Provisional text

OPINION OF ADVOCATE GENERAL

RICHARD DE LA TOUR

delivered on 13 June 2024 (1)

Case C‑80/23

Criminal proceedings

against

V.S.,

interested party:

Ministerstvo na vatreshnite raboti, Glavna direktsia za borba s organiziranata prestapnost

(Request for a preliminary ruling from the Sofiyski gradski sad (Sofia City Court, Bulgaria))

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Accused person – Police record containing personal data – Sensitive data – Biometric and genetic data – Enforcement – Objectives of prevention and detection of criminal offences – Conclusion of an ongoing investigation – Comparison with personal data collected in the context of other investigations – Judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C‑205/21, EU:C:2023:49) – Interpretation of the Court’s judgment – Obligation to interpret national law in conformity with EU law – Article 10 – Article 6(a) – Assessment of whether it is ‘strictly necessary’ for the competent authorities to process sensitive data – Conditions – Review)

I.      Introduction

1.        Cross-jurisdictional dialogue does not always end after the first exchange between the stakeholders concerned. A longer conversation between the Court of Justice and the national court is possible if the latter takes the view, after acquainting itself with the Court’s judgment giving a preliminary ruling, that certain information which it considers to be essential in order to decide the case before it is still lacking. That is so in the present case.

2.        This request for a preliminary ruling made by the Sofiyski gradski sad (Sofia City Court, Bulgaria) concerns Article 6(a) and Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, (2) as interpreted by the Court of Justice in the judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police). (3)

3.        It is the second request that the referring court has made to the Court of Justice in connection with the same dispute in the main proceedings. (4) The dispute relates to a claim made by the Bulgarian police authorities requesting enforcement of the collection of photographic, dactyloscopic and genetic data (5) concerning V.S. in order for them to be entered in a record. After being accused of an intentional offence subject to public prosecution, V.S. was requested to cooperate in the creation of that record, which she refused to consent to. The police authorities therefore requested that the referring court order the mandatory creation of the police record.

4.        The application by the police authorities to the referring court stated that sufficient evidence of V.S.’s guilt had been gathered. It was explained in the application that V.S. had been formally accused of an intentional offence subject to public prosecution and that she had refused to consent to the collection of her data. Only copies of the decision designating V.S. as an accused person and of the declaration in which she refused to give her consent to the creation of the police record were annexed to the application. In the light of that evidence alone, the referring court should have ordered, in accordance with national law, the mandatory creation of a police record of V.S.

5.        However, at the time of examining the application, the referring court had doubts as regards the compatibility of such a situation with the requirements of Directive 2016/680 in respect, in particular, of the collection and processing of sensitive data. The Court of Justice responded to the referring court’s queries in the judgment in Case C‑205/21.

6.        By referring two new questions to the Court of Justice for a preliminary ruling, the referring court explains that it has still not been able to establish whether it could, without infringing EU law, order such a creation.

7.        Those questions invite the Court, first, to explain its ruling in the judgment in Case C‑205/21 as regards the requirement, set out in Article 10 of Directive 2016/680, (6) that the processing of special categories of personal data, which are regarded as sensitive, be ‘strictly necessary’ and, second, to clarify what is expected of the referring court for the purpose of remedying the incompatibility of Bulgarian legislation on police records with that directive.

II.    Legal context

8.        So far as concerns the legal context, I refer to paragraphs 3 to 34 of the judgment in  Case C‑205/21.

III. The facts in the main proceedings and the questions referred for a preliminary ruling

9.        The referring court states that it took note of that judgment on 26 January 2023. It considers, however, that certain circumstances have not been sufficiently clarified, which means that it is unable to determine whether or not it must grant authorisation for the collection of V.S.’s biometric and genetic data.

10.      First, the referring court considers that, for the purpose of ruling on the application for authorisation of enforcement submitted to it by the police authorities, it cannot carry out the verifications set out in paragraph 133 of the judgment in Case C‑205/21, since it does not have available to it the documents necessary to do so. Bulgarian law provides that the court is to rule only on the basis of the application – (7) which refers to the ongoing criminal proceedings against V.S., states that there is sufficient evidence of her guilt, and confirms that a formal accusation has been made against her – to which the decision designating her as an accused person and her written refusal to cooperate in the creation of a police record are annexed. It does not require that the other documents contained in the file be provided to the referring court.

11.      The referring court states that an interpretation of its national law in conformity with EU law is possible if, instead of applying the special rule of Article 68 of the ZMVR, it applies the general rules of the Nakazatelno-protsesualen kodeks (Code of Criminal Procedure; ‘the NPK’), in particular Article 158 thereof. (8) It could thus have full access to the file. Investigative measures adopted in the course of the pre-trial stage of the criminal proceedings (9) that lead to a violation of the privacy of natural persons, such as the collection of connection data or the physical search of a person, are carried out by the investigating authorities after prior authorisation by a court. The case file is then submitted to the court, which may thus examine all of the material in the file in order to assess whether the request for prior authorisation is justified. (10) The referring court identifies the reasons for the difference in legal regime as follows: (i) the request for the collection of biometric and genetic data is made by a police authority and not by the public prosecutor’s office; and (ii) the data are collected for possible future use only, should the need ever arise.

