Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria) – CJEU Judgment (European Union, 2023)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The EU's top court ruled that Bulgarian law on collecting genetic and biometric data for criminal investigations must comply with EU privacy rules. The court highlighted the need for clear legal frameworks when handling sensitive data. This decision emphasizes the importance of aligning national laws with EU directives.
What happened
The EU Court of Justice ruled on the legality of Bulgarian law regarding the collection of genetic and biometric data in criminal cases.
Who was affected
Individuals involved in criminal investigations in Bulgaria, where genetic and biometric data collection was contested.
What the authority found
The court held that Bulgarian law must align with EU directives on data protection, not just GDPR, when collecting sensitive data.
Why this matters
This ruling stresses the need for national laws to fully comply with EU data protection standards, especially for sensitive data. Authorities must ensure their legal frameworks are comprehensive and EU-compliant.
GDPR Articles Cited
National Law Articles
A data subject was accused of a criminal offence and refused to consent to the collection of her genetic and biometric data (Photographs and fingerprints), which the Bulgarian Police required to create a record. The data subject also refused to let the police take a sample for the purpose of creating a DNA profile. In the end, the police did not collect this data. The police went to a Bulgarian Criminal court (Spetsializiran nakazatelen sad), which was also the referring court in this case. Here, the police asked the court to authorise the forced collection of the genetic and biometric data, considering there was enough evidence to convict the data subject of the crime. The police position was mostly based on Bulgatian law (ZMVR, Law of the ministry of Home affairs) authorising the collection of biometric and genetic data for, among the others, law and order purposes. However, the referring court had doubts whether the such law was actually compliant with EU law. This Bulgarian law did refer to Article 9 GDPR, but did not refer to [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L0680&from=DE#d1e1816-89-1 EU directive 2016/680]. The latter is an EU directive which concerns the protection of personal data regarding processing of competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. This directive states that the processing of certain special category data, including genetic and biometric data, can be lawful if this is compliant with EU law or national law. The Bulgarian law had even taken over some of the wording from Article 10(a) of this directive for its national provision. The court determined that there were two problems resulting from the fact that this national law contained a reference to the GDPR, but did not mention the aforementioned directive. The first problem was the fact that the GDPR was not applicable to the processing
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria) in EU
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
26 January 2023
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-5657About this data
Cite as: Cookie Fines. Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria) - European Union (2023). Retrieved from cookiefines.eu
Last updated: