CASE OF P.N. v. GERMANY

FIFTH SECTION

CASE OF P.N. v. GERMANY

(Application no. 74440/17)

JUDGMENT
 

Art 8 • Respect for private life • Five-year retention of photographs, description of the person, finger and palm prints of a repeat offender, subject to safeguards and individualised review • Same principles applicable to the taking of finger and palm prints • Taking of physical description less intrusive than that of a photograph • Retention of the data in issue less intrusive than that of cellular samples and DNA profiles • Domestic courts’ individualised assessment of whether the applicant was likely to be suspected again of a criminal offence, based on nature, severity and number of offences of which he had been previously convicted • Discontinued criminal proceedings relevant to a limited extent in that assessment • Possibility of judicial review • No indication of insufficient protection against unauthorised access to or dissemination of the data • Limited duration and effect of the data retention on the applicant’s daily life

STRASBOURG

11 June 2020

FINAL

16/11/2020

This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision.

In the case of P.N. v. Germany,

The European Court of Human Rights (Fifth Section), sitting as a Chamber composed of:

 Síofra O’Leary, President,
 Gabriele Kucsko-Stadlmayer,
 Ganna Yudkivska,
 André Potocki,
 Yonko Grozev,
 Lәtif Hüseynov,
 Anja Seibert-Fohr, judges,
and Victor Soloveytchik, Deputy Section Registrar,

Having regard to:

the application against the Federal Republic of Germany lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a German national, Mr P.N. (“the applicant”), on 16 October 2017;

the decision to give notice to the German Government (“the Government”) of the complaint under Article 8 of the Convention and to declare the remainder of the application inadmissible;

the decision not to have the applicant’s name disclosed;

Having deliberated in private on 21 April 2020,

Delivers the following judgment, which was adopted on that date:

INTRODUCTION

The application concerns a police order for photographs as well as fingerprints and palm prints to be taken from the applicant and for a description of his person to be drawn up. The applicant submitted that this collection of identification data, ordered on the basis of only a few convictions for petty offences dating back a long time, amounted to a disproportionate interference with his right to respect for his private life under Article 8 of the Convention.

THE FACTS

1.  The applicant was born in 1961 and lives in Dresden. He had been granted legal aid and was represented by Mr I.-J. Tegebauer, a lawyer practising in Trier.

2.  The Government were represented by one of their Agents, Mr H.‑J. Behrens, of the Federal Ministry of Justice and Consumer Protection.

3.  On 7 May 2018 the Vice-President of the Section granted leave to Privacy International, under Article 36 § 2 of the Convention and Rule 44 § 3 of the Rules of Court, to intervene as a third party in the Court’s proceedings concerning the present case. By letter dated 14 June 2018 that organisation informed the Court that, having been unable to obtain any further information relating to the case, they did not consider themselves to be in a position to provide submissions which might assist the Court in the case.

4.  The facts of the case, as submitted by the parties, may be summarised as follows.The administrative proceedings

5.  On 18 August 2011 the Dresden police, relying on Article 81b, second alternative, of the Code of Criminal Procedure (see paragraph 24 below), ordered identification data to be collected from the applicant. In particular, photographs of the applicant’s face and body, including detail pictures, notably of possible tattoos, were to be taken, as well as fingerprints and palm prints. A description of his person was also to be drawn up. The order was based on criminal proceedings against the applicant (see paragraph 6 below).

6.  The police found that, as required by Article 81b, second alternative, of the Code of Criminal Procedure, criminal proceedings had been opened against the applicant in June 2011 for receiving and handling stolen goods after he had bought a stolen bike. It further noted that the applicant was a recidivist. He had been sentenced, in particular, to a fine in 2010 for casting false suspicion on a third person of having committed a criminal offence. In 2009 proceedings for assault and damage to property against him had been discontinued following payment of a sum of money. In 2004 proceedings for fraud (concerning the renting of an apartment) had been discontinued as the applicant’s wrongdoing was considered to be minor. In 2001 the applicant had been sentenced to a term of imprisonment for fraud and making a false declaration in lieu of an oath (concerning cheques issued in respect of a closed bank account) and in 2000 he had been sentenced to a fine for fraud (conclusion of a friendly settlement in court despite his knowing that he would be unable to pay the sum agreed upon). Two further sets of proceedings for withholding wages and salaries and for damage to property had been discontinued in 1999 and 2000 respectively because they concerned insignificant secondary offences compared with the offences of which the applicant had been or could have expected to be convicted.

7.  The police concluded that it was therefore likely that the applicant would commit or be suspected of similar offences in the future. In their view, the identification measures ordered were necessary and proportionate. They would facilitate investigation measures concerning future offences, in particular property offences, as the applicant could more easily be confirmed or excluded as a perpetrator.

8.  On 24 August 2011 the applicant lodged an administrative appeal. He argued that in view of the three petty offences of which he had been convicted, some of them ten years previously, the order was disproportionate. On 16 May 2012 the Dresden police dismissed the appeal. The police confirmed, in particular, that criminal proceedings which had been discontinued without the applicant having been proven innocent could be taken into account, albeit to a lesser extent, alongside his convictions in assessing the likelihood that the applicant would commit or be suspected of offences in the future.

9.  Subsequently, on 4 June 2012, the prosecution discontinued the criminal proceedings opened against the applicant in June 2011 for receiving and handling stolen goods (see paragraph 6 above), on the grounds that there was insufficient proof to prefer charges against the applicant. It could not be proved that the applicant had known that the bicycle which was as new and which he had bought for 29 euros at a flea market had been stolen.The proceedings before the Dresden Administrative Court

10.  On 16 March 2015 the Dresden Administrative Court dismissed an action lodged by the applicant on 15 June 2012 against the decision of the Dresden police, which had been upheld on appeal (see paragraph 8 above). It found that the requirements under Article 81b, second alternative, of the Code of Criminal Procedure for collecting identification data from the applicant were met.

