Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 47 - Right to an effective remedy and to a fair trial
Article 52 - Scope and interpretation
Key facts of the case:
Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data for the purpose of combating crime – Directive (EU) 2016/680 – Article 4(1)(c) and (e) – Data minimisation – Limitation of storage – Article 5 – Appropriate time limits for erasure or for a periodic review of the need for the storage – Article 10 – Processing of biometric and genetic data – Strict necessity – Article 16(2) and (3) – Right to erasure – Restriction of processing – Article 52(1) of the Charter of Fundamental Rights of the European Union – Natural person convicted by final judgment and subsequently legally rehabilitated – Storage of data until death – No right to erasure or restriction of processing – Proportionality.
Outcome of the case:
On those grounds, the Court (Grand Chamber) hereby rules:
Article 4(1)(c) and (e) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Articles 5 and 10, Article 13(2)(b) and Article 16(2) and (3) thereof, and in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union,
must be interpreted as precluding national legislation which provides for the storage, by police authorities, for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, of personal data, including biometric and genetic data, concerning persons who have been convicted by final judgment of an intentional criminal offence subject to public prosecution, until the death of the data subject, even in the event of his or her legal rehabilitation, without imposing on the data controller the obligation to review periodically whether that storage is still necessary, nor granting that data subject the right to have those data erased, where their storage is no longer necessary for the purposes for which they are processed or, where appropriate, to have the processing of those data restricted.
(104) This Directive respects the fundamental rights and observes the principles recognised in the [Charter of Fundamental Rights of the European Union (‘the Charter’)] as enshrined in the TFEU, in particular the right to respect for private and family life, the right to the protection of personal data, the right to an effective remedy and to a fair trial. Limitations placed on those rights are in accordance with Article 52(1) of the Charter as they are necessary to meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.’
...
33 In that regard, first of all, it is apparent from the order for reference, in particular from the considerations summarised in paragraph 27 above, and from the wording of the question referred itself that the referring court asks, in particular, whether the national legislation at issue in the main proceedings is compatible with the principle of proportionality. As recital 104 of Directive 2016/680 highlights, the limitations imposed by that directive on the right to the protection of personal data, provided for in Article 8 of the Charter, and on the right to respect for private and family life and the right to an effective remedy and to a fair trial, protected by Articles 7 and 47 respectively of the Charter, must be interpreted in accordance with the requirements of Article 52(1) thereof, which include respect for that principle.
37 In the light of the foregoing, it must be held that, by its question, the referring court asks, in essence, whether Article 4(1)(c) and (e) of Directive 2016/680, read in conjunction with Articles 5 and 10, Article 13(2)(b) and Article 16(2) and (3) thereof, and in the light of Articles 7 and 8 of the Charter, must be interpreted as precluding national legislation which provides for the storage, by police authorities, for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, of personal data, including biometric and genetic data, concerning persons who have been convicted by final judgment of an intentional criminal offence subject to public prosecution, until the death of the data subject, even in the event of his or her legal rehabilitation, without also granting that person the right to have those data erased or, where appropriate, to have their processing restricted.
39 In the first place, it should be borne in mind that the fundamental rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter are not absolute rights, but must be considered in relation to their function in society and be weighed against other fundamental rights. Any limitation on the exercise of those fundamental rights must, in accordance with Article 52(1) of the Charter, be provided for by law, respect the essence of those fundamental rights and observe the principle of proportionality. Under the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. They must apply only in so far as is strictly necessary and the legislation which entails the limitations in question must lay down clear and precise rules governing the scope and application of those limitations (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 105 and the case-law cited).
45 As stated in recital 26 of Directive 2016/680, that provision seeks to ensure that personal data are not, in accordance with the requirements of Article 4(1)(e) of that directive, kept longer than is necessary. It is true that Directive 2016/680 leaves it to the Member States to set appropriate time limits on the storage period and to decide whether those time limits concern the erasure of those data or the periodic review of the need to store them, provided that the observance of those time limits is ensured by adequate procedural measures. However, the ‘appropriate’ nature of those periods requires, in any event, that – in accordance with Article 4(1)(c) and (e) of that directive, read in the light of Article 52(1) of the Charter – those time limits allow, where appropriate, the erasure of the data concerned where their storage is no longer necessary for the purposes which justified the processing.
47 Next, Article 10 of Directive 2016/680 constitutes a specific provision governing the processing of special categories of personal data, including biometric and genetic data. The purpose of that article is to ensure enhanced protection of the data subject, since the data in question, because of their particular sensitivity and the context in which they are processed, are liable, as is apparent from recital 37 of that directive, to create significant risks to fundamental rights and freedoms, such as the right to respect for private life and the right to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter (judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), C‑205/21, EU:C:2023:49, paragraph 116 and the case-law cited).
