Provisional text
OPINION OF ADVOCATE GENERAL
SZPUNAR
delivered on 1 August 2025 (1)
Case C‑371/24 [Comdribus] (i)
HW
other party
Ministère public
(Request for a preliminary ruling from the cour d’appel de Paris (Court of Appeal, Paris, France))
( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 10 – Processing of special categories of data – Strict necessity – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 49 )
I. Introduction
1. The taking of fingerprints and photographs is a standard method of identification as part of a criminal investigation. Nevertheless, those personal data uniquely identify a natural person and are therefore regarded as particularly sensitive.
2. The delicate task which falls to the Court in the present case is to strike a balance between, on the one hand, practices often regarded as commonplace by the police authorities and, on the other hand, the protection of the data subjects’ data.
II. Legal framework
A. Directive (EU) 2016/680
3. Article 1(1) of Directive (EU) 2016/680 (2) provides that ‘this Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’
4. Article 4 of the directive reads as follows:
‘1. Member States shall provide for personal data to be:
(a) processed lawfully and fairly;
(b) collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;
(c) adequate, relevant and not excessive in relation to the purposes for which they are processed;
…
4. The controller shall be responsible for, and be able to demonstrate compliance with, paragraphs 1, 2 and 3.’
5. Under Article 6 of that directive:
‘Member States shall provide for the controller, where applicable and as far as possible, to make a clear distinction between personal data of different categories of data subjects, such as:
(a) persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence;
(b) persons convicted of a criminal offence;
(c) victims of a criminal offence or persons with regard to whom certain facts give rise to reasons for believing that he or she could be the victim of a criminal offence; and
(d) other parties to a criminal offence, such as persons who might be called on to testify in investigations in connection with criminal offences or subsequent criminal proceedings, persons who can provide information on criminal offences, or contacts or associates of one of the persons referred to in points (a) and (b).’
6. Article 8 of that directive provides:
‘1. Member States shall provide for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority for the purposes set out in Article 1(1) and that it is based on Union or Member State law.
2. Member State law regulating processing within the scope of this Directive shall specify at least the objectives of processing, the personal data to be processed and the purposes of the processing.’
7. Article 10 of Directive 2016/680 provides:
‘Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be allowed only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:
(a) where authorised by Union or Member State law;
(b) to protect the vital interests of the data subject or of another natural person; or
(c) where such processing relates to data which are manifestly made public by the data subject.’
8. Article 13 of that directive reads as follows:
‘1. Member States shall provide for the controller to make available to the data subject at least the following information:
(a) the identity and the contact details of the controller;
(b) the contact details of the data protection officer, where applicable;
(c) the purposes of the processing for which the personal data are intended;
(d) the right to lodge a complaint with a supervisory authority and the contact details of the supervisory authority;
(e) the existence of the right to request from the controller access to and rectification or erasure of personal data and restriction of processing of the personal data concerning the data subject.
2. In addition to the information referred to in paragraph 1, Member States shall provide by law for the controller to give to the data subject, in specific cases, the following further information to enable the exercise of his or her rights:
(a) the legal basis for the processing;
(b) the period for which the personal data will be stored, or, where that is not possible, the criteria used to determine that period;
(c) where applicable, the categories of recipients of the personal data, including in third countries or international organisations;
(d) where necessary, further information, in particular where the personal data are collected without the knowledge of the data subject.
3. Member States may adopt legislative measures delaying, restricting or omitting the provision of the information to the data subject pursuant to paragraph 2 to the extent that, and for as long as, such a measure constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned, in order to:
(a) avoid obstructing official or legal inquiries, investigations or procedures;
(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
(c) protect public security;
(d) protect national security;
(e) protect the rights and freedoms of others.
…’
9. Article 54 of that directive states:
‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 52, Member States shall provide for the right of a data subject to an effective judicial remedy where he or she considers that his or her rights laid down in provisions adopted pursuant to this Directive have been infringed as a result of the processing of his or her personal data in non-compliance with those provisions.’
B. French law
10. Article 55-1 of the code de procédure pénale (French Code of Criminal Procedure) provides:
‘A senior police officer may carry out, or supervise, the procedures for the taking of non-intimate samples from any person who is likely to provide information about the facts in question or from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, that are necessary for the purposes of conducting technical and scientific tests to compare them with traces or evidence obtained for the purposes of the investigation.
That officer shall carry out, or supervise, the procedures for the gathering of identification data, in particular the taking of fingerprints, palm prints or photographs, that are necessary for the purposes of entry into and consultation of police databases, in accordance with the rules applicable to each of those databases.
The refusal, by a person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, to consent to the procedures referred to in subparagraphs 1 and 2, ordered by a senior police officer, shall be punished by a year’s imprisonment and a fine of EUR 15 000.
