ECJ ruling: Police may not collect biometric data on a preemptive basis

In a ruling on the protection of biometric data, the European Court of Justice (ECJ) on Thursday set strict limits on the practice of many police authorities of routinely processing suspects for identification purposes. The judges in Luxembourg emphasize that the collection of sensitive biometric data such as fingerprints or facial images in criminal investigations must not be systematic. Rather, each such measure must be justified and clearly substantiated on a case-by-case basis by an absolute necessity.

The case in Case C-371/24 (Comdribus) was triggered by an incident in Paris in 2020. A man, whose name the ECJ abbreviates as HW, was arrested as the organizer of an unauthorized demonstration. During police custody, he refused to have his fingerprints taken and to be photographed.

HW was later acquitted of the original charge of rioting. Nevertheless, a French criminal court fined him 300 euros for refusing to cooperate with the identification process. HW appealed this conviction, arguing that the French regulation was incompatible with the European data protection directive for law enforcement and judicial matters.

Particularly sensitive data

The Paris Court of Appeal referred the case to the ECJ. It wanted to clarify whether national authorities could indeed demand biometric data from any suspect without specific justification.

The current answer from Luxembourg emphasizes citizens' privacy: Since biometric data belong to particularly sensitive categories, they enjoy enhanced protection according to the ruling. Their processing is therefore only permissible if it is absolutely necessary and is accompanied by appropriate safeguards for the fundamental rights of the data subjects.

In its decision, the ECJ emphasizes that the mere existence of a plausible suspicion of a crime is not sufficient to justify profound intrusions into privacy, such as the collection of biometric characteristics. Any decision for such a measure must include at least a summary justification. This should enable the affected person to understand the necessity and, if necessary, to legally challenge the measure.

Relevant national regulations must be clearly formulated. They are incompatible with EU law if they lead to automatic and undifferentiated collection without law enforcement officers examining the necessity in the specific individual case.

Penalty for saying no?

The ECJ also ruled that a criminal sanction for refusing biometric data collection can only be imposed under certain conditions. Specifically, only if the underlying police request was itself lawful.

This means: If the data collection does not meet the criterion of absolute necessity, the refusal cannot be punished either. Furthermore, any sanction must comply with the principle of proportionality enshrined in the EU Charter of Fundamental Rights.

The ruling specifies the requirements of the data protection directive. It is likely to have far-reaching consequences for police practice in many member states, where identification processing has often been a standard procedure for every arrest until now.

Authorities must now adapt their internal regulations. It is important to ensure that the collection of biometric data is not an automatic process. A justified exceptional case must be demonstrated that serves the specific purposes of the investigation. Citizens will thus be better protected against state overreach in the digital and biometric age.

(wpl)