CEDH · CASELAW;COMMUNICATEDCASES;ENG — 14 février 2025

.s800EAC49 { font-size:12pt } .s379BC09C { margin-top:36pt; margin-bottom:0pt; text-align:right } .sBB9EE52A { font-family:Arial } .sF9195E13 { margin-top:24pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s339D85E6 { margin-top:0pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s10950C61 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify } .sCA1147F8 { margin-top:12pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s29100277 { font-family:Arial; font-weight:bold } .sA36B60A1 { font-family:Arial; font-style:italic } Published on 3 March 2025 THIRD SECTION Application no. 42776/21 Mihail Hristov ANGELOV against Bulgaria lodged on 10 August 2021 communicated on 14 February 2025   SUBJECT MATTER OF THE CASE The application concerns a complaint that the retention of the applicant’s personal data by a laboratory and its refusal to destroy the data, confirmed by a specialised body and two levels of courts, breached the applicant’s right to respect for his private life. The applicant complains in particular that the authorities, deciding on his request to have his data destroyed and/or returned to him, did not adequately assess the necessity of any continued retention/processing of his data after the purpose for which he had provided it voluntarily had ceased to exist. The case raises an issue under Article 8 of the Convention (the applicant also invokes Articles 6 § 1 and 13). On 25 April 2018 the applicant applied to a (private) laboratory, X, requesting to have his DNA profile established. The applicant wished to have his DNA profile compared to the one created by X in respect of another private individual, S.D., with a view to determining if the applicant and S.D. were son and mother. S.D. had also applied to X with a request to that effect, following which she had her DNA profile established by X. In the context of his application to X, the applicant filled-in a form provided by X for that purpose, requesting X to make a DNA expertise. He provided cellular material (saliva), which X collected by taking two samples   – a main buccal swab and a control buccal swab. The DNA expertise in respect of the applicant and that in respect of S.D. were requested on a voluntary basis, were not ordered by a court and were not meant to be used in any legal procedure aiming to establish maternity. The form which the applicant filled-in contained the statement that the results would be used solely for his personal information and not in any way against the interests of third parties. The form did not contain information about for how long the data would be retained. On 14 June 2018, after the DNA expertise had been prepared and the results communicated to the applicant, he asked X in writing to delete his personal data from its database and to have the control buccal swab returned to him. On 25 June 2018 X’s manager sent a letter to the applicant, refusing his request. He specified that the laboratory needed to keep the control buccal swab provided by the applicant for a period of 20 years. This was necessary in order to be able to demonstrate the veracity of the results of the DNA expertise which it had prepared in the applicant’s case. The applicant challenged the refusal before the Commission for Protection of Persona Data (“the Commission”, a State body). In a decision of 17 July 2019 the Commission rejected his challenge, finding that the data controller   X had acted in compliance with the requirements of the Regulation   (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation – “the GDPR”). The applicant brought judicial review proceedings. The Sofia City Administrative Court, acting at first instance, confirmed the Commission’s refusal of the applicant’s request on 19 December 2019. Upon the applicant’s appeal, the Supreme Administrative Court upheld the lower court’s findings in a final decision of 15 March 2021. The highest administrative court held that the continued retention and processing of the applicant’s data by X as data controller, after the DNA expertise had been prepared in his regard, were based on legal grounds provided for in Article   17 § 3(b)(e), and Article 6 § 1(f) in conjunction with Article 9 § 2(f), of the GDPR. Those grounds allowed data controllers not to erase personal data without undue delay, in particular when that was necessary for the compliance with a legal obligation (in the applicant’s case those were specifically X’s obligations under Article 38 § 1(3) of the Tax and Social Security Code of Procedure and under section 12(1)(2) of the Accounting Act), or for the defence of legal claims (which the court found might potentially be brought against X by private individuals questioning the veracity of the DNA expertise produced by X in respect of the applicant). Thus, X’s actions had complied entirely with the requirements of the GDPR, which in turn provided equivalent protection to individual fundamental rights as that found in the European Convention on Human Rights and the Court’s related case law. QUESTIONS TO THE PARTIES Was the validation by the relevant authorities of the laboratory’s refusal to delete and/or return to the applicant his personal data (including his cellular material and DNA profile), which the laboratory purports to store for a period of 20 years, “in accordance with the law” and “necessary in a democratic society” to attain one or more of the aims in Article 8 § 2 of the Convention (see, mutatis mutandis , L.B. v. Hungary [GC], no. 36345/16, §§ 103 and 106, 9 March 2023 and S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, §§ 101-103, 107 and 121, ECHR 2008 on the right to protection of personal data under the Convention; P.N. v. Germany , no.   74440/17, § 84, 11 June 2020 and Catt v. the United Kingdom , no.   43514/15, § 111, 24 January 2019 on the different types of personal data;   as well as Liebscher v. Austria , no. 5434/17, §§ 60-63, 6 April 2021 on States’ positive obligations in respect of effectively protecting Article 8 rights in the context of data protection)? In particular, in their decision making process, did the authorities ensure that the available procedural safeguards were adequately and effectively applied in the applicant’s case (see, mutatis mutandis , Catt , § 111 and Liebscher , §§ 61-62 and 64-69, both cases cited above, in respect of the applicable standard to judicial scrutiny in this context)?