View source for Tietosuojavaltuutetun toimisto (Finland) - TSV/16/2023

{{DPAdecisionBOX

|Jurisdiction=Finland
|DPA-BG-Color=
|DPAlogo=LogoFI.png
|DPA_Abbrevation=Tietosuojavaltuutetun toimisto
|DPA_With_Country=Tietosuojavaltuutetun toimisto (Finland)

|Case_Number_Name=TSV/16/2023
|ECLI=

|Original_Source_Name_1=Finlex
|Original_Source_Link_1=https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242323
|Original_Source_Language_1=Finnish
|Original_Source_Language__Code_1=FI
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Type=Complaint
|Outcome=Upheld
|Date_Started=15.07.2022
|Date_Decided=11.09.2024
|Date_Published=08.10.2024
|Year=2024
|Fine=
|Currency=

|GDPR_Article_1=
|GDPR_Article_Link_1=
|GDPR_Article_2=
|GDPR_Article_Link_2=

|EU_Law_Name_1=Directive 2016/680
|EU_Law_Link_1=https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016L0680
|EU_Law_Name_2=
|EU_Law_Link_2=
|EU_Law_Name_3=
|EU_Law_Link_3=

|National_Law_Name_1=Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security
|National_Law_Link_1=https://www.finlex.fi/fi/laki/ajantasa/2018/20181054
|National_Law_Name_2=Chapter 1 § 2 Coercive Measures Act
|National_Law_Link_2=https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L1P2
|National_Law_Name_3=Chapter 8 § 51(1)(9) Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security
|National_Law_Link_3=https://www.finlex.fi/fi/laki/ajantasa/2018/20181054#L8P51
|National_Law_Name_4=Chapter 9 § 3 Coercive Measures Act
|National_Law_Link_4=https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L9P3
|National_Law_Name_5=Coercive Measures Act
|National_Law_Link_5=https://www.finlex.fi/fi/laki/ajantasa/2011/20110806
|National_Law_Name_6=
|National_Law_Link_6=
|National_Law_Name_7=
|National_Law_Link_7=

|Party_Name_1=National Police Board of Finland
|Party_Link_1=https://poliisi.fi/en/national-police-board
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Not appealed
|Appeal_To_Link=

|Initial_Contributor=[https://gdprhub.eu/index.php?title=User:Fred fred]
|
}}

The DPA ordered the National Police Board of Finland to erase the personal identifying characteristics regarding a person suspected in an offence, which had been taken and processed unnecessarily and in breach of EU law.

== English Summary ==

=== Facts ===
The Finnish DPA was notified that the National Police Board of Finland (the controller) had taken and processed unnecessary personal identifying characteristics of the data subject in the context of a criminal investigation and questioning. The DPA then asked the controller to explain the purpose of the processing of personal identifying characteristics.

In response to the request, the controller clarified that the taking of personal identifying characteristics was based on [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L9P3 Chapter 9 Section 3 of the Finnish Coercive Measures Act], according to which the police may take fingerprints, handprints and footprints, handwriting, voice and olfactory samples, photographs and information on identifying marks regarding a person suspected in an offence, for the purposes of identification, clarification of an offence and registering of offenders.

The controller stated that it had a legal basis for taking personal identifying characteristics in order to register the offender and that the registration did not violate the principle of proportionality because the data subject was suspected of having committed defamation, which is punishable under the Finnish Criminal Code.

The controller argued that the relevance and necessity of taking personal identifying characteristics is not directly linked to the need to process them explicitly in the criminal case on the basis of which the person was registered. The controller argued that the need to process the identifying characteristics may arise in the context of the preliminary investigation of criminal cases that have already taken place or will take place in the future.

According to the expert testimony provided by the data subject, the defamation offence could have been solved without taking personal identifying characteristics. The coercive measure violated the rights of the data subject, as the suspected offence could have been investigated and solved without the processing of personal identifying characteristics.

=== Holding ===
The DPA noted that, according to the principle of proportionality under [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L1P2 Chapter 1 Section 2 of the Finnish Coercive Measures Act], coercive measures may only be used if they can be considered justified, taking into account the seriousness of the offence under investigation, the importance of clarifying the offence, the extent to which the use of coercive measures infringes the rights of the suspect in the offence or of others and the other circumstances of the case.

On the basis of the information provided by the controller, the DPA considered that the taking of personal identifying characteristics for the sole purpose of registration did not meet the requirements of proportionality. The DPA therefore found that the nature of the suspected offence did not support the need for registration.

