On 19 March 2026, the ECJ delivered its judgment in Case C-371/24 (Comdribus) concerning the collection of biometric data by police authorities under Directive 2016/680. The case addressed whether police may systematically collect fingerprints and photographs from persons suspected of criminal offences, whether such collection must be individually justified, and whether refusal to cooperate may itself be punished as a separate offence.

Background of the case

The case arose from criminal proceedings in France against a climate activist who had participated in an unauthorised demonstration in Paris. During police custody, he disclosed his identity but refused to be fingerprinted and photographed. He also refused to unlock his mobile phone. He was subsequently acquitted of the offences relating to the organisation of a demonstration and the refusal to provide access to his phone.

However, he was convicted of a fine of €300 for refusing to consent to the gathering of identification data, including fingerprints and photographs. This is a separate offence under French law. Court of Appeal in Paris asked the ECJ whether Directive 2016/680 precludes national legislation allowing the systematic collection of biometric data from persons reasonably suspected of having committed or attempted to commit an offence, and whether such refusal may be punished even if the person is not ultimately prosecuted or convicted for the underlying offence.

The ECJ's ruling

The judges in Luxembourg held that fingerprints and photographs used for unique identification constitute biometric data and therefore fall within the special protection regime of Art. 10 of Directive 2016/680. Their collection is allowed only where it is strictly necessary, subject to appropriate safeguards, and authorised by EU or national law.

They further found that national legislation is contrary to Art. 10 of Directive 2016/680 if it provides for the systematic collection of biometric data from every person reasonably suspected of having committed or attempted to commit a criminal offence. The fact that a person is reasonably suspected is not, in itself, enough to establish that the collection of biometric data is strictly necessary. The competent authority must assess the necessity of the collection in each individual case, taking into account factors such as the nature and seriousness of the suspected offence, the circumstances of the case, possible links with other proceedings, and the person’s criminal record or individual profile.

The ECJ also held that the competent authority must provide sufficient reasons, in each individual case, explaining why the collection of biometric data is strictly necessary. Ex post judicial review after the fact cannot substitute for this obligation: reasons must be provided so the data subject can effectively challenge the measure and the national court can assess its lawfulness.

Lastly, the ECJ ruled that EU law does not, in principle, preclude national legislation that criminalises refusal to submit to biometric data collection, even if the person is not ultimately prosecuted or convicted for the underlying offence. However, such a penalty is lawful only if the intended collection satisfies the strict necessity requirement in Art. 10 of Directive 2016/680 and the penalty imposed is proportionate as required by Art. 49(3) of the Charter of Fundamental Rights of the EU.

Put in focus

The ECJ ruling in Comdribus imposes strict limits on the practice of police authorities routinely subjecting criminal suspects to identification procedures. In their response to the question referred from the Paris court, the judges in Luxembourg emphasise the importance of citizens’ privacy: as biometric data falls within the category of particularly sensitive personal data, it enjoys enhanced protection. Accordingly, the processing of such data is only permissible if it is absolutely necessary and is accompanied by appropriate safeguards for the fundamental rights of the individuals concerned. The ruling is likely to have implications beyond France. It puts a stop to the practice of taking biometric data following every arrest, which is standard procedure in many countries.