Provisional text

JUDGMENT OF THE COURT (Fifth Chamber)

28 November 2024 ( * )

( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 4(1)(a) to (c) – Article 8(1) and (2) – Article 10 – Accused person – Police record containing biometric and genetic data – Enforcement – Objectives of prevention and detection of criminal offences – Interpretation of the judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C‑205/21, EU:C:2023:49) – Obligation to interpret national law in conformity with EU law – Assessment of whether it is ‘strictly necessary’ for the competent authorities to process sensitive data – Role of the competent authorities )

In Case C‑80/23,

REQUEST for a preliminary ruling under Article 267 TFEU from the Sofiyski gradski sad (Sofia City Court, Bulgaria), made by decision of 14 February 2023, received at the Court on 14 February 2023, in the criminal proceedings against

V.S.,

other party:

Ministerstvo na vatreshnite raboti, Glavna direktsia za borba s organiziranata prestapnost,

THE COURT (Fifth Chamber),

composed of I. Jarukaitis, President of the Fourth Chamber, acting as President of the Fifth Chamber, D. Gratsias (Rapporteur) and E. Regan, Judges,

Advocate General: J. Richard de la Tour,

Registrar: R. Stefanova-Kamisheva, Administrator,

having regard to the written procedure and further to the hearing on 20 March 2024,

after considering the observations submitted on behalf of:

– the Bulgarian Government, by T. Mitova and T. Tsingileva, acting as Agents,

– the Hungarian Government, by Zs. Biró-Tóth and Z. Fehér, acting as Agents,

– the European Commission, by A. Bouchagiar, C. Georgieva, H. Kranenborg and F. Wilman, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 13 June 2024,

gives the following

Judgment

1 This request for a preliminary ruling concerns the interpretation of Article 6(a) and Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89).

2 The request has been made in criminal proceedings brought against V.S. seeking enforcement of the collection of her biometric and genetic data in order for them to be entered in a record.

Legal context

European Union law

3 Recital 37 of Directive 2016/680 states:

‘Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. … The processing of such data should … be allowed by law where the data subject has explicitly agreed to the processing that is particularly intrusive to him or her. However, the consent of the data subject should not provide in itself a legal ground for processing such sensitive personal data by competent authorities.’

4 Article 1 of that directive, entitled ‘Subject matter and objectives’, provides, in paragraph 1:

‘This Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’

5 As set out in Article 3 of that directive:

‘For the purposes of this Directive:

…

7. “competent authority” means:

(a) any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; or

(b) any other body or entity entrusted by Member State law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

…’

6 Article 4 of that directive, entitled ‘Principles relating to processing of personal data’, provides in paragraph 1:

‘Member States shall provide for personal data to be:

(a) processed lawfully and fairly;

(b) collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;

(c) adequate, relevant and not excessive in relation to the purposes for which they are processed;

…’

7 Article 6 of Directive 2016/680, entitled ‘Distinction between different categories of data subject’, is worded as follows:

‘Member States shall provide for the controller, where applicable and as far as possible, to make a clear distinction between personal data of different categories of data subjects, such as:

(a) persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence;

…’

8 As provided for in Article 8 of that directive, entitled ‘Lawfulness of processing’:

‘1. Member States shall provide for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority for the purposes set out in Article 1(1) and that it is based on Union or Member State law.

2. Member State law regulating processing within the scope of this Directive shall specify at least the objectives of processing, the personal data to be processed and the purposes of the processing.’

9 Article 10 of that directive, entitled ‘Processing of special categories of personal data’, provides:

‘Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be allowed only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:

(a) where authorised by Union or Member State law;

(b) to protect the vital interests of the data subject or of another natural person; or

(c) where such processing relates to data which are manifestly made public by the data subject.’

Bulgarian law

The NK

10 By virtue of Article 11(2) of the Nakazatelen kodeks (Criminal Code), in the version applicable to the main proceedings (‘the NK’), offences are intentional where the perpetrator of an act is aware of the nature of that act or has intended or allowed the occurrence of the consequence of the offence. The vast majority of the offences provided for in the NK are intentional.