12.      The referring court further states that submission of the case file for the purposes of the grant of prior authorisation is not considered, under Bulgarian law, as being capable of impeding the conduct of the criminal investigation. The justification for not submitting the case file to the court with which an application for the mandatory creation of a police record has been filed cannot therefore be inferred from the ground set out in paragraph 100 of the judgment in Case C‑205/21, namely the risk that it might impede the proper conduct of the criminal investigation.

13.      Although it is apparent from that judgment that it is consistent with Article 47 of the Charter of Fundamental Rights of the European Union (11) for the file not to be transmitted to the court with which the application for the mandatory creation of a police record has been filed, the referring court asks how it can carry out the verifications necessary in accordance with paragraphs 132 and 133 of that judgment in order to assess whether the processing of V.S.’s biometric and genetic data is ‘strictly necessary’, within the meaning of Article 10 of Directive 2016/680, and whether the nature and gravity of the offence of which she is suspected in the criminal proceedings or other relevant factors, such as the particular circumstances of the offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of V.S., may constitute circumstances capable of establishing such a necessity.

14.      Thus, the referring court asks whether Article 10 of Directive 2016/680 must be interpreted as meaning that the review of whether collection is ‘strictly necessary’ may be carried out without the court having access to the entire case file or whether, conversely, that review requires the court to have access to the entire case file, even though the Court of Justice seems to have found that it is lawful for the court not to have access to the file. (12)

15.      Second, in the event that Directive 2016/680 were to require the submission of the entire case file, the referring court considers that it should review the merits of the accusation. Such a review is required in so far as it is apparent from paragraphs 130 and 131 of the judgment in Case C‑205/21 that the mere fact that a person has been accused is not sufficient to establish that the collection is ‘strictly necessary’ and that there must be serious grounds for believing that the person in question has committed the criminal offence.

16.      The referring court reaches the conclusion that it must be able to assess whether the accusation is sufficiently supported by evidence also due to the fact that (i) Article 6(a) of Directive 2016/680 establishes such a requirement; (ii) that assessment should, in any event, be carried out in procedures pursuant to Article 158 of the NPK, which come closest to the procedure under Article 68(5) of the ZMVR; (iii) the possibility of such an assessment being carried out at a later stage does not rule out the possibility that, at the time of the judicial authorisation of the mandatory collection of the biometric and genetic data, insufficient evidence had been collected to support the accusation; (iv) the purpose of Directive 2016/680 is to establish a mechanism to prevent personal data, in particular biometric and genetic data, from being collected without a legal basis for doing so, which should be subject to immediate verifications; and (v) at least part of the verifications required pursuant to paragraphs 132 and 133 of the judgment in Case C‑205/21 involve precisely an assessment of the evidence collected, since it follows from those paragraphs that the nature and gravity of the offence and the circumstances of its commission must be assessed. In order to assess those circumstances, it is necessary to establish that there are serious grounds for believing that the person concerned has committed the criminal offence; that assessment requires that sufficient evidence has already been gathered.

17.      The assessment of whether the collection is ‘strictly necessary’ thus involves an assessment of the evidence on which the accusation is based and of whether there are serious grounds for believing that the person concerned has committed a criminal offence.

18.      The referring court is uncertain whether, once it has access to the case file, it will be required to carry out a full review of the lawfulness of the compulsory collection, including the merits of the accusation, or whether it should confine itself to a verification of other, unrelated circumstances, referred to in paragraphs 132 and 133 of the judgment in Case C‑205/21 (such as the criminal record or profile of the accused person).

19.      In those circumstances, the Sofiyski gradski sad (Sofia City Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1)      Is the requirement of assessing “strict necessity” under Article 10 of Directive 2016/680, as interpreted by the Court of Justice in paragraph 133 of [the judgment in Case C‑205/21], satisfied if it is carried out solely on the basis of the decision accusing the person and on the basis of her written refusal to have her biometric and genetic data collected, or is it necessary for the court to have before it all the material in the file which, under national law, is made available to it in the event of an application for authorisation to carry out investigative measures which infringe the legal sphere of natural persons, where that application is made in a criminal case?

(2)      If the Court of Justice answers the first question in the affirmative – after having been provided with the case file, may the court in the context of the assessment of “strict necessity” pursuant to Article 10 in conjunction with Article 6(a) of Directive 2016/680 also consider whether there are reasonable grounds to suspect that the accused has committed the criminal offence referred to in the accusation?’

20.      Written observations were submitted to the Court by the Hungarian Government and the European Commission. The Bulgarian and Hungarian Governments and the Commission participated in the hearing held on 20 March 2024, during which the parties also responded to questions put to them by the Court for oral answer.

IV.    Analysis

21.      For the dialogue I referred to above (13) to be successful and to allow the two stakeholders to hear and understand each other, they must ensure they express themselves in a language that is intelligible to both parties.

22.      The Commission proposed that the dialogue be ended somewhat abruptly by asking the Court to declare the questions referred for a preliminary ruling inadmissible on the ground that they are based on a misreading of the judgment in Case C‑205/21. On the contrary, I take the view that a more didactic approach is necessary and that, in any event, those questions are admissible. (14)

23.      Since new questions arise for the referring court from reading the judgment in Case C‑205/21, it is necessary to ensure that that judgment has been properly understood. That does not appear to be the case here.

