Court of Justice of the European Union — Bulgaria police biometric records (C-80/23)
In Ministerstvo na vatreshnite raboti (Case C-80/23), a follow-up to C-205/21, the Court of Justice of the EU held that the police collection of biometric and genetic data for a records file must be shown to be strictly necessary, and that national courts must be able to review that necessity even where national law appears to mandate the collection.
Case brief
Read from the judgment on 2026-09-18. Every holding carries a short verbatim quote from that text.
- Decided by
- Court of Justice of the European Union
- Parties
- Ministerstvo na vatreshnite raboti, Glavna direktsia za borba s organiziranata prestapnost v. V.S.
- Decision date
- November 28, 2024
- Remedy
- The Court of Justice ruled that EU data protection law precludes national courts from substituting their own strict necessity assessment for that required of competent authorities where national law fails to obligate police authorities to verify and demonstrate that collecting biometric and genetic data is strictly necessary.
- Appeal
- Appeal status not stated
Key holdings
Article 10 of Directive 2016/680 establishes enhanced conditions for processing sensitive data compared to general necessity rules under Articles 4 and 8.
“establishing strengthened conditions for lawful processing of such data, compared with those which follow from Article 4(1)(b) and (c), as well as Article 8(1), of Directive 2016/680” — paragraph 54
A court requested to enforce data collection cannot fulfill the obligation to assess strict necessity if national law places no such obligation on the competent police authority.
“compliance with such an obligation cannot be ensured by the court seised by that competent authority for the purpose of the enforcement of that collection” — paragraph 61
National procedures allowing police data collection based on consent without judicial authorization prevent courts from ensuring legal protection regarding strict necessity for consenting individuals.
“the court having jurisdiction is not able, by definition, to ensure the legal protection of data subjects who have expressed such consent” — paragraph 60
In plain English
Bulgarian police authorities sought to compel a person accused of tax evasion and participation in a criminal organization to provide biometric and genetic data, including photographs, fingerprints, and DNA samples, for entry into a police record. When the accused person refused to consent, police requested court authorization to enforce the collection. The Sofia City Court referred questions to the European court regarding whether national judges could themselves evaluate if collecting the sensitive data was strictly necessary, given that Bulgarian law did not require the police to make or demonstrate that assessment. The Court of Justice of the European Union ruled that European Union data protection law prevents national courts from substituting their own evaluation for the missing assessment by police authorities. Under European Union law, processing sensitive categories of personal data like biometric and genetic information requires that the competent authority itself determine and prove that collection is strictly necessary for its specific objectives. Because national law did not obligate police authorities to perform this strict necessity check, a court asked to enforce mandatory collection cannot cure that defect by conducting the review on its own.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.