The NPK

11 Article 46(1) and Article 80 of the Nakazatelno-protsesualen kodeks (Code of Criminal Procedure), in the version applicable to the main proceedings (‘the NPK’), provide that criminal offences involve either public prosecution, that is to say, charges are brought by the prosecutor, or prosecution by the civil party. Almost all the offences under the NK involve public prosecution.

12 Pursuant to Article 219(1) of the NPK, ‘where sufficient evidence that a particular person is guilty of a criminal offence subject to public prosecution is gathered’, that person is to be accused and informed thereof. He or she may be subject to various procedural coercive measures, against which he or she may defend himself or herself by providing explanation or adducing evidence.

13 In accordance with the NPK, the investigative measures implemented during the preliminary stage of criminal proceedings, with a view to collecting evidence, and which affect the private sphere of natural persons, are subject, in principle, to the prior authorisation of a court.

14 Those investigative measures include, inter alia, the examination of the person, as provided for in Article 158 of the NPK. The purpose of that examination is, in essence, to establish the physical characteristics of the person and may include, if necessary, the taking of photographs and fingerprints as well as samples for the purpose of establishing a DNA profile. The examination shall take place with the consent of the person. If he or she does not consent, a compulsory examination shall be carried out, subject to the prior authorisation of a court, except in urgent cases, in which case a subsequent application for judicial approval must be made.

15 In that case, the case file in the criminal proceedings is submitted to the court having jurisdiction, which may examine all of the material in the file in order to assess whether the request for prior authorisation or subsequent approval is justified.

The ZMVR

16 Pursuant to Article 6 of the zakon sa Ministerstvo na vatreshnite raboti (Law on the Ministry of the Interior) (DV No 53 of 27 June 2014), in the version applicable to the case in the main proceedings (‘the ZMVR’), the Ministry of the Interior is to carry out a number of main activities, including operational research and surveillance activity, investigative activities relating to offences and intelligence activity.

17 Under Article 27 of the ZMVR, data recorded by the police pursuant to Article 68 of that law are to be used only in connection with safeguarding national security, combating crime and maintaining law and order.

18 Article 68 of the ZMVR is worded as follows:

‘1. The police authorities shall create a police record of persons who are accused of an intentional criminal offence subject to public prosecution. …

2. The creation of the police record is a form of processing of personal data of the persons referred to in paragraph 1, which shall be carried out in accordance with the requirements of this Law.

3. For the purposes of creating a police record, the police authorities shall:

(1) collect the personal data set out in Article 18 of the [zakon za balgaskite lichni dokumenti (Law on Bulgarian identity documents)];

(2) take a person’s fingerprints and photograph him or her;

(3) take samples to create a person’s DNA profile.

4. The consent of the person is not required to carry out the activities referred to in paragraph 3(1).

5. Persons shall be obliged to cooperate and not to hinder or obstruct the police authorities in carrying out the activities referred to in paragraph 3. In the event of a person’s refusal, the activities referred to in paragraph 3(2) and (3) shall be carried out by compulsion subject to authorisation from the judge of the court of first instance having jurisdiction over the offence subject to public prosecution of which the person has been accused.

…’

The NRISPR

19 The naredba za reda za izvarshvane i snemane na politseyska registratsia (Regulation laying down detailed rules for the implementation of police records) (DV No 90 of 31 October 2014), in the version applicable to the main proceedings (‘the NRISPR’), defines detailed rules for implementation of the police records provided for in Article 68 of the ZMVR.

20 Under Article 11(2) of the NRISPR, the person in respect of whom a police record must be created is to be given a declaration to be completed, in which he or she may express agreement or disagreement regarding the measures for the taking of photographs, fingerprints and DNA samples. Under Article 11(4) of the NRISPR, in the event of disagreement on the part of that person, the police are to submit an application to the court having jurisdiction in order for enforcement of those measures to be authorised.

The dispute in the main proceedings and the questions referred for a preliminary ruling

21 By order of 1 March 2021, V.S. was accused, on the basis of Article 255 and Article 321(2) and (3) of the NK, of participating, with three other persons, in a criminal organisation, formed with the aim of enrichment, in the context of the activities of two commercial companies, with a view to committing, in concert, offences of evasion of the setting and payment of tax obligations relating to value added tax on Bulgarian territory.