Without prejudice to the application of the third subparagraph, where the taking of fingerprints, palm prints or a photograph constitutes the sole means of identifying a person who is being questioned pursuant to Articles 61-1 or 62-2 in respect of a crime or offence punishable by at least three years’ imprisonment and who refuses to prove his or her identity or who provides manifestly incorrect identity information, that process may be carried out without the consent of that person, with the written authorisation of the public prosecutor to whom the senior police officer has addressed a reasoned request. The senior police officer or, under the supervision of the former, a police officer shall use compulsion to the extent strictly necessary and in a proportionate manner. The officer shall take into account, where appropriate, the vulnerability of the person. A record of the process shall be made, stating the reasons why it is the sole means of identifying the person and the day and time at which it was carried out. The record shall be forwarded to the procureur de la République [(French public prosecutor)], a copy having been given to the person concerned.’
III. The dispute in the main proceedings, the questions referred and the procedure before the Court of Justice
11. On 30 May 2020, more than a hundred climate activists occupied the Avenue des Champs-Élysées in Paris (France). Law enforcement officers intervened to disperse them and arrested several people, including HW, for organising a demonstration without giving notice and disobedience. HW was interviewed in police custody and gave his identity but refused to be fingerprinted and photographed for identification purposes, despite having been informed that that refusal constituted an offence punishable by imprisonment and a fine.
12. At the end of his police custody on 1 June 2020, HW was brought before the French public prosecutor and the juge des libertés et de la détention (liberties and detention judge, France), who placed him on bail and informed him that he would have to appear before the tribunal correctionnel de Paris (Criminal Court, Paris, France). HW was accused of:
– first, having organised, in Paris, on 30 May 2020, a demonstration on the public highway without giving prior notice under the conditions established by law, in the present case, in particular, by urging the participants, in giving them instructions not to show their identity documents, not to comply with the orders of law enforcement officers, by creating a human chain, instructions with which the other demonstrators immediately complied;
– second, having refused, on 31 May 2020 in Paris, in full knowledge of a decryption key for a cryptographic device likely to have been used to prepare, facilitate or commit a crime or other offence, to reveal or activate that key further to a judicial request in the context of a preliminary, on-the-spot or judicial investigation, in the present case by refusing to reveal the codes of his telephone; and,
– third, having refused, on 30 May 2020 in Paris, although he was reasonably suspected on one or more grounds of having committed or attempted to commit an offence, to consent to the taking of fingerprints, palm prints or photographs for the purposes of entry into and consultation of police databases, in accordance with the rules applicable to each of those databases.
13. By judgment of 8 September 2021, the tribunal correctionnel de Paris (Criminal Court, Paris) acquitted HW of the first two charges, but found him guilty of the third offence and, accordingly, ordered HW to pay a fine of EUR 300.
14. HW and the public prosecutor’s office brought appeals against that judgment before the cour d’appel de Paris (Court of Appeal, Paris, France), the referring court.
15. The referring court considers that, notwithstanding the judgment in Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), (3) certain questions remain as regards the interpretation of Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof.
16. In the first place, the findings of the Court of Justice in Ministerstvo na vatreshnite raboti I apply to criminal proceedings which provide for the systematic collection of biometric and genetic data from any person against whom there is sufficient evidence of the commission of an offence to justify his or her being charged. (4) However, the referring court submits that the Court has not yet ruled on a legal situation such as that set out in Article 55-1 of the French Code of Criminal Procedure, which provides for the systematic collection of the biometric data (5) of a person ‘reasonably suspected on one or more grounds of having committed or attempted to commit an offence’, in the context of an investigation, without any requirement for that person to have been charged. It is therefore necessary to ascertain whether that condition is sufficient to fulfil the requirements arising from Directive 2016/680.
17. In the second place, the referring court asks whether Directive 2016/680 imposes an obligation on the competent authorities to state reasons as to why the processes which they carry out are strictly necessary.
18. In the third place, the present case raises a novel issue as regards EU law: according to French legislation, a refusal to consent to the gathering of identification data is a stand-alone offence which may be prosecuted and result in a conviction even though the main offence on which the measure to gather identification data was based did not result in a conviction (‘the stand-alone conviction’). The question thus arises whether, in those circumstances, the requirement for the collection of biometric data to be ‘strictly necessary’ has been met and whether such a stand-alone conviction is justified.
19. According to the referring court, the answer to those questions is essential to the resolution of the dispute in the main proceedings, since HW was prosecuted for and convicted solely of the offence of refusing to consent to the gathering of identification data, whereas he was acquitted of the main offence of organising a demonstration without giving notice, which formed the basis of the measure for gathering identification data, and at no stage in the proceedings did it appear that there was a sufficient statement of reasons as to why that measure was strictly necessary.
20. In those circumstances, the cour d’appel de Paris (Court of Appeal, Paris) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Is Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the French Code of Criminal Procedure, which provides for the systematic gathering of identification data (fingerprints and photographs) from persons who are suspected on one or more grounds of having committed or attempted to commit an offence?
