{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:62023cj0313","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:62023cj0313)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-23","fingerprint":"ewai:eu:b67bfc","proof":"sha256:af59759d31aa02483b99e51a8efe0fdca2a5be15be8050ed65e998df96d4aad8","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:62023cj0313","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62023CJ0313","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (First Chamber)","paragraphs":[]},{"title":"30 April 2025 (\n *1\n )","paragraphs":["para_4","para_5","para_6","para_7","para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_26"]},{"title":"2","paragraphs":["para_28"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"3","paragraphs":[]},{"title":"Recitals 16 and 20 of the GDPR state:","paragraphs":["para_33","para_34","para_35"]},{"title":"(20)","paragraphs":["para_37"]},{"title":"4","paragraphs":["para_39","para_40"]},{"title":"2.   This Regulation does not apply to the processing of personal data:","paragraphs":[]},{"title":"(a)","paragraphs":["para_43","para_44"]},{"title":"5","paragraphs":[]},{"title":"Article 4 of that regulation, entitled ‘Definitions’, provides:","paragraphs":["para_47","para_48"]},{"title":"(2)","paragraphs":["para_50","para_51"]},{"title":"(7)","paragraphs":["para_53","para_54"]},{"title":"6","paragraphs":["para_56","para_57"]},{"title":"7","paragraphs":["para_59","para_60"]},{"title":"(a)","paragraphs":["para_62"]},{"title":"(b)","paragraphs":["para_64"]},{"title":"(c)","paragraphs":["para_66"]},{"title":"(d)","paragraphs":["para_68"]},{"title":"(e)","paragraphs":["para_70"]},{"title":"(f)","paragraphs":["para_72","para_73"]},{"title":"(a)","paragraphs":["para_75"]},{"title":"(b)","paragraphs":["para_77"]},{"title":"(c)","paragraphs":["para_79"]},{"title":"(d)","paragraphs":["para_81"]},{"title":"(e)","paragraphs":["para_83"]},{"title":"(f)","paragraphs":["para_85"]},{"title":"(g)","paragraphs":["para_87"]},{"title":"8","paragraphs":[]},{"title":"Article 21 of the GDPR, entitled ‘Right to object’, provides, in paragraph 1 thereof:","paragraphs":["para_90"]},{"title":"9","paragraphs":[]},{"title":"Article 32 of the GDPR, entitled ‘Security of processing’, states, in paragraph 1 thereof:","paragraphs":["para_93","para_94"]},{"title":"(b)","paragraphs":["para_96","para_97"]},{"title":"10","paragraphs":["para_99","para_100","para_101"]},{"title":"3.   The notification referred to in paragraph 1 shall at least:","paragraphs":["para_103"]},{"title":"(d)","paragraphs":["para_105"]},{"title":"11","paragraphs":["para_107"]},{"title":"12","paragraphs":[]},{"title":"Article 51 of that regulation, entitled ‘Supervisory authority’, is worded as follows:","paragraphs":["para_110","para_111","para_112","para_113"]},{"title":"13","paragraphs":[]},{"title":"Article 55 of that regulation, entitled ‘Competence’, provides:","paragraphs":["para_116","para_117","para_118"]},{"title":"14","paragraphs":[]},{"title":"Article 57 of the GDPR, entitled ‘Tasks’, provides, in paragraph 1 thereof:","paragraphs":["para_121"]},{"title":"(a)","paragraphs":["para_123","para_124"]},{"title":"(h)","paragraphs":["para_126","para_127"]},{"title":"15","paragraphs":["para_129"]},{"title":"16","paragraphs":["para_131"]},{"title":"17","paragraphs":["para_133","para_134"]},{"title":"18","paragraphs":["para_136","para_137"]},{"title":"19","paragraphs":["para_139","para_140"]},{"title":"Bulgarian law","paragraphs":[]},{"title":"Constitution of the Republic of Bulgaria","paragraphs":[]},{"title":"20","paragraphs":["para_144","para_145"]},{"title":"21","paragraphs":["para_147","para_148","para_149","para_150","para_151","para_152","para_153","para_154","para_155","para_156"]},{"title":"The ZSV","paragraphs":[]},{"title":"22","paragraphs":["para_159","para_160"]},{"title":"23","paragraphs":[]},{"title":"Article 54(1) and (2) of that law provides:","paragraphs":["para_163","para_164","para_165","para_166","para_167","para_168","para_169","para_170","para_171","para_172","para_173","para_174","para_175","para_176","para_177"]},{"title":"24","paragraphs":[]},{"title":"Article 175a(1) of that law states:","paragraphs":["para_180","para_181","para_182","para_183","para_184"]},{"title":"25","paragraphs":[]},{"title":"Article 175b(4) of the ZSV is worded as follows:","paragraphs":["para_187"]},{"title":"26","paragraphs":[]},{"title":"Article 175d of that law provides:","paragraphs":["para_190","para_191","para_192","para_193","para_194","para_195","para_196","para_197","para_198"]},{"title":"27","paragraphs":[]},{"title":"Article 175e(1) and (6) of that law provides:","paragraphs":["para_201","para_202","para_203"]},{"title":"28","paragraphs":[]},{"title":"Article 307(2) of the ZSV provides:","paragraphs":["para_206"]},{"title":"29","paragraphs":[]},{"title":"Article 311 of that law is worded as follows:","paragraphs":["para_209","para_210","para_211","para_212","para_213","para_214","para_215","para_216"]},{"title":"30","paragraphs":[]},{"title":"Article 312(1) of that law provides:","paragraphs":["para_219","para_220"]},{"title":"3. [the Inspectorate];","paragraphs":["para_222"]},{"title":"31","paragraphs":[]},{"title":"Article 323(1) of that law provides:","paragraphs":["para_225"]},{"title":"The ZKI","paragraphs":[]},{"title":"32","paragraphs":["para_228","para_229","para_230","para_231","para_232","para_233","para_234","para_235","para_236","para_237","para_238","para_239","para_240","para_241","para_242","para_243","para_244","para_245","para_246","para_247"]},{"title":"The ZZLD","paragraphs":[]},{"title":"33","paragraphs":["para_250","para_251"]},{"title":"34","paragraphs":[]},{"title":"Article 17(1) and (2) of that law provides:","paragraphs":["para_254","para_255","para_256","para_257","para_258","para_259"]},{"title":"35","paragraphs":[]},{"title":"Article 17a(1) of the ZZLD provides:","paragraphs":["para_262","para_263","para_264","para_265","para_266","para_267","para_268","para_269","para_270"]},{"title":"36","paragraphs":[]},{"title":"Article 39 of the ZZLD states:","paragraphs":["para_273","para_274","para_275"]},{"title":"(5)   Paragraph 4 shall also apply where proceedings are pending before the Inspectorate.’","paragraphs":[]},{"title":"The disputes in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"37","paragraphs":["para_279"]},{"title":"38","paragraphs":["para_281"]},{"title":"39","paragraphs":["para_283"]},{"title":"40","paragraphs":["para_285"]},{"title":"41","paragraphs":["para_287"]},{"title":"42","paragraphs":["para_289"]},{"title":"43","paragraphs":["para_291"]},{"title":"44","paragraphs":["para_293"]},{"title":"45","paragraphs":["para_295"]},{"title":"46","paragraphs":["para_297"]},{"title":"47","paragraphs":["para_299"]},{"title":"48","paragraphs":["para_301"]},{"title":"49","paragraphs":["para_303"]},{"title":"50","paragraphs":["para_305","para_306","para_307"]},{"title":"(2)","paragraphs":["para_309"]},{"title":"(3)","paragraphs":["para_311"]},{"title":"(4)","paragraphs":["para_313"]},{"title":"(5)","paragraphs":["para_315"]},{"title":"(6)","paragraphs":["para_317"]},{"title":"Procedure before the Court","paragraphs":[]},{"title":"Joinder","paragraphs":[]},{"title":"51","paragraphs":["para_321"]},{"title":"The request that the oral part of the procedure be reopened","paragraphs":[]},{"title":"52","paragraphs":["para_324"]},{"title":"53","paragraphs":["para_326"]},{"title":"54","paragraphs":["para_328"]},{"title":"55","paragraphs":["para_330"]},{"title":"56","paragraphs":["para_332"]},{"title":"57","paragraphs":["para_334"]},{"title":"Admissibility of the requests for a preliminary ruling","paragraphs":[]},{"title":"58","paragraphs":["para_337"]},{"title":"59","paragraphs":["para_339"]},{"title":"60","paragraphs":["para_341"]},{"title":"61","paragraphs":["para_343"]},{"title":"62","paragraphs":["para_345"]},{"title":"63","paragraphs":["para_347"]},{"title":"64","paragraphs":["para_349"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"The first question","paragraphs":[]},{"title":"65","paragraphs":["para_353"]},{"title":"66","paragraphs":["para_355"]},{"title":"67","paragraphs":["para_357"]},{"title":"68","paragraphs":["para_359"]},{"title":"69","paragraphs":["para_361"]},{"title":"The jurisdiction of the