FIRST SECTION

CASE OF TRAJKOVSKI AND CHIPOVSKI v. NORTH MACEDONIA

(Applications nos. 53205/13 and 63320/13)

JUDGMENT

Art 8 • Respect for private life • Disproportionate character of indefinite retention of DNA profiles of convicted persons • Blanket and indiscriminate nature of the powers of retention • Lack of consideration of the nature or gravity of the offence or other circumstances • Absence of a specific review of the necessity of data retention • Lack of possibility to request deletion of data

STRASBOURG

13 February 2020

FINAL

13/06/2020

This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision.

In the case of Trajkovski and Chipovski v. North Macedonia ,

The European Court of Human Rights ( First Section ), sitting as a Chamber composed of:

Ksenija Turković , President, Aleš Pejchal , Armen Harutyunyan , Pauliine Koskelo , Tim Eicke , Jovan Ilievski , Raffaele Sabato , judges, and Abel Campos , Section Registrar ,

Having deliberated in private on 21 January 2020 ,

Delivers the following judgment, which was adopted on that date:

PROCEDURE

1 . The case originated in two applications (nos. 53205/13 and 63320/13) against the Republic of North Macedonia lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by two Macedonian s/ citizens of North Macedonia , Mr Jov ch e Trajkovski (“the first applicant”) and Mr Dimitar Chipovski (“the second applicant”), on 16 August and 4 October 2013 respectively .

2 . The applicants were represented by Ms N. Boshkova , a lawyer practising in Skopje. The Government of North Macedonia (“the Government”) were initially represented by their Agent, Mr K. Bogdanov , and then by the ir current Agent, Ms D. Djonova .

3 . The applicants alleged that the regulatory framework on the basis of which the authorities had collect ed , process ed and stor ed their DNA material was incompatible with the requirements under Article 8 of the Convention .

4 . On 18 April 2016 the Government were given notice of the applications .

THE FACTS

5 . The applicants were born in 1982 and 1979 respectively and live in Skopje .

6 . On 11 February 2010 two police officers approached the first applicant while he was walking d o w n a street and questioned him about a steering wheel lock which he was holding at the time. He was taken to a police station , where police officers took a mouth swab from him w ithout giving him any explanation. In the ensuing criminal proceedings he was convicted of aggravated theft (theft of a car radio) and given a suspended prison sentence. The DNA findings of the sample taken from him were submitted as evidence against him.

7 . The first applicant was convicted of other crimes of theft and aggravated theft prior to and after the proceedings in question .

8 . On 25 March 2010 the first applicant filed a complaint with the Personal Data Protection Directorate (“the Directorate”) , alleging that the police officers had violated his right to privacy. He contended that they had taken cellular material from his mouth unlawfully, without a court order and without his consent. He argued that the police had had no legal right to take and retain his DNA material.

9 . By a decision of 12 April 2010 the Directorate dismissed his complaint , finding that the police officers “had taken [the first applicant ’ s] DNA sample and processed it in order to detect any criminal and minor offences, that is, to establish the identity of a person suspected of committing a crime punishable by law”. Relying on section 5(1 )( 1) and (2) of the Personal Data Protection Act, sections 14 and 66 of the Police Act and section 6 of the Rules on Police Cond uct (see paragraphs 21, 23, 24 and 29 below), the Directorate found that the police were authorised to take, retain and process the personal data of an individual when there was a reasonable suspicion that he or she had committed a punishable crime. Such actions were aimed at the prevention and detection of crime. Furthermore, the police were authorised to establish the identity of a person on the basis of , inter alia , a DNA sample.

10 . The first applicant challenged that decision before the Administrative Court, arguing that there was no law regarding the collection, storage and processing of DNA material. In that connection , he submitted that DNA material was stored indefinitely . Furthermore, given that his identity had been known to the authorities at the relevant time, there had been no justification for taking a DNA sample from him. In his view, i t could be used for “any future investigations which mark [ ed him] out ” .