(2) Is Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the French Code of Criminal Procedure, which does not impose on the competent authority an obligation to provide, in each individual case, a sufficient statement of reasons as to why it is strictly necessary to gather identification data?
(3) Is Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, to be interpreted as precluding national legislation, such as Article 55-1 of the French Code of Criminal Procedure, which allows the prosecution and conviction on a [stand-alone] basis of a person who has refused to consent to the gathering of identification data even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data?’
21. The request for a preliminary ruling was registered at the Court of Justice on 24 May 2024. Written observations were submitted by HW, the French and Polish Governments, Ireland and the European Commission. The French and Czech Governments, Ireland and the Commission were present at the hearing, which took place on 30 April 2025.
IV. Analysis
A. The first question referred
1. The wording
22. As a reminder, the referring court asks, by its first question, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which provides for the systematic identification (dactyloscopic and photographic) of persons in respect of whom there is one or more reasons to suspect that they have committed or attempted to commit an offence.
23. I wish to point out that a reading of the request for a preliminary ruling reveals that the main concern of the referring court appears to be the fact that Article 55-1 of the French Code of Criminal Procedure authorises the collection of biometric data of persons who have not been formally accused in criminal proceedings.
24. As regards the wording of the first question, the use of the adjective ‘systematic’ by the referring court (6) was the subject of debate between the parties in their written observations.
25. The French Government submits that it is incorrect to assert that the French legislation provides for the ‘systematic’ collection of those biometric data, since collection is not an obligation, but an option.
26. The Commission agrees with the French Government, pointing out that the senior police officer has a ‘margin of discretion’ as regards the taking of samples. The Commission submits that the taking of such samples is not ‘systematic’, in so far as they are carried out not in respect of all persons suspected of having committed an offence, but solely in line with the needs of the investigation.
27. HW submits that, in view of the practice of the police authorities, the collection of data at issue is systematic. (7)
28. In that regard, it should be recalled that it is not for the Court of Justice to rule on the interpretation of provisions of national law or to decide whether the interpretation or application of those provisions by the national court is correct, since such a task falls within the exclusive jurisdiction of the national court. (8)
29. That being so, the Court, which is called on to provide an answer that is of use to the national court, may provide it with guidance based on the file in the main proceedings and on the written and oral observations which have been submitted to it. (9)
30. I am aware that there may be a fine line between providing an answer that is of use and interpreting national law.
31. However, I must point out that the referring court’s use of the term ‘systematic collection’ of data stems from the judgment in Ministerstvo na vatreshnite raboti I, which appears to have prompted its questions. (10)
32. It is apparent from paragraph 113 of that judgment that, according to the referring court in that case, Article 4(1)(a) to (c), Article 8(1) and (2) and Article 10 of Directive 2016/680 require that the competent authorities have discretion for the purpose of determining whether collection of biometric and genetic data is necessary. According to that court, the collection of data provided for by the national legislation applied mandatorily to all persons accused of intentional offences subject to public prosecution, without that legislation requiring the specific necessity to collect all those categories of data to be established. (11)
33. In addition, the Court of Justice held, in paragraph 114 of the judgment in Ministerstvo na vatreshnite raboti I, that ‘the fourth question should be understood as seeking to establish, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority to determine and to demonstrate, first, that their collection is necessary for achieving the specific objectives pursued and, second, that those objectives cannot be achieved by collecting only a part of the data concerned’. (12)
34. In the light of the two preceding points and the observations of the parties in the present case, (13) the concepts of ‘discretion’ and ‘systematic collection’ of data should be clarified.
35. As is apparent from paragraphs 113 and 114 of the judgment in Ministerstvo na vatreshnite raboti I, first, ‘discretion’ refers to the possibility, provided for by national law, for the competent authority to determine and demonstrate that the data processing is strictly necessary. Second, collection is ‘systematic’ when it applies, in a mandatory manner, to every person falling within the scope of the national legislation at issue.
36. It follows that, in order to give a useful answer to the referring court, the Court of Justice must first determine whether the collection at issue in the present case is ‘systematic’, within the meaning of the judgment in Ministerstvo na vatreshnite raboti I.
37. It cannot be inferred from Article 55-1 of the French Code of Criminal Procedure that the collection of biometric data is ‘systematic’. Under the wording of that provision, the competent authority is not obliged to collect data from all persons reasonably suspected on one or more grounds of having committed or attempted to commit an offence. In addition, the second subparagraph of that provision states that the collection is to be carried out in accordance with the rules applicable to the police databases and in so far as the data in question are necessary for the purposes of entry into and consultation of those databases. (14)
38. That said, as the debate between the parties demonstrates, in referring to the ‘systematic’ nature of the data collection the wording of the first question referred for a preliminary ruling is confusing, in so far as it appears to presume that collection which is not ‘systematic’ complies with Directive 2016/680. However, I do not consider that to be the case. As I shall explain in the context of the examination of the substance, where the collection of biometric data is not ‘systematic’, it must still, in order to comply with the requirements of Directive 2016/680, be ‘strictly necessary’.