The DPA also noted that under [https://www.finlex.fi/fi/laki/ajantasa/2018/20181054 the Finnish Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security], the personal data processed must be adequate, necessary and not excessive in relation to the purposes for which they are processed. In addition, special categories of personal data may be processed only if it is strictly necessary, subject to appropriate safeguards for the rights of the data subject and only if the processing is based on a specific legal basis.

The DPA stated that the necessity requirement for the processing of the data subject’s special categories of personal data is not met if personal data is collected solely for the purpose of registration without any other legal basis. Therefore, the registration of personal identifying characteristics was not necessary for the clarification of the suspected offence under investigation or for the identification of the data suspect.

The DPA also emphasised that the CJEU has held that [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016L0680 Directive 2016/680] must be interpreted as precluding national legislation which provides for the systematic collection of biometric and genetic data of any person accused of an intentional offence subject to public prosecution in order for them to be entered in a record, without laying down an obligation on the competent authority to verify whether and demonstrate that, first, their collection is strictly necessary for achieving the specific objectives pursued and, second, those objectives cannot be achieved by measures constituting a less serious interference with the rights and freedoms of the person concerned.

In light of this, the DPA concluded that the provision in [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806#L9P3 Chapter 9 Section 3 of the Finnish Coercive Measures Act], which could be interpreted as allowing the registration of personal identifying characteristics only for the purpose of registration, was contrary to EU law. Therefore, the controller did not have a legal basis to register the personal identifying characteristics.

On the basis of the information gathered, the DPA held that the controller violated [https://www.finlex.fi/fi/laki/ajantasa/2011/20110806 the Finnish Coercive Measures Act] and [https://www.finlex.fi/fi/laki/ajantasa/2018/20181054 the Finnish Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security].

As a result, and in accordance with [https://www.finlex.fi/fi/laki/ajantasa/2018/20181054#L8P51	
 Chapter 8 Section 51(1)(9) of the Finnish Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security], the DPA ordered the controller to erase the personal identifying characteristics taken of the data subject.

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.

<pre>
Thing
The legality of the police's registration of personal identification marks and their removal

Incorporated
Incorporated

Registrar
Police Board (hereinafter the data controller)

The requirements of the registered person with reasons
The registered person has been summoned by the police department for questioning on July 15, 2022 on suspicion of basic defamation. In this context, personal identification marks have been registered about him based on the Coercive Measures Act, although according to the registered person's opinion, there was no need or basis for it. Despite the data subject's request, the controller has not removed the registered personal identifiers.

The registrant has obtained an expert opinion on the registration of personal identification marks, which supports the registrant's understanding of the matter.

Expert opinion obtained by the registrant
The registrant has requested an expert opinion on the registration of personal identification marks from criminal and procedural law professor Matti Tolvase. The statement states e.g. the following:

The registered person has been suspected of a crime for which no punishment other than a fine has been stipulated (RL 24:9). The smallness of the crime speaks strongly against the use of coercion. The importance of solving the crime has in no way required the taking of personal identification marks.

Taking photographs has not helped solving the crime at all and could not even theoretically contribute to this goal.

The coercive measure has violated the data subject's rights because there has been no factual basis for it. A formal basis alone is not sufficient to justify the use of coercive measures. The suspicion of a crime could have been resolved without registration, and there is no reasonable basis for registration, even in the light of the future. On the contrary, the use of coercive measures has caused unnecessary harm to the data subject. Thus, the registration in this case also violates the principle of least harm.

The police's actions in taking personal identification tags are open to criticism. In the case, the principles of coercive measures limiting the use of coercive measures have not been sufficiently taken into account. Taking into account the principle of proportionality, the principle of least harm and the principle of sensitivity could have led to the fact that the use of coercive means would not have been considered justified. This is despite the fact that based solely on Chapter 9, Section 3, Subsection 1 of the Coercive Measures Act, the policeman would have had the right to take identification tags. However, the proportionality principle in particular is a powerful principle: coercive measures must be defensible in all cases.

Statement received from the registrar
The Office of the Data Protection Commissioner requested an explanation from the data controller. The report was received on 19 September 2023. The statement of the police department, the statement of the legal unit of the police department and the statement of the head of the investigation are attached to the report of the registry keeper. The registrar's report states e.g. the following:

Report of the Police Board

According to the Coercive Measures Act, a police officer is allowed to take fingerprints, hand and foot prints, handwriting, voice and smell samples, a photograph, and identification information from a suspect in a crime, for the purpose of investigating the crime and registering the perpetrators. The regulation defines three separate, independently applicable purposes for identification data, the key of which is specifically the registration of crime suspects and the storage of the personal data identified in the regulation about them in the police's personal registers. After registration, identification data has the right to be processed in the police's statutory duties, provided that the conditions laid down in the Police Personal Data Act and elsewhere in the law are met.

