In a ruling that strengthens privacy rights across the European Union, the Court of Justice of the European Union (CJEU) established strict limits on the retention of biometric and genetic data by law enforcement. The case, JH v Policejní prezidium, involved a Czech national convicted of a minor offense whose fingerprints and DNA were entered into a police database for an indefinite period. The Czech authorities argued that permanent retention was necessary for "police efficiency," but the Court found this practice to be a grave interference with the right to privacy under the Law Enforcement Directive.
The CJEU ruled that the retention of such sensitive data is only permissible if it is "strictly necessary". The judgment outlines three non-negotiable requirements for national laws: they must distinguish between different categories of convicts (e.g., shoplifters vs. violent offenders), mandate periodic reviews of the data's necessity, and provide an effective remedy for individuals to request deletion upon rehabilitation. The ruling effectively declares "store and forget" policies illegal and is expected to force legislative overhauls in member states with legacy DNA databases.
Source: COJ European Union