22 Following service of that order accusing her, V.S. was requested by the police authorities, the competent authorities within the meaning of Article 3(7) of Directive 2016/680, to cooperate in the creation of the police record provided for in Article 68 of the ZMVR. She was provided with a declaration form in which she stated that she had been informed of the existence of a statutory basis for the creation of that police record and that she refused to consent to the collection of the dactyloscopic and photographic data concerning her in order for them to be entered in the record and to the taking of a sample for the purpose of creating her DNA profile. Those police authorities did not collect the data and brought the matter before the Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria) seeking enforcement of that collection.

23 The application by the police authorities to that court stated that sufficient evidence of the guilt of the persons prosecuted in the criminal proceedings concerned, including of V.S., had been gathered. It was explained in the application that V.S. had been formally accused of an offence referred to in Article 321(3)(2) of the NK, read in conjunction with Article 321(2) thereof, and that she had refused to consent to the collection of dactyloscopic and photographic data concerning her in order for them to be entered in the record and to the taking of a sample for the purpose of creating her DNA profile; the legal basis for the collection of those data was cited. Finally, that court was requested in that application to authorise enforcement of collection of the data. Only copies of the order accusing V.S. and of the declaration that she had made were annexed to that application.

24 Since it had doubts as to the compatibility with EU law of the police record procedure, the Spetsializiran nakazatelen sad (Specialised Criminal Court) made a request for a preliminary ruling to the Court of Justice by decision of 31 March 2021.

25 More specifically, by its third question, that court asked, in essence, whether Article 6(a) of Directive 2016/680 and Articles 47 and 48 of the Charter of Fundamental Rights of the European Union (‘the Charter’) should be interpreted as precluding national legislation which provides that, in the event of a refusal by the person accused of an intentional offence subject to public prosecution to cooperate voluntarily in the collection of biometric and genetic data concerning him or her in order for them to be entered in a record, the criminal court having jurisdiction must authorise enforcement of their collection, without having the power to assess whether there are serious grounds for believing that the person concerned has committed the offence for which he or she is accused (judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) , C‑205/21, EU:C:2023:49, paragraph 77; ‘the judgment in Case C‑205/21’).

26 Furthermore, the fourth question sought to establish, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, should be interpreted as precluding national legislation which provides for the systematic collection of the biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority to determine and to demonstrate, first, that their collection is necessary for achieving the specific objectives pursued and, second, that those objectives cannot be achieved by collecting only a part of the data concerned (judgment in Case C‑205/21, paragraph 114).

27 Following a legislative amendment which entered into force on 27 July 2022, the Spetsializiran nakazatelen sad (Specialised Criminal Court) was dissolved and the case in the main proceedings was transferred from that date to the Sofiyski gradski sad (Sofia City Court, Bulgaria), which is the referring court.

28 In the judgment in Case C‑205/21 (paragraph 110 and point 2 of the operative part), in answer to the third question, the Court held that Article 6(a) of Directive 2016/680 and Articles 47 and 48 of the Charter must be interpreted as not precluding national legislation which provides that, if the person accused of an intentional offence subject to public prosecution refuses to cooperate voluntarily in the collection of the biometric and genetic data concerning him or her in order for them to be entered in a record, the criminal court having jurisdiction must authorise a measure enforcing their collection, without having the power to assess whether there are serious grounds for believing that the person concerned has committed the offence of which he or she is accused, provided that national law subsequently guarantees effective judicial review of the conditions for that accusation, from which the authorisation to collect those data arises.

29 In answering the fourth question, the Court held that national legislation which provides for the systematic collection of the biometric and genetic data of any person accused of an intentional offence subject to public prosecution is, in principle, contrary to the requirement laid down in Article 10 of Directive 2016/680, according to which the processing of the special categories of data referred to in that article is to be allowed ‘only where strictly necessary’ (judgment in Case C‑205/21, paragraph 128).

