Court of Justice of the EU (Bulgarian referral, C-118/22) v. Director of National Police, Bulgarian Ministry of Interior

Decided by

Court of Justice (Grand Chamber)

Parties

NG v. Direktor na Glavna direktsia ‘Natsionalna politsia’ pri MVR — Sofia

Decision date

January 30, 2024

Remedy

The Court ruled that EU law precludes national legislation allowing police authorities to store biometric and genetic data of convicted persons until death without mandatory periodic necessity reviews or rights to erasure or restriction upon legal rehabilitation.

Appeal

Appeal status not stated

Key holdings

1. EU data protection rules preclude national law allowing police to store personal, biometric, and genetic data of convicted individuals until death without mandatory periodic necessity reviews.

   “must be interpreted as precluding national legislation which provides for the storage, by police authorities, for the purposes of the prevention, investigation, detection or prosecution of criminal offences” — Operative part of the judgment

2. National legislation must grant data subjects the right to request erasure or restriction of processing when storage is no longer necessary for criminal enforcement purposes.

   “nor granting that data subject the right to have those data erased, where their storage is no longer necessary for the purposes for which they are processed” — Operative part of the judgment

In plain English

In Case C-118/22, an applicant designated as NG challenged police data storage practices in proceedings against the Director of the National Police Directorate of the Ministry of Interior in Sofia. The case concerned Bulgarian national legislation that permitted police authorities to retain personal data—including biometric and genetic data—of individuals convicted of an intentional criminal offence subject to public prosecution until the person's death, even after legal rehabilitation. Under this framework, data controllers were under no obligation to conduct periodic reviews regarding whether storage remained necessary, and data subjects had no right to request erasure or processing restrictions. The Supreme Administrative Court of Bulgaria referred questions to the Court of Justice of the European Union for a preliminary ruling concerning Directive 2016/680 and Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. On 30 January 2024, the Grand Chamber rendered its judgment. The Court held that EU law precludes national legislation that mandates lifetime retention of police data, including biometric and genetic data, without periodic necessity reviews or options for erasure or processing restriction once storage is no longer necessary for criminal law enforcement purposes.