CJEU - C-118/22 - Direktor na Glavna direktsia "Natsionalna politsia" pri MVR - Sofia

CJEU - C-118/22 Direktor na Glavna direktsia "Natsionalna politsia" pri MVR - Sofia
Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 5(1)(e) GDPR Article 17 GDPR Directive (EU) 2016/680, the data protection law enforcement directive (LED)
Decided:	30.01.2024
Parties:
Case Number/Name:	C-118/22 Direktor na Glavna direktsia "Natsionalna politsia" pri MVR - Sofia
European Case Law Identifier:	ECLI:EU:C:2024:97
Reference from:	Varhoven administrativen sad (Supreme Administrative Court, Bulgaria)
Language:	24 EU Languages
Original Source:	AG Opinion Judgement
Initial Contributor:	sh

The CJEU decided that the LED does not allow for data to be stored and processed indefinitely. The controller has an obligation to review periodically whether the data is necessary and must grant the data subject their rights when the data is no longer necessary for the purpose.

English Summary

Facts

Following an investigation, an entry was made into the police records about a data subject. The data subject was convicted and given a one year suspended sentence. After serving the sentence the data subject was legally rehabilitated according to national law. Due to this, the data subject requested the erasure of the entry concerning him in the police records. The police (the controller) refused on the grounds that legal rehabilitation is not one of the grounds for erasure in the police records under national law.

The administrative court of Sofia in Bulgaria upheld the police's decision. Therefore, the data subject brought an appeal before the Supreme Administrative Court, Bulgaria. The data subject argued that Article 5,13 and 14 LED (the roughly equivalent GDPR articles would be Article 5(1)(e), 13 and 15 GDPR) do not permit the police to indefinitely process his data. This is de facto the data subject's current case, as without a ground for removal, they will never be able to obtain erasure from the police register.

The Supreme Administrative Court, Bulgaria referred the following question to the CJEU:

1) Does Article 5 and 13(2)(b) and 13(3) LED allow national law which leads to a virtually unrestricted right for authorities to process personal data and does this allow the elimination of the data subjectt's right to restricted processing or erasure?

Holding

The CJEU held that the LED precluded national legislation and does not allow the police to process the data indiscriminatly until the data subject's death.

First, the CJEU broadened the question that was being refferred to it by reforumlating it (as is allowed under C-742/19 Ministrtsvo za obramo). It included into the scope of the question special categories of data, as the national legislation on storage also includes biometric and genetic data. It also broadened the relevant LED Articles in question to include 4(1)(c) and (e), 10, 16(2) and (3). The question was therefore, whether these articles preclude more restrictive national law in light of Articles 7 and 8 of the Charter of Fundamental Rights (at para 37).

Second, the CJEU noted that the collection of personal data in the context of criminal proceedings and their storage by the police, always constitutes an inteference with the fundamental right to a private life and protection of personal data. Irrespective of whether the information is sensitive, if the data subject has been inconvenienced by the storage or if the data is even used (at para 42).

Third, given this interference, the CJEU held that the period for which data is stored must be proportionate to the purposes for its storage (at para 43). Article 5 of the LED requires member states to decide on these time limits, provided that the member states undertake periodic review of the need to store the data. For the time limit to be appropriate, it must allow data subjects to erase their data when the storage is no longer necessary for the purposes which justified the processing (at para 45 and 50). Data subjects should be informed over how long their data will be stored and if this is not possible, the criteria used to determine that period (at para 46).

Fouth, the above does not mean that member states must define absolute time limits for the storage of personal data (at para 52). For example, in this case if the police can prove the neccessity of the purpose to keeping these records in the database, then they may do so (at para 55). For example, keeping identity documents, fingerprints and genetic data of the data subject could in future prove that the data subject was involved in further crimial offences or even exonerate him should he be accussed of other offences (at para 56).

Fifth, however, if this is the case then the principle of proportionality requires a balancing between the importance of the objective pursed and the seriousness of the limitation placed on the fundamental right (at para 62). The court proceeded to conduct this balancing excercise and decided that the limitation outweighed the purpose. In this case, the preliminary question relates to events where the data subject is convivted of a criminal offence and that the data in question be stored until their death (at para 58). The Court noted that this was a broad situation which would apply to a large number of offences (at para 59). The fact that the data subject has acquired rehabilitation may play a factor in reducing the period for which that storage is necesary as the data subject would present a lower risk to the police (at para 61). Moreover, the fact that senstive data is involved also reveals a serious limitation as such data must only be processed when 'strictly necessary' (at para 64). In fact, the ECHR has already ruled that indiscriminate powers for the retention of fingerprints, cellular samples and DNA profiles in national legislation creates a dissproportionate intefference with a data subject's right to a private life (ECtHR, S. and Marper v United Kingdom 1950). While it may be necessary to retain that type of data for long periods of time (at para 66), it must still be proportionate to the purpose or only be allowed where strictly necessary (at para 67).

Sixth, Member States must must provide a time limit for the storage of data under Article 5 of the LED. While death of the data subject may constitute a time limit, it cannot be regarded as proportionate or approproate when it is generally applicable to any convicted individual (at para 69). It follows, that the LED precludes national legislation and that controllers must peripodically review the necessity of data and erase it when the data is no longer necessary to their objectives (at para 70). That requirement is not satisfied when the erasure is only permitted at the point of the data subject's death (at para 70).

Comment

This case is decided on the LED (Law Enforcement Directive). It is nonethless still relevant from the perspective of the GDPR as the concepts and requirements for personal data are more or less the same.

Further Resources

Share blogs or news articles here!