Court","paragraphs":[]},{"title":"70","paragraphs":["para_364"]},{"title":"71","paragraphs":["para_366"]},{"title":"72","paragraphs":["para_368"]},{"title":"73","paragraphs":["para_370"]},{"title":"Admissibility","paragraphs":[]},{"title":"74","paragraphs":["para_373"]},{"title":"75","paragraphs":["para_375"]},{"title":"76","paragraphs":["para_377"]},{"title":"77","paragraphs":["para_379"]},{"title":"78","paragraphs":["para_381"]},{"title":"79","paragraphs":["para_383"]},{"title":"80","paragraphs":["para_385"]},{"title":"Substance","paragraphs":[]},{"title":"81","paragraphs":["para_388"]},{"title":"82","paragraphs":["para_390"]},{"title":"83","paragraphs":["para_392"]},{"title":"84","paragraphs":["para_394"]},{"title":"85","paragraphs":["para_396"]},{"title":"86","paragraphs":["para_398"]},{"title":"87","paragraphs":["para_400"]},{"title":"88","paragraphs":["para_402"]},{"title":"89","paragraphs":["para_404"]},{"title":"90","paragraphs":["para_406"]},{"title":"91","paragraphs":["para_408"]},{"title":"92","paragraphs":["para_410"]},{"title":"93","paragraphs":["para_412"]},{"title":"94","paragraphs":["para_414"]},{"title":"95","paragraphs":["para_416"]},{"title":"96","paragraphs":["para_418"]},{"title":"97","paragraphs":["para_420"]},{"title":"The second question","paragraphs":[]},{"title":"98","paragraphs":["para_423"]},{"title":"99","paragraphs":["para_425"]},{"title":"100","paragraphs":["para_427"]},{"title":"101","paragraphs":["para_429"]},{"title":"102","paragraphs":["para_431"]},{"title":"103","paragraphs":["para_433"]},{"title":"104","paragraphs":["para_435"]},{"title":"105","paragraphs":["para_437"]},{"title":"106","paragraphs":["para_439"]},{"title":"The third question","paragraphs":[]},{"title":"107","paragraphs":["para_442"]},{"title":"108","paragraphs":["para_444"]},{"title":"109","paragraphs":["para_446"]},{"title":"110","paragraphs":["para_448"]},{"title":"111","paragraphs":["para_450"]},{"title":"112","paragraphs":["para_452"]},{"title":"113","paragraphs":["para_454"]},{"title":"114","paragraphs":["para_456"]},{"title":"115","paragraphs":["para_458"]},{"title":"116","paragraphs":["para_460"]},{"title":"117","paragraphs":["para_462"]},{"title":"The fourth question","paragraphs":[]},{"title":"118","paragraphs":["para_465"]},{"title":"119","paragraphs":["para_467"]},{"title":"120","paragraphs":["para_469"]},{"title":"121","paragraphs":["para_471"]},{"title":"122","paragraphs":["para_473"]},{"title":"123","paragraphs":["para_475"]},{"title":"The fifth question","paragraphs":[]},{"title":"124","paragraphs":["para_478"]},{"title":"125","paragraphs":["para_480"]},{"title":"The sixth question","paragraphs":[]},{"title":"126","paragraphs":["para_483"]},{"title":"127","paragraphs":["para_485"]},{"title":"128","paragraphs":["para_487"]},{"title":"129","paragraphs":["para_489"]},{"title":"130","paragraphs":["para_491"]},{"title":"131","paragraphs":["para_493"]},{"title":"132","paragraphs":["para_495"]},{"title":"133","paragraphs":["para_497"]},{"title":"134","paragraphs":["para_499"]},{"title":"135","paragraphs":["para_501"]},{"title":"136","paragraphs":["para_503"]},{"title":"137","paragraphs":["para_505"]},{"title":"138","paragraphs":["para_507"]},{"title":"Costs","paragraphs":[]},{"title":"139","paragraphs":["para_510"]},{"title":"On those grounds, the Court (First Chamber) hereby rules:","paragraphs":["para_512","para_513","para_514","para_515","para_516","para_517","para_518"]},{"title":"Article 4(7) of Regulation 2016/679","paragraphs":["para_520","para_521"]},{"title":"Article 51 of Regulation 2016/679","paragraphs":["para_523","para_524","para_525","para_526","para_527","para_528"]}],"paragraphs":[{"text":"62023CJ0313","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (First Chamber)","paragraph_id":"para_2"},{"text":"30 April 2025 (\n *1\n )","paragraph_id":"para_3"},{"text":"(References for a preliminary ruling – Rule of law – Judicial independence – Second subparagraph of Article 19(1) TEU – Effective legal protection in the fields covered by Union law – Judicial body competent to propose the initiation of disciplinary proceedings against judges, public prosecutors and …","paragraph_id":"para_4"},{"text":"In Joined Cases C‑313/23, C‑316/23 and C‑332/23,","paragraph_id":"para_5"},{"text":"THREE REQUESTS for a preliminary ruling under Article 267 TFEU from the Sofiyski rayonen sad (Sofia District Court, Bulgaria), made by decisions of 22 May 2023 (C‑313/23 and C‑332/23) and of 23 May 2023 (C‑316/23), received at the Court on 22 May 2023 (C‑313/23), 23 May 2023 (C‑316/23) and 25 May 2023 (C‑332/23), in the proceedings brought by","paragraph_id":"para_6"},{"text":"Inspektorat kam Visshia sadeben savet,","paragraph_id":"para_7"},{"text":"THE COURT (First Chamber),","paragraph_id":"para_8"},{"text":"composed of K. Lenaerts, President of the Court, acting as President of the First Chamber, T. von Danwitz (Rapporteur), Vice-President of the Court, A. Kumin, I. Ziemele and O. Spineanu-Matei, Judges,","paragraph_id":"para_9"},{"text":"Advocate General: P. Pikamäe,","paragraph_id":"para_10"},{"text":"Registrar: A. Calot Escobar,","paragraph_id":"para_11"},{"text":"having regard to the written procedure,","paragraph_id":"para_12"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_13"},{"text":"–","paragraph_id":"para_14"},{"text":"the Inspektorat kam Visshia sadeben savet, by T. Tochkova, acting as Agent,","paragraph_id":"para_15"},{"text":"–","paragraph_id":"para_16"},{"text":"the Bulgarian Government, by T. Mitova, S. Ruseva and R. Stoyanov, acting as Agents,","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"the Polish Government, by B. Majczyna, acting as Agent,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"the European Commission, by A. Bouchagiar, C. Georgieva, H. Kranenborg and P. Van Nuffel, acting as Agents,","paragraph_id":"para_21"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 4 October 2024,","paragraph_id":"para_22"},{"text":"gives the following","paragraph_id":"para_23"},{"text":"Judgment","paragraph_id":"para_24"},{"text":"1","paragraph_id":"para_25"},{"text":"These requests for a preliminary ruling concern the interpretation of the second subparagraph of Article 19(1) TEU and of Article 2(2)(a), Article 4(7), Article 32(1)(b), Article 33(3)(d), Article 51, Article 57(1)(b) and Article 79(1) of Regulation (EU) 2016/679 of the European Parliament and of th …","paragraph_id":"para_26"},{"text":"2","paragraph_id":"para_27"},{"text":"The requests have been made in proceedings brought by the Inspektorat kam Visshia sadeben savet (Inspectorate at the Supreme Judicial Council, Bulgaria) (‘the Inspectorate’) seeking an order for data relating to the bank accounts of several judges and public prosecutors as well as of their family members to be disclosed to the Inspectorate.","paragraph_id":"para_28"},{"text":"Legal context","paragraph_id":"para_29"},{"text":"European Union law","paragraph_id":"para_30"},{"text":"3","paragraph_id":"para_31"},{"text":"Recitals 16 and 20 of the GDPR state:","paragraph_id":"para_32"},{"text":"‘(16)","paragraph_id":"para_33"},{"text":"This Regulation does not apply to issues of protection of fundamental rights and freedoms or the free flow of personal data related to activities which fall outside the scope of Union law, such as activities concerning national security. …","paragraph_id":"para_34"},{"text":"…","paragraph_id":"para_35"},{"text":"(20)","paragraph_id":"para_36"},{"text":"While this Regulation applies, inter alia, to the activities of courts and other judicial authorities, Union or Member State law could specify the processing operations and processing procedures in relation to the processing of personal data by courts and other judicial authorities. The competence o …","paragraph_id":"para_37"},{"text":"4","paragraph_id":"para_38"},{"text":"Article 2 of that regulation, entitled ‘Material scope’, provides, in paragraphs 1 and 2 thereof:","paragraph_id":"para_39"},{"text":"‘1.   This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.","paragraph_id":"para_40"},{"text":"2.   