CJEU: Storage of biometric data of persons convicted of criminal offences until their death is contrary to EU law

EU Court rules against general and indefinite storage of biometric data for convicted individuals, requiring periodic review and data erasure rights.
Spiral, Coil

The case refers to a Bulgarian citizen convicted of providing false testimony who sought to have their police record entry removed after legal rehabilitation. Despite serving a one-year suspended sentence and being rehabilitated, the application was rejected based on Bulgarian law stating that a final criminal conviction, even after rehabilitation, does not warrant removal from police records until death. Additionally, under Bulgarian law, data stored in police records include, among others, fingerprints, a photograph, and a DNA sample. The case was appealed to the Bulgarian Supreme Administrative Court, which referred questions to the Court of Justice of the EU (CJEU) for further clarification.

In delivering its judgement, the Court stated that not all persons convicted of criminal offences present the same risk of being involved in criminal offences, justifying the storage of such data related to them until their death. Therefore, the Court ruled that “the general and indiscriminate storage of biometric and genetic data of persons convicted of an intentional offence, until their death, is contrary to the EU law” and that “national legislation must lay down an obligation for the data controller to review periodically whether that storage is still necessary and to grant the data subject the right to have those data erased if that is no longer the case.”

Why does it matter?

Essentially, the CJEU decision sets a precedent for what type of criminal offences would be sufficient for the indefinite retention of biometric data. The Court took the same approach as that of the European Court of Human Rights (ECtHR), where it found in two cases (Gaughran vs the United Kingdom/Trajkovski and Chipovski vs North Macedonia) that the disproportionate character of indefinite retention of biometric data violated people’s right to respect for private and family life of the European Convention on Human Rights (ECHR).