FIFTH SECTION

CASE OF M.K. v. FRANCE

(Application no. 19522/09)

JUDGMENT

STRASBOURG

18 April 2013

FINAL

18/07/2013

This judgment is final but it may be subject to editorial revision.

In the case of M.K. v. France,

The European Court of Human Rights (Fifth Section), sitting as a Chamber composed of:

Mark Villiger, President, Angelika Nußberger, Ann Power-Forde, André Potocki, Paul Lemmens, Helena Jäderblom, Aleš Pejchal, judges, and Claudia Westerdiek, Section Registrar,

Having deliberated in private on 26 March 2013,

Delivers the following judgment, which was adopted on that date:

PROCEDURE

1. The case originated in an application (no. 19522/09) against the French Republic lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a French national, Mr M.K. (“the applicant”), on 28 February 2009.

2. The applicant, who had been granted legal aid, was represented by Mr C. Meyer, a lawyer practising in Strasbourg. The French Government (“the Government”) were represented by their Agent, Mrs E. Belliard, Director of Legal Affairs with the Ministry of Foreign Affairs.

3. The applicant alleged, in particular, a violation of Article 8 of the Convention, on the grounds of the retention of data relating to him in the national fingerprint database.

4. On 8 March 2011 the application was communicated to the Government.

THE FACTS

I. THE CIRCUMSTANCES OF THE CASE

5. The applicant was born in 1972 and lives in Paris.

6. On 10 February 2004 an investigation was launched in respect of the applicant for book theft. The investigating authorities took his fingerprints.

7. By a judgment handed down on 15 February 2005 following an appeal against a sentence delivered on 28 April 2004 by the Paris Criminal Court, the Paris Court of Appeal acquitted the applicant.

8. On 28 September 2005 the applicant was taken into police custody under the flagrante delicto procedure, also for book theft. He was again fingerprinted.

9. On 2 February 2006 the proceedings were discontinued by the Paris public prosecutor.

10. The fingerprints taken during these proceedings were entered into the national fingerprint database ( fichier automatisé des empreintes digitales - “the FAED”).

11. In a letter of 21 April 2006 to the Paris public prosecutor, the applicant requested the removal of his fingerprints from the FAED.

12. On 31 May 2006 the public prosecutor ordered the deletion only of the fingerprints taken during the first set of proceedings. He argued that retaining one specimen of the applicant’s fingerprints was justified in the latter’s interests, as it could rule out his involvement in acts committed by a third person stealing his identity.

13. On 26 June 2006 the applicant lodged an appeal with the judge of the Paris Tribunal de grande instance with responsibility for civil liberties and detention matters.

14. By order of 25 August 2006, the judge with responsibility for civil liberties and detention matters dismissed his appeal. He held that retaining the fingerprints was in the interests of the investigating authorities, as it provided them with a database comprising as full a set of references as possible. Furthermore, this measure was not prejudicial to the applicant thanks to the confidentiality of the database, which prevented any impact on the applicant’s private or social life.

15. On 21 December 2006 the President of the Investigation Division of the Paris Court of Appeal upheld this order.

16. In a judgment of 1 October 2008 the Court of Cassation dismissed an appeal on points of law by the applicant on the grounds that since the procedure was written he had been in a position to put forward his arguments and take cognisance of the reasons for the public prosecutor’s objection to the complete deletion of the fingerprints. It added that thanks to the evidence produced during the proceedings, it could verify that the request had been addressed in accordance with the legislation and international treaties cited by the applicant, which included Article 8 of the Convention.

II. RELEVANT DOMESTIC AND INTERNATIONAL LAW

A. Relevant domestic law

17. The relevant provisions of Decree No. 87-249 of 8 April 1987 on the national fingerprint database managed by the Ministry of the Interior, in the version in force at the material time, read as follows:

Article 1

“Under the conditions set out in the present Decree, computer processing of finger and palm prints is authorised with an eye to facilitating the national police and gendarmerie services’ efforts to find and identify the perpetrators of serious crimes and other major offences and ensuring the prosecution, investigation and trial of cases referred to the judicial authorities.”

