{"id":3695,"date":"2026-09-25T19:08:45","date_gmt":"2026-09-25T17:08:45","guid":{"rendered":"https:\/\/johan-callewaert.eu\/?p=3695"},"modified":"2026-09-25T19:08:46","modified_gmt":"2026-09-25T17:08:46","slug":"biometric-data-criminal-investigations-and-fundamental-rights-comparing-comdribus-with-s-and-marper","status":"publish","type":"post","link":"https:\/\/johan-callewaert.eu\/fr\/biometric-data-criminal-investigations-and-fundamental-rights-comparing-comdribus-with-s-and-marper\/","title":{"rendered":"Biometric data, criminal investigations and fundamental rights: comparing Comdribus with S. and Marper"},"content":{"rendered":"\n

The Comdribus<\/em> <\/a>case recently decided by the CJEU (C-371\/24, 19 March 2026) concerned the systematic collection of biometric data<\/strong> from persons suspected of having committed a criminal offence but ultimately not convicted<\/strong>. The case presents some striking similarities with S. and Marper<\/em> v. the United Kingdom<\/em><\/a>, decided by the ECtHR almost twenty years earlier (30562\/04 and 30566\/04, 4 December 2008), making a comparison between the two cases particularly interesting.<\/p>\n\n\n\n

Both cases indeed raised similar legal questions. While both European Courts concur in rejecting the systematic collection or retention<\/strong> of such data, their focus is different: the CJEU mainly addresses the selection of the data concerned<\/strong>, whereas the ECtHR focuses on their use<\/strong>.<\/p>\n\n\n\n

The CJEU indeed requires, in substance, that the collection of such data should, in each individual case, be \u201cstrictly necessary<\/strong>\u201d. This must be justified by a sufficient statement of reasons<\/strong>, relying on specific and concrete purposes<\/strong> defined, in an appropriate and sufficiently precise manner, by national law. The ECtHR, for its part, found that the blanket and indiscriminate nature of the powers of retention<\/strong> at stake failed to strike a fair balance<\/strong> between the competing public and private interests<\/strong> (\u00a7 125).<\/p>\n\n\n\n

The facts<\/em><\/strong><\/h2>\n\n\n\n

In S. and Marper<\/em>, the applicants had been arrested and had their fingerprints and DNA<\/strong> taken. One was acquitted; the proceedings against the other were discontinued. Yet the authorities refused to destroy their fingerprints, cellular samples and DNA profiles. The Grand Chamber of the ECtHR held that the blanket and indiscriminate retention of data<\/strong> relating to persons who had not been convicted failed to strike a fair balance between the public interest in crime prevention and the applicants\u2019 right to respect for their private life. There had therefore been a violation <\/strong>of Article 8 of the Convention (right to private life).<\/p>\n\n\n\n

The facts in Comdribus<\/em> were rather similar. HW was suspected of having committed criminal offences and, during the investigation, refused to have his fingerprints and photograph taken<\/strong>. He was ultimately acquitted of the underlying offences, but was convicted and fined for refusing the collection of his identification data.<\/p>\n\n\n\n

There are, however, some differences between the two cases. While S. and Marper<\/em> concerned the retention<\/strong> of personal data \u2013 the biometric and genetic material had already been collected and was retained after acquittal or discontinuance \u2013 Comdribus<\/em> concerns the collection<\/strong> of personal data (fingerprints and photographs), which was refused by the person suspected of the offences. Comdribus<\/em> also concerned the question whether a person may be prosecuted for such a refusal<\/strong> even if the underlying offence ultimately does not result in prosecution or conviction. The CJEU answered in the affirmative, but only where the envisaged collection itself complied with EU data-protection requirements and the penalty was proportionate.<\/p>\n\n\n\n

Similar criteria<\/em><\/strong><\/h2>\n\n\n\n

The two cases also operate within different legal frameworks: Article 8 of the Convention<\/strong> in S. and Marper<\/em> and, in Comdribus<\/em>, the much more detailed requirements of Directive 2016\/680<\/strong> (on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data), particularly Article 10 on sensitive personal data<\/strong>, read in conjunction with Articles 4(1)(a) to (c) and 8 of the Directive and Articles 7, 8, 47 and 49 of the EU Charter.<\/p>\n\n\n\n

Despite their different legal frameworks, the two European Courts reach their conclusions by applying criteria <\/strong>that are, in many respects, similar<\/strong>.<\/p>\n\n\n\n

Both European Courts indeed consider personal data to be particularly sensitive<\/strong> and therefore to require \u201crigorous\u201d or \u201ccareful\u201d scrutiny<\/strong> of their processing (S. and Marper<\/em>, \u00a7\u00a7 103\u2013104; Directive, Article 10; Comdribus<\/em>, \u00a7 28).<\/p>\n\n\n\n

Both Courts also rely on broadly similar criteria<\/strong> with regard to these data, notably:<\/p>\n\n\n\n

    \n
  • the precise objectives and purposes of the processing;<\/li>\n\n\n\n
  • the type of biometric data concerned;<\/li>\n\n\n\n
  • the nature and gravity of the suspected offence;<\/li>\n\n\n\n
  • the strength of the suspicion;<\/li>\n\n\n\n
  • the age, profile and conduct of the person suspected, including his or her previous arrests or criminal history;<\/li>\n\n\n\n
  • other particular circumstances;<\/li>\n\n\n\n
  • the availability of independent judicial review; and<\/li>\n\n\n\n
  • particularly in S. and Marper<\/em>, the duration of the storage of the data.<\/li>\n<\/ul>\n\n\n\n

