Court of Justice Judgment on Biometric Data for Criminal Offences

Comdribus (Protection of natural persons with regard to the processing of personal data for the purpose of combating criminal offences - Collection of biometric data - Judgment) [2026] EUECJ C-371/24 (19 March 2026)

| | [Home ]
[Databases ]
[World Law ]
[Multidatabase Search ]
[Help ]
[Feedback ]
[DONATE ] | |
| # Court of Justice of the European Communities (including Court of First Instance Decisions) | | |
| You are here: BAILII >> Databases >> Court of Justice of the European Communities (including Court of First Instance Decisions) >>

  Comdribus (Protection of natural persons with regard to the processing of personal data for the purpose of combating criminal offences - Collection of biometric data - Judgment) [2026] EUECJ C-371/24 (19 March 2026)

URL: https://www.bailii.org/eu/cases/EUECJ/2026/C37124.html
Cite as:
ECLI:EU:C:2026:219,

[2026] EUECJ C-371/24,

EU:C:2026:219 | | |
[New search ]

[Contents list ]

[Help ]

Provisional text

JUDGMENT OF THE COURT (Fifth Chamber)

19 March 2026 (*)

( Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data for the purpose of combating criminal offences - Directive (EU) 2016/680 - Article 10 - Processing of special categories of personal data - Collection of biometric data - Taking of fingerprints and of photographs - Person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence - Whether strictly necessary - Discretion - Obligation to state reasons - Refusal of the data subject to consent to the collection of his or her biometric data - National legislation allowing a person to be prosecuted for and convicted of a specific criminal offence penalising such a refusal, even in the absence of any prosecution or conviction in respect of the criminal offence that formed the basis of the envisaged collection of those data )

In Case C‑371/24 [Comdribus], (i)

REQUEST for a preliminary ruling under Article 267 TFEU from the cour d'appel de Paris (Court of Appeal, Paris, France), made by decision of 26 April 2024, received at the Court on 24 May 2024, in the criminal proceedings against

HW

interested party:

Ministère public,

THE COURT (Fifth Chamber),

composed of M.L. Arastey Sahún, President of the Chamber, K. Lenaerts, President of the Court, acting as Judge of the Fifth Chamber, J. Passer, E. Regan (Rapporteur) and D. Gratsias, Judges,

Advocate General: M. Szpunar,

Registrar: E. Sartori, Administrator,

having regard to the written procedure and further to the hearing on 30 April 2025,

after considering the observations submitted on behalf of:

–        HW, by A. Baudelin, avocat,

–        the French Government, by R. Bénard, B. Dourthe, F. du Couëdic and B. Fodda, acting as Agents,

–        the Czech Government, by L. Březinová and J. Vláčil, acting as Agents,

–        Ireland, by M. Browne, Chief State Solicitor, by A. Burke and A. Joyce, acting as Agents, and by A. Thuillier, Barrister-at-Law,

–        the Polish Government, by B. Majczyna, acting as Agent,

–        the European Commission, by A. Bouchagiar, H. Kranenborg and M. Wasmeier, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 1 August 2025,

gives the following

Judgment

1 This request for a preliminary ruling concerns the interpretation of Article 4(1)(a) to (c) and Articles 8 and 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89).

2 The request has been made in criminal proceedings brought against HW, at the end of which he was sentenced to a fine on account of his refusal to consent to procedures for the gathering of identification data by the taking of fingerprints and of photographs, even though he was acquitted of the offence that formed the basis of those procedures.

Legal context

European Union law

3 Article 1 of Directive 2016/680, entitled 'Subject matter and objectives', provides, in paragraph 1 thereof:

'This Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.'

4 Article 2 of that directive, which is entitled 'Scope', provides, in paragraph 1 thereof:

'This Directive applies to the processing of personal data by competent authorities for the purposes set out in Article 1(1).'

5 Under Article 3 of that directive, entitled 'Definitions':

'For the purposes of this Directive:

(1)      “personal data” means any information relating to an identified or identifiable natural person …; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(2)      “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

…

(7)      “competent authority” means:

(a)      any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; or

(b)      any other body or entity entrusted by Member State law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

(8)      “controller” means the competent authority which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

…

(12)      “genetic data” means personal data, relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;

(13)      “biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;

…'

6 Article 4 of Directive 2016/680, entitled 'Principles relating to processing of personal data', states:

'1.      Member States shall provide for personal data to be:

(a)      processed lawfully and fairly;

(b)      collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;

(c)      adequate, relevant and not excessive in relation to the purposes for which they are processed;

…

4.      The controller shall be responsible for, and be able to demonstrate compliance with, paragraphs 1, 2 and 3.'

7 Article 8 of that directive, entitled 'Lawfulness of processing', provides:

'1.      Member States shall provide for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority for the purposes set out in Article 1(1) and that it is based on Union or Member State law.

2.      Member State law regulating processing within the scope of this Directive shall specify at least the objectives of processing, the personal data to be processed and the purposes of the processing.'

8 Under Article 10 of that directive, entitled 'Processing of special categories of personal data':

'Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be allowed only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:

(a)      where authorised by Union or Member State law;

(b)      to protect the vital interests of the data subject or of another natural person; or

(c)      where such processing relates to data which are manifestly made public by the data subject.'

9 Article 54 of that directive, entitled 'Right to an effective judicial remedy against a controller or processor', provides:

'Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 52, Member States shall provide for the right of a data subject to an effective judicial remedy where he or she considers that his or her rights laid down in provisions adopted pursuant to this Directive have been infringed as a result of the processing of his or her personal data in non-compliance with those provisions.'

French law

10 Under Article 55-1 of the code de procédure pénale (Code of Criminal Procedure), in the version applicable to the facts of the main proceedings:

'A senior police officer may carry out, or supervise, the procedures for the taking of non-intimate samples, … from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, that are necessary for the purpose of conducting technical and scientific tests to compare them with traces or evidence obtained for the purposes of the investigation.

That officer shall carry out, or supervise, the procedures for the gathering of identification data, in particular the taking of fingerprints, palm prints or photographs, that are necessary for the purposes of entry into and consultation of police databases, in accordance with the rules applicable to each of those databases.

The refusal, by a person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, to consent to the procedures referred to in the first and second paragraphs, ordered by the senior police officer, shall be punished by a term of imprisonment of one year and a fine of EUR 15 000.'

The main proceedings and the questions referred

11 On 30 May 2020, more than a hundred climate activists occupied the Avenue des Champs-Élysées in Paris (France). Intervening to disperse them, law enforcement officers detained several people, including HW, for organising a demonstration without giving notice and for disobedience. HW was interviewed in police custody and gave his identity but refused, first, to be fingerprinted and photographed, and second, to provide the code to unlock his mobile phone or to unlock it himself, despite having been informed that those refusals amounted to offences punishable by a term of imprisonment and by fines.

12 On 1 June 2020, at the end of his police custody, HW was brought before a Procureur de la République (public prosecutor, France), and subsequently before a juge des libertés et de la détention (liberties and detention judge, France), who placed HW under judicial supervision and informed him that he would have to appear before the tribunal correctionnel de Paris (Criminal Court, Paris, France). HW was accused of:

–        first, having organised, on 30 May 2020 in Paris, a demonstration on a public road without giving prior notice under the conditions established by law, in the present case, in particular, by urging on the participants and by giving them instructions not to show their identity documents and not to comply with the orders of law enforcement officers by creating a human chain, instructions which the other demonstrators immediately followed;

–        second, having refused, on 31 May 2020 in Paris, in full knowledge of a decryption key for a cryptographic device likely to have been used to prepare, facilitate or commit a crime or other offence, to reveal or activate that key further to a judicial request in the context of a preliminary, on-the-spot or judicial investigation, in the present case by refusing to provide the codes for his phone;

–        third, having refused, on 30 May 2020 in Paris, although he was reasonably suspected on one or more grounds of having committed or attempted to commit an offence, to consent to the gathering of identification data, in particular by the taking of fingerprints, palm prints or photographs for the purposes of entry into and consultation of police databases, in accordance with the rules applicable to each of those databases.

13 By judgment of 8 September 2021, the tribunal correctionnel de Paris (Criminal Court, Paris) acquitted HW of the first two offences referred to in the preceding paragraph. By contrast, it found him guilty of the third offence referred to above, and, accordingly, sentenced HW to a fine of EUR 300.

14 HW and the ministère public (Public Prosecutor's Office, France) each brought an appeal against that judgment before the cour d'appel de Paris (Court of Appeal, Paris, France), which is the referring court.

15 The referring court recalls that, in the judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C‑205/21, EU:C:2023:49, paragraph 135), the Court of Justice held that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 thereof, must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation for the competent authority to verify whether and demonstrate that, first, their collection is strictly necessary for achieving the specific objectives pursued and, second, those objectives cannot be achieved by measures constituting a less serious interference with the rights and freedoms of the person concerned.

16 The referring court considers that, notwithstanding that judgment, certain questions remain as regards the interpretation of those provisions of Directive 2016/680, in particular with regard to the differences between the national legislation at issue in the case which led to that judgment and Article 55-1 of the Code of Criminal Procedure.

17 In the first place, according to the referring court, the findings made by the Court of Justice in that judgment apply to criminal procedures in which there is systematic collection of the biometric and genetic data of any person against whom there is sufficient evidence of the commission of an offence such as to justify an accusation being made against that person. The referring court submits that, by contrast, the Court has not yet ruled on a legal situation such as that set out in Article 55-1 of the Code of Criminal Procedure, which provides for the systematic collection of the biometric data of a person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, in the context of an investigation, without that meaning that that person has been accused thereof. It is therefore necessary, according to the referring court, to ascertain whether that latter condition is sufficient to meet the requirements arising from that directive.

18 In the second place, the referring court states that, although asked about the obligation, on the part of the competent authority, to provide a sufficient statement of reasons, in the light of the requirements arising from that directive, for the necessity of the collection of biometric and genetic data, the Court of Justice merely stated, in the judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C‑205/21, EU:C:2023:49), that it was for the national court to verify whether national law enables it to be assessed whether it is 'strictly necessary', within the meaning of Article 10 of that directive, to collect the biometric and genetic data of the data subject. According to the referring court, uncertainty remains as to whether the requirement to provide a sufficient statement of reasons as to why the collection is strictly necessary is the subject of a preliminary assessment by the senior police officer, who is the competent authority under Article 55-1 of the Code of Criminal Procedure, and/or the subject of a subsequent assessment by a court that may be called upon to examine the lawfulness of that collection.

19 In the third place, the referring court states that Article 55-1 of the Code of Criminal Procedure raises an additional, novel question having regard to EU law. According to the third paragraph of that provision, the refusal to consent to a procedure for the gathering of identification data is a specific criminal offence that may give rise to prosecution and conviction even though the main offence that formed the basis of the envisaged collection did not itself lead to such prosecution or conviction of its alleged perpetrator. The question thus arises whether the condition under which biometric data may be collected where 'strictly necessary', within the meaning of Article 10 of Directive 2016/680, is satisfied, and whether prosecution or a potential conviction for that specific criminal offence may be justified.

20 According to the referring court, the answer to those questions is decisive for the outcome of the dispute in the main proceedings, since HW was convicted solely of the offence of refusing to consent to the gathering of identification data, whereas he was acquitted of the main offence that formed the basis of the measure for the gathering of identification data, and at no stage in the procedure was a sufficient statement of reasons provided as to why that measure was strictly necessary.

21 In those circumstances the cour d'appel de Paris (Court of Appeal, Paris) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

'(1)      Is Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 … of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the … Code of Criminal Procedure, which provides for the systematic gathering of identification data (fingerprints and photographs) from persons who are suspected on one or more grounds of having committed or attempted to commit an offence?

(2)      Is Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 … of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the … Code of Criminal Procedure, which does not impose on the competent authority an obligation to provide, in each individual case, a sufficient statement of reasons as to why it is strictly necessary to gather identification data?

(3)      Is Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 … of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the … Code of Criminal Procedure, which allows the prosecution and conviction on a [stand-alone] basis of a person who has refused to consent to the gathering of identification data even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data?'

Consideration of the questions referred

The first question

22 By its first question, the referring court asks, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 thereof, must be interpreted as precluding national legislation which provides for the systematic collection of the biometric data of any person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence.

23 It must be borne in mind at the outset that Article 10 of that directive is a specific provision which, as regards certain categories of personal data, such as biometric or genetic data, seeks to ensure their enhanced protection by establishing strengthened conditions for the lawful processing of such data. Those categories of data are, by their nature, particularly sensitive in relation to fundamental rights and freedoms as the context of their processing could create significant risks to the fundamental rights and freedoms of the data subjects (see, to that effect, judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 48 and the case-law cited).

24 Article 10 of that directive provides, as regards personal data that fall into one of the categories exhaustively listed in that article ('sensitive personal data'), which include biometric and genetic data, that their processing must satisfy, in addition to the condition of being covered by one of the three situations listed in points (a) to (c), the one referred to in point (a) being that that processing is authorised by Member State law, two further conditions, that is to say, first, that there must be 'appropriate safeguards' for the rights and freedoms of the data subject, and second, that the envisaged processing must be 'strictly necessary' (see, to that effect, judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 77).

25 As regards that latter condition, since Article 10 of Directive 2016/680 constitutes a special form of implementation, applicable to sensitive personal data, of the principles set out in Articles 4 and 8 of that directive, which must be observed by any data processing falling within the directive's scope, the scope of that condition must be determined in the light of those principles (judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), C‑205/21, EU:C:2023:49, paragraph 121).

26 It follows, first, that the scope of the 'strictly necessary' condition within the meaning of Article 10 of Directive 2016/680 must be determined, in accordance with Article 4(1)(b) of that directive, in the light of the purposes of the collection of the personal data at issue, which must be specified, explicit and legitimate. In addition, that condition requires, in accordance with Article 4(1)(c) of that directive, that personal data be adequate, relevant and not excessive in relation to the purposes for which they are processed, the latter requirement thus implying observance by the Member States of the principle of data minimisation, to which Article 10 gives specific expression as regards sensitive personal data (see, to that effect, judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), C‑205/21, EU:C:2023:49, paragraph 122).

27 Second, the scope of that condition must, in the light of Article 4(1)(a) of Directive 2016/680, be determined having regard to Article 8(1) of that directive, under which Member States must provide, in particular, for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority for the purposes set out in Article 1(1) of that directive, and to Article 8(2), which requires Member State law regulating processing within the scope of the directive to specify at least the objectives of processing, the personal data to be processed and the purposes of the processing (judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), C‑205/21, EU:C:2023:49, paragraph 123).

28 In the light of those principles arising from Article 4(1)(a) to (c) and Article 8 of Directive 2016/680, the 'strictly necessary' condition within the meaning of Article 10 of that directive, which establishes strengthened conditions for the lawful processing of sensitive data compared with those following from Articles 4 and 8, implies, in the first place, that that necessity is to be assessed with particular rigour in respect of the purposes pursued by the processing in question, and that, accordingly, such processing can be regarded as necessary solely in a limited number of cases (see, to that effect, judgments of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), C‑205/21, EU:C:2023:49, paragraphs 117 and 118, and of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 78).

29 Thus, the purposes of processing sensitive personal data, such as the collection of biometric and genetic data, cannot be indicated in terms that are too general, but have to be defined sufficiently precisely and specifically to enable assessment of whether that processing is 'strictly necessary' within the meaning of Article 10 of the directive (see, to that effect, judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 79 and the case-law cited).

30 In that regard, while Directive 2016/680 does not define the concept of 'purposes of the processing', it may be noted that, as is clear from paragraph 27 above, Article 8(2) of that directive expressly distinguishes that concept from that of 'objectives of processing' (see, to that effect, judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 80).

31 The Court has previously held that the concept of 'objectives of processing' within the meaning of Article 8(2) of Directive 2016/680 refers to the more general objectives, stated in Article 1(1) of Directive 2016/680, that the processing must pursue to be within the scope of that directive, whereas the concept of 'purposes of the processing' within the meaning, inter alia, of Article 8(2) of that directive, must be understood as referring to the specific and real aims pursued by the processing of personal data in the light of the task of the controller, such as a specific task connected with the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties (judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 81).

