ECJ: No Lifetime Storage of Biometric and Genetic Data

Feb 16, 2024 Benn-Ibler Rechtsanwälte

How long may biometric and genetic data be kept on people who have a criminal record? This was a question recently addressed by the European Court of Justice (ECJ).

In Bulgaria, an individual was registered by the police as a false witness as part of a preliminary investigation and given a one-year suspended sentence. Upon completion of the sentence, the offender had a clean record and then applied for the removal of their biometric and genetic data from the police register. However, this request was turned down by the police authorities. Even after rehabilitation, a final conviction is not a reason for data removal from the police register. According to Bulgarian law, all relevant data is stored in the criminal records and can be processed by authorities at any time until an individual’s death.

The Bulgarian Supreme Administrative Court, which heard the case, asked the ECJ for a preliminary ruling on whether Bulgaria’s data retention system is compatible with EU law.

Clearly, any biometric and genetic data collected, such as fingerprints, photographs, or DNA samples, are essential for checking whether individuals might be involved in crimes other than those for which they have been previously convicted.

However, the ECJ stressed that the risk of being involved in further crimes is not the same for everyone. Therefore, there is no justification for the lifelong, general, and indiscriminate storage of biometric and genetic data.

The period of storage until the death of an individual may only be appropriate in special circumstances. Lacking potential danger may not justify keeping an individual’s data in police records until death given the nature and seriousness of the offence committed, or the absence of repeat offenses.

Under EU law, the need for data storage must be reviewed on a regular basis.

ECJ, C-118/22 (30 January 2024)