A police authority may, in a criminal investigation, collect biometric data solely on the ground that that collection is strictly necessary

25 March 2026

In a recent ruling, the EU Court of Justice stated that the gathering of identification data may not be required systematically and clear reasons must be given for it, failing which the criminal penalty laid down for refusing to consent to that gathering will be invalid.

In May 2020, HW was detained in Paris (France) for organising a demonstration without prior notice and for disobedience. While he was in police custody, he refused to consent to the gathering of identification data (the taking of fingerprints and of photographs).

That refusal resulted in HW being sentenced, even though he was acquitted of the offence forming the basis of the envisaged gathering of identification data. He challenged that sentence, claiming that the applicable French legislation was not consistent with the EU rules on the protection of personal data in criminal matters.

It is against that background that the Court of Appeal, Paris, has made a reference for a preliminary ruling to the Court of Justice. The referring court asks, in essence, whether EU law allows national authorities systematically to collect fingerprints and photographs of any person suspected of an offence, without having to provide reasons for that measure on a case-by-case basis. The referring court asks also whether a person may be prosecuted for having refused to consent to such collection, even if that person was ultimately not prosecuted for the offence of which he or she was suspected.

In its judgment, the Court of Justice clarifies the requirements imposed on national authorities when they collect biometric data (fingerprints, photographs) for the purposes of a criminal investigation.

First of all, the Court recalls that biometric data are sensitive personal data within the meaning of EU law, which calls for enhanced protection: their processing is authorised only where it is strictly necessary and where there are appropriate safeguards for the rights and freedoms of the data subject.

Read more here