32 In the second place, the 'strictly necessary' condition within the meaning of Article 10 of Directive 2016/680 entails particularly strict checking as to whether the principle of minimisation of the processing of the data concerned, set out in Article 4(1)(c) of that directive, is observed, and thus requires the controller of sensitive personal data to ensure that the purpose pursued by the processing in question cannot be achieved just as effectively by having recourse to categories of data other than those listed in Article 10 of the directive (see, to that effect, judgments of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), C‑205/21, EU:C:2023:49, paragraphs 125 and 126, and of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraphs 82 and 85), since that principle gives expression to the principle of proportionality (judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 79 and the case-law cited).

33 In the third place, having regard to the significant risks that the processing of sensitive personal data poses to the rights and freedoms of data subjects, in particular in the context of the tasks of the competent authorities for the purposes set out in Article 1(1) of Directive 2016/680, the 'strictly necessary' condition within the meaning of Article 10 of that directive requires account to be taken of the specific importance of the purpose of the processing concerned. Such importance may be assessed on the basis of the very nature of the purpose pursued – in particular of the fact that the processing serves a specific objective connected with the prevention of criminal offences or threats to public security displaying a certain degree of seriousness, the punishment of such offences or protection against such threats – and in the light of the specific circumstances in which that processing is carried out (judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 83 and the case-law cited).

34 In the fourth place, as regards the collection of biometric and genetic data of persons accused or suspected of having committed an intentional criminal offence for the purposes of future identification and comparison of those persons, it is clear from the case-law of the Court that the strictly necessary nature of that collection must reflect all of the relevant factors, such as, in particular, the nature and seriousness of the presumed offence of which those persons are accused, the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the persons in question (see, to that effect, judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 84 and the case-law cited).

35 Consequently, while a Member State may comply with Directive 2016/680 either by delegating to the competent authorities the responsibility of ensuring, in each individual case, that for all processing of sensitive personal data the condition that that processing is 'strictly necessary', within the meaning of Article 10 of that directive, is satisfied, or by laying down in legislation the assessment criteria that the authorities must apply subsequently in a non-discriminatory manner, the fact remains that, in that second situation, those criteria must be capable of meeting all of the requirements that arise from that same condition, as set out in paragraphs 25 to 34 above (judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 87).

36 Thus, in the light of all those requirements, the Court has found that national legislation which provides for the systematic collection of the biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation for the competent authority to verify whether and demonstrate that, first, their collection is strictly necessary for achieving the specific purposes pursued and, second, that those purposes cannot be achieved by measures constituting a less serious interference with the rights and freedoms of the person concerned, is contrary to the 'strictly necessary' condition within the meaning of Article 10 of Directive 2016/680, since such legislation is liable to lead, in an indiscriminate and generalised manner, to the collection of the biometric and genetic data of most accused persons (see, to that effect, inter alia, judgments of 30 January 2024, Direktor na Glavna direktsia 'Natsionalna politsia' pri MVR – Sofia, C‑118/22, EU:C:2024:97, paragraph 64, and of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 88 and the case-law cited).

37 In the present case, Article 55-1 of the Code of Criminal Procedure, in so far as it provides, in essence, that the senior police officer is to carry out, or supervise, the procedures for the gathering of identification data, in particular the taking of fingerprints and of photographs, from any person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence, relates, like national legislation such as that referred to in paragraph 36 above, to the 'processing' of 'biometric data', as referred to in Article 10 of Directive 2016/680. Those identification data give rise, for the purposes of Article 3(2) and (13) of that directive, to the 'collection', respectively, of 'dactyloscopic data' and of 'facial images' which provide, by specific technical processing, data relating to the physical characteristics of a person and which allow or confirm his or her unique identification.

38 As is apparent from the wording of Article 55-1 of the Code of Criminal Procedure and as the French Government confirmed in its written observations, the purpose of that collection of biometric data is to enable a comparison of the biometric data of a person who is the subject of a criminal investigation with the traces and evidence collected for the purposes of that investigation and to identify the accused person in that investigation or in other ongoing or future criminal procedures.

39 As the Advocate General stated, in essence, in points 52 to 54 of his Opinion, the data thus collected appear, in the light of those specific and concrete purposes, to be adequate and relevant, within the meaning of Article 4(1)(c) of that directive, provided that those purposes are defined in an appropriate and sufficiently precise manner by the law of the Member State concerned, including the case-law of the national courts, which it is for the referring court to ascertain (see, to that effect, judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 90).

40 Nevertheless, it should be stated that the scope of the collection of biometric data, as defined in Article 55-1 of the Code of Criminal Procedure, appears to be particularly broad, since it concerns all persons reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence.

41 The mere fact that a person is reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence cannot be regarded as a factor that in itself enables it to be presumed that the collection of his or her biometric data is strictly necessary in the light of the specific and concrete purposes that that collection pursues and given the resulting interferences with the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union ('the Charter') (see, to that effect, judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), C‑205/21, EU:C:2023:49, paragraph 130).

42 First, it cannot be ruled out that, in certain cases, the collection of biometric data will, notwithstanding the existence of one or more reasonable grounds for suspecting that the data subject has committed or attempted to commit a criminal offence, not reflect any specific necessity for the purposes of the criminal procedure in progress (see, to that effect, judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), C‑205/21, EU:C:2023:49, paragraph 131).

43 Second, the possibility that the collection of the biometric data of a person suspected of having committed or attempted to commit a criminal offence may be strictly necessary in the investigation against him or her or in other ongoing or future criminal procedures must be assessed in accordance with the case-law recalled in paragraph 34 above, in the light of all the relevant factors.

