{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-205-21","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-205-21)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-23","fingerprint":"ewai:eu:b67bfc","proof":"sha256:d78e800d0bc44f74e369516c72b537882c6f277bf8a847d2a75f623bdd7639a2","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-205-21","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62021CJ0205","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Fifth Chamber)","paragraphs":[]},{"title":"26 January 2023 (\n *1\n )","paragraphs":["para_4","para_5","para_6","para_7","para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_26"]},{"title":"2","paragraphs":["para_28"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"The GDPR","paragraphs":[]},{"title":"3","paragraphs":["para_33","para_34"]},{"title":"4","paragraphs":[]},{"title":"Article 2 of the GDPR, headed ‘Material scope’, provides in paragraphs 1 and 2:","paragraphs":["para_37"]},{"title":"2.   This Regulation does not apply to the processing of personal data:","paragraphs":[]},{"title":"(a)","paragraphs":["para_40","para_41"]},{"title":"(d)","paragraphs":["para_43"]},{"title":"5","paragraphs":["para_45","para_46"]},{"title":"2.   Paragraph 1 shall not apply if one of the following applies:","paragraphs":[]},{"title":"(a)","paragraphs":["para_49"]},{"title":"(b)","paragraphs":["para_51"]},{"title":"(c)","paragraphs":["para_53"]},{"title":"(d)","paragraphs":["para_55"]},{"title":"(e)","paragraphs":["para_57"]},{"title":"(f)","paragraphs":["para_59"]},{"title":"(g)","paragraphs":["para_61"]},{"title":"(h)","paragraphs":["para_63"]},{"title":"(i)","paragraphs":["para_65"]},{"title":"(j)","paragraphs":["para_67","para_68","para_69"]},{"title":"Directive 2016/680","paragraphs":[]},{"title":"6","paragraphs":[]},{"title":"Recitals 9 to 12, 14, 26, 27, 31 and 37 of Directive 2016/680 state:","paragraphs":["para_73","para_74"]},{"title":"(10)","paragraphs":["para_76"]},{"title":"(11)","paragraphs":["para_78"]},{"title":"(12)","paragraphs":["para_80","para_81"]},{"title":"(14)","paragraphs":["para_83","para_84"]},{"title":"(26)","paragraphs":["para_86"]},{"title":"(27)","paragraphs":["para_88","para_89"]},{"title":"(31)","paragraphs":["para_91","para_92"]},{"title":"(37)","paragraphs":["para_94"]},{"title":"7","paragraphs":["para_96","para_97"]},{"title":"2.   In accordance with this Directive, Member States shall:","paragraphs":[]},{"title":"(a)","paragraphs":["para_100"]},{"title":"(b)","paragraphs":["para_102"]},{"title":"8","paragraphs":[]},{"title":"Article 2 of Directive 2016/680, headed ‘Scope’, provides in paragraphs 1 and 3:","paragraphs":["para_105","para_106"]},{"title":"3.   This Directive does not apply to the processing of personal data:","paragraphs":[]},{"title":"(a)","paragraphs":["para_109","para_110"]},{"title":"9","paragraphs":[]},{"title":"As set out in Article 3 of Directive 2016/680:","paragraphs":["para_113"]},{"title":"(1)","paragraphs":["para_115"]},{"title":"(2)","paragraphs":["para_117","para_118"]},{"title":"(7)","paragraphs":["para_120"]},{"title":"(a)","paragraphs":["para_122","para_123"]},{"title":"(12)","paragraphs":["para_125"]},{"title":"(13)","paragraphs":["para_127","para_128"]},{"title":"10","paragraphs":["para_130","para_131"]},{"title":"(a)","paragraphs":["para_133"]},{"title":"(b)","paragraphs":["para_135"]},{"title":"(c)","paragraphs":["para_137","para_138"]},{"title":"11","paragraphs":["para_140","para_141"]},{"title":"(a)","paragraphs":["para_143"]},{"title":"(b)","paragraphs":["para_145"]},{"title":"(c)","paragraphs":["para_147"]},{"title":"(d)","paragraphs":["para_149"]},{"title":"12","paragraphs":[]},{"title":"Article 8 of Directive 2016/680, headed ‘Lawfulness of processing’, states:","paragraphs":["para_152","para_153"]},{"title":"13","paragraphs":["para_155","para_156","para_157"]},{"title":"14","paragraphs":[]},{"title":"As set out in Article 10 of Directive 2016/680:","paragraphs":["para_160"]},{"title":"(a)","paragraphs":["para_162"]},{"title":"(b)","paragraphs":["para_164"]},{"title":"(c)","paragraphs":["para_166"]},{"title":"15","paragraphs":["para_168","para_169"]},{"title":"16","paragraphs":["para_171","para_172"]},{"title":"17","paragraphs":["para_174","para_175"]},{"title":"18","paragraphs":[]},{"title":"Article 63 of Directive 2016/680, headed ‘Transposition’, provides in paragraphs 1 and 4:","paragraphs":["para_178","para_179","para_180","para_181"]},{"title":"Bulgarian law","paragraphs":[]},{"title":"The NK","paragraphs":[]},{"title":"19","paragraphs":["para_185"]},{"title":"20","paragraphs":["para_187"]},{"title":"21","paragraphs":["para_189"]},{"title":"The NPK","paragraphs":[]},{"title":"22","paragraphs":["para_192"]},{"title":"23","paragraphs":["para_194"]},{"title":"The ZZLD","paragraphs":[]},{"title":"24","paragraphs":["para_197"]},{"title":"The ZMVR","paragraphs":[]},{"title":"25","paragraphs":["para_200"]},{"title":"26","paragraphs":["para_202"]},{"title":"27","paragraphs":["para_204"]},{"title":"28","paragraphs":["para_206"]},{"title":"29","paragraphs":["para_208"]},{"title":"30","paragraphs":["para_210"]},{"title":"31","paragraphs":[]},{"title":"Article 68 of the ZMVR is worded as follows:","paragraphs":["para_213","para_214","para_215","para_216","para_217"]},{"title":"For the purposes of creating a police record, the police authorities shall:","paragraphs":[]},{"title":"(1)","paragraphs":["para_220"]},{"title":"(2)","paragraphs":["para_222"]},{"title":"(3)","paragraphs":["para_224","para_225","para_226","para_227","para_228","para_229"]},{"title":"The NRISPR","paragraphs":[]},{"title":"32","paragraphs":["para_232"]},{"title":"33","paragraphs":["para_234"]},{"title":"34","paragraphs":["para_236"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"35","paragraphs":["para_239"]},{"title":"36","paragraphs":["para_241"]},{"title":"37","paragraphs":["para_243"]},{"title":"38","paragraphs":["para_245"]},{"title":"39","paragraphs":["para_247"]},{"title":"40","paragraphs":["para_249"]},{"title":"41","paragraphs":["para_251"]},{"title":"42","paragraphs":["para_253"]},{"title":"43","paragraphs":["para_255"]},{"title":"44","paragraphs":["para_257"]},{"title":"45","paragraphs":["para_259"]},{"title":"46","paragraphs":["para_261"]},{"title":"47","paragraphs":["para_263"]},{"title":"48","paragraphs":["para_265"]},{"title":"49","paragraphs":["para_267"]},{"title":"50","paragraphs":["para_269","para_270","para_271"]},{"title":"(2)","paragraphs":["para_273"]},{"title":"(3)","paragraphs":["para_275"]},{"title":"(4)","paragraphs":["para_277"]},{"title":"51","paragraphs":["para_279"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"The first and second questions","paragraphs":[]},{"title":"52","paragraphs":["para_283"]},{"title":"Admissibility","paragraphs":[]},{"title":"53","paragraphs":["para_286"]},{"title":"54","paragraphs":["para_288"]},{"title":"55","paragraphs":["para_290"]},{"title":"56","paragraphs":["para_292"]},{"title":"57","paragraphs":["para_294"]},{"title":"58","paragraphs":["para_296"]},{"title":"59","paragraphs":["para_298"]},{"title":"Substance","paragraphs":[]},{"title":"60","paragraphs":["para_301"]},{"title":"61","paragraphs":["para_303"]},{"title":"62","paragraphs":["para_305"]},{"title":"63","paragraphs":["para_307"]},{"title":"64","paragraphs":["para_309"]},{"title":"65","paragraphs":["para_311"]},{"title":"66","paragraphs":["para_313"]},{"title":"67","paragraphs":["para_315"]},{"title":"68","paragraphs":["para_317"]},{"title":"69","paragraphs":["para_319"]},{"title":"70","paragraphs":["para_321"]},{"title":"71","paragraphs":["para_323"]},{"title":"72","paragraphs":["para_325"]},{"title":"73","paragraphs":["para_327"]},{"title":"74","paragraphs":["para_329"]},{"title":"75","paragraphs":["para_331"]},{"title":"76","paragraphs":["para_333"]},{"title":"The third question","paragraphs":[]},{"title":"77","paragraphs":["para_336"]},{"title":"78","paragraphs":["para_338"]},{"title":"79","paragraphs":["para_340"]},{"title":"80","paragraphs":["para_342"]},{"title":"81","paragraphs":["para_344"]},{"title":"The scope of Article 6(a) of Directive 2016/680","paragraphs":[]},{"title":"82","paragraphs":["para_347"]},{"title":"83","paragraphs":["para_349"]},{"title":"84","paragraphs":["para_351"]},{"title":"85","paragraphs":["para_353"]},{"title":"86","paragraphs":["para_355"]},{"title":"Observance of the right to effective judicial protection","paragraphs":[]},{"title":"87","paragraphs":["para_358"]},{"title":"88","paragraphs":["para_360"]},{"title":"89","paragraphs":["para_362"]},{"title":"90","paragraphs":["para_364"]},{"title":"91","paragraphs":["para_366"]},{"title":"92","paragraphs":["para_368"]},{"title":"93","paragraphs":["para_370"]},{"title":"94","paragraphs":["para_372"]},{"title":"95","paragraphs":["para_374"]},{"title":"96","paragraphs":["para_376"]},{"title":"97","paragraphs":["para_378"]},{"title":"98","paragraphs":["para_380"]},{"title":"99","paragraphs":["para_382"]},{"title":"100","paragraphs":["para_384"]},{"title":"101","paragraphs":["para_386"]},{"title":"Observance of the presumption of innocence","paragraphs":[]},{"title":"102","paragraphs":["para_389"]},{"title":"103","paragraphs":["para_391"]},{"title":"104","paragraphs":["para_393"]},{"title":"105","paragraphs":["para_395"]},{"title":"106","paragraphs":["para_397"]},{"title":"107","paragraphs":["para_399"]},{"title":"108","paragraphs":["para_401"]},{"title":"109","paragraphs":["para_403"]},{"title":"110","paragraphs":["para_405"]},{"title":"The fourth question","paragraphs":[]},{"title":"111","paragraphs":["para_408"]},{"title":"112","paragraphs":["para_410"]},{"title":"113","paragraphs":["para_412"]},{"title":"114","paragraphs":["para_414"]},{"title":"115","paragraphs":["para_416"]},{"title":"116","paragraphs":["para_418"]},{"title":"117","paragraphs":["para_420"]},{"title":"118","paragraphs":["para_422"]},{"title":"119","paragraphs":["para_424"]},{"title":"120","paragraphs":["para_426"]},{"title":"121","paragraphs":["para_428"]},{"title":"122","paragraphs":["para_430"]},{"title":"123","paragraphs":["para_432"]},{"title":"124","paragraphs":["para_434"]},{"title":"125","paragraphs":["para_436"]},{"title":"126","paragraphs":["para_438"]},{"title":"127","paragraphs":["para_440"]},{"title":"128","paragraphs":["para_442"]},{"title":"129","paragraphs":["para_444"]},{"title":"130","paragraphs":["para_446"]},{"title":"131","paragraphs":["para_448"]},{"title":"132","paragraphs":["para_450"]},{"title":"133","paragraphs":["para_452"]},{"title":"134","paragraphs":["para_454"]},{"title":"135","paragraphs":["para_456"]},{"title":"Costs","paragraphs":[]},{"title":"136","paragraphs":["para_459"]},{"title":"On