The Court of Justice of the European Union condemns France’s police profiling practices

On 19 March 2026, the Court of Justice of the European Union (CJEU), the highest court in the EU, issued a highly anticipated ruling named “Comdribus” regarding France’s law enforcement data collection practices. The Court assessed how French law allows the collection of fingerprints and photographs of suspects and concludes that it is disproportionate and contrary to EU law. La Quadrature du Net recently denounced police officers’ unchecked practice of taking photographs of people arrested on the streets. This court case showcases another illegal feature of the sprawling edifice of French police databases. It is urgent to dismantle it.

The story begins in 2020 when the plaintiff HW , the person that initiated the lawsuit, participated in an Extinction Rebellion protest on the Champs-Elysées in Paris. HW was arrested because the protest was not registered and he was accused of “rebellion” (i.e. failing to follow police instructions). As it is usually the case, the French police ordereds protesters to give their phone access code and their biometric data (called “signaletic profile” in French), in order to feed and update police databases.

Article 55-1 of the French Code of Criminal Procedure provides for the collection of data,  including fingerprints and a photograph of individuals suspected of having committed an offence. The fingerprints are then stored in the Automated Fingerprints Database (FAED), while the photograph is sent to the Judicial Records Database (TAJ). The TAJ constitutes the highly controversial legal basis for identifying individuals through facial recognition. Police records biometric data for potential or future comparisons in other investigations.

Back to 2020: HW refused to comply with the police identification procedure. However, refusing to provide such data collection is an offence in France, regardless of whether the individual was ultimately convicted of the original offence. This is known as a “stand-alone” offence. Although HW was acquitted of the charges of participating in the undeclared demonstration and of refusing to provide their phone code, they remained prosecuted only for refusing to give their biometric data to the police.

During the proceedings, HW’s lawyer decided to forward the case before the CJEU, so that the Court could examine whether the law enforcement data collection system under French law respects fundamental rights and freedoms protected by the Charter of Fundamental Rights of the EU, in particular the right to privacy. The Court answered (1) this question in its ruling of 19 March, which constitutes a scathing condemnation of France.

Absence of “strict necessity”

Firstly, the Court addresses the compliance of French law with the principle of proportionality. The collection of fingerprints and photographs is considered a processing of biometric data, which are considered “sensitive” data under EU law. This type of processing is therefore prohibited in principle and is only permissible if “strictly necessary” (2).

This notion of “strict necessity” offers strong protection because it means that the collection of fingerprints and photographs can never be carried out systematically. Firstly, the purposes of data processing in this particular case the identification of the perpetrators of an offence, must be sufficiently precisely defined. Secondly, the data collected must be strictly necessary and relevant to achieve that purpose. This means that no alternative method that is less intrusive to fundamental rights is available to achieve the objective just as effectively. Consequently, the processing of biometric data canis only be permitted in a very limited number of cases.

However, Article 55-1 of the French Code of Criminal Procedure allows police officers to take police identification data from “any individual against whom there is one or more plausible grounds to suspect that they have committed or attempted to commit a criminal offence.” Indeed, as in HW’s case, a person simply placed in custody, even without charges being brought against them, is subject to the collection of fingerprints and photographs. The Court consider this scope to be far too broad: the mere existence of a suspicion does not satisfy the requirement of “strict necessity.” Furthermore, the legal provisions establishing the TAJ and FAED databases do not reflect this requirement and apply to a vast number of situations and individuals. (3)

The French government attempted to defend itself by claiming that the collection of biometric data was not an obligation, but merely a discretionary power for police officers, who had significant leeway to decide whether or not such collection was necessary. The Court rejected this argument , calling on the Court of Appeal, which will review the case at national level to examine the “effective implementation of the law”. The Court strongly invited the national court to check how the law is actually enforced by police on the ground rather than, solely considering the literal wording of the law. (4)

The Court’s interpretation allows us to conclude that the French legal framework for fingerprint and photograph collection is contrary to the law of the EU as it does not respect the condition of strict necessity.

The requirement for justification is absent from French law

Secondly, the CJEU examines howwhether French law requires or not police officers to justify their decision to collect biometric data. It requires that a clear explanation must be provided to the individual concerned, even briefly, in order to allow them to exercise their right to an effective remedy. The Court adds that the possibility of a judge later reviewing the legality of the collection does not exonerate the police of their duty of providing an explanation to the individual.

Finally, as biometric data collection must not be systematic but limited to a small number of cases of strict necessity and not systematic, the Court considers that requiring officers to justify their decision does not constitute an unreasonable burden. This is a direct response to the French government, which had argued during the hearing that complying with this requirement would place an excessive workload on police officers.

French law does not impose any obligation to justify the collection of biometric data, and is therefore contrary to EU law. In practice, police officers never explain why they take fingerprints or photographs when a person is detained or interrogated. According to lawyers’ testimonies, these procedures have become routine in police stations, even for individuals attending voluntary interviews or minors. That explains the staggering numbers of 9 million photographs in the TAJ and 6.5 million fingerprints in the FAED. Moreover, Article 55-1 is often used to pressure individuals, threatening them with sanctions or detention if they refuse to have their data collected. It should also be noted that, since 2022, fingerprint collection can even be carried out by force.

Lastly, the Court examines the “stand-alone” nature of the offence of refusing to provide one’s fingerprints. This stand-alone offence means that a person can be prosecuted solely for their refusal, independently of the circumstances that led to their arrest. Unfortunately, the Court does not condemn this principle. However, they require very strict conditions to be met before prosecuting someone for such refusal. Prosecution must take into account the individual circumstances of the person in question (behaviour, profile, prior record) and should be reserved for the most serious cases. Once again, French law fails to meet these requirements, as many individuals are prosecuted solely on the basis of this offencewithout any individual assessment of their situation.

French law enforcement data collection system under crosshair

This decision by the CJEU marks a significant change in French law. In fact, its conclusions delegitimise the whole philosophy that has allowed the police files to be populatedcompiled. In France, data collection by law enforcement is not considered an exception but as a way to gather as much data as possible. Practice shows that if this information is available or retrievable, the police will take it “just in case,” for later use. If a person is at a police station, their biometric data will be collected. If a person is stopped, their photo will be taken and they may be identified through facial recognition, even if this practice is illegal, just as La Quadrature du Net recently denounced in partnership with the media outlet Disclose.

According to this logic, anybody could potentially be a future suspect or be found guilty, justifying the collection of data in a “preventive” way and without any valid reason. This vision that anybody is suspect by default is the very foundation of mass surveillance. Thanks to its decision, the Court of Justice requires an upheaval of this ideology. Contrary to what French law provides for, the collection of information and biometric data should not be routine or should not affect a big part of the population, but rather an exceptional measure reserved for rare cases.

The Comdribus judgment is therefore delivers a major blow to the abusive and mass surveillance that has been in place for years. The Ministry of the Interior must break its silence, be held accountable, and immediately order the end of systematic collection of fingerprints and photographs by the police. This landmark ruling should lead to a complete overhaul of the law and the deletion of the millions of illegitimate records currently contained in the TAJ and FAED databases.

Contribution by: EDRi member, La Quadrature du Net