction to be made between those two categories of persons and, second, the controllers are required, in accordance with national law, including the case-law of the national courts, to comply with all of the principles and specific requirements laid down in Articles 4 and 10 of that directive.

    3. Article 4(1)(e) of Directive 2016/680

      must be interpreted as not precluding national legislation under which the need for the continued storage of biometric and genetic data is assessed by the police on the basis of internal rules, without that legislation laying down a maximum period for storage, in so far as that legislation sets appropriate time limits for a periodic review of the need to store those data and, at the time of that review, the strict necessity of extending their storage is assessed.

  • Paragraphs referring to EU Charter

    44. Article 4 of Directive 2016/680 sets out various principles to which that processing is subject, which convey, as is apparent from recitals 1 and 2 of that directive, the manner in which, within the limits provided for in Article 52 of the Charter, the EU legislature intended to give concrete expression, as regards that processing, to the fundamental right of natural persons to the protection of their personal data, enshrined in Article 8 of the Charter, which itself is closely connected to the right to respect for private life, enshrined in Article 7 of the Charter, by taking into account the specific nature of the activities of prevention and detection of criminal offences, investigations and prosecution of criminal offences or the execution of criminal penalties.

    ...

    50. It follows that Articles 8 and 10 of Directive 2016/680 seek to define the scope of certain principles set out in Article 4 of that directive, which give concrete expression, in the area covered by that directive, inter alia, to the fundamental right of natural persons to the protection of their personal data recognised in Article 8 of the Charter.

    51. Consequently, the concept of ‘Member State law’ used in Articles 8 and 10 must be understood as giving effect, in the area covered by Directive 2016/680, to the condition set out in Article 8(2) of the Charter, under which any processing of personal data that is not based on the consent of the person concerned must be carried out on some other legitimate basis laid down by law, a condition which itself only reflects the requirement of Article 52 of the Charter that any limitation on the exercise of the fundamental rights recognised by the Charter must be provided for by law. That concept thus relates to the validity of the use of national law as the legal basis for the processing of personal data.

    52. First, as the Advocate General stated in point 82 of his Opinion, the Court, taking into account the settled case-law of the European Court of Human Rights, has held that the term ‘law’, used in Article 8(2) of the Charter, in the expression ‘laid down by law’, must be understood in its substantive sense and not its formal sense (judgment of 16 November 2023, Roos and Others v Parliament, C‑458/22 P, not published, EU:C:2023:871, paragraph 61). Second, according to the case-law of the European Court of Human Rights, that sense of the term ‘law’ in the expression ‘in accordance with the law’, referred to in Article 8(2) ECHR, implies that that term refers to the provision in force as the competent courts have interpreted it (see, to that effect, ECtHR, 23 January 2025, H. W. v. France, CE:ECHR:2025:0123JUD 001380521, paragraph 65).

    53. Moreover, as follows from the case-law of the Court, although the requirement that any limitation on the exercise of fundamental rights recognised by the Charter must be provided for by law implies that the act which permits the interference with those rights defines the scope of that limitation, that requirement does not however preclude, on the one hand, the limitation in question from being formulated in terms which are sufficiently open to be able to adapt to different scenarios and keep pace with changing circumstances and, on the other hand, that the competent court may, where appropriate, specify, by means of interpretation, the actual scope of that limitation in the light of the very wording of that act which allows the interference as well as the general scheme of that act and the objectives pursued by that limitation (see, by analogy, judgment of 21 June 2022, Ligue des droits humains, C‑817/19, EU:C:2022:491, paragraph 114).

    54. Accordingly, the concept of ‘Member State law’, within the meaning of Articles 8 and 10 of Directive 2016/680, read in the light of Article 8(2) of the Charter, must be understood as being capable of referring to a provision expressly envisaging the carrying out of processing of personal data falling within the scope of that directive, as interpreted by the case-law of the national courts.

    ...

    58. Similarly, according to the case-law of the Court, to meet the requirement, set out in Article 52 of the Charter, to be provided for by law, legislation involving an interference with the fundamental rights guaranteed by Articles 7 and 8 of the Charter must lay down clear and precise rules governing the scope and application of a measure and imposing minimum safeguards so that the persons whose personal data are concerned have sufficient guarantees to protect effectively their data against the risk of abuse and against any unlawful access and use of those data (see judgments of 8 April 2014, Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238, paragraph 54, and of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 91).

    59. In view of the fact that Article 8(2) of Directive 2016/680 seeks to ensure compliance with the requirements set out in paragraphs 56 and 57 above, it follows that the objectives pursued, the personal data concerned and the purposes of the processing covered by that directive must be apparent, with sufficient clarity and precision, from the legislative provision regulating that processing itself, so that that processing can be regarded as meeting the requirements to be provided for by law, within the meaning of the case-law of the European Court of Human Rights and Article 52 of the Charter.

    ...

    92. In that situation, it is for the national courts to determine, in each case, whether the police have carried out the collection in breach of the principles governing the processing of personal data, laid down in Article 4 of Directive 2016/680 and of the specific requirements applicable to the processing of sensitive personal data, laid down in Article 10 of that directive, as interpreted in the light of Articles 7 and 8 of the Charter.

    ...

    102. By contrast, the appropriate nature of those time limits for a periodic review requires that, first, in accordance with Article 4(1)(c) and (e) of Directive 2016/680, read in the light of Article 52(1) of the Charter, those personal data that have been stored until then must be erased under the conditions laid down in Article 16(2) and (3) of that directive where, at the time that one of the reviews is carried out, the storage of those data no longer appears to be strictly necessary and, therefore, proves excessive as regards the purposes pursued (see, to that effect, judgment of 30 January 2024, Direktor na Glavna direktsia Natsionalna politsia pri MVR – Sofia, C‑118/22, EU:C:2024:97, paragraphs 45, 48 and 50 and the case-law cited).

    103. Second, having regard to the requirements, under Article 4(1)(c) of Directive 2016/680, that all personal data are to be adequate, relevant and not excessive in relation to the purposes for which they have been processed, the fact that that provision and Article 8 of that directive must be read in the light of the requirements that arise under Article 52 of the Charter and the obligation, under Article 6 of that directive, for the controller, where applicable, to make a clear distinction between personal data of different categories of data subjects, those time limits for review cannot be regarded as being appropriate where the changes to the criminal status of the data subject, considered to be relevant in respect of the purpose pursued by that storage, does not result in an obligation, on the controller, to re-examine within a reasonable period of time the need to store the data of that person.

  • Paragraphs referring to EU Charter (original language)