44 As is apparent from the very wording of the first question, the referring court starts from the premiss that Article 55-1 of the Code of Criminal Procedure provides for the systematic collection of the biometric data of any person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence, without there being an obligation for the senior police officer to verify whether and demonstrate that, in each individual case, that collection is 'strictly necessary', within the meaning of Article 10 of Directive 2016/680.

45 It should be noted, however, that the French Government disputes that interpretation of national law by the referring court.

46 First, according to the French Government, it is apparent from the word 'may', used in the first paragraph of Article 55-1 of the Code of Criminal Procedure, that the senior police officer has discretion to carry out procedures for the taking of non-intimate samples that are 'necessary' for the purposes of the investigation, within the meaning of that provision.

47 Second, the French Government submits that it follows also from the very wording of the second paragraph of Article 55-1 of that code that the implementation of the procedures for the gathering of identification data, in particular dactyloscopic and photographic data, that are laid down by that provision is subject to the rules specific to each of the police databases into which those procedures feed, namely, respectively, the automated database of fingerprints, and, for photographs alone, the prior criminal records database. A number of other provisions of that code, to which the referring court has not pointed, strictly limit the possibility of gathering identification data and their use. In particular, in accordance with those provisions, identification data are to be used only where the investigation so requires. In addition, that possibility of gathering identification data is subject to stricter conditions than the mere existence of suspicions of the commission of or of the attempt to commit a criminal offence, since the presence of serious or consistent evidence making it likely that the person accused participated, as perpetrator or accomplice, in a criminal offence punishable by a term of imprisonment or the need for that person to be identified with certainty is required.

48 Furthermore, the French Government claims that while it is true that the 'strictly necessary' condition within the meaning of Article 10 of Directive 2016/680 is not referred to in Article 55-1 of the Code of Criminal Procedure, it is nevertheless expressly set out in the national legislation specifically transposing that directive. According to that government, the collection of biometric data on the basis of Article 55-1 of that code cannot infringe the provisions of that legislation.

49 In that regard, it should be recalled that is not for the Court to rule on the interpretation of provisions of national law or to decide whether the interpretation or application of those provisions by the national court is correct, since such an interpretation falls within the exclusive jurisdiction of the national court (judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 53 and the case-law cited).

50 Thus, the Court must take into account, under the division of jurisdiction between the Courts of the European Union and the national courts, the factual and legal context, as set out in the order for reference, of the questions referred for a preliminary ruling. As a result, whatever criticism the government of a Member State may have made of the interpretation of national law adopted by the referring court, the questions referred for a preliminary ruling must be examined in the light of that court's interpretation, the accuracy of which is not a matter for the Court to determine (judgment of 29 July 2024, CU and ND (Social assistance – Indirect discrimination), C‑112/22 and C‑223/22, EU:C:2024:636, paragraph 40 and the case-law cited).

51 In those circumstances, assuming that, as the referring court states, Article 55-1 of the Code of Criminal Procedure had to be interpreted as rendering systematic the procedures for the gathering of identification data, in particular dactyloscopic and photographic data, from any person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence, without the competent authority being required to assess, in each individual case, whether it is 'strictly necessary' within the meaning of Article 10 of Directive 2016/680 to carry out those procedures for the gathering of identification data, that national legislation would, in accordance with the case-law referred to in paragraph 36 above, be contrary to Article 10 of the directive, in so far as it is liable to lead to the collection of the biometric data of those persons in an indiscriminate and generalised manner.

52 That said, having regard, in particular, to the information referred to in paragraphs 46 to 48 above, it is for the referring court, first, to verify whether the national legislation at issue in the main proceedings requires the police authority systematically to carry out that collection, without that authority being in a position to assess, in each individual case, whether that collection is 'strictly necessary' within the meaning of Article 10.

53 Second, the referring court must also satisfy itself, having regard, in particular, to the claim made by HW both in the main proceedings and in his written observations, referred to also in the grounds of the order for reference, that the automated fingerprint database contains records of the fingerprints of 6.5 million persons, that the effective implementation of the national legislation at issue in the main proceedings by the competent authorities also does not lead to the systematic collection of the biometric data of every person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence (see, by analogy, judgment of 23 April 2009, Angelidaki and Others, C‑378/07 to C‑380/07, EU:C:2009:250, paragraph 164 and the case-law cited). In the situation referred to in paragraph 46 above, where the senior police officer has discretion in the application of the first paragraph of Article 55-1 of the Code of Criminal Procedure, that police officer would have to exercise that discretion in accordance with the requirements set out in paragraphs 28 to 36 above.

54 Consequently, the answer to the first question is that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 of that directive, must be interpreted as precluding national legislation which provides for the systematic collection of the biometric data of any person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence, unless it is established, first, that the national law defines the specific and concrete purposes pursued by that collection in an appropriate and sufficiently precise manner, and second, that the competent authority is required, in each individual case, to assess whether that collection is strictly necessary for achieving those purposes, so that that collection is not systematic.

The second question

55 By its second question, the referring court asks, in essence, whether Article 10 of Directive 2016/680 must be interpreted as precluding national legislation which does not lay down an obligation on the part of the competent authority to provide a sufficient statement of reasons, in each individual case, as to why it is 'strictly necessary', within the meaning of that provision, to collect the biometric data of a person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence.