11 . On 6 June 2012 the Administrative Court dismissed the applicant ’ s complaint. In addition to the arguments given in the Directorate ’ s decision, the court referred to section 69 of the Police Act (see paragraph 25 below) and held that the police were authorised to collect and process personal data, including genetic data, for the purposes of “the detection and prevention of criminal and minor offences and for the detection and apprehension of perpetrators, i.e. regarding an individual about whom there was a reasonable suspicion that he or she [had] committed or participated in the planning, financing or execution of a criminal offence, as was the case with [the first applicant].”On 24 January 2013 (served on the applicant on 22 February 2013) the Higher Administrative Court upheld the lower court ’ s decision, finding no reason to depart from the reason ing given therein .

12 . On 8 October 2009 t he second applicant was arrested and taken to a police station, where he was interrogated in relation to allegations of theft. An identity parade was organised and a mouth swab was taken from him. After the proceedings had been reopened , i n 2014 he was convicted of aggravated theft and given a suspended prison sentence. The analysis of his DNA make-up was not submitted as evidence against him.

13 . T he applicant has another more recent convict ion (not yet final) of aggravated theft , for which he was given a suspended sentence.

14 . On 26 May 2010 the second applicant complained to the Directorate that the police had violated his right to privacy by taking and processing his DNA material.

15 . In reply to the second applicant ’ s complaint , the Ministry of the Interior submitted several documents. It stated that on the basis of, inter alia , the Instruction on the manner and methods for forensic registration and identification dated 25 February 2009 (see paragraph 30 below) , the Forensics Bureau within the Ministry of the Interior had requested that a DNA sample be taken from him . Attempts by him to obtain a copy of the Instruction were to no avail because the Ministry of the Interior stated that it “is not of a public nature, i.e. the Instruction is an internal act ... and has no effect outside the Ministry ...”

16 . On 21 July 2010 the Directorate dismissed the second applicant ’ s complaint , holding that he had been arrested without a court order on account of a reasonable suspicion of theft. In the identity parade the victim had identified him as the perpetrator. The police had taken a DNA sample from his mouth and submitted a criminal complaint against him. Referring to the same provisions as in the first applicant ’ s case (see paragraph 9 above) , the Directorate found that the police had undertaken investigative measures in respect of the second applicant, who had been suspected of committ ing aggravated theft. The police had therefore acted in accordance with the law and had not breached the Personal Data Protection Act.

17 . The applicant challenged that decision, arguing that there was no legislative regulation of the collection, storage and processing of DNA material as a specific category of personal data that contained information about individuals, including information about their health and genetic make-up. Furthermore, there was no legislation on the use of DNA or the time-limits for storing it. He maintained that a s there had been other means of establish ing his identity, the collection and processing of his DNA had not been justified or necessary in his case.

18 . On 6 June 2012 the Administrative Court dismissed the second applicant ’ s complaint, finding that the Ministry of the Interior was authorised to collect and process personal data, including genetic material, in order to prevent and detect criminal and minor offences and to find and apprehend the perpetrators of such crimes.

19 . The applicant appealed. He submitted that his identity had been known to the police. Since the criminal complaint against him had pre-dated the analysis of his DNA, the relevant material had been unlawfully taken from him and stored. The criminal complaint concerned charges of aggravated theft and the Ministry of the Interior had confirmed in similar proceedings that no DNA analysis had ever been carried out in cases of suspected theft and aggravated theft (see paragraph 31 below).

20 . On 12 March 2013 (served on the applicant on 12 April 2013) the Higher Administrative Court dismissed the second applicant ’ s appeal and upheld the lower court ’ s decision. Referring to the legislation specified above, the court held that the police had taken and processed the DNA material because the second applicant had been suspected of committing a crime.

21 . Section 5 of the Personal Data Protection Act provides , inter alia , that personal data is to be processed reasonably and in accordance with the law and collected for specific and clear aims specified by law. It is to be processed in a manner suitable to those aims. It is to be retained in a form which allows for the identification of the person concerned and no longer than is necessary to fulfil the purposes for which the data has been collected. After the time-limit for storage of the personal data has expired, it may only be processed for historical, scientific or statistical purposes.