those grounds, the Court (Fifth Chamber) hereby rules:","paragraphs":["para_461","para_462","para_463","para_464","para_465","para_466","para_467","para_468","para_469","para_470","para_471"]}],"paragraphs":[{"text":"62021CJ0205","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Fifth Chamber)","paragraph_id":"para_2"},{"text":"26 January 2023 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Principles relating to processing of personal data – Purpose limitation – Data minimisation – Article 6(a) – Clear distinction betwe …","paragraph_id":"para_4"},{"text":"In Case C‑205/21,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria), made by decision of 31 March 2021, received at the Court on 31 March 2021, in the criminal proceedings against","paragraph_id":"para_6"},{"text":"V.S.,","paragraph_id":"para_7"},{"text":"interested party:","paragraph_id":"para_8"},{"text":"Ministerstvo na vatreshnite raboti, Glavna direktsia za borba s organiziranata prestapnost,","paragraph_id":"para_9"},{"text":"THE COURT (Fifth Chamber),","paragraph_id":"para_10"},{"text":"composed of E. Regan, President of the Chamber, D. Gratsias (Rapporteur), M. Ilešič, I. Jarukaitis and Z. Csehi, Judges,","paragraph_id":"para_11"},{"text":"Advocate General: G. Pitruzzella,","paragraph_id":"para_12"},{"text":"Registrar: A. Calot Escobar,","paragraph_id":"para_13"},{"text":"having regard to the written procedure,","paragraph_id":"para_14"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_15"},{"text":"–","paragraph_id":"para_16"},{"text":"the Bulgarian Government, by M. Georgieva and T. Mitova, acting as Agents,","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"the French Government, by R. Bénard, A.-L. Desjonquères, D. Dubois and T. Stéhelin, acting as Agents,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"the European Commission, by H. Kranenborg, M. Wasmeier and I. Zaloguin, acting as Agents,","paragraph_id":"para_21"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 30 June 2022,","paragraph_id":"para_22"},{"text":"gives the following","paragraph_id":"para_23"},{"text":"Judgment","paragraph_id":"para_24"},{"text":"1","paragraph_id":"para_25"},{"text":"This request for a preliminary ruling concerns the interpretation of Article 4(1)(a) and (c), Article 6(a) and Articles 8 and 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal da …","paragraph_id":"para_26"},{"text":"2","paragraph_id":"para_27"},{"text":"The request has been made in criminal proceedings instituted against V.S., who, after being accused, refused to consent to collection by the police of her biometric and genetic data in order for them to be entered in a record.","paragraph_id":"para_28"},{"text":"Legal context","paragraph_id":"para_29"},{"text":"European Union law","paragraph_id":"para_30"},{"text":"The GDPR","paragraph_id":"para_31"},{"text":"3","paragraph_id":"para_32"},{"text":"Recital 19 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ 2016 L 119, p. 1 ; ‘the GDPR’), states:","paragraph_id":"para_33"},{"text":"‘The protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of …","paragraph_id":"para_34"},{"text":"4","paragraph_id":"para_35"},{"text":"Article 2 of the GDPR, headed ‘Material scope’, provides in paragraphs 1 and 2:","paragraph_id":"para_36"},{"text":"‘1.   This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.","paragraph_id":"para_37"},{"text":"2.   This Regulation does not apply to the processing of personal data:","paragraph_id":"para_38"},{"text":"(a)","paragraph_id":"para_39"},{"text":"in the course of an activity which falls outside the scope of Union law;","paragraph_id":"para_40"},{"text":"…","paragraph_id":"para_41"},{"text":"(d)","paragraph_id":"para_42"},{"text":"by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’","paragraph_id":"para_43"},{"text":"5","paragraph_id":"para_44"},{"text":"Article 9 of the GDPR, headed ‘Processing of special categories of personal data’, provides in paragraphs 1, 2 and 4:","paragraph_id":"para_45"},{"text":"‘1.   Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.","paragraph_id":"para_46"},{"text":"2.   Paragraph 1 shall not apply if one of the following applies:","paragraph_id":"para_47"},{"text":"(a)","paragraph_id":"para_48"},{"text":"the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, …","paragraph_id":"para_49"},{"text":"(b)","paragraph_id":"para_50"},{"text":"processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law …","paragraph_id":"para_51"},{"text":"(c)","paragraph_id":"para_52"},{"text":"processing is necessary to protect the vital interests of the data subject or of another natural person …","paragraph_id":"para_53"},{"text":"(d)","paragraph_id":"para_54"},{"text":"processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim …","paragraph_id":"para_55"},{"text":"(e)","paragraph_id":"para_56"},{"text":"processing relates to personal data which are manifestly made public by the data subject;","paragraph_id":"para_57"},{"text":"(f)","paragraph_id":"para_58"},{"text":"processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;","paragraph_id":"para_59"},{"text":"(g)","paragraph_id":"para_60"},{"text":"processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;","paragraph_id":"para_61"},{"text":"(h)","paragraph_id":"para_62"},{"text":"processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services …","paragraph_id":"para_63"},{"text":"(i)","paragraph_id":"para_64"},{"text":"processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;","paragraph_id":"para_65"},{"text":"(j)","paragraph_id":"para_66"},{"text":"processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes …","paragraph_id":"para_67"},{"text":"…","paragraph_id":"para_68"},{"text":"4.   Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.’","paragraph_id":"para_69"},{"text":"Directive 2016/680","paragraph_id":"para_70"},{"text":"6","paragraph_id":"para_71"},{"text":"Recitals 9 to 12, 14, 26, 27, 31 and 37 of Directive 2016/680 state:","paragraph_id":"para_72"},{"text":"‘(9)","paragraph_id":"para_73"},{"text":"… [the GDPR] lays down general rules to protect natural persons in relation to the processing of personal data and to ensure the free movement of personal data within the Union.","paragraph_id":"para_74"},{"text":"(10)","paragraph_id":"para_75"},{"text":"In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection …","paragraph_id":"para_76"},{"text":"(11)","paragraph_id":"para_77"},{"text":"It is therefore appropriate for those fields to be addressed by a directive that lays down the specific rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecut …","paragraph_id":"para_78"},{"text":"(12)","paragraph_id":"para_79"},{"text":"The activities carried out by the police or other law-enforcement authorities are focused mainly on the prevention, investigation, detection or prosecution of criminal offences, including police activities without prior knowledge if an incident is a criminal offence or not. … Member States may entru …","paragraph_id":"para_80"},{"text":"…","paragraph_id":"para_81"},{"text":"(14)","paragraph_id":"para_82"},{"text":"Since this Directive should not apply to the processing of personal data in the course of an activity which falls outside the scope of Union law, activities concerning national security, activities of agencies or units dealing with national security issues and the processing of personal data by the …","paragraph_id":"para_83"},{"text":"…","paragraph_id":"para_84"},{"text":"(26)","paragraph_id":"para_85"},{"text":"… The personal data should be adequate and relevant for the purposes for which they are processed. It should, in particular, be ensured that the personal data collected are not excessive and not kept longer than is necessary for the purpose for which they are processed. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. …","paragraph_id":"para_86"},{"text":"(27)","paragraph_id":"para_87"},{"text":"For the prevention, investigation and prosecution of criminal offences, it is necessary for competent authorities to process personal data collected in the context of the prevention, investigation, detection or prosecution of specific criminal offences beyond that context in order to develop an understanding of criminal activities and to make links between different criminal offences detected.","paragraph_id":"para_88"},{"text":"…","paragraph_id":"para_89"},{"text":"(31)","paragraph_id":"para_90"},{"text":"It is inherent to the processing of personal data in the areas of judicial cooperation in criminal matters and police cooperation that personal data relating to different categories of data subjects are processed. Therefore, a clear distinction should, where applicable and as far as possible, be mad …","paragraph_id":"para_91"},{"text":"…","paragraph_id":"para_92"},{"text":"(37)","paragraph_id":"para_93"},{"text":"Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. …’","paragraph_id":"para_94"},{"text":"7","paragraph_id":"para_95"},{"text":"Article 1 of Directive 2016/680, headed ‘Subject matter and objectives’, provides in paragraphs 1 and 2:","paragraph_id":"para_96"},{"text":"‘1.   This Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.","paragraph_id":"para_97"},{"text":"2.   In accordance with this Directive, Member States shall:","paragraph_id":"para_98"},{"text":"(a)","paragraph_id":"para_99"},{"text":"protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data; …","paragraph_id":"para_100"},{"text":"(b)","paragraph_id":"para_101"},{"text":"ensure that the exchange of personal data by competent authorities within the Union, where such exchange is required by Union or Member State law, is neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.’","paragraph_id":"para_102"},{"text":"8","paragraph_id":"para_103"},{"text":"Article 2 of Directive 2016/680, headed ‘Scope’, provides in paragraphs 1 and 3:","paragraph_id":"para_104"},{"text":"‘1.   