Admissibility

56 The French Government submits that the question is inadmissible. According to it, it is apparent from the request for a preliminary ruling that the reasons which led the referring court to ask that question concern the authority which must ensure review of compliance with the 'strictly necessary' condition for the purposes of Article 10 of Directive 2016/680. The wording of the second question does not relate to that aspect, but concerns the obligation to provide a sufficient statement of reasons, on a case-by-case basis, as to why the gathering of the identification data of the data subjects is 'strictly necessary'. According to the French Government, the usefulness of the answer to the second question for the outcome of the main proceedings is therefore not substantiated. In particular, according to that government, the referring court has failed to explain how the provisions of EU law to which it refers, namely Article 4(1)(a) to (c) and Articles 8 and 10 of the directive, support the existence of any obligation to state reasons.

57 In that regard, it should be borne in mind that, according to settled case-law, questions on the interpretation of EU law referred by a national court in the factual and legislative context which that court is responsible for defining, and the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevance (judgments of 15 May 2003, Salzmann, C‑300/01, EU:C:2003:283, paragraph 31, and of 18 December 2025, Tenergie (Request for remission of import duties), C‑259/24, EU:C:2025:1013, paragraph 26 and the case-law cited).

58 The Court may refuse to rule on a question referred by a national court for a preliminary ruling only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 62 and the case-law cited).

59 In the present case, it should be noted that, as is clear from paragraph 18 above, the referring court expressly asks, in the grounds of its request for a preliminary ruling, whether the 'requirement to provide a sufficient statement of reasons' as to why it is 'strictly necessary', within the meaning of Article 10 of Directive 2016/680, to collect the identification data applies to the 'competent authority', as defined in Article 3(7) of that directive, namely the senior police officer, and/or to the national court that may be called upon to review the acts adopted by that authority.

60 It thus appears that, contrary to what the French Government maintains, the referring court is not merely uncertain about the authority that is responsible for reviewing whether such collection is 'strictly necessary' within the meaning of Article 10 of that directive, but also seeks to clarify the scope of the obligation to state reasons, in particular as regards whether such reasons are sufficient, which might, as the case may be, be incumbent on that authority.

61 In those circumstances, it cannot be stated that the interpretation of EU law sought bears no relation to the actual facts of the main action or its purpose or that it relates to a hypothetical problem.

62 As regards the grounds on which EU law requires the competent authority to state reasons as to why it is 'strictly necessary', within the meaning of Article 10 of that directive, to collect biometric data, which are, according to the French Government, not set out in the order for reference, it is sufficient to note that such grounds concern the substance of the answer to be given to the second question and not the admissibility of that question.

63 It follows that that second question is admissible.

Substance

64 As is apparent from paragraph 24 above, Article 10 of Directive 2016/680 provides that the processing of sensitive personal data, such as the collection of biometric data, must satisfy, in addition to the condition that the envisaged processing must be 'strictly necessary', the condition, inter alia, that there must be 'appropriate safeguards' for the rights and freedoms of the data subject.

65 As regards that latter condition, it must be noted that Article 54 of that directive, which gives expression to Article 47 of the Charter, expressly requires Member States to provide that, where a person considers that his or her rights laid down in the provisions adopted pursuant to that directive have been infringed as a result of the processing of his or her personal data in breach of those provisions, that person has the right to an effective judicial remedy (judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 117).

66 In that regard, it is clear also from the Court's case-law that the right to an effective judicial remedy, guaranteed in Article 47 of the Charter, requires, in principle, that the person concerned must be able to ascertain the reasons forming the basis of a decision taken in relation to him or her, either by reading that decision or by being informed of those reasons, so as to enable him or her to defend his or her rights in the best possible conditions and to decide in full knowledge of the facts whether or not it is useful to refer the matter to the court with jurisdiction and so as fully to enable that court to review the lawfulness of that decision (judgment of 13 June 2024, HYA and Others II, C‑229/23, EU:C:2024:505, paragraph 52 and the case-law cited).

67 Although that right is not an absolute right and, in accordance with Article 52(1) of the Charter, limitations may be placed upon it, that is on condition that those limitations are provided for by law, they respect the essence of the rights and freedoms at issue and, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others (judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 119 and the case-law cited).

68 It is therefore for the competent authority, authorised by national law to collect biometric data where it is 'strictly necessary', within the meaning of Article 10 of Directive 2016/680, to provide data subjects, in the context of the applicable national procedures, with the grounds on which that processing is 'strictly necessary', since those grounds are necessary to enable those persons to exercise, inter alia, the right to a remedy expressly provided for in Article 54 of that directive, in accordance with Article 47 of the Charter (see, to that effect, judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 120 and the case-law cited).

69 Those considerations are not called into question by the arguments of the governments which have participated in the present preliminary ruling procedure.

70 First of all, such an obligation, on the part of the competent authority, to state reasons as to why it is 'strictly necessary', within the meaning of Article 10, to collect the biometric data of a person who is the subject of a criminal investigation is in no way capable of compromising that investigation. Such a statement of reasons may be succinct, provided that it is sufficiently clear in order to allow the data subject to exercise his or her right to a remedy.

71 Next, such an obligation to state reasons is all the more important since, as is clear, in particular, from paragraphs 25 to 36 above, the competent authority must, in accordance with Article 10 of the directive, assess, in each individual case, whether that collection is 'strictly necessary', by verifying whether and demonstrating that that is the case. If that authority were not required to state reasons for its decisions in that regard, the national court called upon to rule on the lawfulness of that collection would not be able to review either the effective exercise by that authority of that discretion or the merits of that collection (see, to that effect, judgment of 28 November 2024, Ministerstvo na vanshnite raboti (Recording of biometric and genetic data II), C‑80/23, EU:C:2024:991, paragraph 58).