The appropriateness and necessity of taking personal identification marks is therefore not directly linked to whether there is a need to specifically process them in the criminal case on the basis of which the person is registered on the basis of Chapter 9 § 3 of the Coercive Measures Act. The need to process identification data may arise in connection with the preliminary investigation of criminal cases that have already occurred or will occur in the future, when, for example, fingerprint data taken during registration is technically compared to crime scene traces stored by the police. It is not stipulated in the Coercive Measures Act that the crime used as a basis for registration must be accompanied by, for example, a prison sentence of a certain level, but registration can also be done on the basis of a mere "fine crime" if the conditions laid down in the law are met.

According to the Police Board's view, the general requirements laid down in the law for registering a complainant on the basis of criminal suspicion related to defamation are met. At the time of registration, the complainant has been in the position of a criminal suspect in the criminal case used as a basis for registration, and the registration has been completed when the complainant has been dealing with the police in connection with the preliminary investigation of the criminal case. The registration was therefore carried out by the police department in such a way that the complainant was not unnecessarily harmed or inconvenienced by the use of coercive measures. In the opinion of the Police Board, in connection with the measures, the complainant's rights have not been interfered with more than was necessary to carry out the measures related to the use of coercive means.

However, in the case-by-case consideration related to the use of coercive measures, the interests of securing the protection of private life and the protection of personal data, which are protected as a fundamental right, should always be separately evaluated in relation to the necessity and appropriateness of registration in terms of the police's tasks. Since defamation can only result in a fine, the assessment should primarily take into account the principle of proportionality, but also the general interest in investigating the crime using identifying information.

The Police Board has issued a separate instruction on taking, storing and deleting personal identification marks, shoe prints and DNA tags (POL-2021-8411, 13 July 2022). The aim of the instruction is to harmonize and ensure the taking, storing and deleting of personal identification data and DNA identifiers in police units in accordance with the same principles. According to the Police Board's instruction POL-2021-8411, the personal identification marks and shoe prints of a criminal suspect should, in principle, be taken whenever there are conditions for doing so according to the Coercive Measures Act. However, according to the instructions, personal identification marks and shoe prints do not need to be taken if the registration is obviously unnecessary due to a newly completed registration or some other special reason.

The use of coercive measures may be unnecessary and contrary to the principle of proportionality, e.g. in cases where a person is suspected of only a minor criminal act, and the taking of personal identification marks is not necessary to identify the suspect or investigate the crime. According to the Police Board's view, the matter has been acted upon in accordance with the instructions given by the Police Board. Based on the report made and received in the case, the Police Board considers that the appropriate conditions and grounds for registering the complainant have been established by law.

Investigation by the police department

The taking of personal identification marks from a criminal suspect is regulated in chapter 9, section 3 of the Coercive Measures Act. The legislative basis is an old one, a similar regulation has already been in the decree on taking personal identification marks (245/1936), and the registration of crime suspects has not been justified in subsequent legislative reforms, so there are no legal precedents to facilitate interpretation.

With regard to the provision in question, it should be noted that the authority of the Data Protection Commissioner regarding the application of the provisions of the Coercive Measures Act may also be subject to criticism. Instead, in the law on the processing of personal data in the police department, sections 5 and 6 of the preliminary investigation stipulate what information and under what circumstances the police may process. Section 13 of the law also provides for the processing of the registered data in question for purposes other than their original purpose.

It does not appear from the registrant's complaint that the taking of personal identification marks caused him special harm. With regard to the purpose-related principle, it should be noted that in the case being evaluated now, the authority (taking personal identification marks) has been used for the purpose stipulated in the law (registration of the offender), so that principle is also fulfilled. The principle of proportionality according to Chapter 1, Section 3 of the Police Act requires that police measures are defensible in relation to the importance, dangerousness and urgency of the task, the goal to be pursued, the behavior of the person subject to the measure, age, health and other similar factors related to him, as well as other factors affecting the overall assessment of the situation. In the drafts of the Police Act (HE 224/2010 vp p. 67) it has been stated that the principle of proportionality and the principle of least harm protect basic and human rights. This can be estimated to mean protection from the arbitrary will of the authorities and to act as a general provision to guide all police activities.