    Consequently, both Courts reject the \u201cblanket and indiscriminate<\/strong>\u201d (S. and Marper<\/em>, \u00a7\u00a7 119, 125) or \u201cindiscriminate and general\u201d use<\/strong> of such data (Comdribus<\/em>, \u00a7\u00a7 36 and 51).<\/p>\n\n\n\n

    Different guiding principles<\/em><\/strong><\/h2>\n\n\n\n

    These criteria, however, are applied in light of different guiding principles<\/strong>.<\/p>\n\n\n\n

    In Comdribus<\/em>, based on the wording of Article 10 of the Directive, the guiding principle is the \u201cstrict necessity\u201d<\/strong> of the collection of the personal data concerned (\u00a7\u00a7 26, 29, 32, 33 and 34), combined with the principle of data minimisation<\/strong> (\u00a7\u00a7 26 and 32). Under this approach, the question is not simply whether the use of biometric data is useful <\/strong>for combating crime. Rather, the authorities must ask whether the specific purpose of the data collection could be achieved just as effectively through less intrusive means<\/strong> or through categories of data that are less sensitive<\/strong>.<\/p>\n\n\n\n

    Thus, strict necessity<\/strong> places the emphasis on the selection of the data<\/strong>. The question is: why do we need these particular sensitive data for this particular purpose? In this context, data minimisation<\/strong> requires the authorities to use no more sensitive data than is strictly necessary.<\/p>\n\n\n\n

    By contrast, in S. and Marper<\/em>, the guiding principle is proportionality<\/strong>. It requires the retention of biometric data to strike a fair balance<\/strong> between the public interest<\/strong> in exploiting modern scientific techniques for the prevention and detection of crime and the individual\u2019s private-life interests<\/strong> (\u00a7\u00a7 107, 112, 118 and 125). By relying on proportionality, the ECtHR does not require the State necessarily to use the smallest possible amount of personal data, as the CJEU does. It requires, rather, that the use of such data remain proportionate to the legitimate aims<\/strong> pursued. In other words, having regard to the circumstances of the case, the public interest served by the retention of the data should not be allowed to unduly outweigh the interest of the person concerned in maintaining the confidentiality of his or her personal data.<\/p>\n\n\n\n

    Thus, proportionality<\/strong> places greater emphasis on the overall use of the data<\/strong>. It looks beyond the mere collection of sensitive personal data and asks whether the concrete modalities of their retention and future handling<\/strong> are fairly balanced<\/strong> against the individual\u2019s fundamental rights.<\/p>\n\n\n\n

    Complementary approaches<\/em><\/strong><\/h2>\n\n\n\n

    Because of their different focuses, these two approaches would appear to be complementary <\/strong>rather than mutually exclusive. The result is a two-layered form of scrutiny<\/strong>.<\/p>\n\n\n\n

    First, under EU law, the collection of sensitive personal data must satisfy the particularly demanding requirement of strict necessity<\/strong>. Second, under Article 8 of the Convention, the handling of those data must remain subject to the broader requirements of proportionality <\/strong>and fair balance<\/strong>.<\/p>\n\n\n\n

    For national judges confronted with the increasingly extensive use of biometric data in criminal justice, the two lines of case-law should therefore be read together: strict necessity<\/strong> to determine whether the data should be collected at all; proportionality <\/strong>to ensure that, once collected, they are handled in a manner that respects the fair balance required by Article 8.<\/p>\n","protected":false},"excerpt":{"rendered":"

    The Comdribus case recently decided by the CJEU (C-371\/24, 19 March 2026) concerned the systematic collection of biometric data from persons suspected of having committed a criminal offence but ultimately not convicted. The case presents some striking similarities with S. and Marper v. the United Kingdom, decided by the ECtHR almost twenty years earlier (30562\/04 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,22,19],"tags":[],"class_list":["post-3695","post","type-post","status-publish","format-standard","hentry","category-court-of-justice-of-the-eu","category-european-court-of-human-rights","category-recent-case-law"],"translation":{"provider":"WPGlobus","version":"3.0.5","language":"fr","enabled_languages":["en","de","fr"],"languages":{"en":{"title":true,"content":true,"excerpt":false},"de":{"title":false,"content":false,"excerpt":false},"fr":{"title":false,"content":false,"excerpt":false}}},"_links":{"self":[{"href":"https:\/\/johan-callewaert.eu\/fr\/wp-json\/wp\/v2\/posts\/3695","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/johan-callewaert.eu\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/johan-callewaert.eu\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/johan-callewaert.eu\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/johan-callewaert.eu\/fr\/wp-json\/wp\/v2\/comments?post=3695"}],"version-history":[{"count":1,"href":"https:\/\/johan-callewaert.eu\/fr\/wp-json\/wp\/v2\/posts\/3695\/revisions"}],"predecessor-version":[{"id":3696,"href":"https:\/\/johan-callewaert.eu\/fr\/wp-json\/wp\/v2\/posts\/3695\/revisions\/3696"}],"wp:attachment":[{"href":"https:\/\/johan-callewaert.eu\/fr\/wp-json\/wp\/v2\/media?parent=3695"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/johan-callewaert.eu\/fr\/wp-json\/wp\/v2\/categories?post=3695"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/johan-callewaert.eu\/fr\/wp-json\/wp\/v2\/tags?post=3695"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}