72 That interpretation is borne out, as the European Commission has correctly stated, by Article 4(4) of Directive 2016/680, which requires the competent authority collecting biometric data, as a 'controller' within the meaning of Article 3(8) of that directive, to be able to demonstrate compliance, inter alia, with the obligations set out in Article 4(1)(a) to (c), from which it follows, read in conjunction with Article 10 of that directive, that the purposes of that collection must, as has been noted in paragraph 29 above, be sufficiently precise and specific to enable assessment of whether that collection is 'strictly necessary' within the meaning of Article 10 of that directive.

73 It follows that the existence of judicial review of the lawfulness of the collection of biometric data by the 'competent authority', as defined in Article 3(7) of Directive 2016/680, cannot, in any event, compensate for the absence of an obligation on the part of that authority to state the reasons why that collection is 'strictly necessary', in accordance with Article 10 of that directive, by ensuring, in place of that authority, compliance with that obligation, because it is for that authority to carry out the assessment required under Article 10, and that assessment serves precisely to ensure, in turn, that that review is effective (see, to that effect, judgment of 28 November 2024, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data II), C‑80/23, EU:C:2024:991, paragraphs 57 and 61).

74 Lastly, it must be stated that the obligation, on the part of the competent authority, to state the reasons why the collection of biometric data is 'strictly necessary' within the meaning of Article 10 of Directive 2016/680, cannot, as the Advocate General observed in point 81 of his Opinion, be regarded as an excessive burden for that authority, since, as is clear, in particular, from paragraph 36 above, that collection may not, in any event, be systematic as regards persons reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence.

75 Consequently, the answer to the second question is that Article 10 of Directive 2016/680, read in conjunction with Article 4(4) and Article 54 of that directive and in the light of Article 47 of the Charter, must be interpreted as precluding national legislation which does not lay down an obligation on the part of the competent authority to provide a sufficient statement of reasons, in each individual case, as to why it is 'strictly necessary', within the meaning of that provision, to collect the biometric data of a person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence.

The third question

76 By its third question, the referring court asks, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 thereof, must be interpreted as precluding national legislation which allows a person to be prosecuted for and convicted of a specific criminal offence penalising that person's refusal to allow the collection of his or her biometric data, even though that person has not been prosecuted for or convicted of the criminal offence that formed the basis of the envisaged collection of those data.

Admissibility

77 The French Government is uncertain of the admissibility of that question. According to that government, that question relates to the lawfulness of the specific criminal offence provided for in the third paragraph of Article 55-1 of the Code of Criminal Procedure, which criminalises and penalises the refusal of the data subject to consent to procedures for the gathering of identification data, whereas Directive 2016/680 does not govern the consequences of such a refusal. Moreover, no act of EU law lays down common rules concerning the possibility, for a Member State, of criminalising and penalising such a refusal. In the French Government's submission, the third paragraph of Article 55-1 of the Code of Criminal Procedure therefore does not in any way implement EU law.

78 However, it is sufficient to recall in that regard that, according to settled case-law, where it is not obvious that the interpretation of an act of EU law bears no relation to the facts of the dispute in the main proceedings or its purpose, as is the case of Directive 2016/680 here, the objection alleging the inapplicability of that act to the case in the main proceedings concerns the substance of the questions raised (judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 67 and the case-law cited).

79 Consequently, the third question must be deemed admissible.

Substance

80 In order to answer that third question, it is necessary to examine, as a first step, whether national legislation which, like the third paragraph of Article 55-1 of the Code of Criminal Procedure, allows a person to be prosecuted for and convicted of a specific criminal offence penalising that person's refusal to allow the collection of his or her biometric data, even though that person has not been prosecuted for or convicted of the criminal offence that formed the basis of the envisaged collection of those data, falls within the scope of EU law, and in particular, as contemplated by the referring court, within the scope of Directive 2016/680. If it does, it would then be necessary to determine, as a second step, whether the provisions of that directive preclude such legislation.

81 As regards, in the first place, the scope of that directive, it should be borne in mind that, in accordance with Article 2(1) thereof, that directive applies to the processing of personal data by competent authorities for the purposes set out in Article 1(1) thereof, that is to say, inter alia, the purposes of the prevention, investigation, detection or prosecution of criminal offences.

82 It is clear from the Court's case-law that the attempt by the competent authority to process personal data, such as that taking place where the data subject refuses the collection of his or her biometric data, for the purposes of the prevention, investigation, detection or prosecution of criminal offences, falls within the scope of Directive 2016/680 (see, to that effect, judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), C‑548/21, EU:C:2024:830, paragraph 77).

83 It follows that, as the Advocate General observed in point 99 of his Opinion, where that refusal exposes that person, under national law, to the imposition of a criminal penalty for a specific offence relating to that refusal, compliance of the envisaged collection of biometric data with the provisions of that directive is a condition for the lawfulness of that penalty (see, by analogy, judgment of 16 May 2017, Berlioz Investment Fund, C‑682/15, EU:C:2017:373, paragraphs 41 and 74).

84 Consequently, national legislation which, like the third paragraph of Article 55-1 of the Code of Criminal Procedure, allows the prosecution and conviction, in respect of a specific criminal offence, of a person who has refused to have his or her biometric data collected, even though that person has not been prosecuted for or convicted of the criminal offence that formed the basis of that collection, falls within the scope of that directive.

