What recent EU Court of Justice rulings have addressed biometric data explicit consent?
Executive summary
The Court of Justice of the European Union has in recent years issued a string of rulings tightening the conditions under which biometric and other special-category personal data may be lawfully processed, repeatedly emphasising that explicit, specific consent and strict storage limits are required in many contexts (Schrems/Meta C‑446/21; Policejní prezidium C‑57/23) [1] [2]. Those decisions dovetail with new EU rules and commentary that define biometric data precisely and flag its sensitivity in automated and AI-driven processing (Regulation (EU) 2024/1689; EDPS analysis) [3] [4].
1. Landmark: Schrems v Meta (C‑446/21) — explicit consent cannot be a carte blanche for indefinite processing
In its October 2024 Schrems ruling, the Court clarified that platforms may not rely on disclosed information or opaque inferences to process sensitive personal data for profiling or advertising without explicit, informed consent—and that consent alone does not legitimise indefinite retention of such data—tightening Article 9 protections under the GDPR (C‑446/21) [1] [5]. The judgment specifically held that a person’s public disclosure (here, of sexual orientation) did not allow a data controller like Meta to aggregate outside-sourced data for targeted ads absent that person’s explicit consent [5] [1].
2. Policejní prezidium (C‑57/23) — limits on storing biometric and genetic data by law enforcement
In a separate line of rulings, the Court found that directives governing law enforcement preclude the indefinite storage of biometric and genetic data where no maximum retention period is expressly laid down, and that indiscriminate collection and lifetime retention of such data on people who committed offences is unlawful (Policejní prezidium, C‑57/23) [2] [6]. The press material and coverage show the ECJ’s emphasis on necessity, proportionality and express legislative limits before biometric data may be held long term by public authorities [2] [6].
3. Case law on erasure and special categories — NG (C‑118/22) and related holdings
The Court’s January 30, 2024 judgment in C‑118/22 (NG) addressed the right to erasure for biometric and genetic data retained by police authorities, reinforcing that storage must meet strict legal bases and that individuals can seek deletion where retention exceeds what EU law permits (C‑118/22) [7] [6]. Reporting links this decision to the broader theme that special-category data enjoy heightened protections under EU law and that remedies like erasure must be meaningfully available [7] [6].
4. Broader doctrinal landscape: definitions, AI regulation, and borderline cases
The Court’s case law sits alongside the 2024 EU AI Regulation and evolving definitions that explicitly characterise biometric data as information derived from technical processing of physical or behavioural traits (Regulation (EU) 2024/1689), creating a legal and technical framework that reinforces the Court’s sensitivity to consent and retention questions [3]. Advocate-general opinions, EDPS commentary and subsequent scholarly and practitioner analyses interpret the rulings as pushing controllers—public and private—toward minimisation, documented necessity tests and clearer consent mechanisms [4] [3].
5. Competing perspectives and implicit agendas
Privacy advocates hail the ECJ’s rulings as necessary limits on surveillance and commercial profiling, while industry and some member-state law-enforcement voices warn of operational friction and increased compliance costs; legal commentators note that the Court’s strict approach can push legislatures to adopt clearer retention rules but can also create uncertainty for legitimate public-safety uses [2] [1]. Some reporting and analyses—especially from law firms and industry outlets—frame the rulings as legal risk to business models and may underplay the Court’s emphasis on the non-negotiable nature of explicit consent for certain automated uses [1] [8].
6. What remains unclear from available reporting
Available sources document key holdings on consent, retention and erasure for biometric and special-category data but do not fully catalogue every recent ECJ judgment on biometric consent beyond the named cases (Schrems C‑446/21; NG C‑118/22; Policejní prezidium C‑57/23) nor provide exhaustive text of ongoing follow-ups or how national authorities will operationalise fixed storage maxima across Member States [5] [7] [2]. The EU AI Regulation’s interplay with specific case outcomes is signalled in commentary but not resolved in judicial texts cited here [3].