39. Accordingly, I propose that the Court of Justice rephrase the first question referred to the effect that, by that question, the referring court seeks to determine, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, precludes national legislation which allows biometric data to be collected from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence.
2. Substance
(a) General remarks on Article 10 of Directive 2016/680, as interpreted by the Court of Justice
40. In the first place, it must be emphasised that Article 10 of Directive 2016/680 constitutes a specific provision governing the processing of special categories of personal data (‘sensitive data’), including biometric data. (15) As is clear from the case-law, the purpose of that provision is to ensure enhanced protection with regard to that processing, which, because of the particular sensitivity of the data at issue and the context in which they are processed, is liable, as is apparent from recital 37 of the directive, to create significant risks to fundamental rights and freedoms, such as the right to respect for private life and the right to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’). (16)
41. In the second place, as follows from the very terms in which it is set out in Article 10 of Directive 2016/680, the requirement that the processing of such data be allowed ‘only where strictly necessary’ must be interpreted as establishing strengthened conditions for lawful processing of sensitive data, compared with those which follow from Article 4(1)(b) and (c) and Article 8(1) of that directive, which refer only to the ‘necessity’ of data processing that falls generally within the directive’s scope. (17)
42. Thus, first, the use of the adverb ‘only’ before the words ‘where strictly necessary’ underlines that the processing of sensitive data can be regarded as ‘necessary’ solely in a limited number of cases. Second, the fact that the necessity for the processing of such data is an ‘absolute’ one signifies that that necessity is to be assessed with particular rigour. (18)
(b) The criteria for determining whether processing is strictly necessary
43. I note that Directive 2016/680 does not define the requirement of ‘strictly necessary’ laid down in Article 10 thereof.
44. Some guidance may, however, be derived from other provisions of that directive. Thus, without prejudice to the strengthened conditions relating to the lawfulness of the processing of sensitive data laid down by that directive, the requirement that the processing be strictly necessary must be read in the light of the principles set out in Articles 4 and 8 thereof. (19)
45. That means, inter alia, examining whether the collection of sensitive data is strictly necessary in the light of the purposes and objectives of their collection, in compliance with the principles of purpose limitation and data minimisation, (20) the latter giving expression to the principle of proportionality. (21)
46. In that regard, first, as is apparent from recital 26 of Directive 2016/680, the requirement of necessity is met where the objective pursued by the data processing at issue cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter. In particular, in the light of the enhanced protection of persons with regard to the processing of sensitive data, the controller in respect of that processing should satisfy itself that that objective cannot be met by having recourse to categories of data other than those listed in Article 10 of that directive. (22)
47. Second, having regard to the significant risks posed by the processing of sensitive data to the rights and freedoms of data subjects, in particular in the context of the tasks of the competent authorities for the purposes set out in Article 1(1) of Directive 2016/680, the ‘strictly necessary’ requirement means that account is to be taken of the specific importance of the objective that such processing is intended to achieve. Such importance may be assessed, inter alia, on the basis of the very nature of the objective pursued – in particular of the fact that the processing serves a specific objective connected with the prevention of criminal offences or threats to public security displaying a certain degree of seriousness, the punishment of such offences or protection against such threats – and in the light of the specific circumstances in which that processing is carried out. (23)
48. Third, the Court has previously held that whether the processing of sensitive data is ‘strictly necessary’ can be determined only in the light of all the relevant factors, such as, in particular, the nature and gravity of the offence of which the data subject in the main proceedings is suspected, the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the person in question. (24)
49. As regards the gravity of the offence, I note that account is also to be taken of the specific nature of the tasks of the police authorities. As the Court of Justice pointed out in the judgment in Bezirkshauptmannschaft Landeck, to consider that only combating serious crime may justify access to personal data would limit the investigative powers of the competent authorities, for the purposes of Directive 2016/680, in relation to criminal offences in general. According to the Court, that would increase the risk of impunity for such offences, given the importance that such data may have for criminal investigations. Accordingly, such a limitation would disregard the specific nature of the tasks performed by those authorities for the purposes set out in Article 1(1) of that directive, highlighted in recitals 10 and 11 thereof, and would undermine the objective of achieving an area of freedom, security and justice within the European Union pursued by that directive. (25)
50. Thus, in principle, the fact that an offence is not categorised as ‘serious’ cannot, by itself, justify excluding that the collection of biometric data is strictly necessary. In line with the nature of the offence, rather than its gravity, the collection of that type of data may be necessary to establish the offence or identify the perpetrator.
51. However, if the requirement that the collection of biometric data be strictly necessary is not based on the nature of the offence, it must be based on other elements.