This Directive applies to the processing of personal data by competent authorities for the purposes set out in Article 1(1).","paragraph_id":"para_105"},{"text":"…","paragraph_id":"para_106"},{"text":"3.   This Directive does not apply to the processing of personal data:","paragraph_id":"para_107"},{"text":"(a)","paragraph_id":"para_108"},{"text":"in the course of an activity which falls outside the scope of Union law;","paragraph_id":"para_109"},{"text":"…’","paragraph_id":"para_110"},{"text":"9","paragraph_id":"para_111"},{"text":"As set out in Article 3 of Directive 2016/680:","paragraph_id":"para_112"},{"text":"‘For the purposes of this Directive:","paragraph_id":"para_113"},{"text":"(1)","paragraph_id":"para_114"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;","paragraph_id":"para_115"},{"text":"(2)","paragraph_id":"para_116"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_117"},{"text":"…","paragraph_id":"para_118"},{"text":"(7)","paragraph_id":"para_119"},{"text":"“competent authority” means:","paragraph_id":"para_120"},{"text":"(a)","paragraph_id":"para_121"},{"text":"any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; …","paragraph_id":"para_122"},{"text":"…","paragraph_id":"para_123"},{"text":"(12)","paragraph_id":"para_124"},{"text":"“genetic data” means personal data, relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;","paragraph_id":"para_125"},{"text":"(13)","paragraph_id":"para_126"},{"text":"“biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;","paragraph_id":"para_127"},{"text":"…’","paragraph_id":"para_128"},{"text":"10","paragraph_id":"para_129"},{"text":"Article 4 of Directive 2016/680, headed ‘Principles relating to processing of personal data’, provides in paragraph 1:","paragraph_id":"para_130"},{"text":"‘Member States shall provide for personal data to be:","paragraph_id":"para_131"},{"text":"(a)","paragraph_id":"para_132"},{"text":"processed lawfully and fairly;","paragraph_id":"para_133"},{"text":"(b)","paragraph_id":"para_134"},{"text":"collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;","paragraph_id":"para_135"},{"text":"(c)","paragraph_id":"para_136"},{"text":"adequate, relevant and not excessive in relation to the purposes for which they are processed;","paragraph_id":"para_137"},{"text":"…’","paragraph_id":"para_138"},{"text":"11","paragraph_id":"para_139"},{"text":"Article 6 of Directive 2016/680, headed ‘Distinction between different categories of data subject’, provides:","paragraph_id":"para_140"},{"text":"‘Member States shall provide for the controller, where applicable and as far as possible, to make a clear distinction between personal data of different categories of data subjects, such as:","paragraph_id":"para_141"},{"text":"(a)","paragraph_id":"para_142"},{"text":"persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence;","paragraph_id":"para_143"},{"text":"(b)","paragraph_id":"para_144"},{"text":"persons convicted of a criminal offence;","paragraph_id":"para_145"},{"text":"(c)","paragraph_id":"para_146"},{"text":"victims of a criminal offence or persons with regard to whom certain facts give rise to reasons for believing that he or she could be the victim of a criminal offence; and","paragraph_id":"para_147"},{"text":"(d)","paragraph_id":"para_148"},{"text":"other parties to a criminal offence, such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings, persons who can provide information on criminal offences, or contacts or associates of one of the persons referred to in points (a) and (b).’","paragraph_id":"para_149"},{"text":"12","paragraph_id":"para_150"},{"text":"Article 8 of Directive 2016/680, headed ‘Lawfulness of processing’, states:","paragraph_id":"para_151"},{"text":"‘1.   Member States shall provide for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority for the purposes set out in Article 1(1) and that it is based on Union or Member State law.","paragraph_id":"para_152"},{"text":"2.   Member State law regulating processing within the scope of this Directive shall specify at least the objectives of processing, the personal data to be processed and the purposes of the processing.’","paragraph_id":"para_153"},{"text":"13","paragraph_id":"para_154"},{"text":"Article 9 of Directive 2016/680, headed ‘Specific processing conditions’, provides in paragraphs 1 and 2:","paragraph_id":"para_155"},{"text":"‘1.   Personal data collected by competent authorities for the purposes set out in Article 1(1) shall not be processed for purposes other than those set out in Article 1(1) unless such processing is authorised by Union or Member State law. Where personal data are processed for such other purposes, [the GDPR] shall apply unless the processing is carried out in an activity which falls outside the scope of Union law.","paragraph_id":"para_156"},{"text":"2.   Where competent authorities are entrusted by Member State law with the performance of tasks other than those performed for the purposes set out in Article 1(1), [the GDPR] shall apply to processing for such purposes …, unless the processing is carried out in an activity which falls outside the scope of Union law.’","paragraph_id":"para_157"},{"text":"14","paragraph_id":"para_158"},{"text":"As set out in Article 10 of Directive 2016/680:","paragraph_id":"para_159"},{"text":"‘Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a …","paragraph_id":"para_160"},{"text":"(a)","paragraph_id":"para_161"},{"text":"where authorised by Union or Member State law;","paragraph_id":"para_162"},{"text":"(b)","paragraph_id":"para_163"},{"text":"to protect the vital interests of the data subject or of another natural person; or","paragraph_id":"para_164"},{"text":"(c)","paragraph_id":"para_165"},{"text":"where such processing relates to data which are manifestly made public by the data subject.’","paragraph_id":"para_166"},{"text":"15","paragraph_id":"para_167"},{"text":"Article 52 of Directive 2016/680, headed ‘Right to lodge a complaint with a supervisory authority’, states in paragraph 1:","paragraph_id":"para_168"},{"text":"‘Without prejudice to any other administrative or judicial remedy, Member States shall provide for every data subject to have the right to lodge a complaint with a single supervisory authority, if the data subject considers that the processing of personal data relating to him or her infringes provisions adopted pursuant to this Directive.’","paragraph_id":"para_169"},{"text":"16","paragraph_id":"para_170"},{"text":"Article 53 of Directive 2016/680, headed ‘Right to an effective judicial remedy against a supervisory authority’, provides in paragraph 1:","paragraph_id":"para_171"},{"text":"‘Without prejudice to any other administrative or non-judicial remedy, Member States shall provide for the right of a natural or legal person to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.’","paragraph_id":"para_172"},{"text":"17","paragraph_id":"para_173"},{"text":"As set out in Article 54 of Directive 2016/680, headed ‘Right to an effective judicial remedy against a controller or processor’:","paragraph_id":"para_174"},{"text":"‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 52, Member States shall provide for the right of a data subject to an effective judicial remedy where he or she considers that his or h …","paragraph_id":"para_175"},{"text":"18","paragraph_id":"para_176"},{"text":"Article 63 of Directive 2016/680, headed ‘Transposition’, provides in paragraphs 1 and 4:","paragraph_id":"para_177"},{"text":"‘1.   Member States shall adopt and publish, by 6 May 2018, the laws, regulations and administrative provisions necessary to comply with this Directive. …","paragraph_id":"para_178"},{"text":"When Member States adopt those provisions, they shall contain a reference to this Directive or shall be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made.","paragraph_id":"para_179"},{"text":"…","paragraph_id":"para_180"},{"text":"4.   Member States shall communicate to the [European] Commission the text of the main provisions of national law which they adopt in the field covered by this Directive.’","paragraph_id":"para_181"},{"text":"Bulgarian law","paragraph_id":"para_182"},{"text":"The NK","paragraph_id":"para_183"},{"text":"19","paragraph_id":"para_184"},{"text":"By virtue of Article 11(2) of the Nakazatelen kodeks (Criminal Code), in the version applicable to the main proceedings (‘the NK’), offences are intentional where the perpetrator is aware of the nature of his or her act or has intended or allowed the occurrence of the consequence of the offence. The vast majority of the offences provided for in the NK are intentional.","paragraph_id":"para_185"},{"text":"20","paragraph_id":"para_186"},{"text":"Under Article 255 of the NK, ‘a person who evades the setting or payment of tax obligations of a significant amount’ in accordance with the detailed statutory rules expressly laid down is liable to a custodial sentence of one to six years and a fine of 2000 leva (BGN) (approximately EUR 1000).","paragraph_id":"para_187"},{"text":"21","paragraph_id":"para_188"},{"text":"Under Article 321(2) and (3) in conjunction with Article 94(20) of the NK, a person who participates in a criminal organisation formed with the aim of enrichment in order to commit offences punishable by a ‘custodial sentence’ exceeding 3 years is liable to a ‘custodial sentence’ of 3 to 10 years. It is also stated there that that is an intentional offence and that it is prosecuted under the ordinary law.","paragraph_id":"para_189"},{"text":"The NPK","paragraph_id":"para_190"},{"text":"22","paragraph_id":"para_191"},{"text":"Article 46(1) and Article 80 of the Nakazatelno-protsesualen kodeks (Code of Criminal Procedure), in the version applicable to the main proceedings (‘the NPK’), provide that criminal offences involve either public prosecution, that is to say, charges are brought by the prosecutor, or prosecution by the civil party. Almost all the offences under the NK involve public prosecution.","paragraph_id":"para_192"},{"text":"23","paragraph_id":"para_193"},{"text":"Pursuant to Article 219(1) of the NPK, ‘where sufficient evidence that a particular