Climate justice action repression vs EU data protection law: the Advocate General’s opinion

Context matters: increasing repression of protestors

On 1 August, the Advocate General (AG) of the Court of Justice of the European Union (CJEU) released his opinion on the so-called “Comdribus” case. This case is important for digital rights and human rights organisations alike: it concerns the arrest and prosecution of a climate justice activist suspected of having organised a demonstration in Paris without giving prior notice to local authorities and of disobeying police orders. The activist, named “HW” in the judicial proceedings, was accused and sanctioned for refusing to provide fingerprints, palm prints or photographs during police custody.

This dispute highlights the potential role of data protection and privacy rights of activists, protestors and political dissidents against surveillance, in a wider context of increasing police repression against social movements and severe restrictions on the fundamental freedom of assembly in the European Union.
The French referring court has asked the CJEU to clarify EU data protection law in law enforcement matters, notably the provisions regulating the collection and use of sensitive categories of data like biometrics.

What does EU data protection law say?

Article 10 of the Law Enforcement Directive (LED) has a requirement of strict necessity for processing sensitive personal data, such as biometric data used for unique identification (e.g. fingerprints and facial images). In its previous case law (C-205/21), the CJEU has interpreted LED Article 10 as establishing strengthened conditions for lawful processing, emphasising that the processing can only be regarded as necessary in a limited number of cases. Specifically, the CJEU has ruled that the Article 10 of the LED prohibits the systematic collection of biometrics from any person accused of a criminal offence. However, it does not explicitly oblige competent authorities to demonstrate on a case-by-case basis that the collection is strictly necessary.

Systematic biometric data collection: law vs. reality

The wording of the questions from the French court assumes that the collection of biometric data is systematic. However, the French government submitted that it was incorrect to assert that French law provides for systematic collection of biometric data since collection is not an obligation, but only a possibility. The senior police officer authorising the collection has a margin of discretion. This is a subtle difference from the Bulgarian cases considered by the CJEU, as Bulgarian law mandates the collection of biometric data for police records in (almost) all cases.

HW argued that, in practice, the French police systematically collects fingerprints, as evidenced by the fact that the fingerprints of 6.5 million people are stored in the Automated Fingerprint Identification System (FAED). The size of the database should, in itself, call into question the French government’s claim that biometric data are strictly collected in line with the needs of investigations. Furthermore, HW gave their identity to the police, and the alleged offence was a very minor. These circumstances make it rather implausible that the collection of biometric data in the present case was “strictly necessary”.

However, the AG decided to trust the French government’s assertion that biometric data is not systematically collected He therefore concluded that the French national legislation is in line with LED requirements, as long as there is an obligation for police authorities to assess whether each data collection is strictly necessary.

Ultimately, it will be a matter for the French court to determine whether French law does, in practice, effectively prevent the systematic collection of biometric data and impose the individual, granular assessment assumed by the AG.

Is EU law of any help to activists?

However, the underlying rationale behind the AG’s answer p could make it more difficult for individuals like HW to challenge national laws and practices on grounds that they contravene EU law.

The problem is that Member States can still exploit any ambiguity in the national law when the CJEU simply rules that the national law should always be interpreted in accordance with EU law (like in the “Passenger Name Records” (PNR) ruling, C-817/19). Indeed, this is a requirement, but one that is not always complied with by Member States. When requesting guidance from the CJEU on assessing provisions in national law, the referring court may receive an answer which reflects a mostly hypothetical understanding of the national law.

Granted, unlike Bulgaria, the French law does not mandate the collection of biometric data from all suspected persons. Yet, there is considerable evidence that this practice is quite systematic and seemingly broader than the standard set previously by the CJEU, i.e. “in a limited number of cases”. In addition to the FAED, France’s criminal records police database called “TAJ” (which stands for Traitement des antécédents judiciaires) contained already 8 million photographs in 2018 – a higher number today presumably. Around 9% of the French population are included in biometric databases, according to Member States’ statistics collected in a Council document.

Therefore, the largely hypothetical answer proposed by the AG might be of little help to cases of disproportionate and abusive collection. His opinion highlights the clear limits of EU data protection law and its enforcement gaps, together forming the conditions for systemic impunity of Member States violating fundamental rights.

Potential added value of the AG’s opinion

In previous cases (C-205/21 and C-80/23), the CJEU has already ruled that national law must include an obligation for law enforcement to verify and demonstrate that the collection of biometric data is strictly necessary for the objectives pursued. It means notably that these objectives cannot be achieved with measures that interfere less with fundamental rights. For example, the identity of a person can often be established through less intrusive means than processing of biometric data, e.g. by presenting an identity card.

The French court inquired whether the competent authorities must provide the data subject with a statement of reasons, explaining why the collection of biometric data is strictly necessary. The AG rightly points out that the right to an effective judicial remedy, enshrined in Article 47 of the Charter, requires that the person concerned is able to ascertain the reasons upon which a decision is based, so they can effectively contest them in front of a court. The AG further argued that a statement of reasons is all the more necessary when the collection of biometric data by the police is not subject to prior review by a court.

During the oral hearing, governments argued that an obligation to provide reasons for each decision made under Article 10 of the LED would affect the proper conduct of criminal investigations. However, the AG countered this argument by emphasising that, since the collection of biometric data should not be systematic, the burden on law enforcement would not be excessive.

For these reasons, the AG proposes that national law must impose an obligation on competent authorities to provide, in each individual case, a sufficient statement of reasons for the decision that the collection of biometric data is strictly necessary.

Takeaways for digital rights

Overall, the AG Opinion is a mixed bag for the protection of fundamental rights in Member States that grant law enforcement extensivepowers to collect biometric data. The criterion of strict necessity in LED Article 10 does not completely rule out that biometric data can be collected for suspected involvement in minor offences, such as participation in climate demonstrations. This grants law enforcement wide discretion and makes it inherently difficult to challenge biometric data collection.

On a positive note,the AG Opinion states that law enforcement must justify the recording of biometric data and demonstrate its strict necessity according to the specific circumstances of each case. This could potentially counterbalance the wide discretion given to law enforcement and enable people, like HW, to challenge the collection of biometric data in court. However, given the remarks of national governments about a supposedly excessive burden for investigations, there may be opposition from the police when it comes to the practical implementation. This could, for example, manifest itself in standardised boilerplate statements of reasons. For people affected, this would represent an uphill battle when seeking remedies and challenging abusive biometric data collection.

Contribution by: Chloé Berthélémy, Senior Policy Advisor, EDRi & Jesper Lund, Chairman of EDRi member, IT-Pol