This Regulation does not apply to the processing of personal data:","paragraph_id":"para_41"},{"text":"(a)","paragraph_id":"para_42"},{"text":"in the course of an activity which falls outside the scope of Union law;","paragraph_id":"para_43"},{"text":"…’","paragraph_id":"para_44"},{"text":"5","paragraph_id":"para_45"},{"text":"Article 4 of that regulation, entitled ‘Definitions’, provides:","paragraph_id":"para_46"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_47"},{"text":"…","paragraph_id":"para_48"},{"text":"(2)","paragraph_id":"para_49"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_50"},{"text":"…","paragraph_id":"para_51"},{"text":"(7)","paragraph_id":"para_52"},{"text":"“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;","paragraph_id":"para_53"},{"text":"…’","paragraph_id":"para_54"},{"text":"6","paragraph_id":"para_55"},{"text":"Article 12 of the GDPR, entitled ‘Transparent information, communication and modalities for the exercise of the rights of the data subject’, states, in paragraph 1 thereof:","paragraph_id":"para_56"},{"text":"‘The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language … The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. …’","paragraph_id":"para_57"},{"text":"7","paragraph_id":"para_58"},{"text":"Article 14 of that regulation, entitled ‘Information to be provided where personal data have not been obtained from the data subject’, provides, in paragraphs 1 and 2 thereof:","paragraph_id":"para_59"},{"text":"‘1.   Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:","paragraph_id":"para_60"},{"text":"(a)","paragraph_id":"para_61"},{"text":"the identity and the contact details of the controller and, where applicable, of the controller’s representative;","paragraph_id":"para_62"},{"text":"(b)","paragraph_id":"para_63"},{"text":"the contact details of the data protection officer, where applicable;","paragraph_id":"para_64"},{"text":"(c)","paragraph_id":"para_65"},{"text":"the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;","paragraph_id":"para_66"},{"text":"(d)","paragraph_id":"para_67"},{"text":"the categories of personal data concerned;","paragraph_id":"para_68"},{"text":"(e)","paragraph_id":"para_69"},{"text":"the recipients or categories of recipients of the personal data, if any;","paragraph_id":"para_70"},{"text":"(f)","paragraph_id":"para_71"},{"text":"where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation …;","paragraph_id":"para_72"},{"text":"2.   In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:","paragraph_id":"para_73"},{"text":"(a)","paragraph_id":"para_74"},{"text":"the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;","paragraph_id":"para_75"},{"text":"(b)","paragraph_id":"para_76"},{"text":"where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;","paragraph_id":"para_77"},{"text":"(c)","paragraph_id":"para_78"},{"text":"the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;","paragraph_id":"para_79"},{"text":"(d)","paragraph_id":"para_80"},{"text":"where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;","paragraph_id":"para_81"},{"text":"(e)","paragraph_id":"para_82"},{"text":"the right to lodge a complaint with a supervisory authority;","paragraph_id":"para_83"},{"text":"(f)","paragraph_id":"para_84"},{"text":"from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;","paragraph_id":"para_85"},{"text":"(g)","paragraph_id":"para_86"},{"text":"the existence of automated decision-making …’","paragraph_id":"para_87"},{"text":"8","paragraph_id":"para_88"},{"text":"Article 21 of the GDPR, entitled ‘Right to object’, provides, in paragraph 1 thereof:","paragraph_id":"para_89"},{"text":"‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer …","paragraph_id":"para_90"},{"text":"9","paragraph_id":"para_91"},{"text":"Article 32 of the GDPR, entitled ‘Security of processing’, states, in paragraph 1 thereof:","paragraph_id":"para_92"},{"text":"‘Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:","paragraph_id":"para_93"},{"text":"…","paragraph_id":"para_94"},{"text":"(b)","paragraph_id":"para_95"},{"text":"the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;","paragraph_id":"para_96"},{"text":"…’","paragraph_id":"para_97"},{"text":"10","paragraph_id":"para_98"},{"text":"Article 33 of that regulation, entitled ‘Notification of a personal data breach to the supervisory authority’, provides, in paragraphs 1 and 3 thereof:","paragraph_id":"para_99"},{"text":"‘1.   In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is …","paragraph_id":"para_100"},{"text":"…","paragraph_id":"para_101"},{"text":"3.   The notification referred to in paragraph 1 shall at least:","paragraph_id":"para_102"},{"text":"…","paragraph_id":"para_103"},{"text":"(d)","paragraph_id":"para_104"},{"text":"describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.’","paragraph_id":"para_105"},{"text":"11","paragraph_id":"para_106"},{"text":"Chapter VI of the GDPR, entitled ‘Independent supervisory authorities’, encompasses Articles 51 to 59 thereof.","paragraph_id":"para_107"},{"text":"12","paragraph_id":"para_108"},{"text":"Article 51 of that regulation, entitled ‘Supervisory authority’, is worded as follows:","paragraph_id":"para_109"},{"text":"‘1.   Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (“supervisory authority”).","paragraph_id":"para_110"},{"text":"…","paragraph_id":"para_111"},{"text":"3.   Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the [European Data Protection Board] and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.","paragraph_id":"para_112"},{"text":"4.   Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.’","paragraph_id":"para_113"},{"text":"13","paragraph_id":"para_114"},{"text":"Article 55 of that regulation, entitled ‘Competence’, provides:","paragraph_id":"para_115"},{"text":"‘1.   Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.","paragraph_id":"para_116"},{"text":"2.   Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply.","paragraph_id":"para_117"},{"text":"3.   Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.’","paragraph_id":"para_118"},{"text":"14","paragraph_id":"para_119"},{"text":"Article 57 of the GDPR, entitled ‘Tasks’, provides, in paragraph 1 thereof:","paragraph_id":"para_120"},{"text":"‘Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:","paragraph_id":"para_121"},{"text":"(a)","paragraph_id":"para_122"},{"text":"monitor and enforce the application of this Regulation;","paragraph_id":"para_123"},{"text":"…","paragraph_id":"para_124"},{"text":"(h)","paragraph_id":"para_125"},{"text":"conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;","paragraph_id":"para_126"},{"text":"…’","paragraph_id":"para_127"},{"text":"15","paragraph_id":"para_128"},{"text":"Article 58 of the GDPR, entitled ‘Powers’, lists, in paragraph 1 thereof, the investigative powers that each supervisory authority is to have and, in paragraph 2 thereof, the corrective powers that that authority is to have.","paragraph_id":"para_129"},{"text":"16","paragraph_id":"para_130"},{"text":"Chapter VIII of the GDPR, entitled ‘Remedies, liability and penalties’, encompasses Articles 77 to 84 of that regulation.","paragraph_id":"para_131"},{"text":"17","paragraph_id":"para_132"},{"text":"Article 77 of that regulation, entitled ‘Right to lodge a complaint with a supervisory authority’, provides, in paragraph 1 thereof:","paragraph_id":"para_133"},{"text":"‘Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.’","paragraph_id":"para_134"},{"text":"18","paragraph_id":"para_135"},{"text":"Article 78 of that regulation, entitled ‘Right to an effective judicial remedy against a supervisory authority’, provides, in paragraph 1 thereof:","paragraph_id":"para_136"},{"text":"‘Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.’","paragraph_id":"para_137"},{"text":"19","paragraph_id":"para_138"},{"text":"Article 79 of that regulation, entitled ‘Right to an effective judicial remedy against a controller or processor’, provides, in paragraph 1 thereof:","paragraph_id":"para_139"},{"text":"‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.’","paragraph_id":"para_140"},{"text":"Bulgarian law","paragraph_id":"para_141"},{"text":"Constitution of the Republic of Bulgaria","paragraph_id":"para_142"},{"text":"20","paragraph_id":"para_143"},{"text":"Article 117(2) of the Konstitutsia na Republika Bulgaria (Constitution of the Republic of Bulgaria), in the version applicable to the facts in the main proceedings (‘the Bulgarian Constitution’), provides:","paragraph_id":"para_144"},{"text":"‘The judiciary shall be independent. In carrying out their functions, judges, jurors, public prosecutors and investigating magistrates shall be subject only to the law.’","paragraph_id":"para_145"},{"text":"21","paragraph_id":"para_146"},{"text":"Article 132a of the Bulgarian Constitution, in the version applicable at the time the present requests for a preliminary ruling were made, provides:","paragraph_id":"para_147"},{"text":"‘(1)   An inspectorate shall be established