21 See, in particular, judgments of 6 October 2020, La Quadrature du Net and Others (C-511/18, C-512/18 and C-520/18, EU:C:2020:791) and of 5 April 2022, Commissioner of An Garda Síochána and Others (C-140/20, EU:C:2022:258).
22 Directive of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37).
23 Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017 (EU:C:2017:592), and judgment of 21 June 2022, Ligue des droits humains (C-817/19, EU:C:2022:491).
24 Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017 (EU:C:2017:592), paragraphs 132, 204 and 205.
25 Directive of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (OJ 2016 L 119, p. 132).
26 Judgment of 5 April 2022, Commissioner of An Garda Síochána and Others (C-140/20, EU:C:2022:258, paragraphs 35 to 37). The same applies as regards comparison with the legal regime laid down in the GPDR.
27 Tinière, R., Jurisprudence de la CJUE 2020, décisions et commentaires, Bruylant, Bruxelles, 2021, pp. 130 to 139.
28 Judgments of 5 April 2022, Commissioner of An Garda Síochána and Others (C-140/20, EU:C:2022:258, paragraphs 56 to 59), and of 21 June 2022, Ligue des droits humains (C-817/19, EU:C:2022:491, paragraph 148).
29 Judgment of 21 June 2022, Ligue des droits humains (C-817/19, EU:C:2022:491, paragraph 148).
30 See, to that effect, judgment of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purpose of the processing of personal data – Criminal investigation) (C-180/21, EU:C:2022:967, paragraphs 57 and 58).
31 Judgment of 8 December 2022, Google (De-referencing of allegedly false information) (C-460/20, EU:C:2022:962, paragraph 59).
32 ECtHR, 22 June 2017, Aycaguer v. France (CE:ECHR:2017:0622JUD000880612, § 33, 34 and 38), and 18 September 2014, Brunet v, France (CE:ECHR:2014:0918JUD002101010, § 35).
33 ECtHR, 4 June 2013, Peruzzo and Martens v. Germany (CE:ECHR:2013:0604DEC000784108, § 46), and 13 February 2020, Gaughran v. United Kingdom (CE:ECHR:2020:0213JUD004524515, § 88).
34 See, by analogy, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017 (EU:C:2017:592, paragraphs 122 and 123), and judgment of 21 June 2022, Ligue des droits humains (C-817/19, EU:C:2022:491, paragraphs 94 and 95).
35 ECtHR, 22 June2017, Aycaguer v. France (CE:ECHR:2017:0622JUD000880612, § 33).
36 See, by analogy, judgment of 5 April 2022, Commissioner of An Garda Síochána and Others (C-140/20, EU:C:2022:258, paragraph 44).
37 Judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C-205/21, EU:C:2023:49, paragraph 127).
38 See recitals 4 and 7 of Directive 2016/680.
39 Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017 (EU:C:2017:592, paragraph 134).
40 Judgment of 6 October 2020, Privacy International (C-623/17, EU:C:2020:790, paragraphs 63 and 64).
41 See, to that effect, judgments of 6 October 2020, Privacy International (C-623/17, EU:C:2020:790, paragraph 67), and of 22 November 2022, Luxembourg Business Registers (C-37/20 and C-601/20, EU:C:2022:912, paragraph 64).
42 Judgments of 6 October 2020, Privacy International (C-623/17, EU:C:2020:790, paragraph 65), and of 24 February 2022, Valsts ienemumu dienests (Processing of personal data for tax purposes) (C-175/20, EU:C:2022:124, paragraphs 54 to 56). It is true that such an examination has been placed in judgments of the Court in the context of a detailed analysis of the proportionality of the limitation, where it has not been jointly envisaged from the dual perspective of observance of the principles of legality and proportionality (judgment of 21 June 2022, Ligue des droits humains (C-817/19, EU:C:2022:491, paragraphs 114 and 117)). I will focus in this part of the present Opinion on the verification of the requirement of foreseeability stricto sensu.
43 Judgment of 21 June 2022, Ligue des droits humains (C-817/19, EU:C:2022:491, paragraph 114).
44 See paragraphs 33 to 35 of the Bulgarian Government’s observations.
45 See to that effect, judgment of 20 May 2003, Österreichischer Rundfunk and Others (C-465/00, C-138/01 and C-139/01, EU:C:2003:294, paragraph 77).
46 See, by analogy, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017 (EU:C:2017:592, paragraph 150), and, a contrario, judgment of 22 November 2022, Luxembourg Business Registers (C-37/20 and C-601/20, EU:C:2022:912, paragraph 51).
47 Judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C-205/21, EU:C:2023:49, paragraph 99).
48 Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017 (EU:C:2017:592, paragraph 149), and judgment of 6 October 2020, La Quadrature du Net and Others (C-511/18, C-512/18 and C-520/18, EU:C:2020:791, paragraph 123).
49 Judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C-205/21, EU:C:2023:49, paragraphs 97 and 98). The ECtHR clarified, in the context of the procedural obligation under Article 2 of the ECHR, that the public interest in investigating and, where possible, obtaining the prosecution and sentencing of the perpetrators of unlawful acts many years after the events was firmly recognised (judgment of the ECtHR, 12 June 2014, Jelic v. Croatia, CE:ECHR:2014:0612JUD005785611, § 52).
50 See, to that effect, judgment of 5 April 2022, Commissioner of An Garda Síochána and Others (C-140/20, EU:C:2022:258, paragraph 55).
51 Judgment of 22 November 2022, Luxembourg Business Registers (C-37/20 and C-601/20, EU:C:2022:912, paragraph 66).
52 In general, the existence of a police record does not imply any positive obligation on the part of the person concerned.
