Jose Felgueroso
Abogado | Attorney
The European Directive on the Processing of Personal Data for Criminal Investigations Allows the Collection of Genetic and Biometric Data, but their Systematic Collection is Prohibited
info@josefelgueroso.com
2023-07-13
The Court of Justice of the European Union (the "European Court") ruled in January that Directive 2016/680 (which addresses the processing of personal data by competent authorities for the purpose of criminal investigations) allows authorities to process genetic and biometric data, as long as a national law authorizes the processing and the activities fall under the scope of that Directive. The European Court also held that the systematic collection of genetic and biometric data from all persons accused of criminal offenses is prohibited.
The circumstances of the case were confusing, because the Bulgarian law that regulated the collection of genetic and biometric data mentioned the General Data Protection Regulation (the "GDPR," which generally prohibits the collection of genetic and biometric data), instead of Directive 2016/680 (which allows the collection of those types of data for criminal investigations). The European Court ruled that if national law contains conflicting provisions as to whether it allows the processing of genetic and biometric data for the purpose of criminal investigations, national courts must interpret that law to give effect to Directive 2016/680. If the national law clearly allows the processing of those types of data in the context of activities within the scope of that Directive, then the processing of those types of data is allowed.
Background
The Bulgarian authorities commenced criminal proceedings against V.S. for tax fraud. V.S. refused the collection of fingerprints, photograph, and DNA. The police did not collect those biometric and genetic data, and brought the matter before the Bulgarian Specialised Criminal Court (the "Referring Court"). The Referring Court requested a preliminary ruling from the European Court.
The Referring Court indicated a possible contradiction in the Bulgarian Law on the Ministry of the Interior (the "National Law"), because that law mentioned article 9 of the GDPR (which does not authorize the collection of genetic and biometric data for criminal investigations), but article 68 of the National Law did authorize the collection of those types of data for criminal investigations.
The Referring Court submitted four questions to the European Court:
- Did Bulgaria effectively transpose Directive 2016/680?
- Does a contradiction in the National Law mean that the collection of genetic and biometric data for criminal investigations has no legal basis?
- Does the forced collection of genetic and biometric data from persons accused of criminal offenses violate the right to the presumption of innocence?
- Does the collection of genetic and biometric data from all persons accused of criminal offenses violate Directive 2016/680?
The Judgment
The Effectiveness of Bulgaria's Transposition of Directive 2016/680
European Union directives are legal acts that do not have immediate effect: they require member states to adopt measures to incorporate the directive's goals into national law.
Both the GDPR and Directive 2016/680 consider genetic or biometric data as sensitive. If national authorities process those types of data, they must specify whether the GDPR or Directive 2016/680 is applicable.
The GDPR states that the processing of sensitive data is prohibited, unless several exceptions are met. The exceptions do not include criminal investigations. On the other hand, Directive 2016/680 states that sensitive data must be processed only if it is necessary, the processing includes safeguards for rights and freedoms, and the processing is authorized by either national or European law. The law authorizing the processing must indicate the scope and conditions of processing and the lawful purposes sought by the collection of the data.
The European Court indicated that if a conflict in the provisions of national law creates uncertainty as to whether the processing of genetic and biometric data is authorized, national courts must decide whether the GDPR or Directive 2016/680 authorize the processing. The European Court added that national courts must interpret the conflicting provisions to give effect to Directive 2016/680.
The European Court concluded that if a national law clearly allows the processing of genetic and biometric data within the scope of activities covered by Directive 2016/680, the processing of those data is authorized.
Presumption of Innocence and Effective Judicial Protection
The European Court indicated that a person accused of a crime is presumed innocent, and that the collection of genetic and biometric data does not imply a determination of guilt.
The European Court noted that if sufficient evidence suggests that an accused person is guilty of a crime, the collection of genetic and biometric data is consistent with Directive 2016/680. On the other hand, if the accused opposes the collection of those data and the authorities seek to enforce their collection, the accused is entitled to a judicial remedy under the right to effective judicial protection. The right to effective judicial protection can be limited, as long as the limitations are provided by law, they respect the essence of the right, and they are proportional. The European Court indicated that it is for national courts to determine whether the limits provided by national law on the enforced collection of genetic and biometric data are sufficiently clear and precise.
The European Court concluded that effective judicial protection requires review at some point during the court proceedings, even if that review does not occur immediately after the collection of the genetic and biometric data.
The Systematic Collection of Genetic and Biometric Data
The European Court noted that the fact that a person has been accused of a crime does not make the collection of genetic and biometric data necessary. Those data must be collected only when strictly necessary. This means that no other effective means are available to achieve the goals of the collection; the purposes must be specific, explicit, and legitimate; and the national law regulating the processing must state the objectives, the data to be processed, and the purposes of the processing. Under the principle of data minimization established in Directive 2016/680, the personal data must be adequate, relevant, and limited to what is necessary to achieve the goals of the processing.
The European Court concluded that the systematic collection of genetic and biometric data is prohibited.
Conclusion
In sum, the European Court held that (1) the collection of genetic and biometric data for criminal investigations is authorized if a national law allows it, even if that law erroneously mentions the GDPR instead of Directive 2016/680; (2) the right to effective judicial protection requires that a judge review the collection of genetic and biometric data at some point during the proceedings; and (3) the systematic collection of genetic and biometric data of all persons accused of criminal offenses is prohibited; the collection of those data is allowed only when it is strictly necessary and no less restrictive alternatives exist.
Sources
Criminal proceedings against V.S. (Court of Justice of the European Union, 2023)
General Data Protection Regulation