person is guilty of a criminal offence subject to public prosecution is gathered’, that person is to be accused and informed thereof. He or she may be subject to various procedural coercive measures, while being able to defend himself or herself by providing explanation or adducing evidence.","paragraph_id":"para_194"},{"text":"The ZZLD","paragraph_id":"para_195"},{"text":"24","paragraph_id":"para_196"},{"text":"Under Article 51 of the zakon za zashtita na lichnite danni (Law on the protection of personal data) (DV No 1 of 4 January 2002; ‘the ZZLD’), the processing of genetic data and of biometric data for the purpose of uniquely identifying a natural person is to be allowed only where absolutely necessary …","paragraph_id":"para_197"},{"text":"The ZMVR","paragraph_id":"para_198"},{"text":"25","paragraph_id":"para_199"},{"text":"Pursuant to Article 6 of the zakon sa Ministerstvo na vatreshnite raboti (Law on the Ministry of the Interior) (DV No 53 of 27 June 2014; ‘the ZMVR’), the Ministry of the Interior carries out a number of main activities, including operational research and surveillance activity, investigative activities relating to offences and intelligence activity.","paragraph_id":"para_200"},{"text":"26","paragraph_id":"para_201"},{"text":"Pursuant to Article 18(1) of the ZMVR, the intelligence activity consists in gathering, processing, classifying, storing and using information. Pursuant to Article 20(1) thereof, the intelligence activity is based on information that is reproduced or is liable to be reproduced on recording media prepared by the authorities of the Ministry of the Interior.","paragraph_id":"para_202"},{"text":"27","paragraph_id":"para_203"},{"text":"Article 25(1) of the ZMVR empowers the Ministry of the Interior to process personal data for the purpose of carrying out its activities. In view of Article 6 of the ZMVR, it follows that the Ministry of the Interior processes personal data in order to carry out its main activities, that is to say, its operational research activity, surveillance activity and investigative activity relating to offences.","paragraph_id":"para_204"},{"text":"28","paragraph_id":"para_205"},{"text":"Article 25(3) of the ZMVR provides that the processing of personal data is to be carried out under that law, in accordance with the GDPR and the ZZLD.","paragraph_id":"para_206"},{"text":"29","paragraph_id":"para_207"},{"text":"Under Article 25a(1) of the ZMVR, the processing of personal data involving genetic data and biometric data for the purpose of uniquely identifying a natural person is to be allowed only as provided for in Article 9 of the GDPR or Article 51 of the ZZLD.","paragraph_id":"para_208"},{"text":"30","paragraph_id":"para_209"},{"text":"Under Article 27 of the ZMVR, data recorded by the police pursuant to Article 68 of that law are to be used only in connection with safeguarding national security, combating crime and maintaining law and order.","paragraph_id":"para_210"},{"text":"31","paragraph_id":"para_211"},{"text":"Article 68 of the ZMVR is worded as follows:","paragraph_id":"para_212"},{"text":"‘1.","paragraph_id":"para_213"},{"text":"The police authorities shall create a police record of persons who are accused of an intentional criminal offence subject to public prosecution. …","paragraph_id":"para_214"},{"text":"2.","paragraph_id":"para_215"},{"text":"The creation of the police record is a form of processing of personal data of the persons referred to in paragraph 1, which shall be carried out in accordance with the requirements of this Law.","paragraph_id":"para_216"},{"text":"3.","paragraph_id":"para_217"},{"text":"For the purposes of creating a police record, the police authorities shall:","paragraph_id":"para_218"},{"text":"(1)","paragraph_id":"para_219"},{"text":"collect the personal data set out in Article 18 of the [zakon za balgaskite lichni dokumenti (Law on Bulgarian identity documents)];","paragraph_id":"para_220"},{"text":"(2)","paragraph_id":"para_221"},{"text":"take a person’s fingerprints and photograph him or her;","paragraph_id":"para_222"},{"text":"(3)","paragraph_id":"para_223"},{"text":"take samples to create a person’s DNA profile.","paragraph_id":"para_224"},{"text":"4.","paragraph_id":"para_225"},{"text":"The consent of the person is not required to carry out the activities referred to in paragraph 3(1).","paragraph_id":"para_226"},{"text":"5.","paragraph_id":"para_227"},{"text":"Persons shall be obliged to cooperate and not to hinder or obstruct the police authorities in carrying out the activities referred to in paragraph 3. In the event of a person’s refusal, the activities referred to in paragraph 3(2) and (3) shall be carried out by compulsion subject to authorisation from the judge of the court of first instance having jurisdiction over the offence subject to public prosecution of which the person has been accused.","paragraph_id":"para_228"},{"text":"…’","paragraph_id":"para_229"},{"text":"The NRISPR","paragraph_id":"para_230"},{"text":"32","paragraph_id":"para_231"},{"text":"The naredba za reda za izvarshvane i snemane na politseyska registratsia (Regulation laying down detailed rules for the implementation of police records) (DV No 90 of 31 October 2014), in the version applicable to the main proceedings (‘the NRISPR’), which was adopted on the basis of Article 68(7) of the ZMVR, defines detailed rules for implementation of the police records provided for in Article 68 thereof.","paragraph_id":"para_232"},{"text":"33","paragraph_id":"para_233"},{"text":"Pursuant to Article 2 of the NRISPR, the objectives of creating a police record are safeguarding national security, combating crime and maintaining law and order.","paragraph_id":"para_234"},{"text":"34","paragraph_id":"para_235"},{"text":"Under Article 11(2) of the NRISPR, the person in respect of whom a police record must be created is to be given a declaration to be completed, in which he or she may express agreement or disagreement regarding the measures for the taking of photographs, fingerprints and DNA samples. Under Article 11 …","paragraph_id":"para_236"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_237"},{"text":"35","paragraph_id":"para_238"},{"text":"The Bulgarian authorities instituted criminal proceedings against two commercial companies for fraud concerning the setting and payment of tax obligations, on the basis of Article 255 of the NK.","paragraph_id":"para_239"},{"text":"36","paragraph_id":"para_240"},{"text":"V.S. was accused by an order adopted on 1 March 2021, pursuant to Article 219 of the NPK, and served on her on 15 March 2021. She was accused, on the basis of Article 321(3)(2) of the NK, read in conjunction with Article 321(2) thereof, of participation with three other persons in a criminal organisation, formed with the aim of enrichment, with a view to committing offences under Article 255 of the NK in concert on Bulgarian territory.","paragraph_id":"para_241"},{"text":"37","paragraph_id":"para_242"},{"text":"Following service of that order accusing her, V.S. was requested to cooperate in the creation of a police record. She completed a declaration form in which she stated that she had been informed of the existence of a statutory basis for the creation of the police record and that she refused to consen …","paragraph_id":"para_243"},{"text":"38","paragraph_id":"para_244"},{"text":"The application by the police authorities to the referring court states that sufficient evidence of the guilt of the persons prosecuted in the criminal proceedings concerned, including of V.S., has been gathered. It is explained in the application that V.S. has been formally accused of an offence re …","paragraph_id":"para_245"},{"text":"39","paragraph_id":"para_246"},{"text":"The referring court has doubts as to whether the legislative and regulatory provisions of Bulgarian law that are applicable to the creation of a police record are compatible with EU law.","paragraph_id":"para_247"},{"text":"40","paragraph_id":"para_248"},{"text":"In the first place, the referring court points out that Article 25(3) and Article 25a of the ZMVR refer to the GDPR and not to Directive 2016/680. It points out that, whilst the GDPR, by virtue of Article 2(2)(d) thereof, does not apply to the processing of personal data by competent bodies for the …","paragraph_id":"para_249"},{"text":"41","paragraph_id":"para_250"},{"text":"In the light of those factors, the referring court wonders whether the view may be taken that, despite the reference to Article 9 of the GDPR, the processing of genetic and biometric data for purposes in the criminal field is permissible under national law, having regard to the fact that it is clearly authorised by Article 10 of Directive 2016/680, even though that directive is not referred to by the applicable provisions of the ZMVR.","paragraph_id":"para_251"},{"text":"42","paragraph_id":"para_252"},{"text":"In the second place, if it should be held that Article 10 of Directive 2016/680 has been correctly transposed into national law or that there is a valid legal basis in national law for processing biometric and genetic data, the referring court is uncertain whether the requirement referred to in Arti …","paragraph_id":"para_253"},{"text":"43","paragraph_id":"para_254"},{"text":"The referring court takes the view that there is a contradiction between Article 25a of the ZMVR, which, by referring to Article 9 of the GDPR, appears not to authorise the collection of biometric and genetic data, and Article 68 of the ZMVR, which undoubtedly authorises it.","paragraph_id":"para_255"},{"text":"44","paragraph_id":"para_256"},{"text":"In the third place, the referring court points out that, under Article 219(1) of the NPK, it is necessary to gather sufficient evidence that a particular person may be guilty in order for that person to be accused. It is unsure whether the criterion laid down in that provision corresponds to the cri …","paragraph_id":"para_257"},{"text":"45","paragraph_id":"para_258"},{"text":"In addition, the referring court states that Article 68 of the ZMVR does not provide that, in the context of the procedure for the mandatory creation of a police record, it must carry out any review as to the