CJEU rules on data storage under Law Enforcement Directive
The Court of Justice of the European Union (CJEU) recently issued a significant judgment regarding the storage of personal data of individuals convicted of crimes under EU Directive 2016/680 (Law Enforcement Directive). The case involved a person seeking the erasure of their data from police records after being legally rehabilitated following a criminal conviction. The CJEU analyzed whether national legislation allowing the indefinite storage of such data, even after legal rehabilitation, complies with EU data protection laws.
The CJEU emphasized the importance of data minimization and proportionality in the processing of personal data by competent authorities for criminal purposes. It highlighted that personal data should only be stored for as long as necessary and subject to appropriate time limits for erasure or periodic review. The judgment underscored the need for Member States to establish clear rules governing the scope and application of limitations on data processing to protect the fundamental rights of individuals.
Furthermore, the CJEU examined the specific provisions of Directive 2016/680, including the processing of special categories of personal data like biometric and genetic data. It emphasized that such sensitive data must be processed only when strictly necessary and subject to enhanced safeguards for the rights and freedoms of the data subjects. The judgment clarified that erasure of personal data should occur without undue delay if processing infringes EU data protection provisions or legal obligations.
Overall, the CJEU’s ruling serves as a reminder of the importance of upholding data protection principles and respecting individuals’ rights to privacy and personal data protection. It sets a precedent for Member States to ensure that data storage practices align with EU laws, emphasizing proportionality, data minimization, and the right to erasure. This judgment reinforces the EU’s commitment to safeguarding personal data and upholding fundamental rights in the context of criminal data processing.