(c) The relationship with the data collection at issue in the main proceedings
(1) Objectives of the data collection
52. In its written observations, the French Government stated that the purpose of the taking of the identification data at issue in the main proceedings is, inter alia, to compare the fingerprints with the traces collected during the ongoing investigation, to identify the accused person in the context of the ongoing investigation in order to avoid the risk of confusion with someone of the same name or the risk of impersonation, or to identify the person in the context of comparisons with other ongoing or future procedures, for example to enable fingerprints to be compared with traces collected in other investigations. (26)
53. Those objectives relate, on the one hand, to the use of data collected in the context of specific criminal proceedings and, on the other hand, to processing for the purposes of other proceedings. The need to carry out such processing is expressly stated in recital 27 of Directive 2016/680. (27)
54. It must therefore be held that the collection of biometric data is relevant and adequate in the light of the objectives set out. (28) However, the need for that collection depends, inter alia, on its scope as defined by the applicable legislation.
(2) Scope of the data collection
55. As is apparent from the order for reference and the observations of the French Government, there is disagreement as to the scope of the collection at issue in the main proceedings. According to the referring court, police officers may collect the biometric data of any person ‘reasonably suspected on one or more grounds of having committed or attempted to commit an offence’. (29) However, according to the French Government, such data may be collected from persons in respect of whom there are not mere suspicions but rather serious or consistent evidence pointing to the probability that they have participated, as perpetrators or accomplices, in the commission of a crime, or an offence punishable by imprisonment, and from persons in respect of whom a positive identification is required. (30)
56. That disagreement leads me to examine two aspects of the national legislation at issue: the stage of the procedure at which the collection is carried out (in this case, without the person concerned having been formally accused) and the scope of that collection.
57. In the first place, as regards the procedural stage, I am of the view that the objectives of the collection of biometric data mean that it may take place at an early stage of the criminal investigation. Limiting that possibility to the stage at which the person concerned is accused would run counter to certain purposes set out in Article 1 of Directive 2016/680.
58. In fact, as the Court of Justice pointed out in the judgment in Ministerstvo na vatreshnite raboti I, where there are serious grounds for believing that the person in question has committed a criminal offence justifying his or her being accused, a situation which presupposes that sufficient evidence of that person’s involvement in the offence has already been gathered, it is possible that, in some cases, the collection of biometric data will not reflect any specific necessity for the purposes of the criminal procedure in progress. (31)
59. I would also stress that criminal legislation is a matter for which the Member States are responsible. (32) In particular, the various stages of criminal proceedings, and the rights and safeguards associated with them for the data subject, may differ from one Member State to another. It follows that that factor cannot be decisive for the purposes of interpreting Article 10 of Directive 2016/680.
60. That interpretation is not precluded by Article 6 of Directive 2016/680. That provision lays down an obligation to distinguish, where applicable and as far as possible, between the personal data of the different categories of data subjects, in such a way that they are not subject without distinction to the same degree of interference with their fundamental right to the protection of their personal data. (33) However, that provision does not seek to determine the categories of persons whose data may be collected. (34)
61. In the second place, as regards the scope of the collection of biometric data at issue in the main proceedings, I would point out that, in the context of the preliminary ruling procedure, the Court of Justice can only define the conditions arising from EU law with which national law is required to comply, as the determination of the applicable provisions of domestic law and their interpretation fall within the exclusive jurisdiction of the national courts. (35)
62. In any event, I take the view that the field of application of the legislation on the collection of biometric data referred to by the French Government, although limited to offences punishable by imprisonment, is broad in scope, (36) allowing, inter alia, the collection of data from any person whose positive identification is necessary, irrespective of the nature and gravity of the offence at issue.
(3) The obligation for the competent authority to assess whether the data collection is strictly necessary
63. Despite that broad scope, unlike the Bulgarian legislation at issue in the case which gave rise to the judgment in Ministerstvo na vatreshnite raboti I, it is apparent from the French legislation that the police authorities are under no obligation to collect data from any person falling within the scope of that legislation and that, on the contrary, that collection is a matter for the assessment of those authorities on a case-by-case basis. (37)
64. However, in order for that discretion to comply with the requirements of Directive 2016/680, the French legislation must lay down an obligation for the competent authorities to assess the strict necessity to collect the biometric data of the persons concerned. (38)
65. The Court of Justice has previously held that it is for the competent authorities alone to ensure compliance with that criterion. (39)
66. In the present case, it is apparent from the observations of the French Government that Articles 6 and 88 of loi no 78-17 relative à l’informatique, aux fichiers et aux libertés (Law No 78-17 on information technology, data files and freedoms) of 6 January 1978 (40) transpose Article 10 of Directive 2016/680, expressly reiterating the criterion of strict necessity set out in the latter. The French Government adds that the collection of biometric data on the basis of Article 55-1 of the French Code of Criminal Procedure cannot infringe those legislative provisions.
67. If that were the case, that national legal framework could be interpreted as requiring the competent authority to assess whether the data collection it carries out is ‘strictly necessary’.