existence of serious grounds within the meaning of Article 6(a) of Directive 2016/680. On t …","paragraph_id":"para_259"},{"text":"46","paragraph_id":"para_260"},{"text":"In the fourth place, the referring court infers from Article 4(1)(b) and (c), Article 8(1) and (2) and Article 10 of Directive 2016/680 that national law must confer on the competent authorities a certain degree of discretion when they collect biometric and genetic data by taking photographs, finger …","paragraph_id":"para_261"},{"text":"47","paragraph_id":"para_262"},{"text":"The referring court observes that the creation of a police record applies, however, mandatorily to all persons accused of intentional offences subject to public prosecution and to the three categories of personal data covered by that article, namely photographs, fingerprints and DNA samples.","paragraph_id":"para_263"},{"text":"48","paragraph_id":"para_264"},{"text":"It observes, furthermore, that only the objectives of such processing of personal data are referred to by the ZMVR, namely the carrying out of investigative activity, including for the purpose of safeguarding national security, combating crime and maintaining law and order. On the other hand, nation …","paragraph_id":"para_265"},{"text":"49","paragraph_id":"para_266"},{"text":"The referring court is therefore uncertain whether the condition laid down by national law for authorising the creation of a police record, under which the person concerned must have been accused of an intentional offence subject to public prosecution, is sufficient to satisfy the requirements of Article 4(1)(a) and (c), Article 8(1) and (2) and Article 10 of Directive 2016/680.","paragraph_id":"para_267"},{"text":"50","paragraph_id":"para_268"},{"text":"It was in those circumstances that the Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_269"},{"text":"‘(1)","paragraph_id":"para_270"},{"text":"Is Article 10 of Directive 2016/680 effectively transposed into national law – Article 25(3) and Article 25a of the [ZMVR] – by the inclusion of a reference to the similar provision in Article 9 of [the GDPR]?","paragraph_id":"para_271"},{"text":"(2)","paragraph_id":"para_272"},{"text":"Is the requirement set in Article 10(a) of Directive 2016/680 in conjunction with Article 52 and with Articles 3 and 8 of the Charter, that any limitation on integrity and protection of personal data must be provided for by law, fulfilled if contradictory national provisions exist in relation to the permissibility of processing of genetic and biometric data for the purposes of creating a police record?","paragraph_id":"para_273"},{"text":"(3)","paragraph_id":"para_274"},{"text":"Is a national law, namely Article 68(4) of the [ZMVR], which provides for the obligation of the court of first instance to order the forced collection of personal data (taking photographs for the file, taking fingerprints, and taking samples in order to create a DNA profile), compatible with Article …","paragraph_id":"para_275"},{"text":"(4)","paragraph_id":"para_276"},{"text":"Is a national law, namely Article 68(1) to (3) of [the ZMVR], which provides, as a general rule, for the taking of photographs for the file, the taking of fingerprints, and the taking of samples in order to create a DNA profile for all persons who are accused of an intentional criminal offence requiring public prosecution compatible with Article 10, Article 4(1)(a) and (c), and Article 8(1) and (2) of Directive 2016/680?’","paragraph_id":"para_277"},{"text":"51","paragraph_id":"para_278"},{"text":"By letter of 5 August 2022, the Sofiyski gradski sad (Sofia City Court, Bulgaria) informed the Court that, following a legislative amendment that entered into force on 27 July 2022, the Spetsializiran nakazatelen sad (Specialised Criminal Court) was dissolved and that certain criminal cases brought before it, including the case in the main proceedings, were transferred from that date to the Sofiyski gradski sad (Sofia City Court).","paragraph_id":"para_279"},{"text":"Consideration of the questions referred","paragraph_id":"para_280"},{"text":"The first and second questions","paragraph_id":"para_281"},{"text":"52","paragraph_id":"para_282"},{"text":"By its first and second questions, which it is appropriate to examine together, the referring court seeks, in essence, to ascertain whether Article 10(a) of Directive 2016/680, read in the light of Articles 3, 8 and 52 of the Charter, must be interpreted as meaning that the collection of biometric a …","paragraph_id":"para_283"},{"text":"Admissibility","paragraph_id":"para_284"},{"text":"53","paragraph_id":"para_285"},{"text":"In its written observations, the Commission calls into question the admissibility of the first and second questions, submitting that the referring court, first, seeks solely to ascertain whether national law has in fact transposed Article 10 of Directive 2016/680, without expressing any doubts or ra …","paragraph_id":"para_286"},{"text":"54","paragraph_id":"para_287"},{"text":"In that regard, it should be recalled that, according to the Court’s settled case-law, it is solely for the national court before which the dispute has been brought, and which must assume responsibility for the subsequent judicial decision, to determine, in the light of the particular circumstances …","paragraph_id":"para_288"},{"text":"55","paragraph_id":"para_289"},{"text":"To that end, in order to enable the Court to give an interpretation of EU law that is useful to the national court, the request for a preliminary ruling must, under Article 94(c) of the Rules of Procedure, contain a statement of the reasons which prompted the referring court to inquire about the int …","paragraph_id":"para_290"},{"text":"56","paragraph_id":"para_291"},{"text":"As regards the first and second questions, it is apparent from the order for reference that, in the case in the main proceedings, the referring court is uncertain whether the condition laid down in Article 10(a) of Directive 2016/680, under which processing of genetic and biometric data as covered by that article must be authorised by EU or Member State law, is satisfied so far as concerns the creation of a police record, which is at issue in that case.","paragraph_id":"para_292"},{"text":"57","paragraph_id":"para_293"},{"text":"As the referring court states, in essence, in the request for a preliminary ruling, it is in that context that it seeks guidance from the Court regarding the interpretation of that condition. By its first question, it seeks to ascertain whether Article 10 of Directive 2016/680 may be regarded as hav …","paragraph_id":"para_294"},{"text":"58","paragraph_id":"para_295"},{"text":"Consequently, the referring court identified clearly, in the request for a preliminary ruling, the applicable provisions of EU law, its queries concerning the interpretation of that law and the reasons which led it to submit the first and second questions to the Court. Furthermore, it is clear from …","paragraph_id":"para_296"},{"text":"59","paragraph_id":"para_297"},{"text":"It follows that the first and second questions are admissible.","paragraph_id":"para_298"},{"text":"Substance","paragraph_id":"para_299"},{"text":"60","paragraph_id":"para_300"},{"text":"As a preliminary point, it should be observed that, whilst the second question refers to Articles 3, 8 and 52 of the Charter, it is clear from the request for a preliminary ruling that the referring court’s queries relate only to whether the national legislation at issue in the main proceedings comp …","paragraph_id":"para_301"},{"text":"61","paragraph_id":"para_302"},{"text":"First, it should be noted that, in the light of recital 19 of the GDPR and recitals 9 to 12 of Directive 2016/680 and by virtue of Article 2(1) and Article 9(1) and (2) of that directive, processing of personal data by a ‘competent authority’, within the meaning of Article 3(7) of that directive, ma …","paragraph_id":"para_303"},{"text":"62","paragraph_id":"para_304"},{"text":"In particular, it should be noted that Article 9 of the GDPR and Article 10 of Directive 2016/680 both contain provisions governing the processing of special categories of personal data, which are regarded as sensitive data, including genetic and biometric data.","paragraph_id":"para_305"},{"text":"63","paragraph_id":"para_306"},{"text":"In that regard, Article 10 of Directive 2016/680 provides that the processing of those sensitive data is to be allowed ‘only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject’ and only in three cases, including, by virtue of Article 10(a), wh …","paragraph_id":"para_307"},{"text":"64","paragraph_id":"para_308"},{"text":"Second, the scope of the requirement laid down in Article 10(a) of Directive 2016/680 that the processing of the personal data must have been ‘authorised by Union or Member State law’ must be determined in the light of the requirement enshrined in Article 52(1) of the Charter that any limitation on the exercise of a fundamental right must be ‘provided for by law’.","paragraph_id":"para_309"},{"text":"65","paragraph_id":"para_310"},{"text":"In that regard, it is clear from the Court’s case-law that that requirement means that the legal basis authorising such a limitation must define the scope of that limitation sufficiently clearly and precisely (see, to that effect, judgment of 6 October 2020, État luxembourgeois (Right to bring an action against a request for information in tax matters), C‑245/19 and C‑246/19 , EU:C:2020:795 , paragraph  76 and the case-law cited).","paragraph_id":"para_311"},{"text":"66","paragraph_id":"para_312"},{"text":"Furthermore, it follows from the case-law recalled in the previous paragraph of the present judgment that there can be no uncertainty as to the provisions of EU law pursuant to which national law may authorise processing of biometric and genetic data, such as the processing at issue in the main proc …","paragraph_id":"para_313"},{"text":"67","paragraph_id":"para_314"},{"text":"Accordingly, whilst the national legislature has the option to provide, in the same legislative instrument, for the processing of personal data for purposes covered by Directive 2016/680 and for other purposes covered by the GDPR, it has, on the other hand, the obligation, in accordance with the req …","paragraph_id":"para_315"},{"text":"68","paragraph_id":"para_316"},{"text":"Third, as to the referring court’s queries regarding the possible incorrect transposition of Directive 2016/680, the provisions of national law transposing that directive, in particular Article 10, must be distinguished from those pursuant to which processing of data belonging to the special categories referred to in that article, inter alia biometric and genetic data, may be authorised, within the meaning of Article 10(a).","paragraph_id":"para_317"},{"text":"69","paragraph_id":"para_318"},{"text":"Whilst, as is apparent from the second subparagraph of Article 63(1) thereof, Directive 2016/680 expressly requires the Member States to ensure that the necessary measures transposing the directive contain a reference to it or are accompanied by such a reference on the occasion of their official pub …","paragraph_id":"para_319"},{"text":"70","paragraph_id":"para_320"},{"text":"Finally, it should be pointed out that, where a directive has been properly transposed, its effects reach individuals through the implementing measures adopted by the Member States concerned (see, to that effect, judgment of 15 May 1986, Johnston, 222/84 , EU:C:1986:206 , paragraph  51 ), unlike a r …","paragraph_id":"para_321"},{"text":"71","paragraph_id":"para_322"},{"text":"Fourth, it should be noted that the obligation on a Member State, imposed by the third paragraph of Article 288 TFEU, to take all the measures necessary to achieve the result prescribed by a directive is binding on all the authorities of Member States including, for matters within their jurisdiction …","paragraph_id":"para_323"},{"text":"72","paragraph_id":"para_324"},{"text":"Consequently, when faced with an apparent conflict, such as that described by it in the context of the second question, between, on the one hand, provisions of national legislation which seem to preclude the processing of genetic and biometric data by the competent authorities for purposes covered b …","paragraph_id":"para_325"},{"text":"73","paragraph_id":"para_326"},{"text":"In that regard, it should, in particular, be noted that Article 9(2) of Directive 2016/680 does not preclude the processing of biometric and genetic data by competent authorities, within the meaning of Article 3(7) of that directive, in connection with tasks other than those performed for the purpos …","paragraph_id":"para_327"},{"text":"74","paragraph_id":"para_328"},{"text":"In the present instance, it is apparent from the order for reference that the provisions of national law giving rise to the questions submitted by the referring court are provisions of substantive law governing the activities of the Ministry of the Interior. The first of those provisions lays down t …","paragraph_id":"para_329"},{"text":"75","paragraph_id":"para_330"},{"text":"Consequently, it is for the referring court to review whether the dual reference to Article 9 of the GDPR and to the provision of national law which transposes Article 10 of Directive 2016/680 may be justified by the fact that the scope of the provision of substantive law containing such a dual refe …","paragraph_id":"para_331"},{"text":"76","paragraph_id":"para_332"},{"text":"In the light of the foregoing, the answer to the first and second questions is that Article 10(a) of Directive 2016/680, read in the light of Article 52 of the Charter, must be interpreted as meaning that the processing of biometric and genetic data by the police authorities with a view to their inv …","paragraph_id":"para_333"},{"text":"The third question","paragraph_id":"para_334"},{"text":"77","paragraph_id":"para_335"},{"text":"By its third question, the referring court asks, in essence, whether Article 6(a) of Directive 2016/680 and Articles 47 and 48 of the Charter must be interpreted as precluding national legislation which provides that, if the person accused of an intentional offence subject to public prosecution refu …","paragraph_id":"para_336"},{"text":"78","paragraph_id":"para_337"},{"text":"It should be noted at the outset that this question is asked by the referring court in relation to criminal proceedings in which a provision of national law is applicable that lays down that, if the person concerned refuses to cooperate in the collection of the biometric and genetic data concerning …","paragraph_id":"para_338"},{"text":"79","paragraph_id":"para_339"},{"text":"In addition, according to the explanation provided by the Bulgarian Government in the written answers to the questions asked by the Court, the rules relating to Bulgarian criminal procedure provide that accusation may occur at any time in the preliminary procedure – which constitutes the first stage …","paragraph_id":"para_340"},{"text":"80","paragraph_id":"para_341"},{"text":"However, the referring court states that the national legislation at issue does not confer on the court which authorises collection of the biometric and genetic data concerning the accused person in order for them to be entered in a record jurisdiction to assess the evidence on which that accusation …","paragraph_id":"para_342"},{"text":"81","paragraph_id":"para_343"},{"text":"Against that background, the referring court’s third question should, as the Bulgarian Government and the Commission suggest, be regarded as divided into three parts. First, the referring court is uncertain whether Article 6(a) of Directive 2016/680, which refers to the category consisting of person …","paragraph_id":"para_344"},{"text":"The scope of Article 6(a) of Directive 2016/680","paragraph_id":"para_345"},{"text":"82","paragraph_id":"para_346"},{"text":"Article 6 of Directive 2016/680 obliges the Member States to provide for the controller, ‘where applicable and as far as possible’, to make a clear distinction between personal data of different categories of data subjects, such as those referred to in Article 6(a) to (d), namely, respectively; pers …","paragraph_id":"para_347"},{"text":"83","paragraph_id":"para_348"},{"text":"Thus, the Member States must ensure that a clear distinction is made between the data of the different categories of data subjects in such a way that, as the Advocate General has stated in point 27 of his Opinion, they are not subject without distinction – whatever the category to which they belong …","paragraph_id":"para_349"},{"text":"84","paragraph_id":"para_350"},{"text":"However, it follows from the wording of Article 6 of Directive 2016/680 that the obligation which that provision imposes on the Member States is not absolute. First, the phrase ‘where applicable and as far as possible’, which it contains, indicates that it is for the controller to determine, in each …","paragraph_id":"para_351"},{"text":"85","paragraph_id":"para_352"},{"text":"Furthermore, the existence of sufficient items of evidence pointing to a person’s guilt constitutes, in principle, a serious ground for believing that he or she has committed the offence at issue. Thus, national legislation which provides for the compulsory collection of biometric and genetic data o …","paragraph_id":"para_353"},{"text":"86","paragraph_id":"para_354"},{"text":"It follows from all the foregoing that Article 6(a) of Directive 2016/680 does not preclude national legislation which provides for the compulsory collection, in order to be entered in a record, of biometric and genetic data concerning persons in respect of whom sufficient evidence is gathered that they are guilty of an intentional offence subject to public prosecution and who have been accused for that reason.","paragraph_id":"para_355"},{"text":"Observance of the right to effective judicial protection","paragraph_id":"para_356"},{"text":"87","paragraph_id":"para_357"},{"text":"First, it should be noted that the right to effective judicial protection, enshrined in Article 47 of the Charter, must be accorded to any person relying on rights or freedoms guaranteed by EU law against a decision adversely affecting him or her which is such as to undermine those rights or freedom …","paragraph_id":"para_358"},{"text":"88","paragraph_id":"para_359"},{"text":"Consequently, any accused person who has opposed the collection of photographic, dactyloscopic and genetic data concerning him or her in the context of a procedure such as the creation of a police record, a procedure which has to comply with the requirements of Article 10 of Directive 2016/680, must …","paragraph_id":"para_360"},{"text":"89","paragraph_id":"para_361"},{"text":"In that regard, it must be borne in mind that the right to effective judicial protection is not an absolute right and that, in accordance with Article 52(1) of the Charter, limitations may be placed upon it, on condition that (i) those limitations are provided for by law, (ii) they respect the essen …","paragraph_id":"para_362"},{"text":"90","paragraph_id":"para_363"},{"text":"In addition, it should be noted that Article 54 of Directive 2016/680 imposes an obligation on the Member States to provide that a person who considers that his or her rights laid down in provisions adopted pursuant to that directive have been infringed as a result of the processing of his or her pe …","paragraph_id":"para_364"},{"text":"91","paragraph_id":"para_365"},{"text":"Consequently, it should be determined whether, without prejudice to the judicial remedy provided for by national law pursuant to Article 54 of Directive 2016/680, the fact that the court having jurisdiction, with a view to authorising a measure enforcing the collection of biometric and genetic data …","paragraph_id":"para_366"},{"text":"92","paragraph_id":"para_367"},{"text":"As regards the first condition referred to in paragraph 89 of the present judgment, in accordance with the case-law recalled in paragraph 65 of the present judgment, it is for the referring court to ascertain whether the limits placed on its discretion by national law, in the context of an applicati …","paragraph_id":"para_368"},{"text":"93","paragraph_id":"para_369"},{"text":"As regards the second condition, it follows from the case-law that the essence of the right to an effective remedy includes, among other aspects, the possibility, for