at the Supreme Judicial Council. It shall be composed of an Inspector General and 10 inspectors.","paragraph_id":"para_148"},{"text":"(2)   The Inspector General shall be elected for a five-year term by a majority of two thirds of the members of the National Assembly.","paragraph_id":"para_149"},{"text":"(3)   The inspectors shall be elected for a four-year term by the National Assembly in accordance with the procedure laid down in paragraph 2.","paragraph_id":"para_150"},{"text":"(4)   The Inspector General and the inspectors may be re-elected, although not for two consecutive terms.","paragraph_id":"para_151"},{"text":"…","paragraph_id":"para_152"},{"text":"(6)   The Inspectorate shall scrutinise the activities of the judicial authorities without undermining the independence of judges, jurors, public prosecutors and investigating magistrates in the performance of their functions. The Inspectorate shall carry out checks in respect of the integrity and c …","paragraph_id":"para_153"},{"text":"(7)   The Inspectorate shall act of its own motion, on the initiative of citizens, legal persons or State bodies, including judges, public prosecutors and investigating magistrates.","paragraph_id":"para_154"},{"text":"…","paragraph_id":"para_155"},{"text":"(10)   The conditions and procedure applicable to the election and removal from office of the Inspector General and the inspectors, and to the organisation and activities of the Inspectorate, shall be established by law.’","paragraph_id":"para_156"},{"text":"The ZSV","paragraph_id":"para_157"},{"text":"22","paragraph_id":"para_158"},{"text":"Article 46 of the Zakon za sadebnata vlast (Law on the Judiciary) (DV No 64 of 7 August 2007), in the version applicable to the facts in the main proceedings (‘the ZSV’), provides:","paragraph_id":"para_159"},{"text":"‘The National Assembly shall elect the Inspector General and each of the inspectors individually by a two-thirds majority of members.’","paragraph_id":"para_160"},{"text":"23","paragraph_id":"para_161"},{"text":"Article 54(1) and (2) of that law provides:","paragraph_id":"para_162"},{"text":"‘(1)   The Inspectorate:","paragraph_id":"para_163"},{"text":"…","paragraph_id":"para_164"},{"text":"2.","paragraph_id":"para_165"},{"text":"shall scrutinise the arrangements for initiating and conducting legal proceedings, prosecutions and investigations, in addition to the finalisation of cases within the prescribed time;","paragraph_id":"para_166"},{"text":"…","paragraph_id":"para_167"},{"text":"6.","paragraph_id":"para_168"},{"text":"shall propose disciplinary penalties against judges, public prosecutors, investigating magistrates and administrative heads of the judiciary;","paragraph_id":"para_169"},{"text":"7.","paragraph_id":"para_170"},{"text":"shall issue alerts, recommendations and reports to other State bodies, including competent judicial authorities;","paragraph_id":"para_171"},{"text":"8.","paragraph_id":"para_172"},{"text":"shall carry out checks in respect of the integrity and conflicts of interest of judges, public prosecutors and investigating magistrates, the declarations of their assets, and for the purpose of identifying actions which are detrimental to the reputation of the judiciary or which relate to the violation of the independence of judges, public prosecutors and investigating magistrates;","paragraph_id":"para_173"},{"text":"…","paragraph_id":"para_174"},{"text":"15.","paragraph_id":"para_175"},{"text":"shall supervise the processing of personal data in the cases referred to in Article 17(1) of the Law on the protection of personal data.","paragraph_id":"para_176"},{"text":"(2)   When engaging in the supervision referred to in Article 54(1)(15), the Inspectorate shall perform the tasks and exercise the powers provided for by the Law on the protection of personal data.’","paragraph_id":"para_177"},{"text":"24","paragraph_id":"para_178"},{"text":"Article 175a(1) of that law states:","paragraph_id":"para_179"},{"text":"‘Judges, public prosecutors and investigating magistrates shall submit the following declarations to the [Inspectorate]:","paragraph_id":"para_180"},{"text":"1.","paragraph_id":"para_181"},{"text":"a declaration of assets and interests in two parts;","paragraph_id":"para_182"},{"text":"2.","paragraph_id":"para_183"},{"text":"a declaration of a change in the circumstances declared in the declaration referred to in point 1 in the part concerning the interests referred to in Article 175b(1)(11) to (13) and of the origin of funds in the event of early repayment of debts and loans.’","paragraph_id":"para_184"},{"text":"25","paragraph_id":"para_185"},{"text":"Article 175b(4) of the ZSV is worded as follows:","paragraph_id":"para_186"},{"text":"‘Judges, public prosecutors and investigating magistrates shall declare the assets and income of their spouse or of the person with whom they live together as a couple as well as of their minor children.’","paragraph_id":"para_187"},{"text":"26","paragraph_id":"para_188"},{"text":"Article 175d of that law provides:","paragraph_id":"para_189"},{"text":"‘(1)   The [Inspectorate] shall keep and maintain electronic public registers:","paragraph_id":"para_190"},{"text":"1.","paragraph_id":"para_191"},{"text":"of the declarations under Article 175a(1)(1) and (2);","paragraph_id":"para_192"},{"text":"2.","paragraph_id":"para_193"},{"text":"of decisions imposing administrative penalties that have become final.","paragraph_id":"para_194"},{"text":"(2)   The [Inspectorate] shall record in the public register referred to in point 1 of subparagraph 1 the declarations of assets and interests and of changes in the declared circumstances. These shall be recorded exclusively by officials authorised by the Inspector General.","paragraph_id":"para_195"},{"text":"…","paragraph_id":"para_196"},{"text":"(4)   Everyone shall have the right to access data contained in the public register.","paragraph_id":"para_197"},{"text":"(5)   Access shall be provided via the website of the [Inspectorate], subject to the requirements relating to the protection of personal data.’","paragraph_id":"para_198"},{"text":"27","paragraph_id":"para_199"},{"text":"Article 175e(1) and (6) of that law provides:","paragraph_id":"para_200"},{"text":"‘(1)   Within six months of the expiry of the time limit for submitting the declaration, the [Inspectorate] shall verify the accuracy of the facts declared. …","paragraph_id":"para_201"},{"text":"…","paragraph_id":"para_202"},{"text":"(6)   The [Inspectorate] may obtain information from the information systems referred to in Articles 56 and 56a of the Law on Credit Institutions. The Inspector General and the inspectors from the [Inspectorate] may apply to the rayonen sad [(district court)] in whose jurisdiction the data subject i …","paragraph_id":"para_203"},{"text":"28","paragraph_id":"para_204"},{"text":"Article 307(2) of the ZSV provides:","paragraph_id":"para_205"},{"text":"‘A disciplinary offence is a culpable breach of professional duties and a breach of the duty to uphold the dignity of the judiciary.’","paragraph_id":"para_206"},{"text":"29","paragraph_id":"para_207"},{"text":"Article 311 of that law is worded as follows:","paragraph_id":"para_208"},{"text":"‘The disciplinary penalty shall be imposed by:","paragraph_id":"para_209"},{"text":"1.","paragraph_id":"para_210"},{"text":"the administrative head, as regards the penalty referred to in Article 308(1)(1);","paragraph_id":"para_211"},{"text":"2.","paragraph_id":"para_212"},{"text":"the relevant chamber of the Supreme Judicial Council (the Chamber of Judges, Public Prosecutors and Investigating Magistrates), as regards the penalties referred to in Article 308(1)(2), (3), (4) and (6);","paragraph_id":"para_213"},{"text":"…","paragraph_id":"para_214"},{"text":"4.","paragraph_id":"para_215"},{"text":"the plenary formation of the Supreme Judicial Council, as regards the penalties referred to in Article 308(2) imposed on an elected member of the Supreme Judicial Council.’","paragraph_id":"para_216"},{"text":"30","paragraph_id":"para_217"},{"text":"Article 312(1) of that law provides:","paragraph_id":"para_218"},{"text":"‘A proposal to initiate disciplinary proceedings with a view to the imposition of a disciplinary penalty on a judge, a public prosecutor or an investigating magistrate or on an administrative head or a deputy administrative head may be made by:","paragraph_id":"para_219"},{"text":"…","paragraph_id":"para_220"},{"text":"3. [the