On 20 November 2025, the European Court of Justice (ECJ) ruled in case C-57/23 ("JH v Policejní prezidium") that the indiscriminate collection and indefinite storage of biometric and genetic data of individuals is permissible, provided that there is a strict necessity and regular review is guaranteed.

Background of the case and questions referred

The ruling was prompted by Czech proceedings in which a suspect took action against identification measures and their storage by the Czech police. Paragraph 65 of the Law on the Czech Police stipulates, inter alia, that the police may, for the purpose of future identification of a person accused or suspected of having committed an intentional criminal offence, take fingerprints, identify physical features, perform body measurements, obtain visual, audio, and similar recordings, and take biological samples that make it possible to obtain information about his or her genetic make-up. The police subsequently record that information in the relevant databases.

The Nejvyšší správní soud (Supreme Administrative Court of the Czech Republic) had doubts as to whether this legal regime is compatible with Directive 2016/680, which protects individuals with regard to the processing of their personal data by police and criminal justice authorities ("Law Enforcement Directive", LED). Two issues were mainly put forward:

• Do the requirements laid down in Directive 2016/680 preclude the indiscriminate collection of biometric and genetic data in respect of any person suspected of having committed an intentional criminal offence?
• Do the requirements laid down in Directive 2016/680 preclude the storage of biometric and genetic data without a maximum time limit?

The ECJ's reasoning on the indiscriminate collection of biometric/genetic data

Regarding the question on whether Directive 2016/680 precludes national legislation which permits the indiscriminate collection of biometric and genetic data of any person accused or suspected of having committed an intentional criminal offence, the ECJ first clarified that Art. 6 LED does not oblige Member States to make a distinction between "persons accused" and "persons suspected" of having committed an intentional criminal offence. However, data controllers are required, in accordance with national law, including the case-law of the national courts, to comply with all of the principles and specific requirements laid down in Arts. 4 and 10 LED. In particular, this means that the processing must be "strictly necessary". This concept includes, inter alia:

• The "purpose of the processing" must refer to the specific and real aims pursued by the processing of personal data in the light of the task of the controller in the law enforcement context;
• The importance of the purpose of the processing must be assessed: This means that, considering the measures taken in the case at hand, the data collection must take into account all relevant factors. These include the nature and gravity of the presumed offence of which the person is accused, the particular circumstances of that offence, any link between that offence and other procedures in progress, and the criminal record or individual profile of the persons in question;
• The principle of data minimisation must be strictly checked. This means, inter alia, that only DNA data that does not reveal information about a person's ethnicity or genetic diseases is registered.

According to the ECJ it is up to the referring court to assess the applicable requirements of the LED. However, the judges in Luxembourg emphasised that the case at issue "merely" concerns the police's right to take samples of biometric and genetic data from suspected persons, and not the systematic collection of such data from any accused or suspected person (as decided in its judgment of 26 January 2023 in Case C-205/21 →eucrim 1/2023, 32-33). Furthermore, the economic nature of the offence is not sufficient to exclude the collection of said data from being regarded as strictly necessary.

The ECJ's reasoning on the lack of a maximum period for data storage

Regarding the necessity of establishing maximum time limits for storage, the ECJ found that two issues must be distinguished.

First, the need to establish absolute time limits for data storage: In this context, Member States are not required to define absolute time limits, even if sensitive personal data is stored, provided that they foresee periodic reviews of the need to store personal data. If this review concludes that the storage of these data no longer appears to be strictly necessary, the data must be erased.

Second, the need to assess the continuation of storing biometric and genetic data on the basis of internal police rules: The juges in Luxembourg state that that fact is not in itself contrary to Art. 8(2) LED, in so far as those rules require the police to ensure that the condition that the storage of those data is strictly necessary is satisfied and that the discretion of the police is governed by a sufficient framework under national law, including national case-law.

Put in focus

With its ruling in the present case, the ECJ goes beyond the opinion of Advocate General de la Tour on 27 February 2025. The latter was rather critical of the Czech approach, concluding that the LED requires national legislation to provide for an obligation on the part of the law enforcement authority to assess in each specific case the "strict necessity" of the processing it has performed, or is contemplating performing. He also called for regular reviews of the data retention to be subject to strict procedural safeguards.

However, the ECJ does not apply strict standards to legislation for the collection of biometric and genetic data in criminal proceedings. Laws do not have to regulate the requirements of the LED in detail. The ECJ considers it more important that national law provides clear mechanisms to verify compliance with the LED's requirements, and that national courts are able to monitor the actions of the data controllers. The ECJ also makes it clear that the police must decide on a case-by-case basis whether to collect and record sensitive personal data. Therefore, the case relating to the Czech Police Law differs from cases in which EU Member States permitted the systematic, indiscriminate collection of sensitive data.