EU Court of Justice: police may collect biometric data only “where strictly necessary”

Brussels – Taking fingerprints and photographs cannot be an automatic procedure; they must meet the criteria of specific necessity. The Court of Justice of the European Union (CJEU) clarified this today (19 March) in a judgment setting out the mandatory requirements for national police authorities when collecting biometric data (fingerprints, photographs) for criminal investigations. In effect, according to the judges in Luxembourg, the collection of biometric data cannot be imposed systematically, but must be clearly justified. Otherwise, the criminal penalty imposed on those who refuse to undergo the check is annulled. 

The story begins in Paris, where, in May 2020, a man was arrested on charges of organising an unauthorised demonstration and resisting arrest. During his arrest, the man refused to provide biometric data (fingerprints and photographs) and was consequently fined 300 euros, despite subsequently being acquitted of the main charge. The man, in turn, contested his guilt, “claiming that the applicable French legislation was
not consistent with the EU rules on the protection of personal data in criminal matters.” It was at this point that the Paris Court of Appeal referred the matter to the Court of Justice, asking whether “EU law allows national authorities systematically to collect fingerprints
and photographs of any person suspected of an offence, without having to provide reasons for that measure on a case-by-case basis.” The judge also asked “whether a person may be prosecuted for having refused to consent to such
collection, even if that person was ultimately not prosecuted for the offence of which he or she was suspected.”

The Court reiterated that biometric data are not merely information but constitute sensitive data and, as such, require “enhanced protection.” In particular, “their processing is authorised only where it is strictly necessary and where there are appropriate
safeguards for the rights and freedoms of the data subject,” the Luxembourg judges said. The Court notes that “the mere existence of one or more reasonable grounds for suspecting an offence does not suffice as
a reason for the collection of biometric data. Every decision to gather identification data must therefore contain a clear
statement of reasons, even if that statement is succinct, allowing the data subject to understand the reasons for the
measure and to exercise his or her right to a remedy.” Furthermore, “this obligation to state reasons does not constitute an excessive burden on the authority in question, since such collection cannot be systematic in nature”, it added. 

One of the key points of the ruling concerns the unlawfulness of national laws that impose fingerprinting and identification procedures indiscriminately on anyone suspected of a crime. The Court was categorical on this point: “national legislation rendering that data gathering systematic, without the competent
police authority being able to assess in each individual case whether such gathering is necessary, would be contrary to EU
law since it would lead to an indiscriminate and generalised collection of biometric data.” 

Finally, the Court addressed the issue of penalties for those who refuse to undergo testing: if data collection is “strictly necessary”, a penalty for refusal does not contravene EU law. In any event, however, it must comply with the principle of proportionality enshrined in the Charter of Fundamental Rights of the European Union.