53 Judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C-205/21, EU:C:2023:49, paragraph 78).
54 Frequent offences in the category of road traffic offences.
55 See, by analogy, judgment of 5 April 2022, Commissioner of An Garda Síochána and Others (C-140/20, EU:C:2022:258, paragraphs 77 and 78). I note that, in the judgment of 21 June 2022, Ligue des droits humains (C-817/19, EU:C:2022:491, paragraph 198), the Court held that it follows from the PNR Directive that the criteria used for the purposes of advance assessment of passengers must be determined in such a way as to target, specifically, individuals who might be reasonably suspected of involvement in terrorist offences or serious crime covered by that directive.
56 According to Info Stat Justice bulletin of the French Ministry of Justice No 183, of 2 July 2021, ‘Mesurer et comprendre les déterminants de la récidive des sortants de prison’ (Measuring and understanding the drivers of reoffending among persons leaving prison), 86% of persons leaving prison in 2016 already had one entry in their criminal record before the conviction that led to their detention. The rate of reoffending increases with the number of previous convictions: only 14% of those leaving prison who had no conviction in the five years preceding the year which resulted in their imprisonment reoffended in the year, compared with 23% of those who had previously been the subject of one conviction and 63% of those who had been convicted at least ten times.
57 That finding reflects, moreover, the compliance of that provision with Article 6 of Directive 2016/680 requiring the controller, where applicable and as far as possible, to make a clear distinction between personal data of different categories of data subjects in such a way that they are not subject without distinction – whatever the category to which they belong – to the same degree of interference with their fundamental right to the protection of their personal data (judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C-205/21, EU:C:2023:49, paragraph 83)).
58 Judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C-205/21, EU:C:2023:49, paragraph 126).
59 See, by analogy, judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C-205/21, EU:C:2023:49, paragraph 100). It should also be noted that the passing of time will inevitably be an obstacle to the location of witnesses and to their capacity to recall events.
60 Article 31 of Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ 2016 L 135, p. 53) provides that personal data processed by Europol will be stored by Europol only for as long as is necessary and proportionate for the purposes for which the data are processed. Europol will in any event review the need for continued storage no later than three years after the start of initial processing of personal data and may decide on the continued storage of personal data until the following review, which will take place after another period of three years, if continued storage is still necessary for the performance of its tasks. If no decision is taken on the continued storage of personal data, that data will be erased automatically after three years.
61 In the judgment of 13 February 2020, Gaughran v. United Kingdom (CE:ECHR:2020:0213JUD004524515, § 79 to 81) concerning legislation providing for data retention terminating on the death of the person concerned, a distinction was established between DNA on the one hand, and fingerprints and photographs, on the other hand. The ECtHR held that only the latter data were subject to a retention period comparable to indefinite retention. I would point out, for my part, that none of those data can be used in this case once the person concerned has died, although it should be noted that the post mortem retention of DNA would have made it technically possible to trace the close relatives of the person concerned.
62 Aside from the existence of offences not subject to limitation, the question of the relationship of the data retention period to the limitation period for prosecution must be qualified, in certain legal systems, as regards the mechanisms for suspension or interruption of prescription and the postponement of the starting point of the limitation period for so-called habitual, continuing or concealed offences and for certain offences where the victims are minors (postponement until the age of majority of the victim). Account should also be taken of the fact that sexual violence is the latest to be uncovered.
63 See, to that effect, judgment of 5 April 2022, Commissioner of An Garda Síochána and Others (C-140/20, EU:C:2022:258, paragraph 62).
64 I note that the ECtHR, in the context of the positive obligation arising under Article 2 of the ECHR, firmly recognised the public interest in investigating and possibly obtaining the prosecution and conviction of perpetrators of unlawful acts many years after the events (judgment of the ECtHR, 12 June2014, Jelic v. Croatia CE:ECHR:2014:0612JUD005785611, § 52), and stated that investigating ‘cold cases’, is also in the public interest, in the general sense of combating crime (judgment of 13 February 2020, Gaughran v. United Kingdom (CE:ECHR:2020:0213JUD004524515, § 93).
65 ECtHR, 22 June 2017, Aycaguer v. France (CE:ECHR:2017:0622JUD000880612, § 38), and 13 February 2020, Gaughran v. United Kingdom (CE:ECHR:2020:0213JUD004524515, § 88).
66 The retention period for traces of consultation of the record was not stated.
67 ECtHR, 13 February 2020, Gaughran v. United Kingdom (CE:ECHR:2020:0213JUD004524515, § 83).
68 Judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C-205/21, EU:C:2023:49, paragraphs 128 and 129).
69 Info Stat Justice bulletin of the French Ministry of Justice No 183, of 2 July 2021, ‘Mesurer et comprendre les déterminants de la récidive des sortants de prison’.
70 The subsequent entry and retention of data in the record relate to any first offender and not to an individual already convicted one or more times.
71 ECtHR, 13 February 2020, Gaughran v. United Kingdom (CE:ECHR:2020:0213JUD004524515, § 89).
72 Judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C-205/21, EU:C:2023:49, paragraph 130). The Court adds (paragraphs 132 and 133) that it is for the referring court to verify whether national law makes it possible to assess whether it is ‘strictly necessary’ to collect both the biometric data and the genetic data of the data subject in order for them to be entered in a record in the light of the nature and gravity of the offence of which that person is suspected but also other relevant factors, such as, in particular, the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the person in issue. It is questionable whether that requirement of in-depth individualisation is compatible with the legislative provisions and with the systematic nature and degree of abstraction and generality that they require, which is aimed at establishing general rules for retention of personal data in a record.
73 ECtHR, 13 February 2020, Gaughran v. United Kingdom (CE:ECHR:2020:0213JUD004524515, § 94).
© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.
BAILII: