On 30 January 2024, the ECJ delivered its judgment in Case C-118/22 (NG) involving the Director of the National Police Directorate-General at the Bulgarian Ministry of the Interior (Direktor na Glavna direktsia "Natsionalna politsia" pri MVR – Sofia). The Court ruled that the indefinite and indiscriminate storage of biometric and genetic data of individuals convicted - by final judgement - of intentional offenses, such as fingerprints, photographs, and DNA profiles, is contrary to EU law.

The case arose in Bulgaria, where a person convicted of perjury was unable to have their data removed from police records, despite legal rehabilitation. Under Bulgarian law, data related to criminal convictions are stored indefinitely, to be deleted only upon the individual's death.

The judges in Luxembourg found this practice inconsistent with EU law, which requires that the grounds for storing such data must be periodically reviewed. They emphasised that, while the biometric and genetic data of a convicted person may be essential for the purposes of prevention, detection, investigation, and prosecution of criminal offences, not all convicted individuals pose the same level of risk for the commission of future offenses, and therefore across-the-board data retention until death is unjustified. The judgment mandates that national laws must provide mechanisms for regular assessment of the necessity of data retention by the data controller as well as grant individuals the right to request the deletion of their data when it is no longer necessary. This decision ensures that data retention practices respect individuals' rights to privacy and data protection under EU law.

In January 2023, the ECJ already held that Bulgaria's law providing for the systematic collection of biometric and genetic data for the creation of police records was incompatible with the EU's data protection rules (Case C-205/21, V.S. → eucrim 1/2023, 32-33).