22 . Under section 7 , personal data related to criminal offences, penalties and security measures is to be processed by the competent S tate authorities in accordance with the law.

23 . Section 14 of the Police Act provides that a police officer can take , of his or her own motion or by order of the public prosecutor, court or other body measures for the detection of a crime and prosecution of a person who is suspected of plann ing or committing a crime.

24 . Under section 66(1) the police are authorised to collect, store, process, examine, transfer and delete personal data under the conditions specified by law and maintain a database of personal data for the prevention and detection of criminal and minor offences and in order to find the perpetrators of such acts.

25 . Section 69 provides that the police are to maintain a database of persons for whom DNA profiles have been compiled.

26 . Section 54 of the amendments to the Police Act, which became effective ( се применува ) as of 1 December 2012, namely after the taking of DNA samples from the applicants , provides that DNA data (section 69) are retained permanently ( трајно ).

27 . Section 249(3) and (5) of the Criminal Proce e d ing Act provides that DNA samples can be collected for the identification of persons or for comparison with other biological samples and DNA profiles. In such circumstances the consent of the person concerned is not required. If no criminal proceedings are brought, samples taken under this section can only be retained until prosecution of the offence in question becomes time ‑ barred.

28 . Under section 277, the judicial police are authorised to collect biological material for DNA analysis in order to identify persons or objects or if it is in the interest of the proceedings. The judicial police can also take samples for DNA analysis from suspects in accordance with section 249(3) of the Act. In order to establish the origin of traces on certain objects, the police can collect biological material for DNA analysis from persons who are likely to have come into contact with those objects.

29 . Sections 6 and 7 of the Rules set out the powers of the police to establish the identity of a person who is suspected of committing a crime. The identity of an individual can be established, inter alia , on the basis of a DNA sample. Identification of a person who is not suspected of committing a crime on the basis of DNA analysis can be made only if he or she has consented in writing.

30 . The 2014 Instruction provides that the Forensics Bureau within the Ministry of the Interior is to keep records of DNA profiles (section 3). It specifies that the arresting officer is to apply to register a person in the forensic records. In so doing, the officer can, inter alia , take biological material from that person for DNA analysis (section 9). The DNA samples are to be stored in special containers approved by the Forensics Bureau (section 20) and kept in a refrigerator for a maximum of seven days before they are sent to the Forensics Bureau. On expiry of that time-limit, a new sample is to be taken. Samples which are not submitted to the Forensics Bureau within the specified time-limit are to be destroyed by the Bureau (section 21). The 2014 Instruction further specifies the procedure for DNA analysis and access to records of DNA profiles . The 2014 Instructions set aside the 2009 Instruction, which contained no provision s regarding the collection, processing or storage of DNA material.

31 . By a decision of 11 June 201 0 the Directorate dismissed a complaint by a person who, like in the present cases, alleged that police officers had taken a mouth swab for compiling his DNA profile in violation of his privacy. In th at decision the Directorate referred to a statement of a representative of the Ministry of the Interior that cellular material had never been taken in cases of suspected theft and aggravated theft (decision no. 09 ‑ 30/7).

32 . The international materials relevant to the present case were described in the case s of S. and Marper v. the United Kingdom ( [GC], nos. 30562/04 and 30566/04, §§ 41-44, ECHR 2008) and Gaughran v. the United Kingdom (no. 45245/15, §§ 50-52, 13 February 2020).

