Court of Justice of the EU (Bulgarian referral, C-205/21) v. Bulgarian Ministry of Interior / National Police

Decided by

Court of Justice of the European Union

Parties

Ministerstvo na vatreshnite raboti, Glavna direktsia za borba s organiziranata prestapnost v. V.S.

Decision date

January 26, 2023

Remedy

The Court of Justice ruled that Directive (EU) 2016/680 precludes national legislation providing for the systematic collection of biometric and genetic data of all accused persons without demonstrating that such collection is strictly necessary.

Appeal

Appeal status not stated

Key holdings

1. National legislation providing for the systematic collection of biometric and genetic data from any accused person without evaluating strict necessity violates European Union data protection law.

   “must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution” — paragraph 135

2. The processing of special categories of sensitive personal data, such as biometric and genetic data, requires strengthened necessity conditions compared to general data processing under European Union rules.

   “must be interpreted as establishing strengthened conditions for lawful processing of sensitive data, compared with those which follow” — paragraph 117

3. European Union law does not preclude national law that empowers a court to enforce compulsory data collection when an accused person refuses, provided effective judicial review of the underlying conditions is available later.

   “must be interpreted as not precluding national legislation which provides that, if the person accused of an intentional offence subject to public prosecution refuses to cooperate voluntarily” — paragraph 110

4. A reference in national law to general data protection rules rather than the specific directive does not invalidate authorization if national provisions unequivocally show the law enforcement directive applies.

   “is not capable, in itself, of calling the existence of such authorisation into question, provided that it is apparent, in a sufficiently clear, precise and unequivocal manner” — paragraph 76

In plain English

In criminal proceedings in Bulgaria, an individual named V.S. was accused of participating in a criminal organization formed to commit tax offences. Following the accusation, police requested that V.S. cooperate in creating a police record by providing photographs, fingerprints, and a biological sample for DNA profiling. V.S. refused to give consent. Under Bulgarian law, when an accused person refuses to cooperate, the police must apply to a court to enforce compulsory collection. The Bulgarian court asked the Court of Justice of the European Union to clarify whether Bulgarian law complied with Union rules on personal data protection in criminal law enforcement, specifically Directive 2016/680. The Court of Justice ruled that EU law forbids national rules that automatically require the collection of biometric and genetic data from every person accused of an intentional offence subject to public prosecution. The Court explained that processing sensitive biometric and genetic data is permissible only when strictly necessary for specific objectives, and when those objectives cannot be met by less intrusive measures. A blanket requirement covering almost all intentional offences without evaluating the individual necessity of collecting such sensitive data violates data protection safeguards.