With a new year comes a new European Court of Justice ruling on data protection issues! The European Court of Justice (ECJ) ruled that retaining biometric data of individuals with criminal convictions until their death, without discrimination, violates EU law, specifically addressing the right to erasure.
In case C-118/22 from Bulgaria, a person was convicted for providing false testimony during a criminal inquiry and requested that his name be removed from police records after completing a one-year suspended sentence and undertaking legal rehabilitation. Despite rehab, Bulgarian law permits authorities to keep and process personal data, such as fingerprints, pictures, and DNA samples, until the individual dies.
The ECJ ruled that national legislation requires data controllers to review periodically whether that storage is still necessary and to grant the data subject the right to have those data erased if that is no longer the case. This includes those with criminal offences who want to have their personal data removed from criminal sentences.
The underlying principle is that not all people pose the same degree of risk of being involved in other criminal offences and do not justify a uniform period of storage of the data (someone who was convicted of littering does not deserve the same retention period as a convicted murderer).
The Court has issued a press statement that has more detail and is worth reading. https://lnkd.in/ezHVW2Vf
By Daniel Whooley
I am just a guy interested in data protection, cybersecurity, politics, environmentalism, urban design, public transport, and history (I have too many hobbies).