68. Nevertheless, in view of the division of responsibilities between the Court of Justice and the referring court, it will be for the latter to satisfy itself that that is indeed the case, in particular by complying with its obligation to interpret national law, so far as possible, in conformity with the wording and purpose of Directive 2016/680. (41)
69. Having regard to the circumstances of the dispute in the main proceedings concerning the collection of the biometric data of a person held in custody for having organised and participated in an unauthorised demonstration, the referring court must also ensure that the application of the law by the competent authority remains consistent with the requirements of Directive 2016/680. (42)
70. In the light of the foregoing, I propose that the answer to the first question should be that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as not precluding national legislation which allows the collection of biometric data from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, provided that that legislation imposes an obligation on the competent authority to assess whether each collection is strictly necessary.
B. The second question referred
71. By its second question, the referring court seeks, in essence, to ascertain whether the competent authority is required to state reasons for the decision to collect biometric data, in the light of the requirement of strict necessity arising from Article 10 of Directive 2016/680.
72. In my view, such an obligation follows from the judgments in Ministerstvo na vatreshnite raboti II and Bezirkshauptmannschaft Landeck, and I see no reason to depart from that case-law.
73. In the case which gave rise to the judgment in Ministerstvo na vatreshnite raboti II, the question that arose was whether, where national legislation does not lay down an obligation on the competent authority to verify and demonstrate that the collection of sensitive data is strictly necessary, in accordance with Article 10 of Directive 2016/680, compliance with such an obligation may be ensured by the court seised by that competent authority for the purposes of the enforcement of that collection. (43)
74. In response, the Court of Justice ruled that, in the absence of an obligation imposed on the competent authority, under national law, to assess whether the processing which it has carried out or which it intends to carry out is ‘strictly necessary’, a court asked to rule on such processing of personal data by that competent authority cannot ensure, in place of that authority, compliance with that authority’s obligation under Article 10 of Directive 2016/680. (44)
75. Even though the Court did not expressly mention the obligation to state reasons, such an obligation follows, in my view, from that judgment.
76. In the first place, under Article 54 of Directive 2016/680, which gives expression to Article 47 of the Charter, Member States are to provide for the right of a data subject to an effective judicial remedy where he or she considers that his or her rights laid down in provisions adopted pursuant to that directive have been infringed as a result of the processing of his or her personal data in non-compliance with those provisions.
77. In the second place, according to the case-law, the right to an effective judicial remedy, guaranteed in Article 47 of the Charter, requires, in principle, that the person concerned be able to ascertain the reasons upon which the decision taken in relation to him or her is based, either by reading the decision itself or by communication of those reasons, so as to enable him or her to defend his or her rights in the best possible conditions and to decide with full knowledge of the relevant facts, whether there is any point in his or her applying to the court with jurisdiction, and in order to put the latter fully in a position to carry out the review of the lawfulness of that decision. (45)
78. That necessarily presupposes, in so far as the Court of Justice has held that a court cannot substitute itself for the competent authority as regards the examination of whether it is strictly necessary to collect the data, the right to have that examination assessed subsequently by a court.
79. Although that right is not an absolute right and, in accordance with Article 52(1) of the Charter, limitations may be placed upon it, that is on condition that those limitations are provided for by law, they respect the essence of the rights and freedoms at issue and, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. (46)
80. The governments which participated in the hearing assert that to impose on the competent authorities the obligation to state reasons for each decision taken under Article 10 of Directive 2016/680 would affect the proper conduct of criminal investigations and the fight against crime. Even though this is a question of objectives of general interest, I consider that the restriction of the right to an effective judicial remedy at issue is not limited to what is strictly necessary.
81. In the first place, in so far as the collection of data at issue is not systematic, the obligation to state reasons does not seem to me to constitute an excessive burden for the competent authorities. Furthermore, if the competent authorities are to have a degree of discretion in achieving the objectives set out in Article 1(1) of Directive 2016/680, the obligation to state reasons for their decisions, laid down in Article 10 of the directive, becomes even more essential.
82. In the second place, as the Court of Justice observed, in essence, in the judgment in Bezirkshauptmannschaft Landeck, Article 13(1) and (2) of Directive 2016/680, read in conjunction with Article 54 thereof, imposes an obligation to inform the data subject. Although Article 13(3) of that directive allows Member States to adopt legislative measures to delay, restrict or even omit the provision of information to the data subject, national legal rules which exclude as a general rule any right to information are not consistent with EU law. (47)
83. In that regard, in response to a question put by the Court of Justice at the hearing, the French and Czech Governments maintained that the judgment in Bezirkshauptmannschaft Landeck does not apply to the present case, because that judgment concerns the prior review, by a court or by an independent administrative body, of access by the police authorities to the data contained in the mobile telephone of the data subject.
84. However, I have doubts as to the relevance of those arguments. First of all, in my view, the obligation to state reasons is all the more necessary where the collection of data is not subject to prior review. Next, I note that, while a mobile telephone may, of course, contain sensitive data within the meaning of Article 10 of Directive 2016/680, (48) the judgment in Bezirkshauptmannschaft Landeck does not specifically concern that type of data. It follows that the obligation to state reasons arising from that judgment applies a fortiori to the circumstances of the present case, concerning the collection of sensitive data.