33 . Concerning the retention of DNA profiles following a conviction for a minor criminal offence, it appears from information available to the Court that, of thirty Council of Europe member States other than the respondent State, three (Cyprus, Ireland and Montenegro) have indefinite retention periods. Twenty States have retention periods limited in time (Albania, Austria, Belgium, Bosnia and Herzegovina, Croatia, Denmark, Estonia, Finland, France, Hungary, Latvia, Lithuania, the Republic of Moldova, the Netherlands, Norway, Poland, Portugal, Spain, Sweden and Switzerland). It may also be noted that some of those states for example Belgium and Latvia do not provide for retention of data for ‘ administrative ’ offences, but only criminal offences. Of those twenty, seven have a defined retention period (either general, or for more serious offences) linked to the date of death of the convicted person (Bosnia and Herzegovina, Denmark, Finland, the Republic of Moldova, the Netherlands, Norway and Switzerland). Of those seven, the legislation of the Netherlands specifies the longest retention period of twenty years from the date of death for serious offences, with decreasing periods for less serious offences. Three member States (the Czech Republic, Germany and Malta) do not have specific retention periods but have various substantive limitations on the data retention and require periodic assessments to determine whether the substantive requirements for a prolonged retention are met. Four are without relevant regulation (San Marino, Georgia, Lichtenstein and Romania).

34 . In general, the reasons for retention of the relevant personal data (DNA profiles, fingerprints, photographs) of convicted offenders relate to the necessity of crime prevention and effective investigation and prosecution of crime. The legislation in Austria also refers to the need to protect public security and in Ireland the need to retain data for intelligence purposes. The legislation in Sweden also refers to the fulfilment of obligations which follow from international commitments.

35 . As to the existence of review mechanisms, the report finds that in six of the member States subject to the survey (Albania, Bosnia and Herzegovina, the Czech Republic, the Republic of Moldova, Norway and Poland) there is a possibility of an administrative or other similar specialised review of the necessity of the data retention. In eighteen (Austria, Belgium, Croatia, Cyprus, Finland, France, Georgia, Germany, Hungary, Ireland, Lithuania, Malta, Montenegro, Portugal, Romania, Spain, Sweden and Switzerland) there is a possibility of a judicial review, often coupled with a prior administrative review. In five States (Denmark, Estonia, Latvia, the Netherlands, Lichtenstein) there is no possibility of a review of the necessity of data retention. In San Marino, it would appear that there is no specific regulation on the matter.

THE LAW

36 . The Court considers that, in accordance with Rule 42 § 1 of the Rules of Court, the applications should be joined, given their similar factual and legal background.

37 . The applicant s complained under Article 8 of the Convention that the collection, processing and storage of their DNA material had violated their right to respect for their private life. In that connection , they alleged that there had been no legislative framework that clearly regulate d the taking, use, processing, storing and deletion of DNA material. The legislation on which the authorities had relied in their cases did not me e t the “quality of law” requirement under Article 8 of the Convention. This Article reads as follows:

“1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

38 . The Government did not raise any objection as to the admissibility of the application s .

39 . The Court notes that the application s are not manifestly ill ‑ founded within the meaning of Article 35 § 3 (a) of the Convention. It further notes that they are not inadmissible on any other grounds. They must therefore be declared admissible.

40 . The applicant s observed that the legislative framework at the time had not provided clear rules on the collection, use, retention and deletion of DNA material. It had not been accessible (regarding the Guidelines), sufficiently precise and foreseeable. In this connection , they maintained that the purpose s for which DNA material could be taken, processed and stored had been vague and broadly defined . The inconsistent domestic practice demonstrated that the applicable rules had lacked clarity and foreseeability. Furthermore, t he applicable law had not specified any time-limit for the retention of DNA findings . That was also the case with t he rules that post ‑ dated and had accordingly not applied to the applicants ’ cases, namely the Criminal Proce e d ings Act and the 2014 Instruction . The Criminal Proce e d ings Act neither provide d safeguards for the applicants nor define d a time-limit for the retention of the DNA material of convicted persons who had already served the ir sentence s , such as the applicants. The indefinite retention of DNA material , irrespective of the offen c es concerned , was not necessary in a democratic society. That the courts had not relied on the DNA findings in the proceedings against the second applicant proved that such an analysis had not been justified in his case. Lastly, there were no safeguards against the arbitrary use of their DNA material in the future . In this connection , they argued that DNA registers could be accessed by authorities other than the police.

