The Comdribus case recently decided by the CJEU (C-371/24, 19 March 2026) concerned the systematic collection of biometric data from persons suspected of having committed a criminal offence but ultimately not convicted. The case presents some striking similarities with S. and Marper v. the United Kingdom, decided by the ECtHR almost twenty years earlier (30562/04 and 30566/04, 4 December 2008), making a comparison between the two cases particularly interesting.
Both cases indeed raised similar legal questions. While both European Courts concur in rejecting the systematic collection or retention of such data, their focus is different: the CJEU mainly addresses the selection of the data concerned, whereas the ECtHR focuses on their use.
The CJEU indeed requires, in substance, that the collection of such data should, in each individual case, be “strictly necessary”. This must be justified by a sufficient statement of reasons, relying on specific and concrete purposes defined, in an appropriate and sufficiently precise manner, by national law. The ECtHR, for its part, found that the blanket and indiscriminate nature of the powers of retention at stake failed to strike a fair balance between the competing public and private interests (§ 125).
The facts
In S. and Marper, the applicants had been arrested and had their fingerprints and DNA taken. One was acquitted; the proceedings against the other were discontinued. Yet the authorities refused to destroy their fingerprints, cellular samples and DNA profiles. The Grand Chamber of the ECtHR held that the blanket and indiscriminate retention of data relating to persons who had not been convicted failed to strike a fair balance between the public interest in crime prevention and the applicants’ right to respect for their private life. There had therefore been a violation of Article 8 of the Convention (right to private life).
The facts in Comdribus were rather similar. HW was suspected of having committed criminal offences and, during the investigation, refused to have his fingerprints and photograph taken. He was ultimately acquitted of the underlying offences, but was convicted and fined for refusing the collection of his identification data.
There are, however, some differences between the two cases. While S. and Marper concerned the retention of personal data – the biometric and genetic material had already been collected and was retained after acquittal or discontinuance – Comdribus concerns the collection of personal data (fingerprints and photographs), which was refused by the person suspected of the offences. Comdribus also concerned the question whether a person may be prosecuted for such a refusal even if the underlying offence ultimately does not result in prosecution or conviction. The CJEU answered in the affirmative, but only where the envisaged collection itself complied with EU data-protection requirements and the penalty was proportionate.
Similar criteria
The two cases also operate within different legal frameworks: Article 8 of the Convention in S. and Marper and, in Comdribus, the much more detailed requirements of Directive 2016/680 (on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data), particularly Article 10 on sensitive personal data, read in conjunction with Articles 4(1)(a) to (c) and 8 of the Directive and Articles 7, 8, 47 and 49 of the EU Charter.
Despite their different legal frameworks, the two European Courts reach their conclusions by applying criteria that are, in many respects, similar.
Both European Courts indeed consider personal data to be particularly sensitive and therefore to require “rigorous” or “careful” scrutiny of their processing (S. and Marper, §§ 103–104; Directive, Article 10; Comdribus, § 28).
Both Courts also rely on broadly similar criteria with regard to these data, notably:
- the precise objectives and purposes of the processing;
- the type of biometric data concerned;
- the nature and gravity of the suspected offence;
- the strength of the suspicion;
- the age, profile and conduct of the person suspected, including his or her previous arrests or criminal history;
- other particular circumstances;
- the availability of independent judicial review; and
- particularly in S. and Marper, the duration of the storage of the data.
Consequently, both Courts reject the “blanket and indiscriminate” (S. and Marper, §§ 119, 125) or “indiscriminate and general” use of such data (Comdribus, §§ 36 and 51).
Different guiding principles
These criteria, however, are applied in light of different guiding principles.
In Comdribus, based on the wording of Article 10 of the Directive, the guiding principle is the “strict necessity” of the collection of the personal data concerned (§§ 26, 29, 32, 33 and 34), combined with the principle of data minimisation (§§ 26 and 32). Under this approach, the question is not simply whether the use of biometric data is useful for combating crime. Rather, the authorities must ask whether the specific purpose of the data collection could be achieved just as effectively through less intrusive means or through categories of data that are less sensitive.
Thus, strict necessity places the emphasis on the selection of the data. The question is: why do we need these particular sensitive data for this particular purpose? In this context, data minimisation requires the authorities to use no more sensitive data than is strictly necessary.
By contrast, in S. and Marper, the guiding principle is proportionality. It requires the retention of biometric data to strike a fair balance between the public interest in exploiting modern scientific techniques for the prevention and detection of crime and the individual’s private-life interests (§§ 107, 112, 118 and 125). By relying on proportionality, the ECtHR does not require the State necessarily to use the smallest possible amount of personal data, as the CJEU does. It requires, rather, that the use of such data remain proportionate to the legitimate aims pursued. In other words, having regard to the circumstances of the case, the public interest served by the retention of the data should not be allowed to unduly outweigh the interest of the person concerned in maintaining the confidentiality of his or her personal data.
Thus, proportionality places greater emphasis on the overall use of the data. It looks beyond the mere collection of sensitive personal data and asks whether the concrete modalities of their retention and future handling are fairly balanced against the individual’s fundamental rights.
Complementary approaches
Because of their different focuses, these two approaches would appear to be complementary rather than mutually exclusive. The result is a two-layered form of scrutiny.
First, under EU law, the collection of sensitive personal data must satisfy the particularly demanding requirement of strict necessity. Second, under Article 8 of the Convention, the handling of those data must remain subject to the broader requirements of proportionality and fair balance.
For national judges confronted with the increasingly extensive use of biometric data in criminal justice, the two lines of case-law should therefore be read together: strict necessity to determine whether the data should be collected at all; proportionality to ensure that, once collected, they are handled in a manner that respects the fair balance required by Article 8.
