Court of Justice of the European Union — Czech police biometric & genetic data (C-57/23)

Decided by

Court of Justice of the European Union

Parties

JH v. Policejní prezidium

Decision date

November 20, 2025

Remedy

The Court issued a preliminary ruling interpreting Directive (EU) 2016/680 regarding police collection, storage, and mandatory review of biometric and genetic data.

Appeal

Appeal status not stated

Key holdings

1. The concept of Member State law regulating data processing encompasses provisions of general application as interpreted by national judicial case-law, provided it is accessible and foreseeable.

   “the concept of ‘Member State law’, within the meaning of those articles, must be understood as referring to a provision of general application” — paragraph 60

2. EU data protection rules do not preclude national legislation allowing police to collect biometric and genetic data of suspected or accused individuals, provided strict necessity and data minimisation principles are applied.

   “national legislation which permits the indiscriminate collection of biometric and genetic data of any person accused or suspected of having committed an intentional criminal offence” — paragraph 94

3. Member States are not required to set absolute maximum time limits for sensitive data storage if appropriate periodic reviews assess whether continued retention remains strictly necessary.

   “even where the data stored are sensitive personal data, such a Member State is not required to define the absolute time limits for the storage of those data” — paragraph 101

4. Determining whether collecting biometric and genetic data is strictly necessary requires evaluating specific factors including the gravity of the offence, relevant circumstances, and individual criminal profile.

   “the strictly necessary nature of that collection must take into account all of the relevant factors, such as, in particular, the nature and gravity of the presumed offence” — paragraph 84

In plain English

In December 2015, Czech police initiated criminal proceedings against an individual, JH, for an alleged financial offence involving property administration. In January 2016, police collected JH's fingerprints, photographs, description, and a buccal smear to create a genetic profile, recording this information in police databases. After JH was convicted in March 2017 with a suspended custodial sentence, he challenged the data collection and storage in Czech court, arguing it unlawfully interfered with his fundamental right to private life. The Supreme Administrative Court of the Czech Republic referred questions to the Court of Justice of the European Union regarding whether police collection and storage of biometric and genetic data under Czech law complied with European Union law under Directive 2016/680. On 20 November 2025, the Court of Justice held that European Union law does not prohibit national laws from allowing police to collect biometric and genetic data from suspects or accused persons of intentional crimes without absolute retention limits. However, data processing must strictly meet the principle of minimisation and strict necessity. The Court declared that national courts must assess proportionality based on specific circumstances, such as offence gravity and individual criminal history. Furthermore, periodic reviews of data storage, such as Czech law's requirement to review stored data at least once every three years, satisfy EU rules if strict necessity is evaluated during review.