The Court of Justice of the European Union Condemns France’s Police Profiling Practices

Key Takeaways

• CJEU finds French fingerprint law violates EU proportionality
• Biometric data collection deemed not strictly necessary under EU law
• Police must provide justification when taking fingerprints or photographs
• TAJ holds 9 million photos; FAED stores 6.5 million fingerprints
• Refusal offence requires individual assessment, not automatic prosecution

Pulse Analysis

The Court of Justice of the European Union (CJEU) has long been the arbiter of cross‑border data‑protection standards, and its March 2026 “Comdribus” ruling marks a watershed for privacy law in Europe. By classifying French police biometric practices as disproportionate, the court reaffirmed the EU Charter’s strict necessity test for processing “sensitive” data. This decision not only clarifies the legal threshold for law‑enforcement surveillance but also signals to member states that blanket data‑collection powers will be scrutinized against fundamental rights, setting a precedent that could ripple through other national regimes.

France’s existing framework, anchored in Article 55‑1 of the Code of Criminal Procedure, has enabled the Automated Fingerprints Database (FAED) and the Judicial Records Database (TAJ) to amass roughly 6.5 million fingerprints and 9 million facial images. Critics argue that the databases function as a de‑facto mass‑surveillance tool, with police routinely extracting biometric profiles even from individuals who are merely detained or voluntarily interviewed. The CJEU’s condemnation forces French authorities to confront the operational reality that such systematic collection lacks a narrowly defined, indispensable purpose, and that officers must now justify each capture—a procedural shift that could strain resources but dramatically curtail privacy intrusions.

Looking ahead, the ruling is likely to catalyze legislative reform and spur a wave of compliance initiatives across the EU. French ministries will need to revise statutes, train officers, and potentially purge millions of records deemed unlawfully gathered, creating a market for data‑governance solutions and privacy‑by‑design technologies. Moreover, the decision may embolden privacy advocates in other jurisdictions to challenge similar biometric regimes, accelerating a broader European move toward tighter safeguards on law‑enforcement data collection. Companies operating in the security and surveillance space will need to adapt quickly to avoid liability and align with the heightened standards set by the CJEU.