11.  The court noted that, as required by Article 81b, second alternative, of the Code of Criminal Procedure, the applicant had been suspected of an offence, namely receiving and handling stolen goods, at the time when the police order had been made. It was immaterial that the criminal proceedings in that regard had subsequently been discontinued.

12.  The measures ordered had been and still were necessary for the purposes of the police records department, that is, for identification purposes. Referring to the principles developed in the well-established case‑law of the Federal Administrative Court and the Saxony Court of Appeal, the Administrative Court reiterated that measures taken for the purposes of the police records department were necessary if, in the light of the facts established in the course of the criminal (investigation) proceedings against the person concerned, there were reasons to suppose in the circumstances of the case, on the basis of criminological evidence, that the person concerned would in the future again be suspected with good reason of having participated in a criminal act, and that the identification material would then facilitate the investigations by showing the person concerned to be guilty or innocent. The circumstances of the case to be taken into account included the nature and severity of the criminal offence of which the person concerned was suspected and the manner in which the offence in question had been committed, the personality of the suspect and the length of time for which the person had not come to the notice of the criminal investigation authorities.

13.  In the present case, taking into account the numerous occasions on which criminal investigation proceedings had been opened against the applicant, resulting in some cases in his conviction, the court took the view that the police could reasonably consider that there were reasons to suppose that the applicant might be suspected of a criminal offence in the future.

14.  The court noted that in the period from 1986 to 2001 the applicant had been convicted thirteen times. It referred to the list of previous convictions set out in a judgment of the Dresden District Court of 2 December 2013, which included convictions for offences including traffic offences, intoxication, theft, fraud and insolvency offences. The applicant had been sentenced to terms of imprisonment ranging from two months to two and a half years on five occasions and to fines ranging from 20 daily rates to 330 daily rates on the remaining occasions.

15.  According to the court, it was true that, compared with the period from 1986 to 2001, the frequency of investigation proceedings opened against the applicant had considerably decreased. However, the applicant had been sentenced to a fine of 40 daily rates in 2010 for casting false suspicion on a third person of having committed a criminal offence; this showed that the offence in question was not a petty offence. In 2007 proceedings for fraud (to the detriment of car insurance companies) were discontinued following the payment of a sum of money. In the same year, proceedings for fraud (sale of a damaged washing machine) were discontinued as there was insufficient proof to bring charges against the applicant.

16.  The court stressed that, owing to the preventive nature of an order to collect identification data under Article 81b, second alternative, of the Code of Criminal Procedure, the necessity of such an order did not cease to exist when proceedings did not result in a conviction but were discontinued either following the payment of a sum of money or because the perpetrator’s guilt was considered to be minor, or because there was insufficient proof to bring charges against the perpetrator (unless, at the end of the proceedings, it was clear that the person concerned was innocent). The court further noted that even during the present proceedings, on 2 December 2013, the applicant had again been sentenced to a suspended fine, this time for the offence of insult.

17.  Furthermore, the applicant’s state of health, namely his reduced mobility as a result of rheumatoid arthritis, did not exclude the risk of his being involved in the commission of offences, since the offences he had been suspected of to date had not necessitated much physical movement.

18.  In the court’s view, having regard to the nature, severity and number of offences in respect of which investigation proceedings had been instituted against the applicant in the past twenty-five years, the order for the collection of identification data had been a proportionate interference with his personality rights. The applicant could obtain the deletion of his data from the police register if his future conduct showed that the data were no longer needed.The proceedings before the Saxony Administrative Court of Appeal

19.  On 7 October 2016 the Saxony Administrative Court of Appeal, endorsing the reasons given by the Dresden Administrative Court, dismissed the applicant’s request to admit his appeal for examination.The proceedings before the Federal Constitutional Court

20.  On 17 November 2016 the applicant, represented by counsel, lodged a constitutional complaint with the Federal Constitutional Court against the Dresden police’s order of 18 August 2011, the judgment of the Dresden Administrative Court and the decision of the Saxony Administrative Court of Appeal. Setting out the content of the impugned decisions, he argued that the order for the collection of identification data from him violated, inter alia, his personality rights under the Constitution and his human dignity.

21.  By a letter dated 24 November 2016 the registry of the Federal Constitutional Court informed the applicant that there were doubts about the admissibility of his constitutional complaint. The applicant was told that he might not have sufficiently substantiated his complaint as only his submissions, but not the copies of the impugned decisions of the authorities and courts, had been received at the court within the one-month time-limit.

22.  Meanwhile, on 30 March 2017, the Dresden police collected identification data from the applicant in accordance with its order of 18 August 2011.

23.  On 10 May 2017 the Federal Constitutional Court, without giving reasons, declined to consider the applicant’s constitutional complaint (file no. 1 BvR 804/17). According to the introductory part of the decision, the constitutional complaint was directed against the Dresden police’s order of 18 August 2011 and the judgment of the Dresden Administrative Court.

RELEVANT LEGAL FRAMEWORKRELEVANT DOMESTIC LAW

24.  Article 81b of the Code of Criminal Procedure lays down the requirements for collecting identification data from a suspect. It reads as follows:

“Photographs and fingerprints of persons suspected of having committed an offence may be taken, even against their will, and measurements and other similar measures carried out with regard to them, in so far as this is necessary for the purposes of conducting the criminal proceedings or for the purposes of the police records department (für die Zwecke des Erkennungsdienstes).”