Let it be stated that when bringing the principle of proportionality and respect for fundamental and human rights into the context being discussed, it is quite a far-fetched conclusion that an exception should have been made to the clear main rule, according to which crime suspects are registered by taking personal identification marks, in this particular situation.

When evaluating the grounds for registering a suspect for a crime, it cannot be done solely on the basis of the crime title, but the matter must be weighed on a case-by-case basis. In the situation being assessed now, the police have processed the applicant's personal identification marks by registering the information in a situation where the applicant has been suspected of a crime. On the basis of §§ 5 and 6 of the law on the processing of personal data in the police, there has been a basis for such processing.

The suspicion of a crime concerning the applicant has been brought to the fore, a charge has been filed in the case and according to the information I received from the regional prosecutor who handled the criminal case on August 18, 2023, after the parties reached an agreement, the prosecutor dropped the charge and the case was left to itself on August 17, 2023 in the district court.

The suspicion of a crime concerning the applicant has therefore not been trivial or of an infraction nature, so that the registration of identification marks would have been an unreasonable measure, taking into account the principle of proportionality. The investigation report regarding the criminal case is attached to indicate the quality of the crime under investigation. As can be seen from the statement of the legal unit of the police department, the Police Government has, in its instructions, ordered the police departments to register suspects of a crime whenever there are conditions for doing so according to the Coercive Measures Act. As an example of non-registration based on the principle of proportionality, the instruction mentions acts of a violation nature. Since the applicant is suspected of being guilty of defamation punishable by the Criminal Code, there was a legal basis for taking personal identification marks in order to register the offender, and the registration did not violate the principle of proportionality.

Investigation by the legal unit of the police department

The activity of personal registration creates the basic conditions for the utilization of critical investigation methods, especially in terms of criminal investigations and police investigations carried out on the basis of the Aliens Act. A successful and efficient personal registration operation is a necessary condition for e.g. for the identification of persons, fingerprint and DNA studies and the use of facial recognition technology. The functionality of the registration practices has significant effects on the national operating conditions of crime prevention and immigration control. The up-to-date identification register enables the reliable identification of crime suspects and the efficient use of related technology. If the person has been registered before, the timeliness and correspondence of the identifier information to the person will be checked and, if necessary, the person will be re-registered if the conditions allow.

The taking, storage and removal of personal identification marks, DNA tags and shoe prints based on the Coercive Measures Act (806/2011) and the Aliens Act (301/2004) are instructed by the Police Board's Instruction POL-2021-8411. and removal in police units according to the same principles.

The police officer decides on personal registration. The official authorized to make the arrest decides on the identity check to determine the DNA identifier. For operational reasons, the sample needed to determine the DNA identifier must always be taken in connection with personal registration, if the conditions laid down in the Coercive Measures Act are met. Em. according to the instructions, the personal identification marks and shoe prints of a criminal suspect or the personal identification marks of a foreigner should, in principle, be taken whenever there are conditions for doing so according to the Coercive Measures Act or the Aliens Act.

There is no need to take personal identification marks and shoe prints if the registration is obviously unnecessary due to a newly completed registration or another special reason. The use of coercive measures may be unnecessary and contrary to the principle of proportionality, e.g. in cases where a person is suspected of only a minor criminal act, and taking identification marks is not necessary to identify the suspect or investigate the crime. According to the instructions, the responsibility for checking the need for personal registration and organizing the registration if the conditions are met rests with the case investigator or the police officer handling the case in field operations. Officials authorized to make arrests must ensure that registrations are completed and DNA identification is taken when making decisions against crime suspects. In the case related to the complaint, there has been a question of personal registration in accordance with the Coercive Measures Act, i.e. the taking of personal identification marks from a criminal suspect as stipulated in Chapter 9, Section 3 of the Coercive Measures Act. With reference to the investigation manager's report and the above-mentioned statement, I state that the matter has been acted in accordance with the regulations governing the operation.

Investigation director's statement

The head of the investigation of the matter in question has answered the questions in the clarification request of the Office of the Data Protection Commissioner, e.g. as follows:

1. In what way was the registration of personal identifiers necessary to identify the suspect of the crime or to investigate the crime, especially taking into account the heinousness of the crime under investigation and the importance of investigating the crime.