Article 2

“Such processing shall be effected by the Central Police Directorate with the Ministry of the Interior. The facility shall be known as the ‘automated fingerprint identification system’.”

Article 3

“The following items may be recorded:

1. Prints found during criminal or on-the-spot investigations, preliminary inquiries, measures ordered by a judge, inquiries or investigations seeking to establish the causes of a mysterious or suspicious disappearance as laid down in Articles 74-1 and 80-4 of the Code of Criminal Procedure, or the execution of a search warrant issued by a judicial authority;

2. Where finger and palm prints found during criminal or on-the-spot investigations, preliminary inquiries, measures ordered by a judge or the execution of a search warrant issued by a judicial authority vis-à-vis persons against whom there is serious or corroborative circumstantial evidence pointing to their likely involvement as perpetrators or accomplices in the commission of a serious crime or other major offence, or persons who have been charged in criminal proceedings and who must be identified;

3. Finger and palm prints recorded in prisons in pursuance of the Code of Criminal Procedure with a view to ascertaining the identities of detainees who are being prosecuted for serious crimes or other major offences and to detecting cases of reoffending;

4 . Finger and palm prints transmitted by international police cooperation agencies or foreign police services in pursuance of international undertakings.”

Article 4

“The recorded finger and palm prints shall be accompanied by the following information:

1. Family name, forenames, date and place of birth, parents and sex;

2. The agency or service which initiated the entry;

3. The date and place of establishment of the identification form;

4 . The nature of the case and reference of the proceedings;

5. Police photographs;

6. In the case of prints transmitted as provided for in Article 3-4, the origin of the information and date of its recording in the computer file.

Recorded fingerprints shall be accompanied by the following information:

1. The place and date of fingerprinting;

2. The agency or service carrying out the fingerprinting;

3. The date and place of establishment of the form containing the copies of the fingerprints;

4. The nature of the case and reference of the proceedings;

5. The origin of the information and the date when it was recorded in the computerised file.”

Article 5

“The information recorded shall be retained for a maximum period of twenty-five years from the establishment of the identification form, unless it has been previously deleted under the conditions set out in Articles 7 and 7-1 or because the department responsible for processing has been notified of the death of the data subject or, in the case of a missing person, his or her discovery.

...”

Article 7

“The processing in question shall be supervised by the public prosecutor at the Court of Appeal in whose judicial district the department responsible for processing is located.

The public prosecutor may, of his or her own motion and without prejudice to the supervision conducted by the National Commission on Data Processing and Civil Liberties under the above-mentioned Law of 6 January 1978, order the deletion of information whose retention is manifestly unnecessary in the light of the purpose of the processing in question.

The body responsible for managing the file shall transmit to the prosecutor and the National Commission on Data Processing and Civil Liberties an annual activity report describing, inter alia, the results of the file updating and clearance operations.”

Article 7-1

“Prints collected under the conditions mentioned in Article 3, point (2) may be deleted at the request of the person concerned where their retention has become unnecessary for the purposes of the database. The public prosecutor attached to the court under whose jurisdiction the procedure giving rise to the registration was conducted shall be responsible for ordering such deletion.

The deletion request must be submitted in a registered letter, with a form for acknowledgment of receipt, or by declaration to the registry, failing which it shall be inadmissible. The request shall be directly addressed to the public prosecutor holding responsibility by virtue of the provisions of the previous paragraph. It may also be sent to the public prosecutor with responsibility for the place of residence of the person concerned, who shall then transmit it to the relevant public prosecutor.

The prosecutor in question shall notify the person concerned of his or her decision, by registered letter, within three months of the receipt of the request either by himself or by the public prosecutor of the place of residence of the person concerned.

In the absence of a reply within this time-limit, or where the prosecutor does not order the deletion, the person in question may apply to the judge with responsibility for civil liberties and detention matters within ten days by registered letter with a form for acknowledgment of receipt, or by declaration to the registry.

Having requested the public prosecutor’s written submissions, the judge with responsibility for civil liberties and detention matters shall issue a reasoned decision within two months. The decision shall be notified to the public prosecutor and, by registered letter, to the person concerned.