24.      The referring court starts from the premiss – in my view incorrect – that the Court of Justice gave it the mandate to remedy the shortcomings in its national law through the introduction of ad hoc review procedures. Furthermore, the role assigned to the competent authorities by Directive 2016/680 as regards the assessment of whether processing is ‘strictly necessary’ – an essential condition for the processing of sensitive data – does not appear to have been well understood. Lastly, the referring court’s reading of the judgment in Case C‑205/21 has not made evident the appropriate link between the review of whether collection is ‘strictly necessary’ and that of the merits of the accusation.

25.      It is therefore for the Court of Justice, in the context of those new proceedings aimed at cooperation between it and the referring court, to provide the referring court with an answer which will be of use to it and enable it to determine the case before it. To do so, the Court must answer a question which has not really been referred to it and the answer to which is based, in part, on the interpretation of national law. It is therefore rather an unorthodox task for the Court.

26.      Thus, it is essential, for the remainder of the analysis, to note that the referring court has not been seised of a review of the assessment, by the competent authorities within the meaning of Article 3(7) of Directive 2016/680 (in the present case, the police authorities), as to whether the collection and processing of V.S.’s sensitive data is ‘strictly necessary’. The reason for this is that Bulgarian law does not provide for such an assessment to be carried out by those authorities.

27.      In those circumstances, the questions referred raise the following fundamental preliminary question: can the referring court, by mere review on its part, now based on Article 158 of the NPK – (15) which provides for investigative measures in ordinary criminal proceedings and, in particular, the taking of a sample for the purpose of creating a DNA profile – ensure the full effectiveness of Article 10 of Directive 2016/680?

28.      I propose that the suggested interpretation in conformity with EU law is not such as to render the situation in the main proceedings compatible with the requirements of Article 10 of Directive 2016/680 (A). An answer to the two questions referred should retain its usefulness for the resolution of the dispute in the main proceedings only in the event that the Court adopts a different approach. It is therefore in the alternative, in my view, and following a faster analysis that I will answer these questions (B).

A.      The judgment in Case C‑205/21, the obligation to interpret national law in conformity with EU law and the definition of the task of the referring court

29.      It is necessary, first of all, to return to the conclusions that must be drawn from the judgment in Case C‑205/21, before examining, next, the results that the interpretation put forward by the referring court should lead to, in order to be able to assess, lastly, whether that interpretation is in fact such as to render Bulgarian law in conformity with the requirements of Article 10 of Directive 2016/680, in the sense required by that judgment.

1.      The conclusions drawn from the judgment in Case C‑205/21

30.      In that judgment, the Court was asked, in particular, whether Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8 thereof, had to be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority to determine and to demonstrate, first, that their collection is necessary for achieving the specific objectives pursued and, second, that those objectives cannot be achieved by collecting only a part of the data concerned. (16)

31.      Since the processing of special categories of personal data, including biometric and genetic data, is to be allowed ‘only where strictly necessary’, (17) the Court ruled that such processing will be capable of being regarded as necessary solely in a limited number of cases and that that necessity is to be assessed with particular rigour, (18) the objective pursued by Article 10 being to give greater protection to persons in respect of the processing of sensitive data. (19)

32.      As for the police record, the Court thus stated that the question as to whether collection of the biometric and genetic data of accused persons in order for them to be entered in a record is ‘strictly necessary’ must be determined in the light of the purposes of their collection. Those purposes must be specified, explicit and legitimate. Furthermore, the data collected must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. (20) The provisions of national law must provide for processing to be lawful only if, and to the extent that, processing is necessary for the performance of a task carried out by a competent authority for the purposes set out in Article 1(1) of Directive 2016/680, and specify at least the objectives of processing, the personal data to be processed and the purposes of the processing. (21) Those purposes must be defined sufficiently precisely and specifically to enable assessment of whether that processing is ‘strictly necessary’. (22)

33.      That requirement also entails particularly strict checking as to whether the principle of data minimisation is observed. First, it must not be possible for the objective pursued to be reasonably achieved just as effectively by other means less restrictive of the fundamental rights of data subjects. The controller in respect of that processing must satisfy itself that that objective cannot be met by having recourse to categories of data other than those listed in Article 10 of Directive 2016/680. (23) Second, the ‘strictly necessary’ requirement means that account is to be taken of the specific importance of the objective that such processing is intended to achieve. (24)

34.      On the basis of those considerations, the Court expressly held that ‘national legislation which provides for the systematic collection of the biometric and genetic data of any person accused of an intentional offence subject to public prosecution is, in principle, contrary to the requirement laid down in Article 10 of Directive 2016/680’. (25) Such legislation ‘is liable to lead, in an indiscriminate and generalised manner, to collection of the biometric and genetic data of most accused persons since the concept of “intentional criminal offence subject to public prosecution” is particularly general and is liable to apply to a large number of criminal offences, irrespective of their nature and gravity’. (26) In particular, ‘the mere fact that a person is accused of an intentional criminal offence subject to public prosecution cannot be regarded as a factor that in itself enables it to be presumed that the collection of his or her biometric and genetic data is strictly necessary in the light of the purposes that it pursues and given the resulting interference with fundamental rights, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter’. (27)

