On Tuesday, 30 January, the Court of Justice of the European Union (CJEU) ruled (Case C-118/22) that national legislation that authorises the general and indiscriminate storage of the biometric and genetic data of persons convicted of an intentional offence, until their death, is contrary to EU law.
In fact, in order to be compliant, this regulation should require those responsible for processing such data to periodically check whether it is still necessary to store [the data] in light of the risk that the convicted person represents.
The Court of Justice has thus responded to the Bulgarian Supreme Administrative Court, which essentially asked whether Bulgarian legislation – which allows the police to store biometric data (fingerprints, photographs) and genetic data (DNA samples) of a convicted person as well as data relating to his or her previous offences and convictions without any time limit other than his or her death – complied with Directive 2016/680 (protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of preventing and detecting criminal offences).
In its judgment, the Court of Justice admits that such data may be essential for the purposes of preventing and detecting other criminal offences by the person concerned, investigating and prosecuting [criminal offences], or executing criminal penalties against him or her.
However, the judges indicate that [the data] cannot be generally and indiscriminately stored the same way for all convicted persons until their death, as this storage period can only be appropriate in specific cases, where there is a real risk of recidivism or of seeing the person concerned being involved in other criminal offences.
Therefore, data controllers will have to periodically check whether storing such data is necessary while taking into account factors such as the nature and seriousness of the offence committed or the absence of recidivism and will have to grant the person concerned the right to have his or her data erased from police records when storage of the data is no longer justified.
Link to the judgment: https://aeur.eu/f/amh (Original version in French by Francesco Gariazzo)