Judgment of the Court (Fifth Chamber) of 28 November 2024.Ministerstvo na vatreshnite raboti, Glavna direktsia za borba s organiziranata prestapnost v V.S.Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Article 8(1) and (2) – Article 10 – Accused person – Police record containing biometric and genetic data – Enforcement – Objectives of prevention and detection of criminal offences – Interpretation of the judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C‑205/21, EU:C:2023:49) – Obligation to interpret national law in conformity with EU law – Assessment of whether it is ‘strictly necessary’ for the competent authorities to process sensitive data – Role of the competent authorities.Case C-80/23.

This judgment concerns the interpretation of EU data protection rules regarding collection of biometric and genetic data by police authorities. The key points are:1. The case deals with whether police can systematically collect biometric and genetic data (fingerprints, photos, DNA) from accused persons and enter it into police records without demonstrating strict necessity.2. The Court ruled that national legislation allowing systematic collection of such sensitive data without requiring authorities to verify and demonstrate that collection is “strictly necessary” violates EU data protection law (Directive 2016/680).3. The key provisions analyzed are:

• Article 10 of Directive 2016/680 which requires processing of biometric/genetic data to be “strictly necessary”
• Articles 4 and 8 on lawful processing and necessity requirements
• Article 3(7) defining competent authorities

4. The Court emphasized that:

• The requirement of “strict necessity” establishes stronger conditions compared to general “necessity” requirements
• Police authorities must themselves verify and demonstrate strict necessity – this cannot be delegated to courts
• Systematic collection without case-by-case assessment violates EU law

5. The judgment clarifies that courts cannot remedy the lack of strict necessity assessment by police authorities – the obligation lies with the authorities collecting the data to demonstrate necessity in each case.

Full text by link