30 As regards the conclusions that the referring court must draw from that finding, the Court stated, in paragraph 133 of that judgment, that it was for the referring court to verify whether, in order to ensure the effectiveness of Article 10 of Directive 2016/680, it is possible to interpret the national legislation providing for the enforcement in question in a manner consistent with EU law. In particular, it was for the referring court to verify whether national law enables it to be assessed whether it is ‘strictly necessary’ to collect both the biometric data and the genetic data of the data subject in order for them to be entered in a record. For that purpose, it should, inter alia, be possible to verify whether the nature and gravity of the offence of which the data subject in the main proceedings is suspected or whether other relevant factors may constitute circumstances capable of establishing that the collection is ‘strictly necessary’. In addition, it should be checked whether the collection of civil status data, which is also provided for in the context of the creation of a police record, does not, in itself, enable the objectives pursued to be met.

31 In paragraph 134 of that judgment, the Court held that, if national law does not guarantee such review of the measure whereby biometric and genetic data are collected, it was for the referring court to ensure that Article 10 of Directive 2016/680 is given full effect by dismissing the police authorities’ application requesting it to authorise enforcement of their collection.

32 Thus, in the light of all the grounds set out in paragraphs 116 to 134 of the judgment in Case C‑205/21, the Court ruled, in answer to the fourth question, that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) thereof, must be interpreted as precluding national legislation which provides for the systematic collection of the biometric and genetic data of any person accused of an intentional offence subject to public prosecution, in order for them to be entered in a record, without laying down an obligation on the competent authority to verify whether and demonstrate that, first, their collection is strictly necessary for achieving the specific objectives pursued and, second, those objectives cannot be achieved by measures constituting a less serious interference with the rights and freedoms of the person concerned (judgment in Case C‑205/21, paragraph 135 and point 3 of the operative part).

33 Following the delivery of that judgment, the referring court asks what conclusions it must draw from the Court’s answer to the fourth question, in particular in the light of the findings set out in paragraph 30 of the present judgment, in order to rule on the police authorities’ application seeking enforcement of the collection of the personal data at issue in the main proceedings.

34 In that regard, first, it takes the view that it cannot carry out the checks referred to in that paragraph on the basis of the documents submitted to it by those authorities, namely the order accusing V.S. and the declaration form by which V.S. refuses collection of her biometric and genetic data, referred to in paragraph 23 of the present judgment. It considers that, in order to do so, it should have at its disposal the full case file, which presupposes that it is applying not the special rule laid down, in the context of the procedure for the creation of a police record, by the second sentence of Article 68(5) of the ZMVR, but rather the general rules of the NPK applicable to the issue of prior judicial authorisation to carry out investigative measures affecting the private sphere of natural persons, and in particular Article 158 of that code.

35 Second, the referring court notes that, in paragraphs 100 and 101 of the judgment in Case C‑205/21, the Court held that it was not contrary to Article 47 of the Charter for a court hearing an application for authorisation of enforcement of the collection of biometric and genetic data of an accused person not to have access to the material in the file leading to that accusation and therefore to be unable to assess the evidence.

36 However, it considers that that finding is based on the incorrect premiss that the court’s assessment of the evidence justifying the accusation, during the preliminary stage of the criminal procedure, could impede the conduct of the criminal investigation in the course of which those data are being collected.

37 In particular, the referring court points out that, in the context of the procedure governed by Article 158 of the NPK, the Bulgarian legislature provided for the exercise of effective judicial review and for the case file to be sent to the court, but that that is not the case in the context of the creation of a police record. In its view, the reasons for that difference in legal rules are, first, that the collection of data in the context of the creation of that record is requested by the police and not by the public prosecutor’s office and, second, that that collection takes place only with a view to the data at issue being used in the future, should the need arise. By contrast, the purpose of the absence of such effective judicial review in such a situation is neither to comply with investigative confidentiality nor to prevent future investigative measures in the context of the criminal procedure in question.

38 In those circumstances, the referring court considers that, before requiring the competent authorities to submit the case file in the criminal proceedings, it must obtain from the Court confirmation that such a requirement does not contradict paragraphs 100 and 101 of the judgment in Case C‑205/21 or, on the contrary, a statement that the checks referred to in paragraph 133 of that judgment must be carried out solely on the basis of the order accusing the person concerned and the declaration refusing that her biometric and genetic data be collected.

