On 19 March, the Court of Justice of the European Union in Luxembourg ruled in the case of Comdribus (C-371/24) again made it clear that the use of biometric data in criminal investigations is not straightforward. Fingerprints and photographs may seem like standard tools for investigation services, but legally there are criteria that must be met. Even in the context of the investigation and prosecution of criminal offences, fundamental rights, such as privacy, should not be overlooked.

Strict necessity: a strict test

Central to this is Article 10 of Directive 2016/680, which deals with the processing of sensitive personal data, including biometric data. The Court stresses that processing is only allowed if it is strictly necessary is. This is a tougher requirement than the “ordinary” necessity test.

What does that mean in concrete terms? Authorities may not be satisfied with general assumptions/assumptions or standard procedures. The Court explicitly rejects national schemes leading to a systematic collection of biometric data from all suspects. Instead, on a case-by-case basis be assessed:

• what specific objective is being pursued;
• Whether the biometric data are actually needed for that purpose;
• and whether that goal cannot be achieved by less intrusive means.

This approach is in line with the principle of minimum data processing and the broader principle of proportionality. Biometrics is not a routine tool, but an ultimum remedium that should only be used in extreme cases.

The purpose of data collection should not be vague

An important point of nuance in the judgment is the distinction between general and specific purposes. The Court makes it clear that purposes should not be formulated too abstractly, such as “detection of criminal offences” in a general sense.

There must be a concrete and defined goal, e.g. identification in a specific investigation or linking to certain tracks. Only then can it be assessed whether the use of biometric data is justified. This forces lawmakers and investigative agencies to formulate and apply their powers more precisely.

Reasons for the data collection decision

A second pillar of the judgment is the duty to state reasons. The Court states that the competent authority must explain in each individual case why the collection of biometric data is strictly necessary.

This is crucial for the legal protection of the data subject. Without justification:

• the accused cannot effectively challenge the measure;
• and the court cannot conduct a meaningful review.

The justification need not be extensive, but it must be sufficiently concrete and comprehensible. This prevents data processing from becoming a “black box” against which no effective control is possible.

Significance for (Dutch) practice

The judgment has implications for practice in the Netherlands and other member states. In the Netherlands, it is common practice to already take fingerprints from a suspect as part of a police interrogation. Also to see whether someone appears in the criminal records database (SKDB) or to be able to establish later that the right person has made a statement. For the Court of Justice, therefore, this is apparently not enough. In the ruling, the Court confirmed that:

• routine collection of biometric data is not allowed;
• an individual, concrete assessment is always required;
• and that transparency through justification is essential.

Thus, on a case-by-case basis, investigating authorities should assess whether the collection of biometric data such as fingerprints is strictly necessary. If this test has not taken place, this may present opportunities for the defence if the accused's interests have been harmed as a result. The ruling again shows that respect for individual interests can also be in the public interest. In this case that consideration should be given by the police before storing bodily characteristics of a citizen.

Mr. D.M. Penn