25.  According to Articles 481 § 1 and 484 § 4 of the Code of Criminal Procedure, the use for the prevention of crime of personal data obtained in criminal proceedings or stored in police databases for the purposes of future criminal proceedings is regulated by the Police Acts of the Länder. The Saxony Police Act, in so far as relevant, provides as follows:

Section 43 The storage, modification and use of data

“(1) The police may save personal data in records or data files, and also modify and use them, in so far as this is necessary for the performance of their tasks ....

(2) The police may also save, modify and use personal data which they have acquired in the course of criminal investigation proceedings or from persons who are suspected of having committed a criminal offence, in so far as this is necessary in order to protect against threats to public safety, in particular for the purposes of taking precautionary steps aimed at preventing criminal offences. If the suspicion on the basis of which the data were saved no longer subsists, the data shall be deleted.

(3) The duration for which the data are saved shall be limited to what is strictly necessary. In the case of automated data files, time-limits shall be set for conducting a review of whether the continued searchable storage of the data is still necessary (review deadline). For non-automated data files and records, review deadlines or maximum storage periods shall be fixed. These should take into account the purpose of the storage, as well as the type and significance of the reason for the storage.

(4) The review deadlines or maximum storage periods to be fixed under sub‑section 3 may not exceed ten years for adults ... For cases of minor importance, shorter deadlines shall be set. ...”

26.  The review deadlines or maximum storage periods referred to in the Saxony Police Act are laid down in the directive of 1 January 2007 issued by Saxony’s State Ministry of the Interior concerning the keeping of police archives of personal data in the police stations of the State of Saxony (Richtlinie des Sächsischen Staatsministeriums des Innern für die Führung kriminalpolizeilicher personenbezogener Sammlungen in den Polizeidienststellen des Freistaates Sachsen). It provides, in particular, as follows:

“5.2. If following a review storage is no longer permitted or the personal data are no longer necessary for the purposes of police work when the review deadlines or maximum storage periods under section 43(3) of the Saxony Police Act are reached, the data must be deleted.

...

5.4. Defining review deadlines or maximum storage periods

5.4.1. The decisions on setting review deadlines or maximum storage periods in the individual case at hand, and on deletion, are to be made by the police service handling the matter.

5.4.2. Personal data are to be deleted, as a rule, following prior review:

- after two years, in particular

- in cases of minor significance,

- in cases concerning children,

- where the person concerned has died ... .

- after five years where young adults and adults are concerned, and in special cases after ten years ... .

Cases of minor significance usually relate to offences prosecuted at the victim’s request and offences dealt with in simplified proceedings.

Special cases usually relate to criminal offences of considerable significance, ... .”

27.  A decision by the police refusing the request for the deletion of the data can be made subject to judicial review by the administrative courts in accordance with the general provisions of administrative procedural law.RELEVANT COUNCIL OF EUROPE INSTRUMENTS

28.  The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (“the Data Protection Convention” or “Convention 108”), of 28 January 1981, has been ratified by all 47 Council of Europe member States. It entered into force in respect of Germany on 1 October 1985 and is currently being modernised. Article 2 defines “personal data” as “any information relating to an identified or identifiable individual (‘data subject’)”.

29.  The Data Protection Convention provides, in particular, as follows:

Article 5 – Quality of data

“Personal data undergoing automatic processing shall be

...

(b)  stored for specified and legitimate purposes and not used in a way incompatible with those purposes;

(c)  adequate, relevant and not excessive in relation to the purposes for which they are stored;

...

(e)  preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored.”

Article 6 – Special categories of data

“Personal data revealing racial origin, political opinions or religious or other beliefs, as well as personal data concerning health or sexual life, may not be processed automatically unless domestic law provides appropriate safeguards. The same shall apply to personal data relating to criminal convictions.”

Article 7 – Data security

“Appropriate security measures shall be taken for the protection of personal data stored in automated data files against accidental or unauthorised destruction or accidental loss as well as against unauthorised access, alteration or dissemination.”RELEVANT EUROPEAN UNION TEXTS

30.  Data protection principles in the context of law enforcement under EU law are notably laid down in Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA. The Directive provides, in particular:

“Article 4

Principles relating to processing of personal data

1. Member States shall provide for personal data to be:

...

(c)  adequate, relevant and not excessive in relation to the purposes for which they are processed;

...

(e)  kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed;

(f)  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”

“Article 5

Time-limits for storage and review

Member States shall provide for appropriate time limits to be established for the erasure of personal data or for a periodic review of the need for the storage of personal data. Procedural measures shall ensure that those time limits are observed.”

“Article 10

Processing of special categories of personal data

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be allowed only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:

(a)  where authorised by Union or Member State law;

(b)  to protect the vital interests of the data subject or of another natural person; or ...”

THE LAW

ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION

31.  The applicant complained that the police order to collect identification data from him – by taking (for the purpose of storage and use) photographs as well as fingerprints and palm prints and by drawing up of a description of his person – had violated his right to respect for his private life as provided for in Article 8 of the Convention, which reads as follows:

“1.  Everyone has the right to respect for his private and family life, his home and his correspondence.

2.  There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”AdmissibilityThe parties’ submissions

32.  The Government argued that the applicant had not exhausted domestic remedies as required by Article 35 § 1 of the Convention. Firstly, it had to be noted that according to the introductory part of the decision of the Federal Constitutional Court the constitutional complaint had only been directed against the Dresden police’s order of 18 August 2011 and the Dresden Administrative Court’s judgment of 16 March 2015, but not the decision of the Saxony Administrative Court of Appeal of 7 October 2016. The Government conceded, however, that in his constitutional complaint the applicant had also complained about the decision of the Saxony Administrative Court of Appeal.

