{"id":101385,"date":"2025-11-25T10:40:20","date_gmt":"2025-11-25T09:40:20","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=101385"},"modified":"2025-11-25T10:42:52","modified_gmt":"2025-11-25T09:42:52","slug":"may-the-police-retain-your-dna-and-fingerprints-indefinitely-in-case-of-suspicion-of-a-crime","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/mag-de-politie-uw-dna-en-vingerafdrukken-onbeperkt-bewaren-bij-verdenking-van-een-misdrijf\/","title":{"rendered":"May the police retain your DNA and fingerprints indefinitely when a crime is suspected?"},"content":{"rendered":"

The processing of sensitive personal data, such as DNA and fingerprints, by police departments balances on the line between effective law enforcement and citizen privacy. In a ruling<\/a> 20 November 2025, the Court of Justice of the European Union (CJEU) ruled that the police may collect and store biometric and genetic data from suspects of intentional crimes without a legally established maximum period, provided that a periodic review is carried out to determine whether storage is still strictly necessary.<\/p>\n\n\n\n

The facts and context of the case<\/h2>\n\n\n\n

This ruling stems from a case in the Czech Republic in which an individual (hereinafter \u2018JH\u2019) was suspected of corruption and economic crimes<\/sup>. During the investigation, despite JH's resistance, the police took fingerprints and DNA samples to identify him and include him in police databases<\/sup>.<\/p>\n\n\n\n

JH challenged this in the national court. He argued that the collection of this sensitive data was disproportionate, given that he was only suspected of an economic crime without violence, he had no criminal record, and the likelihood of recidivism was considered low<\/sup>. Moreover, he argued that the police kept this data indefinitely with no clear legal limit<\/sup>.<\/p>\n\n\n\n

The Czech Supreme Administrative Court thereupon submitted preliminary questions to the European Court on the interpretation of Directive (EU) 2016\/680<\/a> (the Police and Justice Data Protection Directive). <\/p>\n\n\n\n

The ruling: the rules around biometric data<\/h2>\n\n\n\n

The Court of Justice's ruling clarifies three crucial points for police practice and the rights of suspects:<\/p>\n\n\n\n

1. Collection when intentional crimes are suspected<\/h3>\n\n\n\n

Police may collect biometric and genetic data from any person suspected or accused of having intentionally committed a criminal offense. The legislation is not required to make strict distinctions between different categories of suspects in advance, as long as the purposes of the collection do not require such distinctions.<\/p>\n\n\n\n

2. No hard end date, but periodic review<\/h3>\n\n\n\n

Article 4(1)(e) of Directive 2016\/680 does not oppose a regime where there is no absolute maximum period of storage. However, storage should not be unlimited without control. There should be a regime that sets appropriate time limits for periodic review. During this review it should be assessed whether extension of storage is still strictly necessary.<\/p>\n\n\n\n

3. Internal rules and case law as legal basis<\/h3>\n\n\n\n

The assessment of the necessity of storage may be based on internal rules of the police, as long as these rules oblige the police to respect \u2018strict necessity. Moreover, the Court ruled that the concept of \u2019member state law\u2018 (the legal basis for data processing) may also be formed by case law, provided it is accessible and foreseeable and establishes the minimum conditions for processing.<\/p>\n\n\n\n

\n\n\n\n

Legal analysis and interpretation<\/h2>\n\n\n\n

This ruling clarifies the application of Directive 2016\/680, which was transposed in Belgium in Title 2 of the Data Protection Act<\/a>.<\/p>\n\n\n\n

The criterion of \u201cstrict necessity\u201d<\/h3>\n\n\n\n

The Court emphasizes that special categories of personal data (such as DNA and fingerprints) are subject to heightened protection. Processing is allowed only when strictly necessary. This is a stricter test than for \u2018ordinary\u2019 personal data. The police must consider specific factors when assessing this necessity, such as:<\/p>\n\n\n\n