The personal registration has been made for the suspect of the crime of the respective preliminary investigation for the purpose of registering the offender. So it's not about identifying a suspect or solving a crime. It would have been possible to bring the defamation crime under preliminary investigation to the prosecutor for prosecution even without registration.

2. Has there been any ambiguity about the identity of the criminal suspect and in what way have the registered personal identification marks contributed to the identification of the suspect.

There has been no ambiguity about the suspect's identity, and no registration has been required to identify him. (See previous answer.)

3. In what way have personal identification marks been used in the investigation of a crime and in what way have the registered personal identification marks contributed to the investigation of a suspected crime.

In no way.

4. In order to identify a suspect of a crime or investigate a crime, instead of taking personal identification marks, could measures less intrusive on the rights of the registered person have been used, i.e. was the registration of personal identification marks necessary or necessary to achieve the purpose of the registration?

As stated, personal identification marks have not been taken from the suspect of a crime to identify the suspect or to investigate the crime, but to register the perpetrator. Taking personal identification marks has therefore been necessary to complete the registration of a person. Naturally, registration cannot be carried out without taking personal identification marks. In other words, in order to realize the purpose of the registration, there have been no measures that interfere with the rights of the registered person. It should be mentioned here that the criminal suspect was registered during the interrogation, i.e. he was in any case obliged to be present at the police station, where the registration was completed immediately after the interrogation. Therefore, he could not have suffered unreasonable inconvenience from completing the registration. In addition, the suspect of a crime has been given the opportunity to consult with his assistant before registration. The assistant has told his boss that there is no legal right to refuse registration.

The registered equivalent
In the response given on 18.10.2023, the registrant states, among other things, the following:

The suspect's basic defamation could have been determined without taking personal identification marks, as stated in the expert report obtained by the data subject. The head of the investigation of the police department states the same in his statement. The formal basis does not legitimize the use of coercive measures, but the use of coercive measures is limited by the principles of coercive measures stipulated in chapter PKL1. I feel that the registration violates my honor and human and fundamental rights.

On August 4, 2023, the registrant submitted a written request to the Police Board to delete the image stored as a personal identification mark. Despite the request, the registration has not been removed or the written request has at least not been answered in any way at the time of writing this reply.

Applicable regulations
Act on the processing of personal data in criminal matters and in connection with maintaining national security (1054/2018, Criminal Matters Data Protection Act)

Act on the processing of personal data in police operations (616/2019, Police Personal Data Act)

Coercive Measures Act (806/2011)

A legal question
The issue to be resolved is whether the registration of personal identification marks was in accordance with the regulations applicable in this individual case. If the registration of personal identification marks has not been in accordance with the applicable regulations, it must be decided whether the controller is given an order according to section 51 subsection 1, paragraph 5 of the Criminal Matters Data Protection Act to remove the registered personal identification marks.

Legal evaluation of the matter
Proportionality principle
1. According to Chapter 1 Section 2 of the Coercive Measures Act (principle of proportionality), coercive measures may only be used if the use of coercive measures can be considered defensible taking into account the seriousness of the crime under investigation, the importance of investigating the crime and the violation of the rights of the suspect or others caused by the use of coercive measures and other relevant factors .

2. According to chapter 9, section 3, subsection 1 of the Coercive Measures Act, a police officer may take fingerprints, hand and foot prints, handwriting, voice and smell samples, facial and photo and identification information (personal identification tags).

3. In the applicable parts of this decision, a provision almost corresponding to Section 3 of Chapter 9 of the Coercive Measures Act was already in the decree on taking personal identification marks enacted in 1936 (245/1936).

4. In Chapter 9, Section 3, Subsection 1 of the Coercive Measures Act, two different expressions are used for persons from whom personal identification marks can be taken, i.e. a suspect of a crime and a perpetrator. The reason for the two different expressions is unknown.

5. Section 2 of Chapter 1 of the Coercive Measures Act and Section 3 of Chapter 9 of the Act must be interpreted together in such a way that the registration of personal identification marks requires that the conditions for registration laid down in both provisions are met. When evaluating the fulfillment of the requirements for the registration of personal data and the proportionality of the measures, it is justified to pay attention not only to other things, but also to the nature of the case that is the basis for the registration.