33.  Secondly, the Government took the view that the applicant’s constitutional complaint had not been lodged in compliance with the formal requirements and time-limits of domestic law. According to the letter of 24 November 2016 from the registry of the Federal Constitutional Court to the applicant, the latter had not submitted copies of the impugned decisions of the domestic courts within the one-month time-limit for lodging a constitutional complaint. Unlike in the case of Keles v. Germany (no. 32231/02, § 42, 27 October 2005), there were therefore concrete indications that the applicant had not complied with the formal requirements of domestic law and that the Federal Constitutional Court had not examined the applicant’s complaint on the merits.

34.  The applicant argued that he had exhausted domestic remedies for the purposes of Article 35 § 1 of the Convention. It was true that the decision of the Federal Constitutional Court had not mentioned the decision of the Saxony Administrative Court of Appeal of 7 October 2016, but he had also complained about the latter decision before that court. The Federal Constitutional Court had not given any reasons for declining to consider his constitutional complaint. In such circumstances it was the Court’s practice, as established in its case-law (the applicant referred to Keles, cited above, § 44), not to speculate as to why the Federal Constitutional Court had not accepted the complaint for adjudication.The Court’s assessment

35.  The Court reiterates that, whereas Article 35 § 1 of the Convention must be applied with some degree of flexibility and without excessive formalism, it normally requires that the complaints intended to be brought subsequently before the Court should have been made to the appropriate domestic courts, at least in substance and in compliance with the formal requirements and time-limits laid down in the domestic law (see, among other authorities, Cardot v. France, 19 March 1991, § 34, Series A no. 200, and Elçi and Others v. Turkey, nos. 23145/93 and 25091/94, § 604, 13 November 2003). However, non-exhaustion of domestic remedies cannot be held against the applicant if, in spite of the latter’s failure to observe the forms prescribed by law, the competent authority has nevertheless examined the substance of the complaint (see, among other authorities, Skałka v. Poland (dec.), no. 43425/98, 3 October 2002; Uhl v. Germany (dec.), no. 64387/01, 6 May 2004; and Keles v. Germany, no. 32231/02, § 42, 27 October 2005).

36.  The Court further reiterates that it has dealt with a number of applications in which the German Federal Constitutional Court had declined to consider an applicant’s constitutional complaint without giving any reasons. In these cases, in which there were no indications that the Federal Constitutional Court itself considered that the applicant had not complied with the formal requirements for lodging the constitutional complaint, the Court stated that it was not in a position to take the place of the Federal Constitutional Court and to speculate as to why that court had decided not to admit the complaint. The applicants were therefore found to have exhausted domestic remedies for the purposes of Article 35 § 1 (compare, inter alia, Keles, cited above, § 44; Kaya v. Germany (dec.), no. 31753/02, 11 May 2006; Stork v. Germany, no. 38033/02, § 33, 13 July 2006; and Marc Brauer v. Germany, no. 24062/13, §§ 25 and 29, 1 September 2016 – the last case concerned an objection that the applicant in the case had not submitted his constitutional complaint with appendices to the Federal Constitutional Court within the statutory one-month time-limit).

37.  The Court observes that in the present case the applicant, in his constitutional complaint, gave an account of the proceedings before the police and the administrative courts. It notes in this context that it is uncontested that in his submissions to the Federal Constitutional Court, the applicant also complained about the decision of the Saxony Administrative Court of Appeal. He therefore brought his complaint about this decision, which he likewise contests before this Court, before the Federal Constitutional Court, notwithstanding the fact that, for reasons which this Court cannot discern, that decision was not mentioned in the introductory part of the Federal Constitutional Court’s decision. The applicant complained before the Constitutional Court that the order to collect identification data from him violated, inter alia, his personality rights under the Constitution and his human dignity. It follows that the applicant raised the complaint he subsequently brought before this Court in substance before the Federal Constitutional Court.

38.  As for the applicant’s compliance with the formal requirements and time-limits laid down in domestic law, the Court notes that the Federal Constitutional Court itself did not give any reasons for declining to consider the applicant’s constitutional complaint. In particular, it did not state that it had done so because of a failure to comply with the formal requirements. In these circumstances, the Court cannot speculate as to why the Federal Constitutional Court decided not to admit the complaint for adjudication and whether or not it examined the substance of the complaint.

39.  The applicant has therefore exhausted domestic remedies for the purposes of Article 35 § 1 of the Convention.

40.  The Court further notes that this complaint is neither manifestly ill‑founded nor inadmissible on any other grounds listed in Article 35 of the Convention. It must therefore be declared admissible.MeritsThe parties’ submissions

(a)   The applicant

41.  The applicant submitted that the interference with his right to respect for his private life as a result of the taking, use and storage of identification data from him had not been justified and had thus violated Article 8 of the Convention.

42.  The applicant conceded that this interference had a basis in domestic law, namely Article 81b, second alternative, of the Code of Criminal Procedure as interpreted by the domestic courts. The impugned measure had also pursued the legitimate aim of the prosecution and prevention of crime.