Where the judge responsible for pre-trial detention fails to issue an order within the two-month time-limit or if the order refuses the deletion, the person in question may, within ten days, apply to the president of the Investigation Division, by registered letter with a form for acknowledgment of receipt or by declaration to the registry. The objection must be accompanied by reasons if it is to be admissible.

In the case of an order prescribing deletion, the public prosecutor may also, within ten days, lodge an objection to the decision with the president of the Investigation Division. This objection shall suspend the execution of the decision.

The president of the Investigation Division shall adjudicate, after having requested the prosecutor’s written submissions, by means of a reasoned order within three months. Such order shall be served on the public prosecutor and, by registered letter, to the person concerned. An appeal to the Court of Cassation against the order may be lodged only if the order fails to satisfy the formal requirements to be legally valid.”

Article 8

“Only duly authorised officials of the criminal identification office of the Ministry of the Interior and of the National Gendarmerie investigation units may access the information recorded and carry out identification operations at the request of the judicial authorities or of police or gendarmerie officers.”

18. Article 55-1 of the Code of Criminal Procedure provides as follows:

Article 55-1

“A senior law-enforcement officer may carry out or supervise the taking of non-intimate samples from any person able to provide information about the offence in question, or from any person against whom there exist one or more plausible reasons to suspect that he has committed or attempted to commit an offence, in order to carry out technical and scientific tests comparing them with traces or evidence obtained for the purposes of the investigation.

He shall carry out or oversee the identification measures – in particular, the taking of fingerprints, palm prints or photographs - necessary for supplying and consulting information in the police databases, and adding information to them, in accordance with the regulations applicable to the database in question.

Refusal by a person suspected on one or more reasonable grounds of having committed or attempted to commit an offence to allow the samples ordered by the senior law-enforcement officer to be taken as provided for in the first two paragraphs above shall be punished by a year’s imprisonment and by a fine of 15,000 euros.”

B. Relevant international law

19. The relevant international material is outlined in the case of S. and Marper v. the United Kingdom [GC] (nos. 30562/04 and 30566/04, §§ 41-42 and 50-53, ECHR 2008).

THE LAW

I. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION

20. The applicant complained that his right to respect for his private life had been infringed by the retention of personal data on him in the national fingerprint database. He relied on Article 8 of the Convention, which provides:

“1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

21. The Government contested that argument.

A. Admissibility

22. The Court notes that this complaint is not manifestly ill-founded within the meaning of Article 35 § 3 (a) of the Convention. It further notes that it is not inadmissible on any other grounds. It must therefore be declared admissible.

B. Merits

1. Submissions of the parties

23. The applicant did not contest the lawfulness of the interference with his right to respect for his private life, but considered it unjustified. He first of all complained that the means used to achieve the aim of the measure were disproportionate. In his view, the provisions of Article 1 of the 1987 Decree on the aim of the measure were overly extensive in terms of scope and too vague in terms of definition. The authorities accordingly had excessive latitude, with sweeping, undifferentiated powers vis-à-vis the retention of data. He complained of a genuine risk of abuse on account of misconduct extending to other databases as well.

24. Furthermore, the applicant argued that the period of retention had been set arbitrarily and was effectively not subject to a time-limit. In his view, the twenty-five-year time-limit in fact corresponded not to a maximum period but to a standard length of time, as attested by the summary rejection of his appeal before the domestic courts. There were no regulations on the reasons to be given for refusing to delete the data, which meant that such refusal could reflect prejudice against the person making the request, as in the applicant’s own case.

25. The applicant also criticised the lack of effective procedural safeguards, submitting that not only could the judges cast doubt on the res judicata principle in criminal matters in order to refuse deletion, as in his own case, but also, the very existence of the data in the database called into question the presumption of innocence ipso facto .

26. The Government did not contest the fact that the retention of the data concerning the applicant in the national fingerprint database (“the FAED”) constituted interference with his right to respect for his private life.