35.      The Court went on to state that, even where there are serious grounds for believing that the person in question has committed a criminal offence, justifying his or her being accused, a situation which presupposes that sufficient evidence has already been gathered, it is possible that the collection of biometric and genetic data will not reflect any specific necessity for the purposes of the criminal procedure in progress. (28) The likelihood of the collection of such data being strictly necessary in connection with other procedures cannot be presumed but must be determined in the light of other relevant factors such as, in particular, the nature and gravity of the presumed offence of which he or she is accused, the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the person in question. (29)

36.      It is therefore in the light of all those statements that the Court held that it is for the referring court ‘to verify whether, in order to ensure the effectiveness of Article 10 of Directive 2016/680, it is possible to interpret the national legislation providing [for the mandatory creation of a police record] in a manner consistent with EU law. In particular, it is for the referring court to verify whether national law enables it to be assessed whether it is “strictly necessary” to collect both the biometric data and the genetic data of the data subject in order for them to be entered in a record. For that purpose, it should, inter alia, be possible to verify whether the nature and gravity of the offence of which the data subject in the main proceedings is suspected or whether other relevant factors, such as [the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the person in question], may constitute circumstances capable of establishing that collection is “strictly necessary”. Furthermore, it should be checked whether the collection of civil status data … does not in itself enable the objectives pursued to be met’. (30)

37.      Lastly, the Court very clearly indicated that ‘if national law does not guarantee such review of the measure whereby biometric and genetic data are collected, it is for the referring court to ensure that Article 10 of Directive 2016/680 is given full effect by dismissing the police authorities’ application requesting it to authorise enforcement of their collection’. (31)

2.      The respects in which Bulgarian legislation is incompatible with Article 10 of Directive 2016/680 and the shortcomings of the consistent interpretation proposed

38.      The conclusion (32) drawn by the Court in Case C‑205/21, while accompanied by habitual caution, (33) is clear: the arrangements for creating a police record, a component of which is its mandatory creation, are not consistent with the requirements of Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive.

39.      The representative of the Bulgarian Government did not argue otherwise in his oral arguments in the present case when he claimed that it was impossible for the competent authorities to assess whether the creation of a police record is ‘strictly necessary’ and stated to the Court that he had been informed by the Ministry of the Interior that an amendment to Article 68 of the ZMVR – intended to establish the obligation on the competent authorities to assess, on a case-by-case basis, whether the collection of biometric and genetic data of accused persons is ‘strictly necessary’ – was in the process of being adopted.

40.      It is true that the Court of Justice did not restrict itself to that finding of incompatibility and that it instructed the referring court to verify whether it was possible to interpret the national legislation providing for the mandatory creation of a police record in a manner consistent with EU law. For that purpose, it gave, in particular, the referring court a mandate to verify whether national law enables it to be assessed whether it is ‘strictly necessary’ to collect data in order for them to be entered in a record. (34)

41.      In order to interpret Article 68 of the ZMVR in a manner consistent with Article 10 of Directive 2016/680, the referring court envisages the application, at the time the decision is taken on the application for the mandatory creation of a police record, of the safeguards provided for in Article 158 of the NPK, from which it seems to follow that the collection of biometric and genetic data in the course of the criminal investigation must, in principle, be subject to the prior authorisation of the court, which can verify whether they are necessary for the purposes of the criminal investigation on the basis of all the documents in the case file which it must have at its disposal.

42.      Nevertheless, first, as the Commission correctly stated, paragraph 133 of the judgment in Case C‑205/21 cannot be interpreted to the effect that the Court held that an assessment of whether it is ‘strictly necessary’ to collect data, carried out by the referring court, is liable to meet the requirements of Article 10 of Directive 2016/680. Second, I take the view that the competent authorities’ failure to assess whether the collection of V.S.’s biometric and genetic data is ‘strictly necessary’, as required by Article 10 of that directive, cannot be offset by the referring court, in the light of the essential role played by those authorities in the arrangements established by that directive. (35) Thus, the review of whether the collection of sensitive data in criminal proceedings was ‘strictly necessary’ is a separate – possibly subsequent – issue from that of the assessment, by the competent authorities, of such necessity.

43.      The interpretation consistent with EU law proposed by the referring court will therefore not, in my opinion, eradicate all the incompatibilities with Article 10 of Directive 2016/680 from the Bulgarian legal system.

44.      In order to satisfy oneself in that regard, one needs only to consider the following matters.

45.      First, unless I am mistaken, under the arrangements provided for in Article 158 of the NPK, (36) only the necessity of the collection in the light of the objective pursued by that provision is assessed by the court. Prior authorisation to collect the data concerned by the investigative measure could be granted, account being taken of the evidence gathered until then, establishing serious doubts as to the participation of the person concerned in the commission of the offence and liable to substantiate the usefulness of that collection for concluding the investigation.

46.      As for Article 10 of Directive 2016/680, it requires the competent authorities to assess whether the processing is strictly necessary – thus, a more stringent condition. Furthermore, subject to verification to be carried out by the referring court, the purposes of creating a police record appear to be more extensive than those pursued by Article 158 of the NPK.