43.  However, the taking, use and storage of his personal data had not been necessary in a democratic society. In the applicant’s view, the domestic courts had erroneously concluded that it was likely that he would reoffend. The order had been based on a suspicion of his having received and handled stolen goods, but the proceedings in that regard had been discontinued subsequently for lack of proof. The vast majority of the previous investigation proceedings against him had likewise been discontinued and could not, therefore, be taken into account. Most of his previous convictions dated back a very long time and the more recent convictions concerned petty offences. In the past seventeen years, he had only been convicted once, in 2010, of casting false suspicion on a third person of having committed a criminal offence, for which he had been sentenced to a fine of EUR 400. In 2013 he had merely been issued with a warning for insult and the fine had been suspended. Therefore, the order to collect identification data from him had been disproportionate.

44.  Moreover, the applicant argued that his serious illness had not been taken into account in assessing the proportionality of the order to collect identification data from him. Owing to the restricted mobility caused by his rheumatoid arthritis it was, firstly, increasingly unlikely that he would commit further offences. Secondly, his illness would be aggravated by the collection of identification data from him and by the fact that they were being stored in a register for criminals, alongside the data of sexual offenders, a situation to which he strongly objected.

45.  The applicant further submitted that the Federal Criminal Police stored some 2.8 million fingerprints in their automated fingerprint identification system; this indicated that the police were collecting excessive amounts of such data.

(b)   The Government

46.  The Government submitted that the impugned order to collect identification data had not breached Article 8. The interference with the applicant’s right to respect for his private and family life as a result of the order had been justified. The legal basis for the order, Article 81b, second alternative, of the Code of Criminal Procedure, as interpreted in the well-established case-law of the Federal Administrative Court which had been applied by the authorities and courts in the present case, was sufficiently precise. In accordance with the requirements established in the cases of Malone v. the United Kingdom and S. and Marper v. the United Kingdom, the scope of the authorities’ discretion had been restricted with regard to the types of measures which could be ordered and their aim.

47.  The interference had also pursued a legitimate aim, namely the prevention and prosecution of offences and thus the protection of the rights and freedoms of others. It had also been necessary in a democratic society.

48.  The Government stressed that in the past twenty-five years, investigation proceedings had had to be conducted against the applicant repeatedly and he had been convicted fourteen times. The offences of which the applicant had been convicted, as set out in the domestic authorities’ decisions (see paragraphs 6 and 14-15 above), could not be considered as minor.

49.  Likewise, the proportionality of the measures had not been compromised by the fact that, subsequent to the order for the collection of identification data, the criminal proceedings against the applicant for handling and receiving stolen goods had been discontinued. Under Article 81b of the Code of Criminal Procedure, such an order could only be made against a person suspected of an offence at the time of the order; this served to ensure the foreseeability and thus the proportionality of the measure concerned. However, as the order did not serve the purposes of the proceedings regarding the offence in question, but rather preventive purposes, domestic law did not require that the person concerned be found guilty of the offence of which he or she was suspected.

50.  For the same reason, the proceedings against the applicant which had been discontinued following payment of a sum of money or because they concerned a minor offence or insignificant additional offences – without the suspicions against the applicant having been fully dispelled – could likewise be taken into account in the individualised assessment of the likelihood that the data in question would be required for future investigation proceedings.

51.  Moreover, unlike, for instance, the taking of DNA material, the taking of fingerprints and photographs did not contain much information on the person concerned and thus constituted a relatively minor interference which did not have a serious impact on that person.

52.  Given that the applicant had been convicted of another offence (insult) since the order to collect identification data from him, he had shown again that his state of health did not prevent him from committing further offences.

53.  Furthermore, Article 81b, second alternative, of the Code of Criminal Procedure did not permit the blanket and indiscriminate retention of data. The provision required it to be likely that the person concerned would be suspected of criminal offences in the future and that the identification data collected would then facilitate the investigations; this required an individual assessment of each case. The authorities had not overstepped their margin of appreciation in coming to the conclusion that the applicant met these requirements.

54.  German law also contained adequate safeguards against abuse. Under Article 481 § 1 and 484 § 4 of the Code of Criminal Procedure, read in conjunction with section 43(2) and (3) of the Saxony Police Act and the directive issued by Saxony’s State Ministry of the Interior in this regard (see paragraphs 25-26 above), personal data could only be stored for as long as the data were required to combat offences. As a rule, data were deleted after five years unless they were still required in order for the police to fulfil their tasks.

55.  Finally, compared with the number of fingerprints stored by the police in the United Kingdom (8 million fingerprints) and France (4.6 million fingerprints), the number of fingerprints stored in the databank of the German Federal Police (2.8 million) could not be considered excessive.The Court’s assessment

(a)   Whether there was an interference

56.  The Court reiterates that the concept of private life extends to aspects relating to personal identity, such as a person’s photograph. The right to the protection of one’s image presupposes the individual’s right to control the use of that image (see Von Hannover v. Germany (no. 2) [GC], nos. 40660/08 and 60641/08, §§ 95-96, ECHR 2012, §§ 95-96, ECHR 2004‑VI with further references). The taking of a person’s photograph and its retention in a police database with the possibility of it being processed automatically constitutes an interference with the right to respect for private life under Article 8 of the Convention (see Gaughran v. the United Kingdom, no. 45245/15, §§ 65-70, 13 February 2020 – not yet final).

57.  The taking and storage on the national authorities’ records of the fingerprints of an identified or identifiable individual also amounts to an interference with that person’s right to respect for private life (see S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, §§ 78‑86, ECHR 2008; M.K. v. France, no. 19522/09, § 26, 18 April 2013; and Gaughran, cited above, § 63).

58.  Likewise, the storing by a public authority of information relating to an individual’s private life, such as contact details of convicted persons, is an interference with that right (see Gardel v. France, no. 16428/05, § 58, ECHR 2009).