27. However, they submitted, firstly, that it had been in accordance with the law, namely with Article 55-1 of the Code of Criminal Procedure and Decree no. 87-249 of 8 April 1987 as amended, and secondly, that it pursued the legitimate aim of preventing public disorder, since it was geared to identifying and prosecuting the perpetrators of criminal offences.

28. The Government also submitted that the interference had been necessary in a democratic society. While reiterating that the Court’s case-law did not prohibit the collection and retention of personal data by States as long as there were appropriate and sufficient guarantees, they stressed three points: States had some discretionary powers in this field, and these powers should be reinforced in the case of straightforward fingerprints; the FAED was a major contribution to the success of investigations into and detection of identity theft; and the management of the FAED was surrounded by extensive safeguards. Where these safeguards were concerned, the Government specified that the data registered were exhaustively listed and that the database could only be consulted on the basis of print comparisons (not with reference to a name or address). Moreover, only authorised police and gendarmerie officers could consult it. Data processing was placed under the supervision of both the public prosecutor attached to the Court of Appeal and the National Commission on Data Processing and Civil Liberties (CNIL), which was an independent administrative authority. While limiting the period of retention of data to twenty-five years, the Decree also provided that the person concerned could request deletion of the data, and a judicial remedy to that end was available should the public prosecutor refuse deletion. In the instant case the Government noted that the applicant had had recourse to this remedy, applying to the judge responsible for civil liberties and detention matters and then to the First President of the Court of Appeal. They also submitted that the Court of Cassation had considered the applicant’s appeal on points of law from the angle of a fair trial, even though it had declared the appeal inadmissible.

2. The Court’s assessment

(a) Whether there was interference

29. The Court reiterates that the retention of fingerprints on the national authorities’ records in connection with an identified or identifiable individual constitutes an interference with the right to respect for private life (see S. and Marper , cited above, § 86).

(b) Whether the interference was justified

i. Legal basis

30. Such interference must therefore be in accordance with the law, which presupposes the existence of a basis in domestic law compatible with the rule of law. The law must thus be adequately accessible and foreseeable, that is, formulated with sufficient precision to enable the individual – if need be with appropriate advice – to regulate his conduct. For domestic law to meet these requirements, it must afford adequate legal protection against arbitrariness and accordingly indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise (see Malone v. the United Kingdom , 2 August 1984, §§ 66-68, Series A no. 82; Rotaru v. Romania [GC], no. 28341/95, § 55, ECHR 2000-V; and S. and Marper , cited above, § 95). The level of precision required of domestic legislation – which cannot, however, provide for every eventuality – depends to a considerable degree on the content of the instrument in question, the field it is designed to cover and the number and status of those to whom it is addressed (see, among other authorities, Hasan and Chaush v. Bulgaria [GC], no. 30985/96, § 84, ECHR 2000-XI, and S. and Marper , cited above, § 96).

31. In the instant case, the Court finds that the interference was in accordance with the law, that is to say with Article 55-1 of the Code of Criminal Procedure and Decree no. 87-249 of 8 April 1987 as amended. As to whether the legislation at issue was sufficiently clear and precise in terms of the conditions for storing, using and deleting personal data, the Court notes that the applicant mentioned these problems as part of his arguments on the proportionality of the interference. At all events, the Court considers that these aspects are in his case closely related to the broader issue of whether the interference was necessary in a democratic society and that such an examination of the “quality” of the law in the instant case relates to the analysis set out below of the proportionality of the interference at issue (see S. and Marper , cited above, § 99).

(ii) Legitimate aim

32. The Court further notes that the interference pursued a legitimate aim, namely the detection and, therefore, prevention of crime (see S. and Marper , cited above, § 100).

(iii) Necessity of the interference

(α) General principles

33. It therefore remains to be seen whether the interference in question can be considered “necessary in a democratic society”, which means that it must answer a “pressing social need” and, in particular, be proportionate to the legitimate aim pursued, and the reasons adduced by the national authorities to justify it must be “relevant and sufficient” (see S. and Marper , cited above, § 101).