39 Furthermore, in the event that the Court were to provide such a confirmation, the referring court considers that, since it would have available to it the file relating to the criminal procedure, it should assess the merits of that accusation.

40 In those circumstances, the Sofiyski gradski sad (Sofia City Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1) Is the requirement of assessing “strict necessity” under Article 10 of Directive 2016/680, as interpreted by the Court of Justice in paragraph 133 of [the judgment in Case C‑205/21], satisfied if it is carried out solely on the basis of the decision accusing the person and on the basis of her written refusal to have her biometric and genetic data collected, or is it necessary for the court to have before it all the material in the file which, under national law, is made available to it in the event of an application for authorisation to carry out investigative measures which infringe the legal sphere of natural persons, where that application is made in a criminal case?

(2) If the Court of Justice answers the first question in the affirmative – after having been provided with the case file, may the court in the context of the assessment of “strict necessity” pursuant to Article 10 in conjunction with Article 6(a) of Directive 2016/680 also consider whether there are reasonable grounds to suspect that the accused has committed the criminal offence referred to in the accusation?’

Admissibility of the request for a preliminary ruling

41 The European Commission submits that the request for a preliminary ruling is inadmissible. In that regard, it considers that, in the judgment in Case C‑205/21, the Court gave the referring court the interpretation of EU law on which the outcome of the dispute before it depends. Furthermore, it submits that the questions referred for a preliminary ruling are based on a misunderstanding of that judgment. First, in paragraph 133 of that judgment, the Court did not rule on the review which the national court must carry out before authorising a measure collecting biometric and genetic data and therefore did not require the referring court to carry out a specific check in connection with that collection. Secondly, the referring court is wrong to infer from paragraphs 100 and 101 of the judgment in Case C‑205/21 that the Court considered that the limited judicial review provided for in Article 68(5) of the ZMVR was compatible with EU law and therefore to conclude that there was a contradiction between those paragraphs and paragraph 133 of that judgment.

42 In the first place, according to settled case-law of the Court, in the context of the cooperation between the Court and the national courts provided for in Article 267 TFEU, it is solely for the national court before which a dispute has been brought, and which must assume responsibility for the subsequent judicial decision, to determine in the light of the particular circumstances of the case both the need for a preliminary ruling in order to enable it to deliver judgment and the relevance of the questions which it submits to the Court. Consequently, where the questions submitted concern the interpretation of EU law, the Court is, in principle, bound to give a ruling (judgment of 6 November 2018, Bauer and Willmeroth , C‑569/16 and C‑570/16, EU:C:2018:871, paragraph 23 and the case-law cited).

43 The Court may therefore refuse to rule on a question referred by a national court only where it is quite obvious that the interpretation of EU law that is sought is unrelated to the actual facts of the main action or its object, or where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (judgment of 6 November 2018, Bauer and Willmeroth , C‑569/16 and C‑570/16, EU:C:2018:871, paragraph 24 and the case-law cited).

44 In the second place, it should also be noted at the outset that the authority of a preliminary ruling does not preclude the national court or tribunal to which it is addressed from taking the view that it is necessary to make a further reference to the Court before giving judgment in the main proceedings. Such a procedure may be justified, in particular, when the national court or tribunal encounters difficulties in understanding or applying the judgment, when it refers a fresh question of law to the Court, or again when it submits new considerations which might lead the Court to give a different answer to a question submitted earlier (see, to that effect, judgments of 6 March 2003, Kaba , C‑466/00, EU:C:2003:127, paragraph 39 and the case-law cited, and of 9 March 2023, Pro Rauchfrei II , C‑356/22, EU:C:2023:174, paragraph 16 and the case-law cited).

45 In the present case, by its questions, the referring court seeks clarification from the Court of Justice concerning the requirement for judicial review of the ‘strict necessity’ for the collection of biometric and genetic data, for the purposes of Article 10 of Directive 2016/680, which, in its view, was set out in paragraph 133 of the judgment in Case C‑205/21, in order to rule on the application of the Bulgarian police authorities for the enforcement of the collection of such categories of data, which is precisely the reason for the questions referred for a preliminary ruling which the Court answered in that judgment. It follows that the questions referred relate directly to the dispute in the main proceedings and are relevant in order to enable the referring court to resolve that dispute.