47.      It is apparent from paragraph 99 of the judgment in Case C‑205/21 that the creation of a police record pursues two fundamental purposes, namely, first, comparison with data already collected during other criminal investigations for the purposes of their possible conclusion and, second, the use of those data for the purposes of the ongoing criminal proceedings. (37) At the hearing held before the Court in the present case, the Bulgarian Government stated that the main purpose of the creation of police records was the use of the data collected in the course of the ongoing criminal proceedings. The possible future use of those data constitutes a secondary purpose. By contrast, the referring court states that, where a police record is created, the data are collected for possible future use only, should the need ever arise. (38)

48.      Such an assertion raises three sets of questions. (39) In the first place, since Article 68 of the ZMVR pursues a purpose identical to that pursued by Article 158 of the NPK, one may wonder under what circumstances the collection of biometric and genetic data requires the court’s prior authorisation and under what circumstances such authorisation is not necessary. It would therefore appear that two parallel procedures coexist, for the same purposes, offering significantly different safeguards. The creation of a police record would thus constitute a method of obtaining evidence used for the purposes of the ongoing proceedings. The referring court has repeatedly pointed out that that procedure for the creation of a police record ‘is distinct from criminal proceedings and is not part of them’. (40)

49.      In the second place, if, as the Bulgarian Government has stated, the main purpose of creating a police record is to gather evidence for the purposes of the ongoing criminal proceedings, the fact that the effect of the legislation is to authorise, as a matter of principle, the collection of biometric and genetic data of a person accused ‘only’ of tax fraud is, at the very least, perplexing. (41)

50.      Furthermore, Article 158 of the NPK does not provide that the court may consider, in connection with the authorisation it is preparing to issue, whether the creation of a police record is ‘strictly necessary’ for the purposes of comparison with data gathered during other investigations, which, however, seems to be one of the purposes pursued by the Bulgarian legislation on which the creation of polices is based.

51.      In the third place, it is clear from the considerations set out in point 47 of the present Opinion that the purposes pursued by the creation of police records are still not clearly established. They would not be any more so if Article 158 of the NPK had to be applied.

52.      Second, the effectiveness of Article 10 of Directive 2016/680 would be manifestly undermined if the question of whether the processing of sensitive data was ‘strictly necessary’ were to arise for the first time only on the occasion of the court granting prior authorisation for the collection measure, pursuant to Article 158 of the NPK.

53.      It is apparent from a combined reading of Articles 27 and 68 of the ZMVR that persons requested to cooperate in the creation of a police record constitute a vast category of persons (42) and that it is always the same data that are collected from them, without any distinction being made. All accused persons are automatically subject, for the purpose of creating a police record, to the collection of the same categories of data without, at any time, the competent authorities, within the meaning of Article 3(7) of Directive 2016/680, examining whether the collection of sensitive data is strictly necessary for the purpose of concluding the ongoing criminal investigation or for the purpose of solving other investigations. It is apparent, moreover, from paragraphs 113 and 114 of the judgment in Case C‑205/21 that the national legislation does not require the specific necessity for the collection of all those data for the purpose of creating a police record to be established and that no provision is made for an obligation on the part of the competent authority to determine and to demonstrate that their collection is strictly necessary for achieving the specific objectives pursued.

54.      It follows that the conditions under which it could be concluded that the creation of a police record pursuant to Article 68 of the ZMVR is strictly necessary are not provided for by the national legislation and that the processing of biometric and genetic data by the competent authorities for purposes covered by Directive 2016/680 is not subject to appropriate safeguards. (43) The application of Article 158 of the NPK is not capable of altering that finding.

55.      If the law provides no definition of when the collection and processing of sensitive data is ‘strictly necessary’ or there are no safeguards provided in that respect by way of the competent authorities exercising their discretionary power, it cannot be for the court itself to remedy the lack, in its national law, of those two prior steps. In that regard, I agree with the position adopted by the Commission at the hearing, according to which judicial review is secondary control, in the sense that it is a review, by the court, of the assessment of whether processing is ‘strictly necessary’ carried out by the competent authorities, in accordance with the provision made by the law. I add that it is legitimate to examine the criteria that the referring court may apply during such a review, in so far as the concept ‘strictly necessary’ is not defined by law.

56.      Third, even if the safeguards afforded by Article 158 of the NPK were sufficient – quad non – they could not benefit persons who are accused of an intentional criminal offence subject to public prosecution who have not opposed the creation of a police record. The assessment of whether the processing is ‘strictly necessary’ will never be carried out by the competent authorities in respect of those persons, as confirmed during the hearing by the Bulgarian Government. (44) That is a particularly worrying situation. It is reasonable to assume that an accused person’s ability to object when ordered to cooperate in the creation of a police record is significantly reduced. The national law resulting from the application of Article 158 of the NPK can therefore be rendered consistent with EU law only in part, since the creation of a police record without the competent authorities examining whether it is ‘strictly necessary’ could occur in respect of all persons coming within its – particularly broad – scope who have not opposed it. (45)

3.      Conclusion

57.      It follows from all the foregoing considerations that Article 10 of Directive 2016/680, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive, must be interpreted as meaning that the assessment, under the conditions described in paragraph 133 of the judgment in Case C‑205/21, of whether the creation of a police record is ‘strictly necessary’, in the light of the purposes allegedly pursued by that creation, must be carried out, in an effective manner, by the authorities that are competent for the creation of that record, before they can, where appropriate, apply for authorisation of its mandatory creation. It is not sufficient, for that purpose, that the assessment of whether the creation of a police record is ‘strictly necessary’ be carried out, for the first time, by the court from which mandatory creation is sought, only in the event that the accused person has refused to consent to the creation of that police record and only in the light of one of the purposes allegedly pursued by the national legislation which forms the legal basis for that collection.

