M.P. – Court Ruling (Czech Republic, 2025)

The controller was the Police of the Czech Republic. The data subject was a man who, in 2003, had been convicted of causing bodily harm and attempted murder committed in a particularly brutal manner and sentenced to 18 years' imprisonment along with mandatory outpatient treatment for alcohol addiction. He had prior criminal convictions. On 17 February 2021, while the data subject was still serving his sentence, a police forensic technician took his fingerprints, collected biological samples capable of revealing genetic information, measured his body and took photographs , relying on § 65 of the Police Act, which allows police to collect such data from persons serving a sentence for an intentional criminal offence, for the purpose of future identification. To carry out these procedures, the data subject was escorted from prison to a police facility by police officers, who restrained him with handcuffs. The data subject brought proceedings against the police alleging an unlawful interference with his rights, based on two separate grounds: (1) that the identification procedures themselves were unlawful, because the processing of his personal data was not necessary given his advanced age, deteriorated health and low risk of reoffending, because his transfer to the police outside the prison did not comply with § 42a(1) of the Execution of Sentences Act and (2) that his physical restraint during the escort was unlawful. The regional court dismissed his claim regarding the identification procedures, finding that his criminal history and the severity of his offences justified the interference. In a related, separately handled case concerning the escort itself, a different court later found that the escort had indeed been unlawful, because the police lacked legal authority to remove him from prison other than for the specific purpose defined in § 42a(1) and this finding was not challenged on appeal. The data subject appealed the dismissal regarding the identification procedures to the Supreme Administrative Court, arguing primarily that the processing of his personal data was not necessary and that the underlying transfer being unlawful rendered the identification procedures unlawful as well. Because the case raised questions about whether § 65 of the Police Act constituted a sufficient legal basis under the Law Enforcement Directive (Directive 2016/680), the Supreme Administrative Court stayed proceedings and awaited a preliminary ruling C-57/23 from the CJEU in a related reference concerning the same provision. First, following the CJEU's judgment of 20 November 2025 in JH v Policejní prezidium (C-57/23), the court held that the concept of "law of the Member State" under Articles 8 and 10 of Directive 2016/680 can include national legislation as interpreted by domestic case law, provided that case law is accessible and sufficiently foreseeable. The court held that Section 65 of the Czech Police Act meets this standard: it specifies the aim of the processing (via the erasure obligation in its paragraph 5, tied to the general purposes of the Directive), the purpose of the processing (future identification in the course of police duties) and the categories of personal data covered (fingerprints, body measurements, images and biological samples for genetic information). Second, the court held that Czech administrative case law interpreting § 65 requiring police to weigh factors such as the person's criminal history, the type and severity of the offence and personal circumstances including age meets the CJEU's requirements of accessibility and sufficient foreseeability. The court noted this interpretation was further supported by a 2022 Constitutional Court decision upholding the constitutionality of the same provision. Third, applying these standards to the case, the court agreed with the lower court that the collection of the data subject's data, including his DNA profile, was necessary and proportionate. It emphasised that the data subject had been repeatedly convicted and had committed attempted murder in a particularly brutal manner, one of the most serious offences under Czech law, in the detection of which forensic evidence such as DNA or fingerprints is typically indispensable. The court held that his advanced age, health conditions and the passage of time (most of which he had spent in prison) did not outweigh this strong interest in retaining his identification data. Finally, the court held that the separately established unlawfulness of the data subject's escort from prison due to a failure to comply with the specific transfer procedure under § 42a(1) of the Execution of Sentences Act did not render the subsequent identification procedures unlawful. The court reasoned that the defect in the escort concerned only the question of which authority was empowered to remove him from the prison and had no bearing on his right to informational self-determination, on the manner in which the identification procedures were carried out, or on his ability to defend his rights. The court also held that unlawfulness of the escort would not, without more, render evidence obtained through the identification procedures inadmissible in criminal proceedings, since only defects violating the right to a fair trial have that consequence under Czech case law. The Supreme Administrative Court accordingly dismissed the appeal.