34. While it is for the national authorities to make the initial assessment in all these respects, the final evaluation of whether the interference is necessary remains subject to review by the Court for conformity with the requirements of the Convention (see Coster v. the United Kingdom [GC], no. 24876/94, § 104, 18 January 2001, and S. and Marper , cited above). A margin of appreciation, the extent of which varies depending on a number of factors, including the nature of the activities restricted and the aims pursued by the restrictions (see Smith and Grady v. the United Kingdom , nos. 33985/96 and 33986/96, § 88, ECHR 1999-VI; Gardel v. France , no. 16428/05, ECHR 2009; B.B. v. France , no. 5335/06; and M.B. v. France , no. 22115/06, 17 December 2009, §§ 60, 59 and 51 respectively), must therefore, in principle, be left to the States in this context (see, among many other authorities , Klass and Others v. Germany , 6 September 1978, § 49, series A no. 28). The margin will tend to be narrower where the right at stake is crucial to the individual’s effective enjoyment of intimate or key rights (see Connors v. the United Kingdom , no. 66746/01, § 82, 27 May 2004, and S. and Marper , cited above, § 102). Where a particularly important facet of an individual’s existence or identity is at stake, the margin allowed to the State will be restricted (see Evans v. the United Kingdom [GC], no. 6339/05, § 77, ECHR 2007-I; S. and Marper , cited above; and Gardel , B.B. v. France and M.B. v. France , cited above, §§ 61, 60 and 52 respectively). Where, however, there is no consensus within the member States of the Council of Europe either as to the relative importance of the interest at stake or as to the best means of protecting it, the margin will be wider (see Dickson v. the United Kingdom [GC], no. 44362/04, § 78, ECHR 2007 ‑ V).

35. The protection of personal data is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention. The domestic law must therefore afford appropriate safeguards to prevent any such use of personal data as may be inconsistent with the guarantees of this Article (see S. and Marper , cited above, § 103, and Gardel , B.B. and M.B. , cited above, §§ 62, 61 and 53 respectively). In line with its findings in S. and Marper (cited above), the Court is of the opinion that the need for such safeguards is all the greater where the protection of personal data undergoing automatic processing is concerned, not least when such data are used for police purposes. The domestic law should notably ensure that such data are relevant and not excessive in relation to the purposes for which they are stored, and preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored. The domestic law must also afford adequate guarantees that retained personal data were efficiently protected from misuse and abuse (ibid.).

36. Lastly, of particular concern to the Court in the present context is the risk of stigmatisation, stemming from the fact that persons in the applicant’s position, who have not been convicted of any offence and are entitled to the presumption of innocence, are treated in the same way as convicted persons. While, from this angle, the retention of private data cannot be equated with the voicing of suspicions, the conditions of retention of the data must not give the impression that the persons concerned are not being treated as innocent (see S. and Marper , cited above, § 122).

(β) Application of the above principles in the instant case

37. In the instant case, the measure at issue, which does not per se impose any obligation on the applicant, entails sufficiently well-defined procedures as regards consultation, concerning both the persons authorised to consult the database and the authorisation system governing identification operations in line with the purpose of the database (contrast Khelili v. Switzerland , no. 16188/07, § 64, 18 October 2011).

38. The Court notes that the same cannot be said of the system for collecting and retaining data.

39. The Court notes at the outset that the purpose of the database, notwithstanding the legitimate aim pursued, necessarily involves adding and retaining as many names as possible, as is borne out by the reasoning adopted by the judge with responsibility for civil liberties and detention matters in his order of 25 August 2006 (see paragraph 14 above).

40. It also notes that the public prosecutor’s refusal to delete the prints taken during the second set of proceeding was motivated by the need to protect the applicant’s interests by ruling out his involvement should someone else attempt to steal his identity (see paragraph 12 above). Besides the fact that such a reason is not explicitly mentioned in the provisions of Article 1 of the impugned decree, barring a particularly extensive interpretation of this Article, the Court considers that accepting the argument based on an alleged guarantee of protection against potential identity theft would in practice be tantamount to justifying the storage of information on the whole population of France, which would most definitely be excessive and irrelevant.