Inspectorate];","paragraph_id":"para_221"},{"text":"…’","paragraph_id":"para_222"},{"text":"31","paragraph_id":"para_223"},{"text":"Article 323(1) of that law provides:","paragraph_id":"para_224"},{"text":"‘The decision of the plenary formation or of the relevant chamber of the Supreme Judicial Council may be challenged by the person on whom the disciplinary penalty is imposed and, where no disciplinary penalty has been imposed or the penalty imposed is less severe than that proposed, by the person who made the proposal, before the Varhoven administrativen sad [(Supreme Administrative Court, Bulgaria)] within 14 days of notification or service of the decision.’","paragraph_id":"para_225"},{"text":"The ZKI","paragraph_id":"para_226"},{"text":"32","paragraph_id":"para_227"},{"text":"Article 62 of the Zakon za kreditnite institutsii (Law on Credit Institutions) (DV No 59 of 21 July 2006), in the version applicable to the facts in the main proceedings (‘the ZKI’), provides:","paragraph_id":"para_228"},{"text":"‘(1)   Bank employees, members of the management and supervisory bodies of banks, officials from the [Bulgarian National Bank (BNB)], employees and members of the board of directors of the Deposit Insurance Fund, liquidators, temporary administrators and administrators, and any other person working for a bank, shall be prohibited from disclosing or using for their own personal gain or for the benefit of their family members information covered by banking secrecy.","paragraph_id":"para_229"},{"text":"(2)   Banking secrecy consists of the facts and circumstances affecting the balances and transactions on the accounts and deposits held by the bank’s customers.","paragraph_id":"para_230"},{"text":"…","paragraph_id":"para_231"},{"text":"(5)   Except to the BNB and for the purposes and under the conditions provided for in Article 56, the bank may provide the information referred to in paragraph 2 concerning individual customers only:","paragraph_id":"para_232"},{"text":"1.","paragraph_id":"para_233"},{"text":"with their consent;","paragraph_id":"para_234"},{"text":"2.","paragraph_id":"para_235"},{"text":"pursuant to a court decision adopted in accordance with paragraphs 6 and 7;","paragraph_id":"para_236"},{"text":"3.","paragraph_id":"para_237"},{"text":"by order of a court, where that is necessary to clarify the circumstances of a case pending before it;","paragraph_id":"para_238"},{"text":"4.","paragraph_id":"para_239"},{"text":"in the situations referred to in paragraph 12, in the case of a bank involved in an insolvency procedure; or","paragraph_id":"para_240"},{"text":"5.","paragraph_id":"para_241"},{"text":"in the context of ongoing international arbitration proceedings to which the Republic of Bulgaria is a party.","paragraph_id":"para_242"},{"text":"(6)   The court may order the disclosure of the information referred to in paragraph 2 also at the request:","paragraph_id":"para_243"},{"text":"…","paragraph_id":"para_244"},{"text":"12. of the Inspector General or of an inspector from the [Inspectorate].","paragraph_id":"para_245"},{"text":"(7)   The judge of the rayonen sad [(district court)] shall rule in closed session by reasoned decision on the request referred to in paragraph 6, no later than 24 hours after its submission, specifying the period to which the information referred to in paragraph 1 pertains. The decision of the court cannot be appealed.","paragraph_id":"para_246"},{"text":"…’","paragraph_id":"para_247"},{"text":"The ZZLD","paragraph_id":"para_248"},{"text":"33","paragraph_id":"para_249"},{"text":"Article 6(1) of the Zakon za zashtita na lichnite danni (Law on the protection of personal data) (DV No 1 of 4 January 2002), in the version applicable to the facts in the main proceedings (‘the ZZLD’), is worded as follows:","paragraph_id":"para_250"},{"text":"‘The Komisia za zashtita na lichnite danni [(Commission for Personal Data Protection, Bulgaria; ‘the KZLD’)] is a permanent and independent supervisory authority which ensures the protection of individuals with regard to the processing of and access to their personal data as well as inspections in respect of compliance with [the GDPR] and with this law.’","paragraph_id":"para_251"},{"text":"34","paragraph_id":"para_252"},{"text":"Article 17(1) and (2) of that law provides:","paragraph_id":"para_253"},{"text":"‘(1)   The [Inspectorate] shall monitor and ensure compliance with the [GDPR], the present law and the normative acts relating to the protection of personal data, where personal data are processed by:","paragraph_id":"para_254"},{"text":"1.","paragraph_id":"para_255"},{"text":"a court in the performance of its functions as a judicial authority, and","paragraph_id":"para_256"},{"text":"2.","paragraph_id":"para_257"},{"text":"the public prosecutor’s office and the investigating authorities in the performance of their functions as judicial authorities, for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal law penalties.","paragraph_id":"para_258"},{"text":"(2)   The detailed procedure for the performance of the activity referred to in paragraph 1, including the carrying out of checks as well as the conduct of proceedings before the Inspectorate, shall be laid down in the rules referred to in Article 55(8) [of the ZSV].’","paragraph_id":"para_259"},{"text":"35","paragraph_id":"para_260"},{"text":"Article 17a(1) of the ZZLD provides:","paragraph_id":"para_261"},{"text":"‘In supervising the processing of personal data by a court in the performance of its functions as a judicial authority, except in cases where personal data are processed for the purposes of Article 42(1), the Inspectorate shall:","paragraph_id":"para_262"},{"text":"1.","paragraph_id":"para_263"},{"text":"perform the tasks referred to in Article 57(1)(a) to (i), (l), (u) and (v) and Article 57(2) and (3) of [the GDPR];","paragraph_id":"para_264"},{"text":"2.","paragraph_id":"para_265"},{"text":"exercise the powers conferred by Article 58(1)(a), (b), (d), (e), (f), Article 58(2)(a) to (g), (i) and (j) and Article 58(3)(a), (b) and (c) of [the GDPR];","paragraph_id":"para_266"},{"text":"3.","paragraph_id":"para_267"},{"text":"apply accordingly the list drawn up by [the KZLD] in accordance with Article 35(4) of [the GDPR], read in conjunction with the requirement for a data protection impact assessment;","paragraph_id":"para_268"},{"text":"4.","paragraph_id":"para_269"},{"text":"refer the matter to a court in the event of an infringement of [the GDPR].’","paragraph_id":"para_270"},{"text":"36","paragraph_id":"para_271"},{"text":"Article 39 of the ZZLD states:","paragraph_id":"para_272"},{"text":"‘(1)   In the event of an infringement of his or her rights under [the GDPR] and the present law, the data subject may challenge the acts and actions of the controller and the processor before a court in accordance with the procedure provided for by the Code of Administrative Procedure.","paragraph_id":"para_273"},{"text":"…","paragraph_id":"para_274"},{"text":"(4)   The data subject cannot refer the matter to a court when there are pending proceedings before [the KZLD] for the same infringement or where a decision of [the KZLD] concerning the same infringement has been challenged and there is no final court decision. At the request of the data subject or of the court, [the KZLD] shall certify that there are no pending proceedings before it regarding the same dispute.","paragraph_id":"para_275"},{"text":"(5)   Paragraph 4 shall also apply where proceedings are pending before the Inspectorate.’","paragraph_id":"para_276"},{"text":"The disputes in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_277"},{"text":"37","paragraph_id":"para_278"},{"text":"On 15 May 2023, after the expiry of the period prescribed for the submission, for 2022, of the annual declarations of the assets of judges, public prosecutors and investigating magistrates and of their families, referred to in Articles 175a and 175b of the ZSV, the Inspectorate requested the Sofiysk …","paragraph_id":"para_279"},{"text":"38","paragraph_id":"para_280"},{"text":"The referring court notes, in the first place, that it must ascertain whether the Inspectorate has competence to submit such a request to it. In that regard, the referring court states that that body, which was created by an amendment to the Bulgarian Constitution adopted in 2007, is entrusted with …","paragraph_id":"para_281"},{"text":"39","paragraph_id":"para_282"},{"text":"The