Luxembourg, 30 January 2024
PRESS RELEASE No 20/24
Right to erasure: the general and indiscriminate storage of biometric and genetic data of persons convicted of criminal offences, until their death, is contrary to EU law
The police authorities may not store biometric and genetic data concerning all persons who have been convicted by final judgment of an intentional offence, without any time limit other than the death of the person concerned. Even if that general and indiscriminate storage is justified by the prevention, detection, investigation and prosecution of criminal offences or the execution of criminal penalties, the national authorities are required to impose on the data controller the obligation to review periodically whether that storage is still necessary, and to grant the data subject the right to have those data erased where that is no longer the case.
In Bulgaria, an entry was made in the police records concerning a person in the course of a criminal investigation for failing to tell the truth as a witness. That person was ultimately found guilty of that offence and given a one year suspended sentence. After serving that sentence, that person was legally rehabilitated. He subsequently applied to be removed from the police records. Under Bulgarian law, the data relating to him are retained in those records and may be processed by the authorities, who have access to them without any time limit other than his death. His application was rejected on the ground that a final criminal conviction, even after legal rehabilitation, is not one of the grounds for removal of the entry from the police records. On appeal, the Bulgarian Supreme Administrative Court referred questions to the Court of Justice.
In its judgment, the Court of Justice holds that the general and indiscriminate storage of biometric and genetic data of persons convicted of an intentional offence, until their death, is contrary to EU law. The Court notes that the personal data stored in the police records in Bulgaria include, amongst other things, fingerprints, a photograph and a DNA sample taken for profiling purposes. The records also contain data relating to the criminal offences committed by the data subject and to his or her convictions in that regard. Those data may be essential for the purposes of verifying whether the data subject is involved in criminal offences other than that in respect of which he or she was convicted by final judgment.
However, such persons do not all present the same degree of risk of being involved in other criminal offences, justifying a uniform period of storage of the data relating to them. Thus, factors such as the nature and seriousness of the offence committed or the absence of recidivism may mean that the risk represented by the convicted person does not necessarily justify the storage of the data relating to that person in the police records until his or her death. Consequently, that time limit is appropriate only in specific circumstances which duly justify it. That is not the case where it is applicable generally and indiscriminately to any person convicted by final judgment of an intentional offence. Under EU law, national legislation must lay down an obligation for the data controller to review periodically whether that storage is still necessary and to grant the data subject the right to have those data erased if that is no longer the case.
NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of EU law or the validity of an EU act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.
Source – EU Court of Justice – Email