6. According to the controller's opinion, the registration of personal data in question has not violated the principle of proportionality. According to the registrar's opinion, the appropriateness and necessity of taking personal identification marks is not directly related to whether there is a need to explicitly process them in the criminal case on the basis of which the person is registered on the basis of Chapter 9 § 3 of the Coercive Measures Act. According to the registrar's report, the need to process identification data may arise in connection with the preliminary investigation of criminal cases that have already occurred or will occur in the future, when, for example, fingerprint data taken during registration is technically compared to crime scene traces stored by the police. According to the registrar's understanding, personal identification marks can thus be registered for a purpose that may materialize in the future.

7. According to the registrar's report, the registration of personal identification marks was done in this case only for the purpose of registering the offender. Thus, it has not been about the identification of a suspect related to the crime under investigation or a measure necessary for the investigation of the crime. The registrar has also not presented any other concrete arguments affecting the matter, for example related to crimes that have already occurred or may occur.

8. On the grounds mentioned above, the registration of personal identification marks has been contrary to the principle of proportionality laid down in Chapter 1, Section 2 of the Coercive Measures Act, because the registration of personal identification marks solely for the purpose of registration has not met the requirements of the principle of proportionality in this case. The question has been a single suspected crime that has not concerned a serious crime or a wider criminal entity, and no grounds other than the registration of personal identification marks have been presented for the registration of personal identification marks, nor can the nature of the suspected crime support the need for registration in this case.

Processing of special personal data groups
9. According to section 11 (treatment of special personal data groups) of the Criminal Matters Data Protection Act, subsection 1, data belonging to special personal data groups are personal data that reveal ethnic origin, political opinions, religious or philosophical convictions or trade union membership, as well as genetic data, biometric data intended for the unambiguous identification of a natural person information as well as information regarding health or the sexual behavior and sexual orientation of a natural person.

Paragraph 2 of the aforementioned Section 11 stipulates that the processing of personal data referred to in Paragraph 1 is permitted only if it is necessary, the protective measures required to protect the rights of the data subject have been implemented and if:

1) processing is regulated by law;
2) it is about the handling of a criminal case by the prosecutor's office or a court;
3) protection of the vital interest of the registered person or another natural person requires it; or
4) the processing concerns information that the data subject has expressly made public.

10. According to section 3, paragraph 13 of the Criminal Matters Data Protection Act, biometric data means personal data obtained through technical processing related to the physical and physiological characteristics or behavior of a natural person, on the basis of which the natural person in question can be identified or the identification of the person in question can be confirmed.

In the detailed justifications of the government proposal regarding the data protection law in criminal matters (HE 31/2018 vp), it is stated that biometric data would be defined in paragraph 13 of the aforementioned Section 3. According to the arguments in question, biometric data would mean personal data obtained through technical processing related to the physical and physiological characteristics or behavior of a natural person, on the basis of which the natural person in question can be identified or the identification of the person in question can be ensured. Biometric data would include, for example, facial images and fingerprint data.

11. The necessity requirement regarding the processing of biometric data required in the aforementioned provision is not met when personal data is collected only for the purpose of registration, without any other legal basis. From the report received, it does not appear that the registration of the personal identifiers of the registered person was necessary or even necessary at the time of registration.

12. On the grounds mentioned above, the registration of personal identifiers for the registrant has, in this individual case, been contrary to the conditions for the processing of special personal data groups referred to in Section 11 of the Criminal Data Protection Act.

Necessity requirement
13. According to Chapter 2, Section 6, Subsection 1, Clause 2 of the Police Personal Data Act, the police may process, in addition to the basic data of the person referred to in Section 4, about the persons referred to in Section 5 (Processing of personal data in investigative and supervisory tasks): identification data to establish identity, including fingerprint, hand and foot prints, handwriting, voice and smell sample, DNA identifier, facial image and other biometric data.

14. According to Chapter 2, Section 4 of the Criminal Matters Data Protection Act (lawfulness requirement), personal data may only be processed if it is necessary for the competent authority to perform a task prescribed by law, falling within the scope of Section 1, subsection 1 or 2.

15. According to Chapter 2 § 6 (requirement of necessity) subsection 1 of the Criminal Matters Data Protection Act, the personal data processed must be appropriate and necessary for the purpose of the processing, and they must not be too extensive for the purposes for which they are processed. Unnecessary personal data must be deleted without undue delay.

16. According to the registrar's report, the appropriateness and necessity of taking personal identification marks is not directly linked to whether there is a need to specifically process them in the criminal case on the basis of which the person is registered on the basis of Chapter 9 § 3 of the Coercive Measures Act. The need to process identification data may arise in connection with the preliminary investigation of criminal cases that have already occurred or will occur in the future, when, for example, fingerprint data taken during registration are technically compared to crime scene traces stored by the police.

