In its interesting judgment in case C-118/22, published on 30 January 2024, the Grand Chamber of the Court of Justice of the European Union addressed the topic of the retention of genetic and biometric data of convicted persons, stating an important principle about the correct application of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data.
Present case
The facts occurred in Bulgaria, where a person had been entered in the police records with the charge of failing to tell the truth as a witness and subsequently sentenced to a one-year suspended sentence. After the legal rehabilitation, the person applied for the erasure of the entry concerning him from the police records; the Ministry of the Interior refused the application, stating that a final criminal conviction could not lead to the approval of such a request, even in case of rehabilitation. The Administrative Court of the City of Sofia also refused the application. The subject therefore brought an appeal to the Supreme Administrative Court, claiming that the storage of his personal data, as a convicted person who has already served the sentence and has also been rehabilitated, could not be of unlimited duration. Hence, the referral to the Court of Justice, to which was requested a preliminary ruling whether a national law providing for the retention of biometric and genetic data of persons who have been convicted and already legally rehabilitated until death, without authorizing their erasure or limitation, is compatible with Directive (EU) 2016/680.
The relevant legislation and the analysis of the Court of Justice
Directive (EU) 2016/680 deals with the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection and prosecution of criminal offences. The Court firstly recalled that Article 4 (1)(c) of the Directive requires Member States to respect the principle of data minimization; the collection and storage of personal data must be in accordance with it in criminal proceedings. In addition, the retention of such data must be for a period no longer than is necessary for the purpose for which they are processed: there should be specific time limits for the erasure (or, in any case, for the review of the need for the storage). In addition to this, the processing of biometric and genetic data is permitted only if strictly necessary, and there is also the right to erasure data if their storage is no longer necessary for the purposes for which they are processed (Article 16).
The Court, therefore, thoroughly analyzed the case in question.
Indeed, there is no doubt that the storage of personal data of finally convicted persons, who have already served the sentence, could be necessary even after the erasure from the police records. In the present case, the Bulgarian authority had stored the person’s fingerprints, photograph and DNA sample, as well as data about the offences committed and the convictions. It also emerged that for a conviction such as the one suffered by the appellant, resulting from an ex officio offence, the data are stored until death. However, the nature and seriousness of the crime committed cannot justify, in any case, the storage of the data until death; on the contrary, it results in violation of the principle of data minimization. Moreover, the person’s legal rehabilitation, in situations such as the present one, is evidence of the person’s reduced dangerousness, as an element to be duly considered to reduce the period of storage of personal data. Consequently, the national legislation providing for the storage of biometric and genetic data, until death, of a person convicted of an intentional ex officio crime, such as the failure to tell the truth as a witness, was found to be inadequate. The data subject must be able to exercise the right to erasure or otherwise to limit their processing.
Remarks
The Court reiterates the importance of the protection of the principles of data minimization and storage limitation, which are also stated in Article 5 of Regulation 2016/679 (“GDPR”). In recent judgments as well, regarding the correct application of the Directive, with reference to Bulgarian national legislation (C-180/21 and C-205/21), the Court has affirmed that the compliance with European legislation concerning personal data, especially if these are biometric and genetic, must overrule the one of the single Member State which does not adequately safeguard them. Indeed, an extremely long-time limit, such as one that identifies the final moment with the death of the data subject, is not applicable in an undifferentiated and generalized manner, but it must be periodically reviewed to assess that the need for storage has ended.
Avv. Rossella Bucca e Dott. Lapo Lucani
For the Italian version click here.
