Case C‑118/22
NG
v
Direktor na Glavna direktsia ‘Natsionalna politsia’ pri Ministerstvo na vatreshnite raboti – Sofia
(Request for a preliminary ruling from the Varhoven administrativen sad)
Judgment of the Court (Grand Chamber) of 30 January 2024
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data for the purpose of combating crime – Directive (EU) 2016/680 – Article 4(1)(c) and (e) – Data minimisation – Limitation of storage – Article 5 – Appropriate time limits for erasure or for a periodic review of the need for the storage – Article 10 – Processing of biometric and genetic data – Strict necessity – Article 16(2) and (3) – Right to erasure – Restriction of processing – Article 52(1) of the Charter of Fundamental Rights of the European Union – Natural person convicted by final judgment and subsequently legally rehabilitated – Storage of data until death – No right to erasure or restriction of processing – Proportionality)
Approximation of laws – Protection of natural persons in relation to the processing of personal data in criminal matters – Directive 2016/680 – Storage of personal data, including biometric and genetic data, concerning persons who have been convicted by final judgment of an intentional criminal offence subject to public prosecution – National legislation providing for such storage until the death of the data subject, even in the event of his or her legal rehabilitation – No obligation to review periodically whether that storage is necessary – No right to erasure or restriction of processing – Unlawful
(Charter of Fundamental Rights of the European Union, Arts 7, 8 and 52(1); European Parliament and Council Directive 2016/680, recital 26 and Arts 4(1)(c) and (e), 5, 10, 13(2)(b) and 16(2) and (3))
(see paragraphs 39, 41-45, 48-52, 59-61, 66-72, operative part)
Résumé
Following a reference for a preliminary ruling from the Varhoven administrativen sad (Supreme Administrative Court, Bulgaria), the Grand Chamber of the Court of Justice rules on the time limits for the storage – for the purposes of combating crime – of personal data of persons who have been convicted by final judgment of a criminal offence, in the light of Directive 2016/680. (1)
An entry in the police records was made in respect of NG in the course of a criminal investigation for failing to tell the truth as a witness. Following that investigation, NG was charged with a criminal offence, was subsequently found guilty of that offence and was given a one year suspended sentence. After serving that sentence, NG was legally rehabilitated.
On the basis of that legal rehabilitation, NG applied for the erasure of the entry concerning him in the police records. That application was refused on the ground that a final criminal conviction, even in the event of legal rehabilitation, is not one of the grounds for erasure of an entry in the police records, which are exhaustively listed in national law. The action brought by NG against that decision having been dismissed, NG brought an appeal before the referring court, arguing that it follows from Directive 2016/680 that the storage of personal data cannot be carried on indefinitely. According to NG, that is de facto the case where the data subject can never obtain the erasure of personal data collected in connection with a criminal offence for which he or she was convicted by final judgment, even after serving his or her sentence and having been legally rehabilitated.
In those circumstances, the Court was asked to give a preliminary ruling on whether Directive 2016/680, (2) read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, (3) precludes national legislation which provides for the storage, by police authorities, for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, of personal data, including biometric and genetic data, concerning persons who have been convicted by final judgment of an intentional criminal offence subject to public prosecution, until the death of the data subject, even in the event of his or her legal rehabilitation, without also granting that person the right to have those data erased or, where appropriate, to have their processing restricted.
In its judgment, the Court answers that question in the affirmative.
Findings of the Court
In the first place, the Court states that Directive 2016/680 establishes a general framework to ensure, inter alia, that the storage of personal data and, more specifically, the period of storage, are limited to what is necessary for the purposes for which those data are stored, while leaving it to the Member States to determine, in compliance with that framework, the specific situations in which the protection of the fundamental rights of the data subject requires the erasure of those data and the time at which those data must be erased. However, that directive does not require the Member States to define absolute time limits for the storage of personal data, beyond which those data must be automatically erased.