58.      The interpretation in conformity with EU law put forward by the referring court does not therefore appear to be sufficient to bring the Bulgarian law in line with the requirements set out above. Accordingly, that court should, in accordance with what the Court of Justice already anticipated in paragraph 134 of the judgment in Case C‑205/21, dismiss the police authorities’ application requesting it to authorise enforcement of the collection of V.S.’s data.

B.      The questions referred

59.      In so far as the questions referred are based on the premiss that the referring court can remedy the shortcomings in the Bulgarian legislation on the processing of personal data, by the competent authorities, in the light of the requirements of Article 10 of Directive 2016/680, by the application of the rules of criminal procedure, and since I consider such a measure to be insufficient for that legislation to be regarded as consistent with EU law, it is in the alternative that I will address those questions, in the event that the Court should take a different view.

60.      In essence, the referring court asks the Court of Justice to clarify if the review of whether the processing of sensitive data is ‘strictly necessary’ may be carried out on the sole basis of the decision designating the person concerned as an accused person or if it is necessary for all the documents in the file (first question referred) to be provided with the purpose of the court being able to assess whether there are serious grounds for believing that the accused person committed the offence of which he or she is accused (second question referred).

61.      It is apparent from the request for a preliminary ruling that the referring court seems to identify a certain tension between, on the one hand, paragraphs 100 and 101 of the judgment in Case C‑205/21 and, on the other, paragraphs 130 to 133 of that judgment.

62.      In paragraph 100 of the judgment in Case C‑205/21, the Court held that ‘it may prove justified, during the preliminary stage of the criminal procedure, to shield temporarily from judicial review the assessment of the evidence on which accusation of the person concerned, and therefore the collection of his or her biometric and genetic data, is founded. Such review, at that stage, might impede the conduct of the criminal investigation in the course of which those data are being collected and excessively limit the investigators’ ability to clear up other offences on the basis of a comparison of those data with data gathered during other investigations. That limitation of effective judicial protection is therefore not disproportionate, provided that national law subsequently guarantees effective judicial review’. It inferred from that that Article 47 of the Charter does not preclude a national court, when it rules on an application for authorisation of enforcement of the collection of the sensitive data of an accused person, ‘from being unable to assess the evidence on which the accusation of that person is based, provided that national law subsequently guarantees effective judicial review of the conditions for that accusation, from which the authorisation to collect those data arises’. (46)

63.      The Court also held, this time interpreting Article 10 of Directive 2016/680, that ‘the mere fact that a person is accused of an intentional criminal offence subject to public prosecution cannot be regarded as a factor that in itself enables it to be presumed that the collection of his or her biometric and genetic data is strictly necessary in the light of the purposes that it pursues and given the resulting interference with fundamental rights …’. (47) It added that, ‘first, where there are serious grounds for believing that the person in issue has committed a criminal offence, justifying his or her being accused, a situation which presupposes that sufficient evidence of that person’s involvement in the offence has already been gathered, it is possible that the collection both of the biometric data and of the genetic data will not reflect any specific necessity for the purposes of the criminal procedure in progress’. (48) Second, ‘the likelihood of the biometric and genetic data of an accused person being strictly necessary in connection with procedures other than the procedure in which that accusation has taken place can be determined only in the light of all the relevant factors, such as, in particular, the nature and gravity of the presumed offence of which he or she is accused, the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the person in issue’. (49)

64.      Thus, the Court acknowledged that the fact that the court with jurisdiction to authorise the mandatory creation of a police record cannot review, on the merits, the conditions for the accusation that constitutes the legal basis for the collection (50) may amount to a permitted limitation of the right to effective judicial protection on the ground of a risk that that might impede the proper conduct of the criminal investigation.

65.      So far as concerns the review of whether the collection is ‘strictly necessary’, it does not follow from paragraphs 130 to 133 of the judgment in Case C‑205/21 that the Court required a review as to whether the accusation is well founded. It merely stated that the accusation constituted, in the context of the dispute in the main proceedings, a necessary – but not sufficient – condition for establishing that the collection of the sensitive data of the person concerned was ‘strictly necessary’. Furthermore, the matters referred to in paragraph 132 of that judgment, such as the nature and gravity of the offence, the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the person in question, are criteria distinct from those on which the accusation is based, namely, in principle, solid and consistent evidence for believing that the person in question has committed a criminal offence.

66.      In those circumstances, the review by the court of whether the collection of biometric and genetic data is ‘strictly necessary’ does not require a review as to whether the accusation of the person concerned is well founded. Article 10 of Directive 2016/680 does not require – while not precluding it, however – the full disclosure of the case file, provided that the assessment of whether collection is ‘strictly necessary’, in accordance with the arrangements set out by the Court in paragraph 133 of the judgment in Case C‑205/21, can be carried out in an effective manner on the sole basis of the decision designating the person in question as an accused person.

67.      Lastly, in so far as the wording of the second question referred also refers to Article 6(a) of Directive 2016/680, I will merely recall here, for the sake of completeness, that that article requires, in principle, the Member States to ensure that a clear distinction is made between data of the different categories of data subjects in such a way that they are not subject without distinction – whatever the category to which they belong – to the same degree of interference with their fundamental right to the protection of their personal data. (51) Under that article, one of those categories consists of ‘persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence’.