59.  In the present case, the police ordered that photographs as well as fingerprints and palm prints be taken from the applicant and a description of his person be drawn up for the police records; this was designed to serve future identification purposes. That order was subsequently executed (see paragraph 22 above). The Court, having regard to its case-law, considers that the taking and storage of these various types of personal data amount to interference with the applicant’s right to respect for his private life. This was indeed not contested by the Government.

60.  The Court finds, in particular, that the taking of palm prints constitutes a measure which, both in its intensity and as regards the possible future use of the data obtained, is very similar to the taking of fingerprints; therefore, the same considerations must apply. The physical description of the applicant and its inclusion in the police records for future identification purposes must be considered comparable to the taking of a photograph, albeit less intrusive. However, as the Court has previously considered that even the storing of contact details of a convicted offender by a public authority was an interference with the individual’s right to respect for private life, Article 8 is likewise applicable to the applicant’s physical description and its inclusion in the police records.

(b)   Whether the interference was justified

(i)  Whether the interference was “in accordance with the law”

61.  In order to be justified in accordance with Article 8 § 2, such interference must be in accordance with the law, which presupposes the existence of a basis in domestic law compatible with the rule of law. The law must be adequately accessible and foreseeable, that is, formulated with sufficient precision to enable the individual – if need be with appropriate advice – to regulate his conduct. For domestic law to meet these requirements, it must afford adequate legal protection against arbitrariness and accordingly indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise (see Malone v. the United Kingdom, 2 August 1984, §§ 66-68, Series A no. 82; Rotaru v. Romania [GC], no. 28341/95, § 55, ECHR 2000-V; S. and Marper, cited above, § 95; and M.K. v. France, cited above, § 30).

62.  Moreover, it is essential in the context of the retention of an individual’s identification data to have minimum safeguards concerning, inter alia, duration, storage, usage, access of third parties, procedures for preserving the integrity and confidentiality of data and procedures for its destruction, thus providing sufficient guarantees against the risk of abuse (see S. and Marper, cited above, § 99 with many references; see also, mutatis mutandis, Rotaru, cited above, §§ 56-59, and Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria, no. 62540/00, §§ 75-77).

63.  In determining whether the conditions for a law’s foreseeability are met, the Court has regard not only to the wording of the legal provision in question, but also to the definition of its meaning and scope in the case-law of the domestic courts (compare, for instance, Malone, cited above, § 66, and Peruzzo and Martens v. Germany (dec.), nos. 7841/08 and 57900/12, §§ 36-38, 4 June 2013).

64.  The Court observes that the order to collect identification data from the applicant was based on Article 81b, second alternative, of the Code of Criminal Procedure. This accessible provision enumerates with a high degree of precision the type of identification data which may be collected – photographs and fingerprints, measurements and other similar data. It must be considered as foreseeable that the data here at issue, namely photographs, fingerprints and palm prints and a physical description of the applicant, would fall within the range of measures permitted under that provision.

65.  As regards the circumstances in which such data may be collected from persons suspected of having committed an offence, Article 81b, second alternative, of the Code of Criminal Procedure provides that this may be done “in so far as this is necessary for the purposes ... of the police records department”. While this wording is relatively broad, the superior administrative courts have clarified and clearly circumscribed the meaning of this provision in their established case-law. According to that case-law, the authorities have to make an individualised assessment of whether it is likely that the identification material would be useful in future investigation proceedings against that person. The authorities must have regard in this context to, among other criteria, the nature and severity of the offence of which the person concerned is suspected, that person’s personality and the type and frequency of previous offences (see in detail paragraph 12 above).

66.  The Court considers that Article 81b, second alternative, of the Code of Criminal Procedure, as interpreted by the national superior courts in their established case-law, thereby indicated with sufficient clarity the scope of discretion conferred on the competent authorities by that provision and the manner of its exercise, and was thus adequately foreseeable.

67.  The Court further observes that the applicant did not contend that Article 81b, second alternative, of the Code of Criminal Procedure, taken together with Articles 481 § 1 and 484 § 4 of the same Code read in conjunction with section 43(2) and (3) of the Saxony Police Act and point 5 of the relevant directive issued by Saxony’s State Ministry of the Interior, lacked precision as regards the conditions for storing, using and deleting the identification data obtained. It considers that the question whether that provision provided sufficient guarantees against the risk of abuse is more appropriately examined with reference to whether more broadly the interference was necessary in a democratic society (see paragraphs 69 et seq. below; compare, for a similar approach, inter alia, S. and Marper, cited above, § 99; Peruzzo and Martens, cited above, § 39; and M.K. v. France, cited above, § 31).

(ii)  Whether the interference pursued a legitimate aim

68.  The collection of identification data from persons such as the applicant served the prevention of crime as well as the protection of the rights of others, namely by facilitating the investigation of future crimes. It therefore pursued legitimate aims for the purposes of Article 8 § 2 of the Convention.

(iii)  Whether the interference was “necessary in a democratic society”

(α)   General principles

69.  It remains to be determined whether the interference in question can be considered “necessary in a democratic society”, which means that it must answer a “pressing social need” and, in particular, be proportionate to the legitimate aim pursued, and that the reasons adduced by the national authorities to justify it must be “relevant and sufficient” (see S. and Marper, cited above, § 101, and M.K. v. France, cited above, § 33).

70.  In relation, in particular, to interference concerning personal data, the Court reiterates that the protection of such data is of fundamental importance to a person’s enjoyment of his or her right to respect for private life as guaranteed by Article 8 of the Convention. The domestic law must therefore afford appropriate safeguards to prevent any such use of personal data as may be inconsistent with the guarantees of this Article (see S. and Marper, cited above, § 103; Gardel, cited above, § 62; and B.B. v. France, no. 5335/06, § 61, 17 December 2009).