More specifically, first of all, Article 4(1)(c) of Directive 2016/680 establishes the principle of ‘data minimisation’, according to which Member States must provide for personal data to be adequate, relevant and not excessive in relation to the purposes for which they are processed. In addition, under Article 4(1)(e) of that directive, Member States must provide that those data are to be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed. In that context, Article 5 of that directive requires the Member States to provide for, inter alia, the establishment of appropriate time limits for the erasure of personal data or for a periodic review of the need for the storage of those data. The ‘appropriate’ nature of those periods requires, in any event, that those time limits allow the erasure of the data concerned where their storage is no longer necessary for the purposes which justified the processing.
Next, Article 10 of Directive 2016/680, which governs the processing of special categories of personal data, including biometric and genetic data, authorises the processing of such data ‘only where strictly necessary’.
Lastly, Article 16(2) of Directive 2016/680 establishes a right to erasure of personal data where the processing infringes the provisions adopted pursuant to that directive (4) or where those data must be erased in order to comply with a legal obligation to which the data controller is subject. (5) It follows that that right to erasure may be exercised, inter alia, where the storage of the personal data in question is not or is no longer necessary for the purposes for which they are processed or where that erasure is required in order to comply with the time limit set, for that purpose, by national law.
In the second place, the Court notes that, in the present case, the personal data entered in the police records concerning persons prosecuted for an intentional offence subject to public prosecution are stored only for operational investigation purposes and, more specifically, for the purpose of comparison with other data collected during investigations into other offences. In that regard, however, the concept of an ‘intentional criminal offence subject to public prosecution’ is particularly general and is liable to apply to a large number of criminal offences, irrespective of their nature and gravity. However, persons convicted by final judgment of such an offence do not all present the same degree of risk of being involved in other criminal offences, justifying a uniform period of storage of the data relating to them. Thus, in certain cases, in the light of factors such as the nature and seriousness of the offence committed or the absence of recidivism, the risk represented by the convicted person will not necessarily justify maintaining the data relating to him in the national police records provided for that purpose until his death, with the result that there will no longer be a necessary connection between the data stored and the objective pursued. Accordingly, in such cases, the storage of such data will not comply with the principle of data minimisation and will exceed the period necessary for the purposes for which they are processed.
Next, since the personal data stored in the police records at issue includes biometric and genetic data, the Court notes that the storage of the biometric and genetic data of persons who have already been convicted by final judgment, even until the death of those persons, may indeed be strictly necessary, (6) in particular in order to enable the possible involvement of those persons in other criminal offences to be verified and, accordingly, to prosecute and convict the perpetrators of those offences. However, the storage of those data meets that requirement only if it takes into consideration the nature and seriousness of the offence which led to the final criminal conviction, or other circumstances such as the particular context in which that offence was committed, its possible connection with other ongoing proceedings or the background or profile of the convicted person. Accordingly, where, as provided for by national law in the main proceedings, the biometric and genetic data of data subjects entered in the police records is – in the event that those persons are convicted by final judgment – to be stored until the death of those persons, the scope of that storage is excessively broad with regard to the purposes for which those data are processed.
Lastly, as regards, first, the obligation to provide for the establishment of appropriate time limits, (7) a time limit can be regarded as ‘appropriate’, in particular as regards the storage of the biometric and genetic data of any person convicted by final judgment of an intentional criminal offence subject to public prosecution, only if it takes into consideration the relevant circumstances which might require such a storage period. Consequently, even if the reference to the death of the data subject may constitute a ‘time limit’ for the erasure of stored data, such a time limit can be regarded as ‘appropriate’ only in specific circumstances which duly justify it. That is clearly not the case where it is applicable generally and indiscriminately to any person convicted by final judgment. It is true that it is for the Member States to decide whether time limits must be established concerning the erasure of those data or the periodic review of the need for their storage. (8) However, the ‘appropriate’ nature of the time limits for such a periodic review requires that they allow the erasure of the data at issue, where their storage is no longer necessary. That requirement is not satisfied where such erasure is provided for only in the event of that person’s death.
Secondly, the provisions of Directive 2016/680 laying down guarantees concerning the conditions relating to the rights to erasure and to the restriction of processing also preclude national legislation which does not allow a person convicted by final judgment of an intentional criminal offence subject to public prosecution to exercise those rights.