Keep Factually independent
Whether you agree or disagree with our analysis, these conversations matter for democracy. We don't take money from political groups - even a $5 donation helps us keep it that way.
What recent EU Court of Justice rulings have addressed biometric data retention for travel documents?
Executive summary
Two recent rulings of the Court of Justice of the European Union (CJEU) have become central in debates over biometric retention tied to travel and policing: [1] the CJEU confirmed the Entry/Exit System (EES) regime will record facial images and fingerprints of non‑EU travellers as it rolls out from October 2025, with stored records and retention rules set by the system (e.g., typical retention three years; overstayers five years) [2] [3]. [4] In a November 20, 2025 judgment (Case C‑57/23), the CJEU said EU law does not bar Member States from allowing police to collect, retain and assess continued storage of biometric and genetic data of suspects or convicts — subject to safeguards and Directive 2016/680 principles [5] [6].
1. How the EES decision shapes travel-document biometric retention
The European Commission and media reporting explain that the Entry/Exit System (EES) will capture passport data plus biometric identifiers (facial image and fingerprints) of non‑EU nationals on first entry and subsequently check facial biometrics — effectively linking a travel document to a person and replacing passport stamps [2] [7]. Reporting and official materials state the EES is being rolled out from October 12, 2025 with full implementation targets in April 2026, and that data retention periods are explicit in system rules (typical retention: three years and one day for most short‑stay travellers; five years for overstayers) [2] [3].
2. The CJEU’s November 2025 judgment on police retention of biometric/genetic data
The Court’s November 20, 2025 judgment in Case C‑57/23 addressed national police powers under Directive 2016/680. The CJEU held that EU law does not preclude national legislation permitting the collection and storage of biometric and genetic data of suspects or convicts, including potentially without an express maximum storage period — provided such storage is governed by Member State law that is "accessible and sufficiently foreseeable" and the Directive’s safeguards [5] [8]. The Court attached conditions: purposes must not require distinguishing suspects from convicted persons and national law must guarantee rights and compliance with processing principles for sensitive data [5] [6].
3. Tension between border-system rules and policing powers
EES creates a tiered, harmonised register for travellers’ biometrics with specified retention times and technical safeguards [2] [9]. The CJEU’s policing judgment, by contrast, leaves room for Member States to adopt broader domestic rules for police databases under Directive 2016/680, subject to procedural safeguards and proportionality. Reporters and analysts note this combination means biometric data flows and retention will be governed by different legal frameworks depending on context: border management (EES/VIS) versus criminal‑justice/police processing (Directive 2016/680) [2] [5].
4. What proponents and critics emphasize
Proponents (including EU officials explaining EES) argue digital border systems make travel more efficient and secure while specifying technical safeguards and retention windows [2]. Reporting on the CJEU police judgment highlights judicial deference to national security and policing needs, stressing that Member States may assess ongoing needs for storage [5] [6]. Critics, as reflected in watchdog and press coverage, warn that allowing national discretion for police retention — combined with expansive border‑system databases — raises risks of indefinite or disproportionate retention unless national law and oversight are robust [5] [3].
5. Practical effects for travellers and residents
Visitors to Schengen will encounter biometric enrolment at first use of EES (photo + fingerprints), and subsequent trips generally use facial checks; passport stamps are replaced by digital records [7] [10]. The EES retention periods reported (three years and a day; five years for overstayers) mean non‑EU travellers’ biometrics may remain accessible to border authorities for multiple years under the system rules [3]. Available sources do not mention whether the CJEU policing judgment directly affects EES retention rules; the sources treat the rulings as applying in different statutory domains [5] [2].
6. Legal and policy open questions to watch
Sources indicate key areas to monitor: how national courts and legislatures interpret "accessible and sufficiently foreseeable" storage rules for police databases [5]; whether interoperability or data‑sharing policies will blur boundaries between EES and national police systems; and how oversight bodies like the EDPS will respond to ensure proportionality and safeguards [11] [5]. The available reporting does not describe any CJEU ruling that directly merges EES retention rules with police retention powers; that linkage is not found in current reporting (not found in current reporting).
Notes on sources and limits: this analysis is based solely on the provided reporting about the EES rollout and the CJEU judgment in Case C‑57/23 [2] [3] [5] [6]. Where the sources do not state a fact, I note that explicitly rather than infer beyond the cited material.