referring court states that the Inspectorate is composed of an Inspector General and 10 inspectors, who are elected by the National Assembly for a five- and four-year term, respectively. The terms of office of all the members of the Inspectorate expired in 2020, without new members having been elected by the National Assembly.","paragraph_id":"para_283"},{"text":"40","paragraph_id":"para_284"},{"text":"It is true that, by judgment of 27 September 2022, the Konstitutsionen sad (Constitutional Court, Bulgaria) ruled that the Bulgarian Constitution must be interpreted as meaning that the Inspector General and the inspectors whose terms of office have expired are to continue to perform their functions …","paragraph_id":"para_285"},{"text":"41","paragraph_id":"para_286"},{"text":"The referring court is therefore uncertain whether EU law lays down stricter conditions than the Bulgarian Constitution as interpreted by the Konstitutsionen sad (Constitutional Court). In particular, in the light of the case-law of the Court of Justice established in the judgment of 11 May 2023, In …","paragraph_id":"para_287"},{"text":"42","paragraph_id":"para_288"},{"text":"In the second place, the referring court is uncertain about the role and obligations of the national courts where they are called upon to authorise the Inspectorate to access the personal data of judges, public prosecutors or investigating magistrates.","paragraph_id":"para_289"},{"text":"43","paragraph_id":"para_290"},{"text":"In that regard, the referring court observes that, in 2019, a serious problem relating to the security of the data held by the Inspectorate attracted the attention of the Bulgarian media. The KZLD found that the personal data of approximately 20 judges and public prosecutors held by the Inspectorate …","paragraph_id":"para_291"},{"text":"44","paragraph_id":"para_292"},{"text":"The referring court is uncertain whether an authorisation it might grant to the Inspectorate to access personal data covered by banking secrecy comes within the scope of the GDPR and, if so, what impact that would have on the review which it must carry out. It points out, in that regard, that the GDPR imposes obligations on persons who process personal data, on controllers and on supervisory authorities.","paragraph_id":"para_293"},{"text":"45","paragraph_id":"para_294"},{"text":"By contrast, the obligations of a court granting authorisation to an authority to access such data are not directly governed by the GDPR. It is therefore necessary to determine whether such a court must be regarded as having the status of ‘controller’, within the meaning of Article 4(7) of the GDPR, …","paragraph_id":"para_295"},{"text":"46","paragraph_id":"para_296"},{"text":"In that regard, the referring court observes that its review should, according to the interpretation of national law which prevails in Bulgaria, be purely formal and be limited to ascertaining whether the persons in respect of whom the lifting of banking secrecy is sought have the status of persons …","paragraph_id":"para_297"},{"text":"47","paragraph_id":"para_298"},{"text":"Although those courts do not have direct access to the personal data covered by banking secrecy, they determine to a certain extent the purposes of the processing by authorising or prohibiting access to those data. Furthermore, the national provisions applicable in the main proceedings do not specif …","paragraph_id":"para_299"},{"text":"48","paragraph_id":"para_300"},{"text":"In addition, the referring court is uncertain whether it may check, before authorising access to the data, whether the Inspectorate has taken measures to ensure that the data are processed in accordance with the law, in order not to act as a mere rubber stamp.","paragraph_id":"para_301"},{"text":"49","paragraph_id":"para_302"},{"text":"Lastly, even if the court responsible for authorising access by the Inspectorate to personal data covered by banking secrecy does not have the status of controller or supervisory authority, the question arises as to whether it must carry out such checks in order to ensure effective judicial protecti …","paragraph_id":"para_303"},{"text":"50","paragraph_id":"para_304"},{"text":"In those circumstances, the Sofiyski rayonen sad (Sofia District Court) decided to stay the proceedings and to refer the following questions, worded identically in Cases C‑313/23, C‑316/23 and C‑332/23, to the Court of Justice for a preliminary ruling:","paragraph_id":"para_305"},{"text":"‘(1)","paragraph_id":"para_306"},{"text":"Must the second subparagraph of Article 19(1) TEU, read in conjunction with the second paragraph of Article 47 of [the Charter], be interpreted as meaning that it is per se or under certain conditions an infringement of the obligation incumbent on Member States to provide effective remedies sufficie …","paragraph_id":"para_307"},{"text":"(2)","paragraph_id":"para_308"},{"text":"Must Article 2(2)(a) of [the GDPR] be interpreted as meaning that the disclosure of data covered by banking secrecy for the purposes of verifying assets and liabilities of judges and public prosecutors which are subsequently made public constitutes an activity which falls outside the scope of [EU] l …","paragraph_id":"para_309"},{"text":"(3)","paragraph_id":"para_310"},{"text":"If the answer to the second question is that [EU] law is applicable, must Article 4(7) of [the GDPR] be interpreted as meaning that a judicial authority which allows another State authority to access data concerning the account balances of judges and public prosecutors and their family members determines the purposes or means of the processing of personal data and is therefore a “controller” for the purposes of the processing of personal data?","paragraph_id":"para_311"},{"text":"(4)","paragraph_id":"para_312"},{"text":"If the answer to the second question is that [EU] law is applicable and the third question is answered in the negative, must Article 51 of [the GDPR] be interpreted as meaning that a judicial authority which allows another State authority to access data concerning the account balances of judges and …","paragraph_id":"para_313"},{"text":"(5)","paragraph_id":"para_314"},{"text":"If the answer to the second question is that [EU] law is applicable and either the third or the fourth questions are answered in the affirmative, must Article 32(1)(b) of [the GDPR] and Article 57(1)(a) of that regulation be interpreted as meaning that a judicial authority which allows another State …","paragraph_id":"para_315"},{"text":"(6)","paragraph_id":"para_316"},{"text":"If the answer to the second question is that [EU] law is applicable, and irrespective of the answers to the third and fourth questions, must Article 79(1) of [the GDPR], read in conjunction with Article 47 of [the Charter], be interpreted as meaning that, where the national law of a Member State pro …","paragraph_id":"para_317"},{"text":"Procedure before the Court","paragraph_id":"para_318"},{"text":"Joinder","paragraph_id":"para_319"},{"text":"51","paragraph_id":"para_320"},{"text":"By decision of the President of the Court of Justice of 30 June 2023, Cases C‑313/23, C‑316/23 and C‑332/23 were joined for the purposes of the written and oral procedures and the judgment.","paragraph_id":"para_321"},{"text":"The request that the oral part of the procedure be reopened","paragraph_id":"para_322"},{"text":"52","paragraph_id":"para_323"},{"text":"By document lodged at the Court Registry on 30 October 2024, the Inspectorate requested an order, pursuant to Article 83 of the Rules of Procedure of the Court of Justice, that the written part of the procedure be reopened. Since Article 83 of those Rules governs the reopening of the oral part of th …","paragraph_id":"para_324"},{"text":"53","paragraph_id":"para_325"},{"text":"In support of its request, the Inspectorate relies on two reasons in connection with the first question referred for a preliminary ruling. In the first place, it states that there has been a new development, namely an amendment, in December 2023, of Article 132a(4) of the Bulgarian Constitution, to …","paragraph_id":"para_326"},{"text":"54","paragraph_id":"para_327"},{"text":"In that regard, it must be noted, first, that the Statute of the Court of Justice of the European Union and the Rules of Procedure make no provision for the interested parties referred to in Article 23 of that statute to submit observations