CJEU Rules Member States Must Clarify Legal Basis for Law Enforcement Biometric Data Processing
Written by AI from the linked story. Not reviewed by an editor. How this works
The CJEU ruling in C-205/21 highlights a critical compliance gap: organizations and member states must clearly identify which legal framework — GDPR or Directive 2016/680 — governs the processing of sensitive biometric and genetic data in law enforcement contexts. The ambiguity between overlapping legal instruments creates risk of unlawful data processing and violations of individuals' fundamental rights. This matters because failing to establish a clear legal basis for processing special category data (DNA, fingerprints, photographs) can render entire investigative processes legally invalid and expose authorities to liability. Organizations handling dual-purpose data — where both civil and law enforcement uses are possible — must proactively map their data flows against applicable legal instruments before processing begins.
Tactical Insight
Immediate actions
- Conduct a legal basis audit for all existing biometric and genetic data processing activities to determine whether GDPR, Directive 2016/680, or both apply.
- Establish a documented data classification policy that explicitly distinguishes between law enforcement data processing and general public-sector data processing.
Long-term improvements
- Develop and maintain a Data Processing Register (Article 30 GDPR) that records the applicable legal instrument for each processing activity involving special category data.
- Engage legal counsel and Data Protection Officers to create clear decision frameworks for scenarios where GDPR and Directive 2016/680 overlap.
- Implement regular staff training on the distinctions between GDPR and EU Directive 2016/680 obligations for personnel handling biometric data.
Governance & Oversight measures
- Establish a cross-functional review board to assess new biometric data collection initiatives against both regulatory frameworks before deployment.
- Require mandatory Data Protection Impact Assessments (DPIAs) for any processing of genetic, biometric, or facial recognition data in law enforcement contexts.