71.  The need for such safeguards is all the greater where the protection of personal data undergoing automatic processing is concerned, not least when such data are used for police purposes. The domestic law should notably ensure that such data are relevant and not excessive in relation to the purposes for which they are stored, and preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored (see Article 5 of the Data Protection Convention, paragraph 29 above; see also Gardel, cited above, § 62). The domestic law must also afford adequate guarantees that retained personal data are efficiently protected from misuse and abuse (see notably Article 7 of the Data Protection Convention). The above considerations are especially valid as regards the protection of special categories of more sensitive data (see Article 6 of the Data Protection Convention; and S. and Marper, cited above, § 103; M.K. v. France, cited above, § 35; and Peruzzo and Martens, cited above, § 42).

72.  In its assessment of the proportionality of national measures comprising the collection of personal data in the context of criminal proceedings and their subsequent retention, the Court, in its case-law, has had regard, in particular, to the following elements. It considered whether and how the domestic authorities had taken into account the nature and gravity of the offences in question in their decision to retain data (see S. and Marper, cited above, §§ 113 and 119; M.K. v. France, cited above, § 41; and Peruzzo and Martens, cited above, § 44). It further noted whether these authorities had taken into account in that decision the fact that the person concerned was subsequently not convicted (see S. and Marper, cited above, §§ 106, 113, 119 and 122; and M.K. v. France, cited above, §§ 41-42).

73.  Furthermore, the Court had regard to the level of the actual interference with the right to respect for private life. It found, in particular, that the retention of cellular samples was particularly intrusive compared with other measures such as the retention of fingerprints, given the wealth of genetic information contained therein (see S. and Marper, cited above, § 120). The Court also considered it to be a relevant factor whether there was a time-limit for the retention of the data, and the length of that time-limit (see S. and Marper, cited above, §§ 107 et seq. and 119; Gardel, cited above, §§ 67-68; M.K. v. France, cited above, § 45; and Peruzzo and Martens, cited above, § 46).

74.  Another relevant element in the Court’s assessment of the proportionality of the impugned measures was whether there was an independent review of the necessity to further retain the data in question, allowing the deletion in practice of the data if they were no longer needed for the purpose for which they had been obtained (see S. and Marper, cited above, § 119; Gardel, cited above, § 69; M.K. v. France, cited above, § 44; and Peruzzo and Martens, cited above, § 46). Finally, the Court also determined whether, in the light of the above case-law, there were sufficient safeguards against abuse (such as unauthorised access to or dissemination) of the data (see Gardel, cited above, §§ 62 and 70, and Peruzzo and Martens, cited above, § 47).

75.  A margin of appreciation must be left to the national authorities in their assessment whether the interference is necessary in a democratic society. The breadth of this margin varies and depends on a number of factors, including the nature of the Convention right in issue, its importance for the individual, the nature of the interference and the object pursued by the interference. The margin will tend to be narrower where the right at stake is crucial to the individual’s effective enjoyment of intimate or key rights (see Connors v. the United Kingdom, no. 66746/01, § 82, 27 May 2004, with further references, and Peruzzo and Martens, cited above, § 41). Where a particularly important facet of an individual’s existence or identity is at stake, the margin allowed to the State will be restricted. Where, however, there is no consensus within the member States of the Council of Europe, either as to the relative importance of the interest at stake or as to how best to protect it, the margin will be wider (see S. and Marper, cited above, § 102).

(β)   Application of these principles to the present case

76.  In determining whether the impugned collection and storage of identification data from the applicant, which pursued the aims of the prevention of offences and of the protection of the rights of others, was proportionate to the aims pursued, the Court observes, firstly, that the police and the domestic courts had to take into account the nature and gravity of the offences previously committed by the applicant in their decision to collect and store identification data from him (see paragraph 65 above).

77.  As required by the superior administrative courts’ case-law, the courts, in an individualised assessment of whether it was likely that the applicant might again be suspected of a criminal offence in the future, had regard to the nature, severity and number of offences of which he had previously been convicted. They noted that in a period dating back some fifteen to thirty years, the applicant had been convicted thirteen times of offences such as theft, fraud, traffic and insolvency offences; he had been sentenced to fines but also, on five occasions, to terms of imprisonment ranging from two months to two and a half years. Since then, the number of convictions had considerably decreased; the applicant had been fined in 2010 for casting false suspicion on another person of having committed an offence and had been sentenced to a suspended fine for insult in 2013 (see in detail paragraphs 15-16 above).

78.  The domestic authorities further took into consideration several sets of investigation proceedings for offences including assault, damage to property and fraud which had been discontinued in the years preceding the order, while attaching less weight to these proceedings. These proceedings were discontinued either following the payment of a sum of money or because the offence in question was considered as a minor or insignificant secondary offence, or because there was insufficient proof to bring charges against the applicant, without the applicant, in the domestic authorities’ view, having been proven innocent, which was the relevant standard under domestic law (see in detail paragraphs 6, 8 and 15-16 above).

79.  As the domestic authorities stressed, these last proceedings were taken into account in their preventive assessment of whether it was likely that the applicant might be suspected of an offence in the future. The Court can therefore accept that these discontinued proceedings, none of which ended with the domestic authorities’ finding that the applicant was innocent and in the absence of any indication that these proceedings had been instituted arbitrarily, were also relevant, to a very limited extent, in that assessment.

