CJEU - C-205/21 - Ministerstvo na vatreshnite raboti

Summary

The Court of Justice of the European Union (CJEU) ruled in case C-205/21 that member states must clarify which legal instrument applies when both GDPR and the EU Directive 2016/680 are relevant for processing genetic and biometric data for law enforcement. This case involved Bulgarian police seeking to collect DNA, photographs, and fingerprints from a suspect.

Full text

Help CJEU - C-205/21 - Ministerstvo na vatreshnite raboti: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 08:01, 5 June 2023 view sourceLs (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators386 editsTag: Visual edit← Older edit Latest revision as of 12:21, 24 July 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators512 editsm Tag: Visual edit Line 32: Line 32: |GDPR_Article_Link_3=|GDPR_Article_Link_3= |EU_Law_Name_1=Article 10 Directive 2016/680|EU_Law_Name_1=Article 10 Law Enforcement Directive 2016/680 |EU_Law_Link_1=|EU_Law_Link_1=http://data.europa.eu/eli/dir/2016/680/oj |EU_Law_Name_2=Article 4(1) Directive (EU) 2016/680|EU_Law_Name_2=Article 4(1) Law Enforcement Directive 2016/680 |EU_Law_Link_2=|EU_Law_Link_2=http://data.europa.eu/eli/dir/2016/680/oj |EU_Law_Name_3=Article 52 Directive 2016/680|EU_Law_Name_3=Article 52 Law Enforcement Directive 2016/680 |EU_Law_Link_3=|EU_Law_Link_3=http://data.europa.eu/eli/dir/2016/680/oj |EU_Law_Name_4=Article 6(a) Directive 2016/680|EU_Law_Name_4=Article 6(a) Law Enforcement Directive 2016/680 |EU_Law_Link_4=|EU_Law_Link_4=http://data.europa.eu/eli/dir/2016/680/oj |EU_Law_Name_5=Article 63 Directive 2016/680|EU_Law_Name_5=Article 63 Law Enforcement Directive 2016/680 |EU_Law_Link_5=|EU_Law_Link_5=http://data.europa.eu/eli/dir/2016/680/oj |EU_Law_Name_6=Article 8 Directive 2016/680|EU_Law_Name_6=Article 8 Law Enforcement Directive 2016/680 |EU_Law_Link_6=|EU_Law_Link_6=http://data.europa.eu/eli/dir/2016/680/oj |EU_Law_Name_7=Article 9 Directive 2016/680|EU_Law_Name_7=Article 9 Law Enforcement Directive 2016/680 |EU_Law_Link_7=|EU_Law_Link_7=http://data.europa.eu/eli/dir/2016/680/oj |EU_Law_Name_8=|EU_Law_Name_8= |EU_Law_Link_8=|EU_Law_Link_8= Latest revision as of 12:21, 24 July 2026 CJEU - C-205/21 Court: CJEU Jurisdiction: European Union Relevant Law: Article 9 GDPR Article 10 Law Enforcement Directive 2016/680Article 4(1) Law Enforcement Directive 2016/680Article 52 Law Enforcement Directive 2016/680Article 6(a) Law Enforcement Directive 2016/680Article 63 Law Enforcement Directive 2016/680Article 8 Law Enforcement Directive 2016/680Article 9 Law Enforcement Directive 2016/680Nakazatelen kodeks (Bulgarian Criminal Code)Nakazatelno-protsesualen kodeks (Code of Criminal Procedure)zakon sa Ministerstvo na vatreshnite raboti (Law on the Ministry of the Interior)zakon za zashtita na lichnite danni (Law on the protection of personal data) Decided: 26.01.2023 Parties: Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria) Case Number/Name: C-205/21 European Case Law Identifier: ECLI:EU:C:2023:49 Reference from: Language: 24 EU Languages Original Source: Initial Contributor: xameliaa.a The CJEU ruled that member states had to provide clarity on the matter which legal instrument was applicable, in a situation where both the GDPR and EU Directive 2016/680 applied to the processing of genetic and biometric data for law enforcement purposes. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A data subject was accused of a criminal offence and refused to consent to the collection of her genetic and biometric data (Photographs and fingerprints), which the Bulgarian Police required to create a record. The data subject also refused to let the police take a sample for the purpose of creating a DNA profile. In the end, the police did not collect this data. The police went to a Bulgarian Criminal court (Spetsializiran nakazatelen sad), which was also the referring court in this case. Here, the police asked the court to authorise the forced collection of the genetic and biometric data, considering there was enough evidence to convict the data subject of the crime. The police position was mostly based on Bulgatian law (ZMVR, Law of the ministry of Home affairs) authorising the collection of biometric and genetic data for, among the others, law and order purposes. However, the referring court had doubts whether the such law was actually compliant with EU law. This Bulgarian law did refer to Article 9 GDPR, but did not refer to EU directive 2016/680. The latter is an EU directive which concerns the protection of personal data regarding processing of competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. This directive states that the processing of certain special category data, including genetic and biometric data, can be lawful if this is compliant with EU law or national law. The Bulgarian law had even taken over some of the wording from Article 10(a) of this directive for its national provision. The court determined that there were two problems resulting from the fact that this national law contained a reference to the GDPR, but did not mention the aforementioned directive. The first problem was the fact that the GDPR was not applicable to the processing of personal data with regard to criminal investigations, pursuant to Article 2(2)(d) GDPR. The second problem was the fact that Article 9 GDPR prohibited the processing of genetic and biometric data. The court also reiterated that a law enforcement purpose could not fall under one of the exceptions under Article 9(2) GDPR. The referring court referred several questions to the CJEU. The main issue was to know whether the processing of genetic and biometric data for purposes of criminal investigations in this case was permissible under the national law, despite the mention of Article 9 GDPR, and despite the fact that EU directive 2016/680 was not mentioned in the national law. Holding First, The CJEU determined that both Article 9 GDPR and Article 10 of the directive contain provisions regarding the processing of special categories of personal data, including biometric en genetic data. Second, The CJEU determined that processing of biometric and genetic data by the police authorities could be permissible, as long as this processing fell under Article 10(a) of the directive. This meant that the processing had to be strictly necessary, with adequate safeguards and was provided for in national / EU law, pursuant to Article 52 CFR. However, it could still be unlawful to process this data, when this processing also fell within the scope of the GDPR. Third, The court stated that the requirement of ''authorised by Union or Member State' law' in Article 10a of the directive must be interpreted pursuant to Article 52(1) CFR, which states that any limitation on the exercise of a fundamental right "must be ‘provided for by law". The legal basis which is used for this limitation (in this case, the legal basis was the Bulgarian law), must define the scope of the limitation sufficiently clearly and precisely. This meant that there should not be any uncertainty about the laws concerning - or the conditions of the processing of genetic and biometric data. However, The CJEU also noted that these conditions of processing could vary between the GDPR and the directive. In this context, The CJEU determined that the member states were free to organise their processing operations under either the GDPR or the aforementioned directive. However, member states would have to make sure that there would be no uncertainty about the fact which law would be applicable to different kinds of processing of biometric/genetic data. Fourth, The court also determined that member states were not obligated to cite the directive in the national law itself when they were transposing this directive into national law. It was therefore not necessary for the Bulgarian legislature to mention directive 2016/680 in its transposed national provisions. Fifth, the CJEU noted that national courts had the obligation to explain the national law. For this exp

Entities