Biometric Data Collection, Suspicion and the Risk of Mass Surveillance: The Limits of “Strict Necessity” Under Directive 2016/680

Abstract

This article examines the growing use of biometric data in criminal investigations under EU law, focusing on the interpretation of the “strict necessity” requirement in Article 10 of Directive (EU) 2016/680. Using the judgment in Case C-371/24 as a starting point, it analyses the legal and structural implications of collecting, retaining and reusing biometric data based on suspicion. It shows that biometric data, due to their sensitive and lasting nature, are increasingly stored in large-scale databases supporting both ongoing and future investigations. While suspicion triggers data collection, its relatively low threshold raises concerns when combined with long-term retention and reuse. Drawing on national examples, including France, the article highlights risks such as function creep, profiling and the expansion of data-driven policing. Although the Court requires case-by-case assessment and rejects systematic collection, the article argues that “strict necessity” is insufficient if applied only to individual measures, calling instead for a more structural approach.