ECJ: Police may indiscriminately collect DNA and biometric data of suspects

Police authorities of EU member states may indiscriminately collect and store biometric and genetic data, such as fingerprints and DNA profiles, of suspects and persons prosecuted. The prerequisite is that national laws or jurisprudence ensure appropriate time limits for the regular review of the necessity of retention and compliance with strict principles for the protection of sensitive data. This was decided by the European Court of Justice (ECJ) on Thursday.

In essence, according to the ruling in Case C-57/23, national police authorities can decide on the basis of their internal regulations whether the storage of information on physical characteristics and DNA is necessary.

The procedure stems from the case of a Czech official who was interrogated by the police in connection with criminal proceedings against him. Despite his objection, the authorities ordered the collection of his fingerprints, the creation of a genetic profile using a cheek swab, and the taking of photos and a personal description, which were stored in databases.

Lifetime storage is problematic

The official, who was legally convicted in 2017, challenged the identification measures and the storage of his data in separate proceedings as an unlawful interference with his private life. A Czech court initially ordered the deletion of the disputed information. The Czech Supreme Administrative Court appealed against this and asked the ECJ whether the national regulation was compatible with the EU Directive on Data Protection in Criminal Proceedings.

The ECJ first clarified that the term "law of the Member States" in the context of the collection, storage, and deletion of such data encompasses a general provision. This sets the minimum requirements, provided that the requirements are sufficiently foreseeable and can be judicially reviewed.

The Luxembourg judges link the retention of physical characteristics and DNA traces to two conditions: the purposes of collection must not require a distinction between suspects and persons prosecuted. Furthermore, those responsible for processing must be nationally obliged to observe all principles and special requirements for the processing of sensitive data.

Regarding the storage period, the ECJ explains that the relevant national regulation does not necessarily have to provide for a maximum limit. The prerequisite is that it establishes appropriate time limits for the regular review of the necessity of storing this data. It must also be assessed whether an extension is absolutely necessary.

As early as 2024, the Court ruled that the general storage of biometric and genetic data of convicted persons until their death violates EU law. The specific risk of recidivism must be taken into account.

(mho)