17. According to the report given by the registrar, the personal registration was done for the suspect of a crime in the preliminary investigation in question only for the purpose of registering the offender. So it's not about identifying a suspect or solving a crime. It would have been possible to bring the defamation crime under preliminary investigation to the prosecutor for prosecution even without registration. The registration of personal identification marks has therefore not been necessary to investigate the suspected crime under investigation or to identify the suspect. Nor has a purpose for the registration of personal identification marks, which has already taken place or which may materialize in the future, been presented. The registration of personal identifiers concerning the registrant has thus been in violation of the necessity requirement stipulated in Chapter 2, Section 6 of the Criminal Matters Data Protection Act.

Primacy of EU law
18. The evaluation of the matter must also take into account the provisions of EU law, because EU law takes precedence over national law, in which case EU law supersedes all national regulations that deviate from EU rules. The legal consequence of this primacy rule is that, in the event of a conflict, national law contrary to EU law is not applied. Nor can new national legislative measures against EU law be implemented. A conflict situation between EU law and national law, which can be resolved by applying the primacy rule, can be avoided in such a way that all state bodies responsible for the use of law or jurisprudence must first interpret national law in accordance with EU law.

19. The legal basis for the interpretation according to EU law is the principle of sincere cooperation (Article 4, paragraph 3 of the TEU Treaty). According to it, Member States must implement all general or special measures that can ensure the fulfillment of obligations arising from the SEU Treaty or the acts of the EU institutions (Treaty on the European Union (2016/C 202/01).

20. The primacy rule of EU law obliges all member states' bodies to take care of the implementation of the full effect of the various legal rules of the Union, and the law of the member states cannot interfere with the effect that these legal rules are considered to have in the territory of the said states. For example, the decision of the Court of Justice of the European Union C-140/20, paragraph 118, states that if a national court, whose task is to apply the provisions and regulations of the Union law within the scope of its competence, cannot interpret the national legislation in accordance with the requirements of the Union law, it has the duty to ensure the full application of the provisions and regulations in question effect and, if necessary, on its own initiative, disapply all provisions of national legislation that are in conflict with Union law, including those issued later, without having to request or wait for such a provision to be removed through legislation or some other means in accordance with the Constitution (C-140/20, paragraph 118 and the case law cited therein).

21. Interpretation according to the directive is a special form of interpretation according to EU law. According to it, the member states are obliged to implement the directives. Law users and courts must, by interpreting the directive in accordance with the directive, promote that the relevant member state fully complies with this obligation. Interpretation in accordance with the directive ensures that the administration of justice is in accordance with the directives and that the national implementing regulations are interpreted and applied in the same way in all member states.

Judgment of the Court of Justice in Case C-205/21 (Registration of biometric and genetic data by the police) and its application to the case in question
22. When making a decision, the Deputy Data Protection Commissioner takes into account the decision practice of the Court of Justice of the European Union. The Court of Justice of the European Union interprets EU legislation and its task is to ensure the uniform application of EU legislation in all EU states.

23. According to Chapter 9, Section 3 of the Coercive Measures Act, a police officer may take fingerprints, hand and foot prints, handwriting, voice and smell samples, a photograph, and identifying information (personal identification marks) from a crime suspect for identification, investigation of the crime and registration of criminals. The provision in the current Coercive Measures Act, according to the interpretation of which personal identification marks can only be taken for the purpose of registering criminals, was enacted in 2011, however, the provision corresponding to section 3 of chapter 9 of the Coercive Measures Act in the applicable parts in this decision was already in the decree on taking personal identification marks (245/1936). It is not known that the provision has been assessed as to whether it complies with Directive 2016/680.

24. Judgment C-205/21 issued by the Court of Justice of the European Union on January 26, 2023 must be taken into account when evaluating the right to register personal identification data by the police. In these judgments, the Court emphasized that Directive 2016/680 aims to ensure, inter alia, better protection against the processing of sensitive data, including biometric and genetic data, insofar as they may entail significant risks to fundamental rights and freedoms. The requirement mentioned therein, according to which the processing of such data is permitted "only if it is absolutely necessary", must be interpreted as defining stricter conditions for the legality of the processing of sensitive data. In addition, the scope of this requirement must also be defined taking into account principles related to data processing, such as the principle of purpose limitation and the principle of data minimization.

