On 28 November 2024, the ECJ ruled on the role of the competent authorities in deciding on the "strict necessity" of processing sensitive data in accordance with Art. 10 of Directive 2016/680 - the Law Enforcement Data Protection Directive. The referral concerns Bulgarian law, which provides that, for the purpose of a police record, the systematic collection of biometric and genetic data of all persons accused of an intentional offence subject to public prosecution is permitted without the Bulgarian police having to examine whether first the data collection is necessary for achieving the specific objectives pursued and, second, that those objectives cannot be achieved by collecting only a part of the data concerned .

In its judgment of 26 January 2023 in Case C-205/21 (→eucrim 32-33), the ECJ ruled that Bulgarian law only complies with EU law if it is ensured that the processing of the special categories of data referred to in Art. 10 of the Directive is permitted "only" where it is "strictly necessary". In the now renewed reference for preliminary ruling in the same case, the competent Bulgarian criminal court asked for clarification as to how and on what material basis it must implement this requirement (Case C-80/23, V.S. II).

The ECJ replied that it is up to the competent authority (in the Bulgarian case: the police) to make the assessment required under Art. 10. The court seised by that competent authority for the purpose of the enforcement of the data collection cannot ensure the necessary legal protection if the obligation has not been imposed on the competent authority.