85 As regards, in the second place, the question whether the provisions of Directive 2016/680 preclude such national legislation, it should be stated that, in so far as compliance of the envisaged collection of biometric data with those provisions amounts, as is clear from paragraph 83 above, to a condition for the lawfulness of the criminal penalty imposed, for a specific offence, on the person refusing the collection of those data, such a penalty may be imposed on that person only if, as is clear, in particular, from paragraphs 24 to 36 above, the collection attempt satisfies the 'strictly necessary' condition within the meaning of Article 10 of that directive, read in conjunction with Article 4(1)(a) to (c) and Article 8 thereof.

86 In that regard, as is clear from the case-law recalled in paragraphs 34 and 43 above, the possibility that the envisaged collection of biometric data may be strictly necessary, within the meaning of that directive, must be assessed in the light of all the relevant factors at the time the competent authorities are envisaging to collect those data. Accordingly, the fact that the data subject who was reasonably suspected, at the time that collection was envisaged, on one or more grounds of having committed or attempted to commit a criminal offence, is not, ultimately, prosecuted for or convicted of that offence, is not, in itself, decisive for determining whether the 'strictly necessary' condition has been satisfied.

87 Thus, the Court has previously stated that the mere fact that collection of the biometric data of a person who is accused of a criminal offence takes place before he or she has been convicted by final judgment is not sufficient to exclude that collection from being regarded as 'strictly necessary', within the meaning of Article 10 of that directive, since, in the light of the specific and concrete purposes pursued, that collection, including as regards the type of data concerned, may prove strictly necessary, inter alia to make it possible to establish whether, because of that person's possible involvement in a criminal organisation, he or she may have been involved in other offences for which that type of data could be relevant or, where there is a risk that that person will flee, to enable that person to be identified (see, to that effect, judgment of 20 November 2025, Policejní prezidium (Storage of biometric and genetic data), C‑57/23, EU:C:2025:905, paragraph 93).

88 That said, it is important to point out that, since such a criminal penalty, for a specific offence penalising a person's refusal to allow the collection of his or her biometric data, falls within the scope of EU law, it must observe the general principles of EU law, which include the principle of proportionality, enshrined, in particular, in Article 49(3) of the Charter, according to which the severity of penalties must not be disproportionate to the offence (see, to that effect, judgment of 8 March 2022, Bezirkshauptmannschaft Hartberg-Fürstenfeld (Direct effect), C‑205/20, EU:C:2022:168, paragraph 31 and the case-law cited).

89 The principle of proportionality requires, first, that the penalty imposed corresponds to the seriousness of the offence and, second, that the individual circumstances of the particular case are taken into account in determining the penalty and fixing the amount of the fine (judgment of 4 October 2018, Link Logistik N&N, C‑384/17, EU:C:2018:810, paragraph 45).

90 In that regard, as the Advocate General stated, in essence, in points 109 to 112 of his Opinion, it is for the national court having jurisdiction to impose a criminal penalty in respect of a specific offence penalising a person's refusal to allow the collection of his or her biometric data to take account, in accordance with the case-law referred to in paragraph 34 above, inter alia, of that person's conduct and profile, of his or her criminal record and of the seriousness of the alleged criminal offence that formed the basis of the envisaged collection.

91 Consequently, the answer to the third question is that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 thereof and in the light of Article 49(3) of the Charter, must be interpreted as not precluding national legislation which allows a person to be prosecuted for and convicted of a specific criminal offence penalising that person's refusal to allow the collection of his or her biometric data, even though that person has not been prosecuted for or convicted of the criminal offence that formed the basis of the envisaged collection of those data, provided that that collection satisfies the 'strictly necessary' condition within the meaning of Article 10 of the directive and that the criminal penalty imposed in that respect observes the principle of proportionality.

Costs

92 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Fifth Chamber) hereby rules:

1. Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Article 4(1)(a) to (c) and Article 8 of that directive,

must be interpreted as precluding national legislation which provides for the systematic collection of the biometric data of any person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence, unless it is established, first, that the national law defines the specific and concrete purposes pursued by that collection in an appropriate and sufficiently precise manner, and second, that the competent authority is required, in each individual case, to assess whether that collection is strictly necessary for achieving those purposes, so that that collection is not systematic.

1. Article 10 of Directive 2016/680, read in conjunction with Article 4(4) and Article 54 of that directive and in the light of Article 47 of the Charter of Fundamental Rights of the European Union,

must be interpreted as precluding national legislation which does not lay down an obligation on the part of the competent authority to provide a sufficient statement of reasons, in each individual case, as to why it is 'strictly necessary', within the meaning of that provision, to collect the biometric data of a person reasonably suspected on one or more grounds of having committed or attempted to commit a criminal offence.

1. Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 of that directive and in the light of Article 49(3) of the Charter of Fundamental Rights,

must be interpreted as not precluding national legislation which allows a person to be prosecuted for and convicted of a specific criminal offence penalising that person's refusal to allow the collection of his or her biometric data, even though that person has not been prosecuted for or convicted of the criminal offence that formed the basis of the envisaged collection of those data, provided that that collection satisfies the 'strictly necessary' condition within the meaning of Article 10 of the directive and that the criminal penalty imposed in that respect observes the principle of proportionality.

[Signatures]

* Language of the case: French.

i The name of the present case is a fictitious name. It does not correspond to the real name of any party to the proceedings.

© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.

BAILII: Copyright Policy | Disclaimers | Privacy Policy | Feedback | Donate to BAILII
URL: https://www.bailii.org/eu/cases/EUECJ/2026/C37124.html