“The systematic collection of biometric and genetic data of all accused persons for the purposes of their police registration violates the requirement to ensure increased protection against the processing of sensitive personal data” – this is the core statement of the ECJ’s judgment in Case C-205/21 of 26 January 2023 data by the police.
The Bulgarian court referred a total of four questions to the ECJ for a preliminary ruling. The criminal court subsequently received, in particular, an answer to the question concerning the legality of systematic collection of genetic and biometric data by the police in the context of criminal investigations.
Initial facts data by the police
The Bulgarian authorities had initiated criminal proceedings against two trading companies for tax evasion. In these criminal proceedings, Ms. VS was accus,canada business fax list along with three other individuals, of participating in a criminal organization intent on committing further crimes for the purpose of personal enrichment. The decision was issued on March 1, 2021, and served on Ms. VS on March 15, 2021.
As part of the official accusation, VS was asked to undergo a police registration. This registration would include the collection of biometric and genetic data (photograph, fingerprints, and DNA sample), which the accused VS refused to do.
The Bulgarian Specialised Criminal Court should now authorise the compulsory collection of the accused’s biometric and genetic data at the request of the Bulgarian police authority and upon mere notification of the existence of sufficient evidence of VS’s guilt.
Questions from the Specialised Criminal Court to the ECJ
The police authority’s request, in turn, prompted the court to refer four questions to the ECJ for a preliminary ruling. With regard to data protection, what is the best logo size for your website? (and social, print etc) questions 1, 2, and 4 are relevant:
The Bulgarian court takes the view that Article 10 of the Directive provides for discretion. Regarding the collection of genetic and biometric data by the competent authority. In the context of police registration, the authority must . Consider whether collection is actually necessary and whether, in this context, all three categories of dat should be collected or whether only some of them are sufficient.
ECJ decision
Regarding questions 1 and 2:
The ECJ’s comprehensive response was as follows:
First of all, it should be notthat both Article 9 of the GDPR and Article 10 of Directive 2016/680 contain the processing of special categories of personal data.
Article 9 GDPR provides for a general prohibition on the processing of genetic and biometric data.
Article 10(a) of the Directive. On the other hand, albania business directory only permits such processing . If it is strictly necessary and subject to appropriate safeguards for the rights and freedoms . The data subject and if it is permittby Union or Member State law ” (para. 14) .
However, this does not necessarily apply to processing that falls within the scope of the GDPR.
Regarding question 4:
The ECJ clearly states: No.
Article 10 of the Directive constitutes a specific provision inten to provide increas protection against processing operations which, due to the particular sensitivity of the data concern and the context in which they are process, may pose significant risks to the right to respect for private life and the right to the protection of personal data (Articles 7 and 8 of the EU Charter).