CJEU confirms that EU police can collect and store biometric data of suspects without a maximum term

Luxembourg, November 20, 2025 - The Court of Justice of the European Union has established that the police of member states can collect and store biometric and genetic data of individuals accused or suspected of intentional crimes, even without a maximum storage period, if national legislation provides for periodic checks of necessity. The ruling interprets Directive 2016/680 on the processing of personal data in criminal matters and provides a clear framework for how authorities can use this sensitive data.

The case originated from a Czech official who contested the collection of fingerprints, genetic samples, photographs, and physical descriptions after being suspected and subsequently convicted of abuse of office. National courts had ordered the deletion of all data from police databases, and the Supreme Administrative Court of the Czech Republic asked the CJEU to clarify whether national legislation is compatible with European data protection standards.

European judges decided that the notion of "member state law" in Directive 2016/680 includes not only legal provisions but also the consistent jurisprudence of national courts, provided that it is accessible and foreseeable. This interpretation allows states to define their personal data processing regime based on a coherent set of written norms and jurisprudence.

The Court established that it is not contrary to EU law for national authorities to collect indiscriminately biometric and genetic data of all individuals suspected or accused of intentional crimes. The essential condition is that the purpose pursued must be the same for both categories and that data operators must respect the applicable principles for sensitive data, including necessity, proportionality, and purpose limitation.

Regarding the duration of storage, the CJEU confirms that member states can allow the police to decide on the retention of data based on internal rules, without imposing an explicit maximum term. However, legislation must ensure clear deadlines for the periodic review of the necessity of data retention and a strict assessment of the justification for each extension.

The ruling does not resolve the national dispute, but the decision of the Court of Justice is binding for the court in the Czech Republic and for all other European courts facing similar situations. The decision may influence how member states adjust their procedures for collecting, storing, and deleting biometric data in criminal investigations.

https://2eu.brussels/articol/stiri/cjue-confirma-ca-politiile-ue-pot-colecta-si-pastra-date-biometrice-ale-suspectilor-fara-termen-maximum