80.  The Court further takes note of the applicant’s submission that it was increasingly unlikely that he would reoffend owing to the restrictions on his mobility caused by his rheumatoid arthritis. It observes, however, that the domestic courts included his physical condition in their overall assessment and expressly found that the applicant’s previous offences had not necessitated much physical movement (see paragraph 17 above). Moreover, following the police order for the collection of identification data in 2011, the applicant was again found guilty of an offence (insult) in 2013.

81.  In view of these elements, while the Court accepts that the applicant has not been found guilty of a particularly serious offence, it cannot but note the domestic courts’ finding that he has been convicted on numerous occasions and that some of his offences were sufficiently serious for terms of imprisonment to be imposed on him. Moreover, criminal investigations had to be opened against him repeatedly, including in the years preceding the order for the collection of identification data.

82.  As to whether the domestic authorities took into account the fact that the applicant was subsequently not found guilty of the offence of handling stolen goods in the proceedings in the context of which the collection of his data had been ordered, the Court notes that, in accordance with domestic law, the outcome of these proceedings was not relevant for the decision to collect and store the applicant’s data. An order to collect identification data under Article 81b, second alternative, of the Code of Criminal Procedure could only be made against a person suspected of having committed an offence at the time of the order. As the Government explained (see paragraph 49 above), this served to ensure the foreseeability of the measure. However, the subsequent outcome of these proceedings was not decisive in the individual assessment of whether, having regard notably to previous investigation proceedings against him, it was likely that the applicant might be suspected of an offence in the future, the investigation of which would then be facilitated by the identification data collected from him (see also paragraphs 11-12 above).

83.  The Court would note that the present case differs in this respect from cases such as S. and Marper (cited above, §§ 106, 113-114 and 122‑123) or M.K. v. France (cited above, §§ 41-42). In those two cases, the proceedings which had led to the order for the collection of identification data had likewise been discontinued or the applicants had been acquitted of the offences in question. However, unlike in the present case, there had not been any previous convictions that were taken into account in the decision to collect the data in question.

84.  In its assessment of the proportionality of the impugned measure, the Court further considers it an important element that the collection and retention of the identification data here at issue – photographs, fingerprints and palm prints and a description of the person – constitute a less intrusive interference with the applicant’s right to respect for his private life notably than the collection of cellular samples and the retention of DNA profiles, which contain considerably more sensitive information.

85.  As regards the duration of retention of the identification data in question, the Court observes that domestic law, namely Articles 481 § 1 and 484 § 4 of the Code of Criminal Procedure, read in conjunction with section 43(2) and (3) of the Saxony Police Act and point 5 of the relevant directive issued by Saxony’s State Ministry of the Interior (see paragraphs 25-26 above), provides for specific deadlines for review of whether the continued storage of the data is still necessary. Data must be deleted if they are no longer necessary for the purposes of police work. The purposes of the storage, as well as the type and significance of the reason for the storage, must be taken into account in the assessment thereof. In a case like that of the applicant – an adult offender whose offences were neither of minor nor of special significance as defined by the relevant directive – personal data are to be deleted, as a rule, after five years. As has been stressed by the Dresden Administrative Court (see paragraph 18 above), the applicant could thus obtain the deletion of his data from the police register if his conduct showed that the data were no longer needed.

86.  The Court observes that the present case thus differs also in this respect from cases such as S. and Marper (cited above, § 119) and Gaughran (cited above, § 94), which concerned the indefinite retention of data, or M.K. v. France (cited above, § 45) where it was found that in practice data were retained for twenty-five years.

87.  In view of the relatively limited intrusiveness and duration of the collection as such of the identification data in question and the limited effect of the retention of the data in an internal police database on the applicant’s daily life, the Court, having regard to the material before it, further considers that the applicant failed to substantiate that his state of health (see paragraph 44 above) has been affected by the stress and unease caused by the impugned measure.

88.  It is also apparent from the foregoing considerations that there is a possibility of review – by the police authorities, subject to judicial review (see paragraph 27 above) – of the necessity of further retaining the data in question. It is clear from the provisions of domestic law (see paragraphs 25‑26 above), as well as from the reasons given in the Administrative Court’s judgment (see paragraph 18 above), that these data are to be deleted – as a rule, five years after their storage – if there were no fresh criminal investigation proceedings against the applicant in that period. The mere interest of the investigation authorities in having a database with a large number of references is thus not sufficient to justify the retention of the data (contrast M.K. v. France, cited above, § 44). There is nothing to indicate that this review does not, in practice, allow the deletion of the identification data if they are no longer needed for the purpose for which they were obtained.

89.  The Court further notes that there is nothing to indicate, and the applicant has not argued, that the identification data taken from him and stored by the police were insufficiently protected against abuse such as unauthorised access or dissemination.

90.  Having regard to the foregoing considerations, the Court concludes that the reasons adduced by the national authorities to justify the interference with the applicant’s right to respect for his private life by the taking and storage of personal data from him were “relevant and sufficient”. The collection and storage of these data in the present case struck a fair balance between the competing public and private interests and therefore fell within the respondent State’s margin of appreciation. Accordingly, the impugned measure constituted a proportionate interference with the applicant’s right to respect for his private life and can be regarded as necessary in a democratic society. It was therefore justified in accordance with Article 8 § 2.

91.  There has accordingly been no violation of Article 8 of the Convention.

FOR THESE REASONS, THE COURT, UNANIMOUSLY,Declares the application admissible;Holds that there has been no violation of Article 8 of the Convention.

 Victor Soloveytchik Siofra O’Leary
 Deputy Registrar President

 

Full & Egal Universal Law Academy