85. Lastly, as the Commission rightly pointed out in replying to the same question put by the Court, it follows from Article 4(4) of Directive 2016/680 that the competent authority must be able to demonstrate, inter alia, the need for the data processing which it carries out. That principle of accountability, which is also laid down in Article 5(2) of Regulation (EU) 2016/679, (49) must be interpreted in the light of Article 54 of that directive. It follows that the obligation to state reasons arises from the general scheme of the directive.
86. In the third place, as is apparent from settled case-law, the extent of the obligation to state reasons depends on the specific circumstances of each situation. (50) While a more detailed statement of reasons may be necessary, in particular, for less serious offences, it may be succinct in the case of serious crime. Moreover, as regards offences in respect of which it is clearly necessary to identify the perpetrator, such as burglary, I do not rule out the possibility that it may be inferred from the elements on file, taken as a whole, that it is strictly necessary to collect the biometric data. The data subject can easily understand the reasons for that interference with his or her rights to respect for private life and to the protection of personal data.
87. By contrast, the reason why the collection of biometric data of a person suspected of having participated in an unauthorised demonstration is strictly necessary, in particular where his or her identity is beyond doubt, is not obvious, at least for the purposes of that specific procedure. In such a situation, the competent authority must therefore give adequate reasons for its decision, so that the person concerned is able to understand the reasons for that collection. The mere reference to the elements on file, taken as a whole, cannot, in principle, suffice. (51)
88. Consequently, I propose that the answer to the second question should be that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which does not impose on the competent authority an obligation to provide, in each individual case, a sufficient statement of reasons as to why it is strictly necessary to gather identification data.
C. The third question referred
1. Admissibility
89. By its third question, the referring court asks, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which allows the prosecution and conviction on a stand-alone basis of a person who has refused to consent to the gathering of identification data, even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data.
90. According to the French Government, that question is inadmissible in so far as Directive 2016/680 does not contain any rules relating to an offence for refusal to consent to the collection of personal data. It follows, in its view, that such a conviction does not fall within the scope of that directive or, consequently, of EU law.
91. In addition, the French Government and the Commission submit that the referring court does not state the reasons why the provisions of Directive 2016/680 could have an impact on the stand-alone conviction.
92. In that regard, I would point out that, pursuant to Article 94(c) of the Rules of Procedure of the Court of Justice, a request for a preliminary ruling must contain a statement of the reasons which prompted the referring court or tribunal to inquire about the interpretation or validity of certain provisions of EU law, and the relationship between those provisions and the national legislation applicable to the main proceedings. That statement must be of such a kind as to enable the Court to ascertain, not only whether the request for a preliminary ruling is admissible, but also whether it has jurisdiction to answer the question referred. (52)
93. Although I agree with the finding that the referring court does not explain how the abovementioned provisions of Directive 2016/680 could have an impact on the stand-alone conviction, I consider that such a link may be inferred from all the elements in the file before the Court of Justice, as well as from the case-law, as I shall set out below.
94. In addition, I note that, according to settled case-law, where it is not obvious that the interpretation of an act of EU law bears no relation to the facts of the dispute in the main proceedings or its purpose, as is the case with Directive 2016/680 in the present case, the objection alleging that that act is inapplicable to the case in the main proceedings concerns the substance of the question raised. (53)
2. Substance
(a) Application of Directive 2016/680 to the stand-alone conviction
95. First of all, I would point out that the stand-alone conviction does not result from the transposition into French law of Article 10 of Directive 2016/680. As the French Government rightly points out, the directive does not contain any provision in that regard.
96. However, that does not necessarily mean that the stand-alone conviction for falls outside the scope of EU law. (54) In order for a national provision to fall within the scope of EU law, it is not necessary for the national legislature to have intended to implement it; it follows, instead, from the actual application of the national measure. (55)
97. Next, the scope of Directive 2016/680 is defined in Article 2(1) thereof, which provides that the directive ‘applies to the processing of personal data by competent authorities for the purposes set out in Article 1(1)’, namely, inter alia, for the purposes of ‘the prevention, investigation, detection or prosecution of criminal offences’.
98. Consequently, that means that HW was convicted on the ground that he objected to an act which falls within the scope of Directive 2016/680. It may thus be considered that there was an ‘attempt’ by police officers to process personal data and that that attempt failed as a result of HW’s refusal, the attempt falling within the scope of the directive in question. (56)
99. Lastly, I would point out that a stand-alone conviction may be authorised only if the collection envisaged by the competent authorities, to which the data subject objects, complies with the requirements of Article 10 of Directive 2016/680, in particular the requirement that collection be ‘strictly necessary’. The requirements which that directive imposes on the processing of data falling within its scope must therefore be met in order for a stand-alone conviction to be lawful. (57)
(b) Does Directive 2016/680 preclude a stand-alone conviction?