41. Moreover, in addition to the primary function of the database, which is to facilitate efforts to find and identify the perpetrators of serious crimes and other major offences, the decree mentions another function, namely to facilitate “the prosecution, investigation and trial of cases referred to the judicial authority”, without specifying whether this is confined to serious crimes and other major offences. It also covers “persons who have been charged in criminal proceedings and whose identification is required” (Article 3-2 of the decree), and so can embrace all offences de facto , including mere summary offences, in the hypothesis that this would help identify the perpetrators of crimes and offences as specified in Article 1 of the Decree (see paragraph 17 above). At all events, the circumstances of the case, which concerned book theft and was discontinued, show that the instrument applies to minor offences. The instant case is thus very different from those specifically relating to such serious offences as organised crime (see S. and Marper , cited above) or sexual assault (see Gardel , B.B. v. France and M.B. v. France , cited above).

42. Furthermore, the Court notes that the decree draws no distinction based on whether or not the person concerned has been convicted by a court, or has even been prosecuted. In S. and Marper, the Court highlighted the risk of stigmatisation, stemming from the fact that persons who had either been acquitted or had their cases discontinued - and were therefore entitled to the presumption of innocence – were treated in the same way as convicted persons (ibid., § 22). The situation in the instant case is similar on this point, as the applicant was acquitted and discharged in an initial set of proceedings, and subsequently had the charges against him dropped.

43. In the Court’s view, the provisions of the impugned decree on the procedure for the retention of data also fail to provide sufficient protection for the persons in question.

44. In connection with the possibility of deleting such data, the Court considers that the right at any time to submit a deletion request to the court is liable, in the words of the 25 August 2006 order, to conflict with the interests of the investigating authorities, which require access to a database with as many references as possible (see paragraph 14 above). Accordingly, since the interests at stake are contradictory, if only partially, the deletion, which is not in fact a right, provides a safeguard which is “theoretical and illusory” rather than “practical and effective”.

45. The Court notes that while the retention of information stored in the file is limited in time, it nevertheless extends to twenty-five years. Having regard to its previous finding that the chances of deletion requests succeeding are at best hypothetical, a twenty-five-year time-limit is in practice tantamount to indefinite retention, or at least, as the applicant contends, a standard period rather than a maximum one.

46. In conclusion, the Court considers that the respondent State has overstepped its margin of appreciation in this matter, as the regulations on the retention in the impugned database of the fingerprints of persons suspected of having committed offences but not convicted, as applied to the applicant in the instant case, do not strike a fair balance between the competing public and private interests at stake. Consequently, the retention of the data must be seen as a disproportionate interference with the applicant’s right to respect for his private life and cannot be regarded as necessary in a democratic society.

47. There has accordingly been a violation of Article 8 of the Convention.

II. ALLEGED VIOLATION OF ARTICLE 6 OF THE CONVENTION

48. The applicant also complained that the procedure for requesting a deletion was unfair. He relied on Article 6 § 1 of the Convention, the relevant provisions of which read as follows:

“In the determination of his civil rights and obligations ... everyone is entitled to a fair ... hearing ... by a ... tribunal ...”.

49. Besides the fact that this complaint partly overlaps with the one under Article 8 of the Convention, having regard to all the information in its possession and to the extent that it has jurisdiction to rule on the allegations put forward, the Court has found no appearance of a violation of the rights and freedoms secured under the Convention and the Protocols thereto.

50. It follows that this complaint is manifestly ill-founded and must be rejected pursuant to Article 35 §§ 3 (a) and 4 of the Convention.

III. APPLICATION OF ARTICLE 41 OF THE CONVENTION

51. Article 41 of the Convention provides:

“If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party.”

52. The applicant, having been granted legal assistance during proceedings before the Court, did not submit a claim for just satisfaction. Accordingly, the Court considers that there is no call to award him any sum on that account.

FOR THESE REASONS, THE COURT, UNANIMOUSLY,

1. Declares the application admissible in respect of the complaint under Article 8 and the remainder of the complaints inadmissible;

2. Holds that there has been a violation of Article 8 of the Convention.

Done in French, and notified in writing on 18 April 2013, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.

Claudia Westerdiek Mark Villiger Registrar President