[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f36dCY_kqNiH0riuUKqvuhGgx41YOrFex95qhm1E3_qc":3},{"article":4,"iocs":39,"watch_terms":40,"solutions":41,"lesson":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"ddb811db-1977-41e2-9b33-6c2a4581cf4c","CJEU - C-205\u002F21 - Ministerstvo na vatreshnite raboti","cjeu-c-205-21-ministerstvo-na-vatreshnite-raboti-e4addf","Standardised names, added link ← Older revision Revision as of 12:21, 24 July 2026 Line 32: Line 32: |GDPR_Article_Link_3= |GDPR_Article_Link_3= |EU_Law_Name_1=Article 10 Directive 2016\u002F680 |EU_Law_Name_1=Article 10 Law Enforcement Directive 2016\u002F680 |EU_Law_Link_1= |EU_Law_Link_1=http:\u002F\u002Fdata.europa.eu\u002Feli\u002Fdir\u002F2016\u002F680\u002Foj |EU_Law_Name_2=Article 4(1) Directive (EU) 2016\u002F680 |EU_Law_Name_2=Article 4(1) Law Enforcement Directive 2016\u002F680 |EU_Law_Link_2= |EU_Law_Link_2=http:\u002F\u002Fdata.europa.eu\u002Feli\u002Fdir\u002F2016\u002F680\u002Foj |EU_Law_Name_3=Article 52 Directive 2016\u002F680 |EU_Law_Name_3=Article 52 Law Enforcement Directive 2016\u002F680 |EU_Law_Link_3= |EU_Law_Link_3=http:\u002F\u002Fdata.europa.eu\u002Feli\u002Fdir\u002F2016\u002F680\u002Foj |EU_Law_Name_4=Article 6(a) Directive 2016\u002F680 |EU_Law_Name_4=Article 6(a) Law Enforcement Directive 2016\u002F680 |EU_Law_Link_4= |EU_Law_Link_4=http:\u002F\u002Fdata.europa.eu\u002Feli\u002Fdir\u002F2016\u002F680\u002Foj |EU_Law_Name_5=Article 63 Directive 2016\u002F680 |EU_Law_Name_5=Article 63 Law Enforcement Directive 2016\u002F680 |EU_Law_Link_5= |EU_Law_Link_5=http:\u002F\u002Fdata.europa.eu\u002Feli\u002Fdir\u002F2016\u002F680\u002Foj |EU_Law_Name_6=Article 8 Directive 2016\u002F680 |EU_Law_Name_6=Article 8 Law Enforcement Directive 2016\u002F680 |EU_Law_Link_6= |EU_Law_Link_6=http:\u002F\u002Fdata.europa.eu\u002Feli\u002Fdir\u002F2016\u002F680\u002Foj |EU_Law_Name_7=Article 9 Directive 2016\u002F680 |EU_Law_Name_7=Article 9 Law Enforcement Directive 2016\u002F680 |EU_Law_Link_7= |EU_Law_Link_7=http:\u002F\u002Fdata.europa.eu\u002Feli\u002Fdir\u002F2016\u002F680\u002Foj |EU_Law_Name_8= |EU_Law_Name_8= |EU_Law_Link_8= |EU_Law_Link_8=","The Court of Justice of the European Union (CJEU) ruled in case C-205\u002F21 that member states must clarify which legal instrument applies when both GDPR and the EU Directive 2016\u002F680 are relevant for processing genetic and biometric data for law enforcement. This case involved Bulgarian police seeking to collect DNA, photographs, and fingerprints from a suspect.","CJEU rules on GDPR and Law Enforcement Directive applicability for genetic\u002Fbiometric data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-205\u002F21_-_Ministerstvo_na_vatreshnite_raboti&diff=52482&oldid=33165","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-07-24T12:21:27+00:00","2026-07-24T14:00:15.38986+00:00",7,[17,20],{"name":18,"type":19},"GDPR","product",{"name":21,"type":19},"Law Enforcement Directive 2016\u002F680","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":22,"icon":24,"name":25,"slug":26},null,"Policy","policy",[28,32,37],{"category":29},{"id":30,"icon":24,"name":18,"slug":31},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":33},{"id":34,"icon":24,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":22,"icon":24,"name":25,"slug":26},[],[18,21],{"controls":42,"vendors":43},[],[],{"slug":45,"title":46,"body":47,"framework_refs":48,"framework_notes":59},"cjeu-rules-member-states-must-clarify-legal-basis-for-law-enforcement-biometric-data-processing","CJEU Rules Member States Must Clarify Legal Basis for Law Enforcement Biometric Data Processing","The CJEU ruling in C-205\u002F21 highlights a critical compliance gap: organizations and member states must clearly identify which legal framework — GDPR or Directive 2016\u002F680 — governs the processing of sensitive biometric and genetic data in law enforcement contexts. The ambiguity between overlapping legal instruments creates risk of unlawful data processing and violations of individuals' fundamental rights. This matters because failing to establish a clear legal basis for processing special category data (DNA, fingerprints, photographs) can render entire investigative processes legally invalid and expose authorities to liability. Organizations handling dual-purpose data — where both civil and law enforcement uses are possible — must proactively map their data flows against applicable legal instruments before processing begins.",[49,50,51,52,53,54,55,56,57,58],"GDPR Article 9 — Processing of special categories of personal data","GDPR Article 10 — Processing of criminal conviction data","GDPR Article 30 — Records of processing activities","GDPR Article 35 — Data Protection Impact Assessment (DPIA)","EU Directive 2016\u002F680 — Law Enforcement Directive (LED)","EU Directive 2016\u002F680 Article 10 — Processing of special categories of data","NIST SP 800-188 — De-Identification of Government Datasets","NIST Privacy Framework PR.PO-P1 — Policies and procedures for data processing","CIS Control 3 — Data Protection","ISO\u002FIEC 27701 — Privacy Information Management System (PIMS)",{}]