68.      The Court held that the existence of sufficient items of evidence pointing to a person’s guilt constitutes, in principle, a serious ground for believing that he or she has committed the offence at issue and that Article 6(a) of Directive 2016/680 does not preclude national legislation which provides for the compulsory collection, in order to be entered in a record, of biometric and genetic data concerning persons in respect of whom sufficient evidence is gathered that those persons are guilty of an intentional offence subject to public prosecution and who have been accused for that reason. (52) Contrary to the interpretation adopted by the referring court, that provision cannot require the court responsible for reviewing whether the collection of sensitive data is ‘strictly necessary’ to ensure that the accusation of the person concerned is well founded by assessing the evidence upon which the accusation is based.

69.      It follows from those considerations that Article 6(a) and Article 10 of Directive 2016/680 must be interpreted as meaning that the review, by the court, of whether the collection of biometric and genetic data is ‘strictly necessary’ does not require a review as to whether the accusation is well founded. Those provisions do not require – while not precluding it, however – the full disclosure of the case file, provided that the assessment of whether collection is ‘strictly necessary’, in accordance with the arrangements set out by the Court in paragraph 133 of the judgment in Case C‑205/21, can be carried out in an effective manner on the sole basis of the decision designating the person in question as an accused person.

V.      Conclusion

70.      In the light of the foregoing considerations, I propose that the Court answer the questions referred for a preliminary ruling by the Sofiyski gradski sad (Sofia City Court, Bulgaria) as follows:

Principally:

Article 10 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Article 4(1)(a) to (c) and Article 8(1) and (2) of that directive,

must be interpreted as meaning that:

–        the assessment, under the conditions described in paragraph 133 of the judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police)  (C‑205/21, EU:C:2023:49), of whether the creation of a police record is ‘strictly necessary’, in the light of the purposes allegedly pursued by that creation, must be carried out, in an effective manner, by the authorities that are competent for the creation of that record, before they can, where appropriate, apply for authorisation of its mandatory creation;

–        it is not sufficient, for that purpose, that the assessment of whether the creation of a police record is ‘strictly necessary’ be carried out, for the first time, by the court from which mandatory creation is sought, only in the event that the accused person has refused to consent to the creation of the police record and only in the light of one of the purposes allegedly pursued by the national legislation which forms the legal basis for that collection.

In the alternative:

Article 6(a) and Article 10 of Directive 2016/680

must be interpreted as meaning that the review, by the court, of whether the collection of biometric and genetic data is ‘strictly necessary’ does not require a review as to whether the accusation of the person concerned is well founded. Those provisions do not require – while not precluding it, however – the full disclosure of the case file, provided that the assessment of whether collection is ‘strictly necessary’, in accordance with the arrangements set out by the Court in paragraph 133 of the judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police)  (C‑205/21, EU:C:2023:49), can be carried out in an effective manner on the sole basis of the decision designating the person in question as an accused person.

1      Original language: French.

2      OJ 2016 L 119, p. 89.

3      C‑205/21, EU:C:2023:49; ‘the judgment in Case C‑205/21’.

4      Although Case C‑205/21 was referred to the Court of Justice by the Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria), that court was abolished in the course of the proceedings and the case in the main proceedings was transferred, during the proceedings, to the Sofiyski gradski sad (Sofia City Court): see the judgment in Case C‑205/21 (paragraph 51).

5      Samples to create a DNA profile of the person accused are included in the data collected for the creation of the police record.

6      See the judgment in Case C‑205/21 (paragraph 63).

7      The application in the main proceedings sets out the legal basis for creating a police record, namely Article 68(1) of the Zakon za Ministerstvoto na vatreshnite raboti (Law on the Ministry of the Interior) (DV No 53 of 27 June 2014; ‘the ZMVR’) and Article 11(4) of the Naredba za reda za izvarshvane i snemane na politseyska registratsia (Regulation laying down detailed rules for the implementation of police records) (DV No 90 of 31 October 2014).

8      It is apparent from the file before the Court that Article 158 of the NPK concerns the physical search of a person as an investigative measure in the pre-trial stage. That search may result in the collection of biometric and genetic data. The physical search of a person is carried out with the person’s written consent. If the person does not consent, the public prosecutor is to apply for prior authorisation for the mandatory search of a person to the judge of the court of first instance having jurisdiction or of the court of first instance in the district where the action is being carried out (Article 158(3) of the NPK). In urgent cases, the search is carried out without authorisation, and a request is made for its subsequent judicial approval (Article 158(4) of the NPK). According to the information submitted to the Court of Justice by the referring court, the case file is submitted to the court, which may examine all of the material in the file in order to assess whether the request for prior authorisation or subsequent approval is justified.

9      At the request, it appears, of the public prosecutor’s office: see paragraphs 16 and 24 of the request for a preliminary ruling.

10      Or the request for subsequent approval, depending on the circumstances.

11      ‘The Charter’.

12      According to the conclusion drawn by the referring court from paragraphs 100 and 101 of the judgment in Case C‑205/21.