100. The fact I have mentioned above is also, in my view, the only criterion in Directive 2016/680 which has an impact on the stand-alone conviction: before finding a defendant guilty of the offence of refusing to consent to the gathering of his or her identification data, a national court must satisfy itself that such collection, if it had taken place, would have complied with Article 10 of that directive, read in conjunction with Article 4(1)(a) to (c) (58) and Article 8(1) and (2) thereof.
101. On the other hand, it is my opinion that, from the point of view of the wording of those provisions of Directive 2016/680, and of its objectives, (59) there is nothing to prevent the national legislature from providing for the conviction of a person who has refused to consent to the gathering of identification data, even if that person is not prosecuted for or convicted of the offence which formed the basis of the gathering of identification data. As all the participants in the hearing pointed out, the requirement of strict necessity must be assessed at the time when the authorities envisaged gathering the data. That said, I consider that two further clarifications must be made.
102. First, the competent authority remains obliged to assess whether any subsequent processing of the data is strictly necessary. The fact that the data subject has not been prosecuted, in particular, is a relevant criterion for determining whether the retention of his or her data is strictly necessary. (60)
103. Second, I consider that the stand-alone conviction must be examined in the light of Articles 7 and 8 and Article 49(3) of the Charter.
(c) Articles 7 and 8 and Article 49(3) of the Charter
104. According to the explanations given by the French Government, the offence of refusing to consent to procedures for the gathering of identification data is specifically intended to criminalise conduct constituting an obstacle to the proper conduct of a criminal investigation.
105. Although this is an objective of general interest recognised by EU law, the fact remains that the stand-alone conviction also constitutes an interference with the rights guaranteed by Articles 7 and 8 of the Charter. (61) Under Article 52(1) of the Charter, such a conviction must comply with the principle of proportionality.
106. Furthermore, in so far as the stand-alone conviction is a criminal conviction, account must also be taken of Article 49(3) of the Charter, which provides that the severity of penalties must not be disproportionate to the criminal offence.
107. Member States are required to observe the principle of proportionality when they implement EU law, including in the absence of harmonisation of EU legislation in the field of sanctions applicable, and specifically where they adopt penalties of a criminal nature. (62)
108. The principle of proportionality requires, first, that the penalty imposed corresponds to the seriousness of the offence and, second, that the individual circumstances of the particular case are taken into account in determining the penalty and fixing the amount of the fine. (63)
109. In my view, those circumstances should include, in particular, the conduct and profile of the person concerned, his or her criminal record, the seriousness of the offence which formed the basis of the collection of his or her data and the context of the stand-alone conviction.
110. As regards the latter aspect, as the French Government confirmed at the hearing, a decision is taken on the offence of refusing to consent to the gathering of identification data, if established, at the same time as the ‘main’ offence. In the case in the main proceedings, it appears that the acquittal for participation in an unauthorised demonstration and the conviction for refusal to consent to the gathering of identification data were handed down simultaneously at the time of the judgment of the tribunal correctionnel de Paris (Criminal Court, Paris) of 8 September 2021.
111. In those circumstances, it must be observed that while a conviction for refusal to consent to the gathering of identification data may contribute to the proper conduct of future procedures, particularly in the event of a repeat offence, it does not contribute to the proper conduct of the ongoing procedure.
112. Lastly, the fact that the person concerned has not been convicted of the main offence must also be taken into account in determining the severity of the penalty for refusing to consent to the gathering of identification data. In that regard, I note that, according to the explanations provided by the French Government, when a decision that there is insufficient evidence to convict or an acquittal has become final, the fingerprints and information in question are erased.
113. Consequently, I propose that the answer to the third question should be that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as not precluding a national provision which allows the prosecution and conviction on a stand-alone basis of a person who has refused to consent to the gathering of identification data even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data, provided that gathering that identification data, if it had taken place, would have complied with the requirements arising from those articles.
V. Conclusion
114. In the light of all the foregoing considerations, I propose that the Court of Justice answer the questions referred for a preliminary ruling by the cour d’appel de Paris (Court of Appeal, Paris, France) as follows:
Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof,
must be interpreted as:
– not precluding national legislation which allows the collection of biometric data from any person reasonably suspected on one or more grounds of having committed or attempted to commit an offence, provided that that legislation imposes an obligation on the competent authority to assess whether each collection is strictly necessary;
– precluding national legislation which does not impose on the competent authority an obligation to provide, in each individual case, a sufficient statement of reasons as to why it is strictly necessary to gather the identification data;
– not precluding a national provision which allows the prosecution and conviction on a stand-alone basis of a person who has refused to consent to the gathering of identification data even though that person is not prosecuted for or convicted of the offence which formed the basis of the measure for gathering identification data, provided that the gathering of that identification data, if it had taken place, would have complied with the requirements arising from those articles of Directive 2016/680.