the person who holds that right, of accessing a court or tribunal with the power to ensure respect for the rights guaranteed to that …","paragraph_id":"para_370"},{"text":"94","paragraph_id":"para_371"},{"text":"However, it also follows from the case-law of the Court that that condition does not mean, as such, that the holder of the right to effective judicial protection must have a direct remedy the primary object of which is to call into question a given measure, provided that one or more legal remedies a …","paragraph_id":"para_372"},{"text":"95","paragraph_id":"para_373"},{"text":"In particular, as the Advocate General has noted, in essence, in point 36 of his Opinion, the third question is based on the hypothesis that the preliminary stage of the criminal procedure, during which enforcement of collection of the biometric and genetic data concerning an accused person in order …","paragraph_id":"para_374"},{"text":"96","paragraph_id":"para_375"},{"text":"In any event, in accordance with Article 54 of Directive 2016/680, national law must provide the person concerned with the opportunity to effectively challenge the compulsory collection of his or her biometric and genetic data in judicial proceedings, founded on the alleged infringement, on account …","paragraph_id":"para_376"},{"text":"97","paragraph_id":"para_377"},{"text":"As regards the third condition, it should be pointed out, first of all, that the collection of genetic and biometric data concerning persons accused in a criminal procedure, in order for them to be entered in a record, pursues purposes set out in Article 1(1) of Directive 2016/680, in particular those relating to the prevention, investigation, detection and prosecution of criminal offences, which constitute objectives of general interest recognised by the European Union.","paragraph_id":"para_378"},{"text":"98","paragraph_id":"para_379"},{"text":"Such collection may contribute to the objective set out in recital 27 of Directive 2016/680, which states that, for the prevention, investigation and prosecution of criminal offences, it is necessary for competent authorities to process personal data collected in the context of the prevention, inves …","paragraph_id":"para_380"},{"text":"99","paragraph_id":"para_381"},{"text":"In the present instance, as the Bulgarian Government stated in its written observations and further explained in a written reply to a question asked by the Court, the creation of police records that is established by national law pursues two fundamental purposes. First, the data are gathered and pro …","paragraph_id":"para_382"},{"text":"100","paragraph_id":"para_383"},{"text":"It may prove justified, during the preliminary stage of the criminal procedure, to shield temporarily from judicial review the assessment of the evidence on which accusation of the person concerned, and therefore the collection of his or her biometric and genetic data, is founded. Such review, at th …","paragraph_id":"para_384"},{"text":"101","paragraph_id":"para_385"},{"text":"It follows from all the foregoing that Article 47 of the Charter does not preclude a national court, when it rules on an application for authorisation of enforcement of the collection of biometric and genetic data of an accused person in order for them to be entered in a record, from being unable to …","paragraph_id":"para_386"},{"text":"Observance of the presumption of innocence","paragraph_id":"para_387"},{"text":"102","paragraph_id":"para_388"},{"text":"First of all, it should be noted that, under Article 48(1) of the Charter, the content of which corresponds to that of Article 6(2) of the Convention for the Protection of Human Rights and Fundamental Freedoms, everyone who has been charged is to be presumed innocent until proved guilty according to law.","paragraph_id":"para_389"},{"text":"103","paragraph_id":"para_390"},{"text":"In particular, the Court has acknowledged that it follows from the case-law of the European Court of Human Rights inter alia that the presumption of innocence is infringed if a judicial decision concerning an accused person reflects the feeling that he or she is guilty, although his or her guilt has …","paragraph_id":"para_391"},{"text":"104","paragraph_id":"para_392"},{"text":"In addition, as is apparent from recital 31 of Directive 2016/680, the establishment of different categories of persons, the processing of whose personal data is to differ correspondingly, pursuant to Article 6 of that directive, should not prevent the application of the right of presumption of innocence as guaranteed by the Charter and by the Convention for the Protection of Human Rights and Fundamental Freedoms.","paragraph_id":"para_393"},{"text":"105","paragraph_id":"para_394"},{"text":"As regards the referring court’s queries as to whether the right to be presumed innocent is observed by a judicial decision authorising the collection of biometric and genetic data concerning accused persons in order for them to be entered in a record, it must be stated, first, that, in so far as na …","paragraph_id":"para_395"},{"text":"106","paragraph_id":"para_396"},{"text":"Second, where a judicial decision authorising the collection of biometric and genetic data concerning accused persons in order for them to be entered in a record merely takes note of the accusation of the person concerned and of his or her refusal to consent to such collection, it cannot be interpreted as defining a position on that person’s guilt or, therefore, as undermining the presumption that he or she is innocent.","paragraph_id":"para_397"},{"text":"107","paragraph_id":"para_398"},{"text":"The fact that the court which must make such a judicial decision cannot assess, at that stage of the criminal procedure, whether the evidence on which the accusation of the person concerned is based is sufficient constitutes a guarantee for the latter of observance of the right to be presumed innocent.","paragraph_id":"para_399"},{"text":"108","paragraph_id":"para_400"},{"text":"Such a guarantee is all the more necessary where national law, such as the provision at issue in the main proceedings, provides that the court having jurisdiction to rule on enforcement of collection of the biometric and genetic data concerning accused persons in order for them to be entered in a re …","paragraph_id":"para_401"},{"text":"109","paragraph_id":"para_402"},{"text":"It follows from the foregoing that the right to be presumed innocent, enshrined in Article 48 of the Charter, does not preclude accused persons, at the preliminary stage of the criminal procedure, from being the subject of a measure by which the biometric and genetic data concerning them are collected in order to be entered in a record and which is authorised by a court that does not have the power to assess, at that stage, the evidence upon which such accusation is based.","paragraph_id":"para_403"},{"text":"110","paragraph_id":"para_404"},{"text":"It follows from all the foregoing that the answer to the third question is that Article 6(a) of Directive 2016/680 and Articles 47 and 48 of the Charter must be interpreted as not precluding national legislation which provides that, if the person accused of an intentional offence subject to public p …","paragraph_id":"para_405"},{"text":"The fourth question","paragraph_id":"para_406"},{"text":"111","paragraph_id":"para_407"},{"text":"First of all, it should be recalled that, according to settled case-law, in the procedure laid down by Article 267 TFEU, providing for cooperation between national courts and the Court, it is for the latter to provide the national court with an answer which will be of use to it and enable it to dete …","paragraph_id":"para_408"},{"text":"112","paragraph_id":"para_409"},{"text":"As is clear from the order for reference and as has been observed in paragraphs 46 and 49 of the present judgment, in the context of the fourth question the referring court is uncertain as to the implications of the requirements set out in Article 4(1)(a) to (c), Article 8(1) and (2) and Article 10 of Directive 2016/680.","paragraph_id":"para_410"},{"text":"113","paragraph_id":"para_411"},{"text":"Furthermore, as has been observed in paragraphs 46 to 48 of the present judgment, the referring court states that, although those provisions appear to it to require that the competent authorities have a discretion for the purpose of determining whether collection of biometric and genetic data is nec …","paragraph_id":"para_412"},{"text":"114","paragraph_id":"para_413"},{"text":"It follows that the fourth question should be understood as seeking to establish, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which provides for the syst …","paragraph_id":"para_414"},{"text":"115","paragraph_id":"para_415"},{"text":"More specifically, the referring court’s queries concern the requirement set out in Article 10 of Directive 2016/680 that processing of the special categories of data referred to in that article is to be allowed ‘only where strictly necessary’.","paragraph_id":"para_416"},{"text":"116","paragraph_id":"para_417"},{"text":"In that regard, in the first place, it should be noted that, as has been stated in paragraphs 62 and 63 of the present judgment, Article 10 of Directive 2016/680 constitutes a specific provision governing processing of the special categories of personal data, including biometric and genetic data. As …","paragraph_id":"para_418"},{"text":"117","paragraph_id":"para_419"},{"text":"In the second place, as follows from the very terms in which it is set out in Article 10 of Directive 2016/680, the requirement that the processing of such data be allowed ‘only where strictly necessary’ [(‘ uniquement en cas de nécessité absolue ’ in the French-language version)] must be interprete …","paragraph_id":"para_420"},{"text":"118","paragraph_id":"para_421"},{"text":"Thus, first, the use of the adverb ‘only’ before the words ‘where strictly necessary’ underlines that the processing of special categories of data, within the meaning of Article 10 of Directive 2016/680, will be capable of being regarded as necessary solely in a limited number of cases. Second, the fact that the necessity for processing of such data is an ‘absolute’ one [(‘ absolue ’)] signifies that that necessity is to be assessed with particular rigour.","paragraph_id":"para_422"},{"text":"119","paragraph_id":"para_423"},{"text":"The fact pleaded by the French Government that, in certain language versions of Article 10 of Directive 2016/680, that article refers to cases where the data processing is ‘strictly necessary’ is not decisive in that regard. That terminological variation does not alter the nature of the criterion th …","paragraph_id":"para_424"},{"text":"120","paragraph_id":"para_425"},{"text":"Furthermore, as the Commission also notes, the requirement that processing of data falling within Article 10 of Directive 2016/680 is to be allowed only where strictly necessary did not appear in the proposal for a directive (COM(2012) 10 final) giving rise to that directive, but was introduced subs …","paragraph_id":"para_426"},{"text":"121","paragraph_id":"para_427"},{"text":"In the third place, as regards what is entailed by the requirement that the processing of sensitive data is to be allowed ‘only where strictly necessary’, it should be pointed out that the specific requirements of Article 10 of Directive 2016/680 constitute a special form of implementation, applicab …","paragraph_id":"para_428"},{"text":"122","paragraph_id":"para_429"},{"text":"In particular, first, the question whether collection of the biometric and genetic data of accused persons in order for them to be entered in a record is ‘strictly necessary’, within the meaning of Article 10 of Directive 2016/680, must be determined in the light of the purposes of their collection. …","paragraph_id":"para_430"},{"text":"123","paragraph_id":"para_431"},{"text":"Furthermore, in the light of Article 4(1)(a) of Directive 2016/680, the scope of that requirement must also be determined having regard to Article 8(1) thereof, according to which Member States must provide, in particular, for processing to be lawful only if and to the extent that processing is nece …","paragraph_id":"para_432"},{"text":"124","paragraph_id":"para_433"},{"text":"In that regard, the purposes of processing biometric and genetic data cannot be indicated in terms that are too general, but have to be defined sufficiently precisely and specifically to enable assessment of whether that processing is ‘strictly necessary’.","paragraph_id":"para_434"},{"text":"125","paragraph_id":"para_435"},{"text":"Furthermore, the requirement that processing of sensitive data be ‘strictly necessary’ entails particularly strict checking, in that context, as to whether the principle of data minimisation is observed.","paragraph_id":"para_436"},{"text":"126","paragraph_id":"para_437"},{"text":"In that regard, first, it must be borne in mind, as is apparent from recital 26 of Directive 2016/680, that the requirement of necessity is met where the objective pursued by the data processing at issue cannot reasonably be achieved just as effectively by other means less restrictive of the fundame …","paragraph_id":"para_438"},{"text":"127","paragraph_id":"para_439"},{"text":"Second, having regard to the significant risks posed by the processing of sensitive data to the rights and freedoms of data subjects, in particular in the context of the tasks of the competent authorities for the purposes set out in Article 1(1) of Directive 2016/680, the ‘strictly necessary’ requir …","paragraph_id":"para_440"},{"text":"128","paragraph_id":"para_441"},{"text":"In view of the foregoing, it must be held that national legislation which provides for the systematic collection of the biometric and genetic data of any person accused of an intentional offence subject to public prosecution is, in principle, contrary to the requirement laid down in Article 10 of Directive 2016/680 that processing of the special categories of data referred to in that article is to be allowed ‘only where strictly necessary’.","paragraph_id":"para_442"},{"text":"129","paragraph_id":"para_443"},{"text":"Such legislation is liable to lead, in an indiscriminate and generalised manner, to collection of the biometric and genetic data of most accused persons since the concept of ‘intentional criminal offence subject to public prosecution’ is particularly general and is liable to apply to a large number of criminal offences, irrespective of their nature and gravity.","paragraph_id":"para_444"},{"text":"130","paragraph_id":"para_445"},{"text":"It is true that such legislation restricts the scope of the collection of biometric and genetic data to persons accused at the investigation stage of a criminal procedure, that is to say, to persons with regard to whom there are serious grounds for believing that they have committed a criminal offen …","paragraph_id":"para_446"},{"text":"131","paragraph_id":"para_447"},{"text":"Thus, first, where there are serious grounds for believing that the person in issue has committed a criminal offence, justifying his or her being accused, a situation which presupposes that sufficient evidence of that person’s involvement in the offence has already been gathered, it is possible that the collection both of the biometric data and of the genetic data will not reflect any specific necessity for the purposes of the criminal procedure in progress.","paragraph_id":"para_448"},{"text":"132","paragraph_id":"para_449"},{"text":"Second, the likelihood of the biometric and genetic data of an accused person being strictly necessary in connection with procedures other than the procedure in which that accusation has taken place can be determined only in the light of all the relevant factors, such as, in particular, the nature a …","paragraph_id":"para_450"},{"text":"133","paragraph_id":"para_451"},{"text":"That being so, it is for the referring court to verify whether, in order to ensure the effectiveness of Article 10 of Directive 2016/680, it is possible to interpret the national legislation providing for the enforcement in question in a manner consistent with EU law. In particular, it is for the re …","paragraph_id":"para_452"},{"text":"134","paragraph_id":"para_453"},{"text":"If national law does not guarantee such review of the measure whereby biometric and genetic data are collected, it is for the referring court to ensure that Article 10 of Directive 2016/680 is given full effect by dismissing the police authorities’ application requesting it to authorise enforcement of their collection.","paragraph_id":"para_454"},{"text":"135","paragraph_id":"para_455"},{"text":"It follows from all the foregoing that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person a …","paragraph_id":"para_456"},{"text":"Costs","paragraph_id":"para_457"},{"text":"136","paragraph_id":"para_458"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_459"},{"text":"On those grounds, the Court (Fifth Chamber) hereby rules:","paragraph_id":"para_460"},{"text":"1.","paragraph_id":"para_461"},{"text":"Article 10(a) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal …","paragraph_id":"para_462"},{"text":"must be interpreted as meaning that the processing of biometric and genetic data by the police authorities with a view to their investigative activities, for purposes of combating crime and maintaining law and order, is authorised by Member State law, within the meaning of Article 10(a) of Directive …","paragraph_id":"para_463"},{"text":"2.","paragraph_id":"para_464"},{"text":"Article 6(a) of Directive 2016/680 and Articles 47 and 48 of the Charter of Fundamental Rights of the European Union","paragraph_id":"para_465"},{"text":"must be interpreted as not precluding national legislation which provides that, if the person accused of an intentional offence subject to public prosecution refuses to cooperate voluntarily in the collection of the biometric and genetic data concerning him or her in order for them to be entered in …","paragraph_id":"para_466"},{"text":"3.","paragraph_id":"para_467"},{"text":"Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof,","paragraph_id":"para_468"},{"text":"must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the compet …","paragraph_id":"para_469"},{"text":"[Signatures]","paragraph_id":"para_470"},{"text":"(\n *1\n ) Language of the case: Bulgarian.","paragraph_id":"para_471"}],"word_count":16613,"cites":["C-77/21","C-497/12","C-245/19","C-246/19","C-658/19","C-447/20","C-448/20","C-419/18","C-483/18","C-615/19","C-748/19","C-754/19","C-709/20","C-136/17","C-184/20"],"sha256":"7e7f1725cc700279b5694abeec19e6c3ebf97490a6a84ebf62b17c8094e3fa1c","source_url":"https://publications.europa.eu/resource/celex/62021CJ0205.ENG.xhtml.ECR_62021CJ0205_EN_01.html","fetched_at":"2026-10-03T12:40:14.456+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-205-21","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-205-21","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-205-21","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-205-21","verification":{"stored_sha256":"7e7f1725cc700279b5694abeec19e6c3ebf97490a6a84ebf62b17c8094e3fa1c","recomputed_sha256":"7e7f1725cc700279b5694abeec19e6c3ebf97490a6a84ebf62b17c8094e3fa1c","intact":true,"checked_at":"2026-10-24T01:53:13.807Z"}},"hash":"sha256:d78e800d0bc44f74e369516c72b537882c6f277bf8a847d2a75f623bdd7639a2","version":"legal-2026-10-23","expires":"2026-10-25T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-23+legal-2026-10-23+2026-10-23T14:34:08","content_hash":"sha256:d78e800d0bc44f74e369516c72b537882c6f277bf8a847d2a75f623bdd7639a2","revalidate_after":"2026-10-24T02:53:14.568Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-205-21","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-205-21"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-205-21"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-205-21"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":10},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-205-21","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-2d3a62d06aae743b93ba85c235cec4fb","response_hash":"sha256:d78e800d0bc44f74e369516c72b537882c6f277bf8a847d2a75f623bdd7639a2"}},"freshness":{"freshness_class":"live","as_of":"2026-11-03T14:23:46.189Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-205-21&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":30487}}