46 The Commission’s argument relating to the alleged misinterpretation by the referring court of paragraphs 100, 101 and 133 of the judgment in Case C‑205/21 concerns, in actual fact, the substance of the questions referred and cannot therefore, by its nature, lead to the inadmissibility of those questions (see, to that effect, judgment of 27 October 2022, Proximus (Public electronic directories) , C‑129/21, EU:C:2022:833, paragraph 59 and the case-law cited).

47 It follows from the foregoing that the request for a preliminary ruling is admissible.

Consideration of the questions referred

The first question

48 According to settled case-law, in the procedure laid down by Article 267 TFEU providing for cooperation between national courts and the Court of Justice, it is for the latter to provide the national court with an answer which will be of use to it and enable it to decide the case before it. To that end, the Court of Justice should, where necessary, reformulate the questions referred to it. The Court may also find it necessary to consider provisions of EU law which the national court has not referred to in its questions (judgment of 30 January 2024, Direktor na Glavna direktsia ‘Natsionalna politsia’ pri MVR – Sofia , C‑118/22, EU:C:2024:97, paragraph 31 and the case-law cited).

49 In the present case, as is apparent from paragraphs 29 to 32 of the present judgment, in paragraphs 116 to 135 of the judgment in Case C‑205/21, the Court examined the question whether EU law precludes national legislation which does not impose an obligation on the competent authorities to verify and demonstrate whether it is ‘strictly necessary’ to collect both the biometric data and the genetic data of the data subject in order for them to be entered in a record.

50 In that regard, it should be recalled that Article 3(7) of Directive 2016/680 defines the concept of ‘competent authority’, which covers the police authorities in question in the main proceedings, as any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and any other body or entity entrusted by Member State law to exercise public authority and public powers for such purposes.

51 Furthermore, given that, in paragraph 135 and point 3 of the operative part of the judgment in Case C‑205/21, the Court referred, as regards the answer to the fourth question in the case giving rise to that judgment, to the interpretation of Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, it must be held that the present question also covers all of those provisions.

52 Therefore, it must be held that, by its first question, the referring court asks, in essence, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, must be interpreted as meaning that, where national legislation provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the part of the competent authority, within the meaning of Article 3(7) of that directive, to verify whether and demonstrate that their collection is strictly necessary, in accordance with Article 10 of that directive, compliance with such an obligation may be ensured by the court seised by that competent authority for the purpose of the enforcement of that collection, as the case may be by requiring that the case file in the criminal procedure be disclosed.

53 It must be noted that Article 10 of Directive 2016/680 constitutes a specific provision governing the processing of special categories of personal data, including biometric and genetic data. The purpose of that article is to ensure enhanced protection of the data subject, since the data in question, because of their particular sensitivity and the context in which they are processed, are liable, as is apparent from recital 37 of that directive, to create significant risks to fundamental rights and freedoms, such as the right to respect for private life and the right to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter (judgments in Case C‑205/21, paragraph 116, and of 30 January 2024, Direktor na Glavna direktsia ‘Natsionalna politsia’ pri MVR – Sofia , C‑118/22, EU:C:2024:97, paragraph 47).

54 To that end, as follows from the very wording of Article 10 of that directive, the requirement that the processing of such data be allowed ‘only where strictly necessary’ [(‘uniquement en cas de nécessité absolue’ in the French-language version)] must be interpreted as establishing strengthened conditions for lawful processing of such data, compared with those which follow from Article 4(1)(b) and (c), as well as Article 8(1), of Directive 2016/680, and refer only to the ‘necessity’ of data processing that falls generally within that directive’s scope (see, to that effect, judgments in C‑205/21, paragraph 117, and of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone) , C‑548/21, EU:C:2024:830, paragraph 107).

