Court of Justice of the European Union — Direktor na Glavna direktsia ‘Natsionalna politsia’ pri MVR — Sofia (R

Decided by

Court of Justice of the European Union

Parties

NG v. Direktor na Glavna direktsia ‘Natsionalna politsia’ pri Ministerstvo na vatreshnite raboti – Sofia

Decision date

January 30, 2024

Remedy

The Court ruled that EU law precludes national legislation providing for police storage of personal, biometric, and genetic data of convicted persons until death without periodic reviews or rights to erasure or restriction.

Appeal

Appeal status not stated

Key holdings

1. EU data protection law precludes national legislation allowing police authorities to retain personal, biometric, and genetic data of convicted persons until death without mandatory periodic necessity reviews.

   “must be interpreted as precluding national legislation which provides for the storage, by police authorities, for the purposes of the prevention, investigation, detection or prosecution of criminal offences” — paragraph 72

2. Retaining personal data when it no longer shares a necessary connection with the criminal prevention or investigation objective violates data minimisation principles.

   “In such cases, there will no longer be a necessary connection between the data stored and the objective pursued” — paragraph 60

3. Indiscriminate retention of sensitive biometric and genetic data until death for all persons convicted of public criminal offences is excessively broad.

   “the scope of that storage is, as stated in paragraphs 59 and 60 above, excessively broad with regard to the purposes for which those data are processed.” — paragraph 67

In plain English

In 2016, NG was convicted in Bulgaria of giving false witness testimony and received a one year suspended sentence. Following the completion of his sentence, NG achieved legal rehabilitation on 14 March 2020 under national criminal law. On 15 July 2020, NG requested that the Bulgarian police authorities erase his entry from the national police records, which contained personal data, fingerprints, photographs, and DNA profiling samples. The police refused his request because Bulgarian law exhaustively listed grounds for erasing police records that did not include legal rehabilitation, effectively allowing data to be stored until the individual's death. NG appealed the decision, leading the Supreme Administrative Court of Bulgaria to request a preliminary ruling from the Court of Justice of the European Union. The Grand Chamber ruled that Directive 2016/680, read alongside Articles 7 and 8 of the Charter of Fundamental Rights, precludes national legislation requiring police to store biometric, genetic, and personal data of all persons convicted of intentional criminal offences until death. The Court emphasized that such blanket retention without periodic reviews or rights to erasure or restriction violates data minimisation principles and exceeds what is strictly necessary, even after legal rehabilitation.