25. The judgment concerns a case where the Bulgarian police authorities relied on national law, which provides for the "marking in the police register" of persons who have been investigated for an intentional crime subject to formal charges, and sought permission from the Special Criminal Court to enforce the collection of genetic and biometric data. Only copies of the preliminary investigation order and the notification form, in which he did not give his consent to the collection of his information, were attached to the police authorities' application. This court doubted whether this Bulgarian legislation applicable to "police registration" is compatible with Directive 2016/6801, read in the light of the Charter of Fundamental Rights of the European Union, and therefore asked the Court of Justice for a preliminary ruling.

26. Based on the judgment of the EU court, national legislation that provides for the systematic collection of biometric and genetic data for the purpose of registering a person for whom a preliminary investigation has been initiated for an intentional crime subject to official charges may lead to the collection of data of most persons for whom a preliminary investigation has been initiated, indiscriminately and generally. because the concept of "indictable intentional crime" is particularly general and can be applied to many crimes regardless of their nature and seriousness, the specific circumstances of these crimes, their possible connection to other pending proceedings, the person's previous convictions or his individual profile.

27. The Court of Justice of the European Union states in its judgment that Directive 2016/6808 is an obstacle to national legislation, which provides for the systematic collection of biometric and genetic data for the purpose of their registration, of a person who has been subject to a preliminary investigation for an intentional crime under official charges, and which does not provide for the obligation of the competent authority on the one hand check whether the collection of data is absolutely necessary to achieve the concrete objectives pursued and demonstrate this, and on the other hand check whether these objectives could be achieved with measures that interfere less with the rights and freedoms of the person concerned and demonstrate this.

28. According to the registrar's interpretation, it can register personal identifiers on the basis of Chapter 9, Section 3 of the Coercive Measures Act, solely for the purpose of registering criminals, when the person is suspected of a crime, and the law does not stipulate the duty of the competent authority to check whether the collection of information is absolutely necessary to achieve the concrete goals pursued, and demonstrate this, and on the other hand, to check whether these objectives could be achieved through measures that interfere less with the rights and freedoms of the person concerned, and to demonstrate this.

29. According to the interpretation of the registry keeper, Chapter 9, Section 3 of the Coercive Measures Act enables the processing of personal identification marks much more broadly than the Bulgarian legislation found to be contrary to EU law in the judgment of the European Court of Justice. According to the registrar's interpretation, on the basis of Chapter 9 § 3 of the Coercive Measures Act, personal identifiers can be registered without a specific basis, only for the purpose of collecting personal data, without distinguishing and generally registered from all those persons for whom a preliminary investigation has been initiated.

30. For this reason, the interpretation of the provision of the Coercive Measures Act mentioned above, according to which personal identification marks can be systematically registered only for the purpose of registration, is contrary to EU law, according to the arguments presented above.

31. Because EU law takes precedence over national law, in which case EU law supersedes all national regulations deviating from EU rules and replaces them in national legal systems. On the grounds mentioned above, the legal consequence of this primacy rule is that national law contrary to EU law is not applied. The provision in Chapter 9, Section 3 of the Coercive Measures Act, which can be interpreted in such a way that it enables the registration of personal identification marks only for the purpose of registration, is against EU law. In the case in question, there have thus been no legal grounds for registering personal identification marks.

Decision and reasons of the Deputy Data Protection Commissioner
Regulation
On the basis of Chapter 8, Section 51, Subsection 1, Section 9 of the Criminal Matters Data Protection Act, the Deputy Data Protection Commissioner orders the data controller to delete the personal identifiers stored on July 15, 2022, from the data subject.

Reasoning
In this case, the registration of personal identifiers has been contrary to the principle of proportionality stipulated in Chapter 1, Section 2 of the Coercive Measures Act (sections 1–8 above).

In this case, the registration of personal identifiers has been contrary to the conditions for the processing of special personal data groups laid down in Chapter 2, Section 11 of the Criminal Matters Data Protection Act (sections 9–12 above).

In this case, the registration of personal identifiers has been contrary to the requirement of necessity stipulated in Chapter 2, Section 6 of the Criminal Matters Data Protection Act (sections 13–17 above).

The basis for the registration of personal identification marks has been the interpretation of the provision in Chapter 9, Section 3 of the Law on Coercive Measures is contrary to EU law (sections 18–31 above).

Other measures of the Deputy Data Protection Commissioner
This decision applies exclusively to the registrant and personal identification marks registered for him in this case. The decision will be brought to the attention of the Ministry of Justice for the assessment of possible changes to the Coercive Measures Act.
</pre>