55 Thus, in the judgment in Case C‑205/21, the Court held that national legislation which provides for the systematic collection of the biometric and genetic data of any person accused of an intentional offence subject to public prosecution, without laying down an obligation on the competent authority to verify whether and demonstrate that their collection is strictly necessary for achieving the specific objectives pursued, in accordance with Article 10 of Directive 2016/680, is, in principle, contrary to Article 10, since such legislation is liable to lead, in an indiscriminate and generalised manner, to collection of the biometric and genetic data of most accused persons (see, to that effect, judgment in Case C‑205/21, paragraphs 128, 129 and 135).

56 In that context, the Court stated, however, in paragraph 133 of the judgment in Case C‑205/21, that it was for the referring court to verify, inter alia, whether, in order to ensure the effectiveness of Article 10 of Directive 2016/680, it is possible to interpret national law in a manner consistent with EU law. Therefore, in so doing, the Court asked that court to determine whether national law allows the competent authorities, within the meaning of Article 3(7) of that directive, to assess whether it is ‘strictly necessary’ to collect both the biometric data and the genetic data of the data subject in order for them to be entered in a record. Thus, the Court intended to remind that court that the primacy principle required it, inter alia, to interpret, to the greatest extent possible, its national law in conformity with EU law (see, to that effect, judgment of 27 April 2023, M.D. (Ban on entering Hungary) , C‑528/21, EU:C:2023:341, paragraph 99 and the case-law cited). Consequently, that paragraph merely indicated to that court that it had to verify whether national law could be interpreted as meaning that the authorities competent to carry out that data processing were in a position to carry out the assessment required of them under Article 10.

57 It follows that, as the Advocate General pointed out, in particular, in points 24 and 55 of his Opinion, contrary to the premiss on which the referring court’s questions are based, in the absence of an obligation on the competent authority, under national law, to assess whether the processing which it has carried out or which it intends to carry out is ‘strictly necessary’, a court asked to rule on such processing of personal data by that competent authority cannot ensure, in place of that authority, compliance with that authority’s obligation under Article 10.

58 Thus, it must be held that the interpretation of national law by which the referring court intends to assess itself whether the collection of the biometric and genetic data of the person concerned is ‘strictly necessary’ is not such as to ensure that national legislation such as that referred to in paragraph 57 of the present judgment complies with EU law, since it does not, in any event, compensate for the absence of an obligation on the competent authorities, under that legislation, to verify and demonstrate that such collection is ‘strictly necessary’.

59 That conclusion is, moreover, supported by the fact that the request for a preliminary ruling concerns, as is apparent from paragraphs 18, 20, 22 and 23 of the present judgment, national legislation which provides that the collection of the biometric and genetic data of persons accused of an intentional offence subject to public prosecution is to be enforced, at the request of the competent authorities, by the court having jurisdiction, where the person concerned does not consent to such collection. By contrast, as the Bulgarian Government confirmed at the hearing in response to a question from the Court, where the data subject has consented to it, such a judicial authorisation is not required, so that the competent authorities may carry out that collection solely on the basis of that consent.

60 Consequently, in such a situation, the court having jurisdiction is not able, by definition, to ensure the legal protection of data subjects who have expressed such consent, in particular as regards the review of compliance, by the competent authorities, with the requirement of strict necessity, as interpreted by the case-law referred to in paragraphs 53 to 55 of the present judgment.

61 It follows from all the foregoing that the answer to the first question is that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, must be interpreted as meaning that, where national legislation provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority, within the meaning of Article 3(7) of that directive, to verify whether and demonstrate that their collection is strictly necessary, in accordance with Article 10 of that directive, compliance with such an obligation cannot be ensured by the court seised by that competent authority for the purpose of the enforcement of that collection, because it is for that competent authority to carry out the assessment required under Article 10.

The second question

62 Having regard to the answer given to the first question, there is no need to answer the second question.

Costs

63 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Fifth Chamber) hereby rules:

Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive,

must be interpreted as meaning that where national legislation provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority, within the meaning of Article 3(7) of that directive, to verify whether and demonstrate that their collection is strictly necessary, in accordance with Article 10 of that directive, compliance with such an obligation cannot be ensured by the court seised by that competent authority for the purpose of the enforcement of that collection, because it is for that competent authority to carry out the assessment required under Article 10.

[Signatures]

* Language of the case: Bulgarian.