CJEU - C-205/21 - Ministerstvo na vatreshnite raboti
CJEU rules on GDPR and Law Enforcement Directive applicability for genetic/biometric data.
The Court of Justice of the European Union (CJEU) ruled in case C-205/21 that member states must clarify which legal instrument applies when both GDPR and the EU Directive 2016/680 are relevant for processing genetic and biometric data for law enforcement. This case involved Bulgarian police seeking to collect DNA, photographs, and fingerprints from a suspect.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe CJEU ruling in C-205/21 highlights a critical compliance gap: organizations and member states must clearly identify which legal framework — GDPR or Directive 2016/680 — governs the processing of sensitive biometric and genetic data in law enforcement contexts. The ambiguity between overlapping legal instruments creates risk of unlawful data processing and violations of individuals' fundamental rights. This matters because failing to establish a clear legal basis for processing special category data (DNA, fingerprints, photographs) can render entire investigative processes legally invalid and expose authorities to liability. Organizations handling dual-purpose data — where both civil and law enforcement uses are possible — must proactively map their data flows against applicable legal instruments before processing begins.