41 . The Government agreed that DNA material constituted personal data that required protection and that there had been an interference with the applicants ’ right to respect for their private life. However, in their view that interference had been in accordance with the law ( paragraphs 2 1 - 29 ) , which had been sufficiently precise and foreseeable, and had pursued a legitimate aim, namel y the detection and prevention of crime. Furthermore, it had been proportionate to the aim sought to be achieved. In this connection , they maintained that even though it had not been the only means available, DNA analysis had been the most efficient way of identifying the applicants , as prior convicts who had been suspected of committing a crime. The applicants had not objected to the taking of the DNA samples (both applicants) and us e of the DNA findings in the impugned proceedings (the first applicant).

42 . According to the Government, t he regulatory framework in force at the material time had been subsequently developed in order to strengthen and improve the safeguards against arbitrary conduct by State authorities in future cases. T he amendments to the Crim inal Proceedings Act set a time ‑ limit for the retention of DNA material. Furthermore, the 2014 Instruction provided that DNA samples were to be destroyed immediately after the DNA analysis had been completed. The DNA profile s derived from that analysis were to be recorded in registers and “retained for a certain [length of ] time, but not indefinitely”. The applicants ’ DNA information had not been used in any other proceedings or for purposes different from those for which it had been collected. Accordingly, t he applicants ’ allegations of potential misuse of the DNA material were speculative . Moreover, they had not present ed any evidence in support of an y actual or potential misuse of their personal (genetic) material.

(a) Existence of an interference

43 . The Court notes that it is not disputed by the Government that DNA material is personal data and that in the present cases there was an interference with the applicants ’ right to respect for their private li fe . The Court, having regard to its case-law , according to which DNA profiles clearly constitute data pertaining to one ’ s “private life” and their retention amounts to an interference with the right to respect for one ’ s private life, within the meaning of Article 8 § 1 of the Convention ( see S. and Marper v. the United Kingdom ([GC], nos. 30562/04 and 30566/04, §§ 67-77 , ECHR 2008) , finds no reason to hold otherwise .

44 . It will accordingly examine whether th e interference was justified in terms of Article 8 § 2 of the Convention, that is , whether it was in accordance with the law, pursued a legitimate aim and was “necessary in a democratic society”.

(b) Whether the interference was “in accordance with the law”

45 . The Court refers to its settled case-law as to what the wording “in accordance with the law” entails within the meaning of Article 8 § 2 of the Convention ( ibid. , §§ 95 and 96 , and Segerstedt-Wiberg and Others v. Sweden , no. 62332/00, § 76, ECHR 2006 ‑ VII).

46 . In the present case, it notes that the collection and storage of DNA material in respect of the applicants had a basis in domestic law. Indeed, the relevant provisions of the Personal Data Protection Act, the Police Act and the Rules on Police Conduct, which were in force at the time when the DNA samples were taken from the applicants and on which the authorities relied in the ir cases (see paragraphs 9 and 16 above) , authorise d the police to collect, process and store personal data, including DNA material , in order to establish the identity of a person who is suspected of committing a crime . S uch material can be collected irrespective of the nature or seriousness of the offence of which the person i s suspected. The consent of the person concerned is not required (see paragraph 29 above). Such data is to be stored no longer than it is necessary to fulfil the purposes for which the data has been collected. The subsequent amendments to the Police Act and the Criminal Proceedings Act contain further provisions in this respect (see paragraphs 26 - 2 8 above).

47 . Th e existence of legal provisions for the taking and storing of DNA material was not contested by the applicants. However, they maintained that that framework lacked the requisite quality within the meaning of Article 8 of the Convention . In particular, they submitted that the purposes for which DNA samples could be taken and profiles stored were couched in broad terms and that the relevant national provisions did not specify the duration of the retention of DNA material in respect of convicted persons , such as themselves .

