The GDPR

Instead, the Regulation introduces a specific provision for data processing on convictions for criminal offenses or security measures and proceeds with a clarification of that provision, the initial version of which was confusing (Article 10).

The data processing for these data can be performed only if:

- the data processing takes place under the control of official authority;

- the data processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.

Unlike the text of the Directive, the national law may not derogate from these conditions.

Finally, the comprehensive centralization of criminal convictions may be carried out only under the control of the official authority.

The Directive

The Directive provided for a derogation from the prohibition to process sensitive data to the processing of data relating to offences, criminal convictions or security measures (Article 8 (5), provided that they are conducted under the supervision of the public authority or that suitable specific safeguards are provided under national law.

Paragraph 5 in fine of Article 8 of the Directive specified that a file containing exhaustively all the criminal convictions may be kept only under the control of the official authority.

Potential issues

Differences can occur between the Member States with respect to the data processing related to convictions or criminal offences or security measures as far as the conditions of data processing are determined in the national law (terms of official authority controls or specific legislative authorization).

European Union

CJEU caselaw

C-141/12 ; C-372/12 (17 july 2014) - YS e.a.

1.      Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the data relating to an applicant for a residence permit contained in an administrative document, such as the ‘minute’ at issue in the main proceedings, setting out the grounds that the case officer puts forward in support of the draft decision which he is responsible for drawing up in the context of the procedure prior to the adoption of a decision concerning the application for such a permit and, where relevant, the data in the legal analysis contained in that document, are ‘personal data’ within the meaning of that provision, whereas, by contrast, that analysis cannot in itself be so classified.

2.      Article 12(a) of Directive 95/46 and Article 8(2) of the Charter of Fundamental Rights of the European Union must be interpreted as meaning that an applicant for a residence permit has a right of access to all personal data concerning him which are processed by the national administrative authorities within the meaning of Article 2(b) of that directive. For that right to be complied with, it is sufficient that the applicant be in possession of a full summary of those data in an intelligible form, that is to say a form which allows that applicant to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that he may, where relevant, exercise the rights conferred on him by that directive.

3.      Article 41(2)(b) of the Charter of Fundamental Rights of the European Union must be interpreted as meaning that the applicant for a residence permit cannot rely on that provision against the national authorities.

Opinion of Advocate general

Judgment of the Court

C-439/19 ( 22 June 2021) - Latvijas Republikas Saeima (Points de pénalité)

1. Article 10 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as applying to the processing of personal data relating to penalty points imposed on drivers of vehicles for road traffic offences.

2. The provisions of Regulation (EU) 2016/679, in particular Article 5(1), Article 6(1)(e) and Article 10 thereof, must be interpreted as precluding national legislation which obliges the public body responsible for the register in which penalty points imposed on drivers of vehicles for road traffic offences are entered to make those data accessible to the public, without the person requesting access having to establish a specific interest in obtaining the data.

3. The provisions of Regulation (EU) 2016/679, in particular Article 5(1), Article 6(1)(e) and Article 10 thereof, must be interpreted as precluding national legislation which authorises the public body responsible for the register in which penalty points imposed on drivers of vehicles for road traffic offences are entered to disclose those data to economic operators for re-use.

4. The principle of primacy of EU law must be interpreted as precluding the constitutional court of a Member State, before which a complaint has been brought challenging national legislation that proves, in the light of a preliminary ruling given by the Court of Justice, to be incompatible with EU law, from deciding, in accordance with the principle of legal certainty, that the legal effects of that legislation be maintained until the date of delivery of the judgment by which it rules finally on that constitutional complaint.

Opinion of Advocate general

Judgment of the Court

C‑205/21, Ministerstvo na vatreshnite raboti (26 January 2023)

1)      L’article 10, sous a), de la directive (UE) 2016/680 du Parlement européen et du Conseil, du 27 avril 2016, relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel par les autorités compétentes à des fins de prévention et de détection des infractions pénales, d’enquêtes et de poursuites en la matière ou d’exécution de sanctions pénales, et à la libre circulation de ces données, et abrogeant la décision-cadre 2008/977/JAI du Conseil, lu à la lumière de l’article 52 de la charte des droits fondamentaux de l’Union européenne,

doit être interprété en ce sens que :

le traitement de données biométriques et génétiques par les autorités de police en vue de leurs activités de recherche, à des fins de lutte contre la criminalité et de maintien de l’ordre public, est autorisé par le droit d’un État membre, au sens de l’article 10, sous a), de cette directive, dès lors que le droit de cet État membre contient une base juridique suffisamment claire et précise pour autoriser ledit traitement. Le fait que l’acte législatif national contenant une telle base juridique se réfère, par ailleurs, au règlement (UE) 2016/679 du Parlement européen et du Conseil, du 27 avril 2016, relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE (règlement général sur la protection des données), et non à la directive 2016/680, n’est pas de nature, en lui-même, à remettre en cause l’existence d’une telle autorisation, pour autant qu’il ressort, de manière suffisamment claire, précise et dénuée d’équivoque de l’interprétation de l’ensemble des dispositions applicables du droit national que le traitement de données biométriques et génétiques en cause relève du champ d’application de cette directive, et non de ce règlement.

Conclusions de l'avocat général (fr)

Arret rendu (fr)

Retour au sommaire Retour au sommaire