CJEU: Police biometric data collection must be strictly necessary

Communications Directorate Press and Information Unit curia.europa.eu PRESS RELEASE No 39/26 Luxembourg, 19 March 2026 Judgment of the Court in Case C-371/24 | [Comdribus] A police authority may, in a criminal investigation, collect biometric data solely on the ground that that collection is strictly necessary The gathering of identification data may not be required systematically and clear reasons must be given for it, failing which the criminal penalty laid down for refusing to consent to that gathering will be invalid In May 2020, HW was detained in Paris (France) for organising a demonstration without prior notice and for disobedience. While he was in police custody, he refused to consent to the gathering of identification data (the taking of fingerprints and of photographs). That refusal resulted in HW being sentenced, even though he was acquitted of the offence forming the basis of the envisaged gathering of identification data. He challenged that sentence, claiming that the applicable French legislation was not consistent with the EU rules on the protection of personal data in criminal matters. It is against that background that the Court of Appeal, Paris, has made a reference for a preliminary ruling to the Court of Justice. The referring court asks, in essence, whether EU law allows national authorities systematically to collect fingerprints and photographs of any person suspected of an offence, without having to provide reasons for that measure on a case-by-case basis. The referring court asks also whether a person may be prosecuted for having refused to consent to such collection, even if that person was ultimately not prosecuted for the offence of which he or she was suspected. In its judgment, the Court of Justice clarifies the requirements imposed on national authorities when they collect biometric data (fingerprints, photographs) for the purposes of a criminal investigation. First of all, the Court recalls that biometric data are sensitive personal data within the meaning of EU law, which calls for enhanced protection: their processing is authorised only where it is strictly necessary and where there are appropriate safeguards for the rights and freedoms of the data subject. The Court states that the mere existence of one or more reasonable grounds for suspecting an offence does not suffice as a reason for the collection of biometric data. Every decision to gather identification data must therefore contain a clear statement of reasons, even if that statement is succinct, allowing the data subject to understand the reasons for the measure and to exercise his or her right to a remedy. That obligation to state reasons is not an excessive burden for the authority in question, since that collection may not be systematic. Furthermore, the Court specifies that national legislation rendering that data gathering systematic, without the competent police authority being able to assess in each individual case whether such gathering is necessary, would be contrary to EU law since it would lead to an indiscriminate and generalised collection of biometric data. National law must therefore specify the concrete purposes of the collection. As regards the lawfulness of the penalty for refusing to consent to the gathering of biometric data, the Court holds that that lawfulness is dependent on compliance of the underlying collection with the ‘strictly necessary’ condition: if the

Communications Directorate Press and Information Unit curia.europa.eu Stay Connected! collection satisfies that condition, the penalty is not incompatible with EU law, provided, however, that it observes the principle of proportionality laid down by the Charter of Fundamental Rights of the European Union. NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of European Union law or the validity of a European Union act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised. Unofficial document for media use, not binding on the Court of Justice. The full text, and, as the case may be, an abstract of the judgment is published on the CURIA website on the day of delivery. Press contact: Jacques René Zammit ✆ (+352) 4303 3355. Pictures of the delivery of the judgment are available from "Europe by Satellite" ✆ (+32) 2 2964106. The name of the present case is a fictitious name. It does not correspond to the real name of any party to the proceedings. By judgment of the Criminal Court, Paris, HW was sentenced to a fine of € 300 for refusing to consent to procedures for the gathering of identification data to be included in a police database on persons suspected of a crime or another offence. Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA. Within the meaning of Article 10 of Directive 2016/680, which lays down the rules governing the processing of the most sensitive data, such as fingerprints, facial images or genetic information.