13      See point 1 of the present Opinion.

14      It is apparent from the Court’s case-law that, even where there is case-law resolving the point of law at issue, national courts remain entirely at liberty to bring a matter before the Court if they consider it appropriate to do so. The fact that the Court has already interpreted that provision of EU law in the light of the same national legislation cannot in itself lead to the inadmissibility of the questions referred in the present case (see judgment of 6 November 2018, Bauer and Willmeroth, C‑569/16 and C‑570/16, EU:C:2018:871, paragraph 21 and the case-law cited, and paragraph 22). Furthermore, it is apparent from the request for a preliminary ruling that the questions submitted are directly connected with the dispute in the main proceedings and are relevant in order to enable the referring court to make a decision regarding that dispute. Moreover, that request contains sufficient elements for the Court to determine the implications of those questions and to provide a useful answer thereto. They must therefore be found to be admissible (see, by analogy, judgment of 20 December 2017, Schweppes, C‑291/16, EU:C:2017:990, paragraph 25).

15      See footnote 8 to the present Opinion.

16      See the judgment in Case C‑205/21 (paragraph 114).

17      I note that it is apparent from the case-law that the purpose of Article 10 of Directive 2016/680 is to ensure enhanced protection with regard to that processing, which, because of the particular sensitivity of the data at issue and the context in which they are processed, is liable, as is apparent from recital 37 of that directive, to create significant risks to fundamental rights and freedoms, such as the right to respect for private life and the right to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter (see the judgment in Case C‑205/21, paragraph 116 and the case-law cited).

18      See the judgment in Case C‑205/21 (paragraph 118).

19      See the judgment in Case C‑205/21 (paragraph 120).

20      See the judgment in Case C‑205/21 (paragraph 122).

21      See the judgment in Case C‑205/21 (paragraph 123).

22      See the judgment in Case C‑205/21 (paragraph 124).

23      See the judgment in Case C‑205/21 (paragraphs 125 and 126)

24      See the judgment in Case C‑205/21 (paragraph 127).

25      The judgment in Case C‑205/21 (paragraph 128). Emphasis added.

26      The judgment in Case C‑205/21 (paragraph 129).

27      The judgment in Case C‑205/21 (paragraph 130).

28      See the judgment in Case C‑205/21 (paragraph 131).

29      See the judgment in Case C‑205/21 (paragraph 132).

30      The judgment in Case C‑205/21 (paragraph 133).

31      The judgment in Case C‑205/21 (paragraph 134). In doing so, the Court seems to have acknowledged the direct effect of Article 10 of Directive 2016/680. A national court is not required, solely on the basis of EU law, to disapply a provision of its domestic law which is contrary to a provision of EU law if the latter provision does not have direct effect (see judgment of 20 February 2024, X (Lack of reasons for termination), C‑715/20, EU:C:2024:139, paragraph 74).

32      Set out in point 3 of the operative part in the judgment in Case C‑205/21.

33      In so far as proceedings under Article 267 TFEU are based on a clear separation of functions between the national courts and the Court of Justice, the national court alone has jurisdiction to find and assess the facts in the case before it and to interpret and apply national law: see, among the Court’s settled case-law, judgment of 9 April 2024, Profi Credit Polska (Reopening of proceedings concluded with a final judicial decision (C‑582/21, EU:C:2024:282, paragraph 31).

34      See the judgment in Case C‑205/21 (paragraph 133).

35      I note that the scope of Directive 2016/680 is specifically defined by reference to those authorities, since it is apparent from Article 2(1) of that directive that it ‘applies to the processing of personal data by competent authorities for the purposes set out in Article 1(1)’.

36      See footnote 8 to the present Opinion.

37      Article 27 of the ZMVR states that the data recorded by the police under Article 68 of the ZMVR are used only in the context of the protection of national security, the fight against crime and the maintenance of public order.

38      See paragraph 25 of the request for a preliminary ruling.

39      I note that the precise and specific definition of those purposes is an essential prerequisite to enable assessment of whether the processing is ‘strictly necessary’: see the judgment in Case C‑205/21 (paragraph 124).

40      Paragraph 21 of the request for a preliminary ruling. See, also, paragraph 6 thereof.

41      It is not apparent from the file before the Court that the application, in the main proceedings, of Article 158 of the NPK would allow the court to adjust the quantity and quality of the – particularly sensitive – data to be collected.

42      See, also, the judgment in Case C‑205/21 (paragraph 78).

43      According to the guidance given by the Court in the judgment in Case C‑205/21 (paragraph 63).

44      In that regard, I note that recital 37 of Directive 2016/680 states that ‘the consent of the data subject should not provide in itself a legal ground for processing such sensitive personal data by competent authorities’. In any event, first, the consent of the data subject does not amount to a release from the obligation to assess whether the collection is ‘strictly necessary’ and, second, that necessity must be ascertained even before consent is given.

45      The file before the Court does not contain any information on the possibility for those persons to bring an action in accordance with Article 54 of Directive 2016/680. Both the referring court in its request for a preliminary ruling (see paragraph 25 thereof) and the Bulgarian Government during the hearing before the Court seem to claim, however, that there is no judicial remedy available in such circumstances.

46      The judgment in Case C‑205/21 (paragraph 101).

47      The judgment in Case C‑205/21 (paragraph 130).

48      The judgment in Case C‑205/21 (paragraph 131).

49      The judgment in Case C‑205/21 (paragraph 132).

50      See the judgment in Case C‑205/21 (paragraph 88).

51      See the judgment in Case C‑205/21 (paragraph 83).

52      See the judgment in Case C‑205/21 (paragraphs 85 and 86).