48 . The Court observes that the regulatory framework on the retention of DNA material was not very precise. However , the issues related to the conditions attached to it and arrangements for the storing of DNA material are closely related to the broader issue of whether the interference was necessary in a democratic society. A ccordingly, it does not find it necessary to decide whether the applicable rules meet the “quality of law” requirements within the meaning of Article 8 § 2 of the Convention ( see S. and Marper , cited above, § 99).

(c) Legitimate aim

(d) Necessary in a democratic society

50 . The relevant Convention principles are summarised in the Court ’ s judgment in the case of S. and Marper ( ibid., §§ 101-104). Unlike that case , which concerned the retention of personal data of persons not convicted, the question in the present case is whether the retention of the DNA data of the applicants , as persons who were convicted of aggravated theft, was justified under Article 8 § 2 of the Convention .

52 . In this connection , it observes that t he applicable legislation at the time d id not set a specific time-limit for the retention of DNA data of the applicants as convicted persons . Indeed, as stated by the Government, DNA profiles were to be recorded in the relevant registers and “retained for a certain [length of] time, but not indefinitely ( засекогаш ) ”. That such data “may be retained until it has fulfilled the purpose for which it has been taken” (see paragraph 21 above) is open to various interpretations. The amendments to the Police Act (see paragraph 26 above) introduced subsequent to the taking of DNA samples from the applicants provide that DNA data is stored in the relevant register permanently. In the absence of anything to suggest that such retention may be linked to any fixed point in time, the Court considers that the respondent State permits indefinite retention period of DNA profiles . The relevant provisions of the Criminal Proceedings Act (see paragraphs 27 and 28 above) concern personal data taken from a person in respect of whom no criminal proceedings were initiated and cannot therefore be applied to the applicants , whose guilt was established by a final court judgment.

53 . Furthermore , it has not been argued that the nature or gravity of the offence of which a person was convicted, or received a penalty for , or any other defined criteria, such as previous arrests, and any other special circumstances , ha ve any bearing on the collection, storage and retention of DNA records (see , S. and Marper , cited above, § 119, and conversely, Peruzzo and Martens v. Germany ( dec. ), no s . 7841/08 and 57900/12 , 4 June 2013, § 44) . Moreover, wh ereas the police are vested with the power to delete personal data from the registers (see paragraph 24 above) , the law is silent on the conditions under which it can be done and procedure to be followed . Whereas the law provides, in general terms, for the possibility of judicial review coupled with a prior administrative review, t here is no provision allowing for a specific review of the necessity of data retention. Similarly , there is no provision under which a person concerned can apply to have the data concerning him or her deleted if conserving the data no longer appears necessary in view of the nature of the offence, the age of the person concerned, the length of time that has elapsed and the person ’ s current personality (see Gardel , cited above, § 68).

54 . In conclusion, the Court finds that the blanket and indiscriminate nature of the powers of retention of the DNA profiles of the applicants, as persons convicted of an offence, coupled with the absence of sufficient safeguards available to the applicants, fails to strike a fair balance between the competing public and private interests and that the respondent State has overstepped the acceptable margin of appreciation in this regard. Accordingly, the retention at issue constitutes a disproportionate interference with the applicants ’ right to respect for private life and cannot be regarded as necessary in a democratic society.

55 . Accordingly, there has been a violation of Article 8 of the Convention in the present case.

56 . Article 41 of the Convention provides:

“If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party.”

57 . The applicant s claimed 1,000 euros (EUR) each in respect of non ‑ pecuniary damage.

58 . The Government contested this claim as unsubstantiated. They further submitted that there was no causal link between the damage claimed and the alleged violation. Lastly, they argued that the finding of a violation of the Convention would be sufficient just satisfaction.

59 . The Court considers that, for the reasons given in the S. and Marper case ( ibid., § 134), the finding of a violation may be regarded as constituting sufficient just satisfaction in this respect. The Court accordingly rejects the applicants ’ claim for non-pecuniary damage.

FOR THESE REASONS, THE COURT, UNANIMOUSLY,

Done in English, and notified in writing on 13 February 2020 , pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.

Abel Campos Ksenija Turković Registrar President