in response to the Advocate General’s Opinion. Second, unde …","paragraph_id":"para_328"},{"text":"55","paragraph_id":"para_329"},{"text":"It is true that, in accordance with Article 83 of the Rules of Procedure, the Court may at any time, after hearing the Advocate General, order the opening or reopening of the oral part of the procedure, in particular if it considers that it lacks sufficient information or where a party has, after th …","paragraph_id":"para_330"},{"text":"56","paragraph_id":"para_331"},{"text":"However, in the present case, the Court has all the information necessary to give a ruling on the requests for a preliminary ruling and the present cases do not have to be decided on the basis of arguments which have not been debated between the interested persons. Furthermore, the request that the …","paragraph_id":"para_332"},{"text":"57","paragraph_id":"para_333"},{"text":"In those circumstances, the Court considers, having heard the Advocate General, that there is no need to order that the oral part of the procedure be reopened.","paragraph_id":"para_334"},{"text":"Admissibility of the requests for a preliminary ruling","paragraph_id":"para_335"},{"text":"58","paragraph_id":"para_336"},{"text":"The Bulgarian Government expresses doubts as regards the admissibility of the requests for a preliminary ruling, on the ground that, according to that government, the referring body in the main proceedings does not, in the context of those proceedings, have the characteristics of a ‘court or tribuna …","paragraph_id":"para_337"},{"text":"59","paragraph_id":"para_338"},{"text":"According to the Court’s settled case-law, in order to determine whether the body in question that is making a reference is a ‘court or tribunal’ within the meaning of Article 267 TFEU, which is a question governed by EU law alone, the Court takes account of a number of factors, such as, inter alia, …","paragraph_id":"para_339"},{"text":"60","paragraph_id":"para_340"},{"text":"It is also clear from settled case-law that, although Article 267 TFEU does not make reference to the Court subject to the proceedings during which the national court refers a question for a preliminary ruling being inter partes , a national court may refer a question to the Court only if there is a …","paragraph_id":"para_341"},{"text":"61","paragraph_id":"para_342"},{"text":"It is not disputed that the Sofiyski rayonen sad (Sofia District Court), as such, meets the requirements set out in paragraph 59 above, concerning its establishment, its permanence, the application of rules of law and its independence, and there is nothing in the file before the Court to give rise t …","paragraph_id":"para_343"},{"text":"62","paragraph_id":"para_344"},{"text":"In particular, the authorisation which the referring court might grant is intended as a substitute, as is apparent from Article 62(5) of the ZKI, for the consent of the persons concerned. That authorisation may be relied on vis-à-vis banks with which those persons have bank accounts and has the effe …","paragraph_id":"para_345"},{"text":"63","paragraph_id":"para_346"},{"text":"In those circumstances, the functions performed by the referring court under Article 62(6)(12) of the ZKI do not consist in the adoption of acts of an administrative nature amenable to judicial review, but must be classified as judicial functions, since that court is in fact called upon to give a ru …","paragraph_id":"para_347"},{"text":"64","paragraph_id":"para_348"},{"text":"Consequently, the requests for a preliminary ruling are admissible.","paragraph_id":"para_349"},{"text":"Consideration of the questions referred","paragraph_id":"para_350"},{"text":"The first question","paragraph_id":"para_351"},{"text":"65","paragraph_id":"para_352"},{"text":"As a preliminary point, it should be borne in mind that, according to settled case-law, in the procedure laid down by Article 267 TFEU providing for cooperation between national courts and the Court of Justice, it is for the latter to provide the national court with an answer which will be of use to …","paragraph_id":"para_353"},{"text":"66","paragraph_id":"para_354"},{"text":"In the present case, although the first question refers to a judicial body ‘which can impose disciplinary penalties on judges and has powers to collect data relating to their assets’, it is apparent both from the requests for a preliminary ruling and from the file before the Court that that body scr …","paragraph_id":"para_355"},{"text":"67","paragraph_id":"para_356"},{"text":"As is apparent from the requests for a preliminary ruling, the referring court considers that the fact that the members of the Inspectorate, who are elected by a two-thirds majority of the members of the National Assembly, continue to perform their functions despite the expiry of their terms of offi …","paragraph_id":"para_357"},{"text":"68","paragraph_id":"para_358"},{"text":"Thus, the first question referred for a preliminary ruling concerns the interpretation of the second subparagraph of Article 19(1) TEU, read in the light of Article 47 of the Charter, solely in the light of the extension of the expired terms of office of the members of the Inspectorate, without the scope of the powers of that judicial body being, as such, covered by that question.","paragraph_id":"para_359"},{"text":"69","paragraph_id":"para_360"},{"text":"In those circumstances, the view must be taken that, by its first question, the referring court asks, in essence, whether and, as the case may be, under what conditions the second subparagraph of Article 19(1) TEU, read in the light of Article 47 of the Charter, precludes a Member State’s practice u …","paragraph_id":"para_361"},{"text":"The jurisdiction of the Court","paragraph_id":"para_362"},{"text":"70","paragraph_id":"para_363"},{"text":"The Polish Government submits that the Court does not have jurisdiction to answer the first question, since, according to that government, the European Union has no competence in the field of the organisation of justice in the Member States.","paragraph_id":"para_364"},{"text":"71","paragraph_id":"para_365"},{"text":"In that regard, although the organisation of justice in the Member States falls within the competence of those Member States, the Member States are nevertheless required, when exercising that competence, to comply with their obligations deriving from EU law and, in particular, from the second subpar …","paragraph_id":"para_366"},{"text":"72","paragraph_id":"para_367"},{"text":"That is the case with national rules governing the disciplinary liability of judges (see, to that effect, judgments of 21 December 2021, Euro Box Promotion and Others, C‑357/19, C‑379/19, C‑547/19, C‑811/19 and C‑840/19 , EU:C:2021:1034 , paragraph  133 , and of 11 May 2023, Inspecţia Judiciară, C‑8 …","paragraph_id":"para_368"},{"text":"73","paragraph_id":"para_369"},{"text":"In those circumstances, and since the first question referred for a preliminary ruling concerns the interpretation of EU law, the Court has jurisdiction to answer that question.","paragraph_id":"para_370"},{"text":"Admissibility","paragraph_id":"para_371"},{"text":"74","paragraph_id":"para_372"},{"text":"The Bulgarian Government and the Inspectorate are challenging the admissibility of the first question on the ground that the Inspectorate does not have the power to impose disciplinary penalties, with the result that, according to them, the first question bears no relation to the subject matter of the main proceedings.","paragraph_id":"para_373"},{"text":"75","paragraph_id":"para_374"},{"text":"In addition, the Inspectorate submits that the first question is hypothetical. First, according to the Inspectorate, the main proceedings bear no relation to disciplinary proceedings. Second, while a structural failure to meet the requirements of independence is required for a finding of an infringement of the second subparagraph of Article 19(1) TEU, the referring court does not specify in what way the alleged failure at issue in the main proceedings is structural in nature.","paragraph_id":"para_375"},{"text":"76","paragraph_id":"para_376"},{"text":"In that regard, according to settled case-law, it is solely for the national court, before which the dispute has been brought and which must assume responsibility for the judicial decision to be made, to determine, in the light of the particular circumstances of the case, both the need for and the r …","paragraph_id":"para_377"},{"text":"77","paragraph_id":"para_378"},{"text":"Consequently, questions relating to EU law enjoy a presumption of relevance. The Court may refuse to rule on a question referred for a preliminary ruling by a national court only where it is quite obvious that the interpretation of an EU rule that is sought bears no relation to the actual facts of t …","paragraph_id":"para_379"},{"text":"78","paragraph_id":"para_380"},{"text":"In the present case, the referring court is uncertain as regards the action to be taken in response to the Inspectorate’s requests for an authorisation to access data relating to the bank accounts of several judges and public prosecutors and their family members. In particular, that court wishes to …","paragraph_id":"para_381"},{"text":"79","paragraph_id":"para_382"},{"text":"As regards the submissions of the Inspectorate set out in paragraph 75 above, relating in particular to the powers available to it in the context of the main proceedings and to the absence of a structural failure to meet the requirements arising from the second subparagraph of Article 19(1) TEU, those submissions come, in fact, within the scope of the examination of the substance of the first question and, therefore, cannot lead to that question being inadmissible.","paragraph_id":"para_383"},{"text":"80","paragraph_id":"para_384"},{"text":"It follows from the foregoing that the first question referred for a preliminary ruling is admissible.","paragraph_id":"para_385"},{"text":"Substance","paragraph_id":"para_386"},{"text":"81","paragraph_id":"para_387"},{"text":"It should be recalled that every Member State must, in accordance with the second subparagraph of Article 19(1) TEU, ensure that the bodies which are called upon, as ‘courts or tribunals’ within the meaning of EU law, to rule on questions relating to the application or interpretation of EU law and w …","paragraph_id":"para_388"},{"text":"82","paragraph_id":"para_389"},{"text":"The very existence of effective judicial review designed to ensure compliance with EU law is of the essence of the rule of law. In that regard, in accordance with the second subparagraph of Article 19(1) TEU, it is for the Member States to establish a system of legal remedies and procedures ensuring …","paragraph_id":"para_390"},{"text":"83","paragraph_id":"para_391"},{"text":"To that end, maintaining the independence of bodies which may be called upon to rule on questions concerning the application or interpretation of EU law is essential, as confirmed by the second paragraph of Article 47 of the Charter, which refers to access to an ‘independent’ tribunal as one of the …","paragraph_id":"para_392"},{"text":"84","paragraph_id":"para_393"},{"text":"That requirement that courts be independent, which is inherent in the task of adjudication, forms part of the essence of the right to effective judicial protection and the fundamental right to a fair trial, which is of cardinal importance as a guarantee that all the rights which individuals derive f …","paragraph_id":"para_394"},{"text":"85","paragraph_id":"para_395"},{"text":"It is settled case-law of the Court that the guarantees of independence and impartiality required under EU law presuppose rules that are such as to dispel any reasonable doubt, in the minds of individuals, as to the imperviousness of the body in question to external factors and its neutrality with r …","paragraph_id":"para_396"},{"text":"86","paragraph_id":"para_397"},{"text":"As regards specifically the rules governing the disciplinary regime in respect of judges, the requirement of independence of courts and tribunals following from the second subparagraph of Article 19(1) TEU requires that that regime must provide the necessary guarantees in order to prevent any risk o …","paragraph_id":"para_398"},{"text":"87","paragraph_id":"para_399"},{"text":"Since the prospect of opening a disciplinary investigation is, as such, liable to exert pressure on those who have the task of adjudicating in a dispute, it is essential that a body competent to conduct investigations and bring disciplinary proceedings should act objectively and impartially in the p …","paragraph_id":"para_400"},{"text":"88","paragraph_id":"para_401"},{"text":"Thus, it is important that all the rules governing the organisation and operation of such a body, including those governing the procedure for the appointment of its members, be designed in such a way that there can be no reasonable doubt, in the minds of individuals, that the powers and functions of …","paragraph_id":"para_402"},{"text":"89","paragraph_id":"para_403"},{"text":"Those rules may, generally speaking, affect that body’s practice directly and thus prevent or, on the contrary, encourage disciplinary action the object or effect of which is to exert pressure, in particular, on those who have the task of adjudicating in a dispute or of ensuring political control over their activity (see, to that effect, judgment of 11 May 2023, Inspecţia Judiciară, C‑817/21 , EU:C:2023:391 , paragraph  52 ).","paragraph_id":"para_404"},{"text":"90","paragraph_id":"para_405"},{"text":"It is ultimately for the referring court to rule, in the final analysis, on the imperviousness of the body at issue in the main proceedings to external influence as well as on its objectivity and impartiality in relation to the performance of its duties, having made the relevant findings in that reg …","paragraph_id":"para_406"},{"text":"91","paragraph_id":"para_407"},{"text":"In the present case, the Inspectorate consists of an Inspector General and 10 inspectors, who are elected by the National Assembly by a two-thirds majority of its members for a five- and four-year term of office, respectively. In accordance with the national legislation applicable as at the date of submission of the present requests for a preliminary ruling, the members of the Inspectorate could not be re-elected for a second consecutive term of office.","paragraph_id":"para_408"},{"text":"92","paragraph_id":"para_409"},{"text":"As regards the situation at issue in the main proceedings, in which the terms of office of the members of the Inspectorate expired without the National Assembly having elected its new members, the national legislation does not appear to contain any rule as to whether members of the Inspectorate whos …","paragraph_id":"para_410"},{"text":"93","paragraph_id":"para_411"},{"text":"First, while it is for the Member States alone to decide whether or not to authorise the performance of the functions, beyond the legal duration of their term of office, of members of a judicial body which is competent to scrutinise the activity of judges, public prosecutors and investigating magist …","paragraph_id":"para_412"},{"text":"94","paragraph_id":"para_413"},{"text":"In addition, the Member States must ensure that the conditions and detailed rules to which that performance is subject are designed in such a way as to enable the relevant members of the judicial body to act objectively and impartially in the performance of their duties as well as ensure that they are, for that purpose, free of any external influence, as required by the case-law cited in paragraphs 87 and 88 above.","paragraph_id":"para_414"},{"text":"95","paragraph_id":"para_415"},{"text":"Second, as the Advocate General observed, in essence, in point 58 of his Opinion, although, in certain circumstances, the extension of the terms of office may prove necessary in view of the importance of the functions performed by the judicial body concerned, the fact remains that, beyond the legal …","paragraph_id":"para_416"},{"text":"96","paragraph_id":"para_417"},{"text":"Nevertheless, when a Member State circumscribes such an extension, it cannot amend its legislation or its Constitution in such a way as to bring about a reduction in the protection of the value of the rule of law, a value which is given concrete expression by, inter alia, Article 19 TEU, in particul …","paragraph_id":"para_418"},{"text":"97","paragraph_id":"para_419"},{"text":"In the light of the foregoing considerations, the answer to the first question is that the second subparagraph of Article 19(1) TEU, read in the light of Article 47 of the Charter, must be interpreted as meaning that the principle of judicial independence precludes a Member State’s practice under wh …","paragraph_id":"para_420"},{"text":"The second question","paragraph_id":"para_421"},{"text":"98","paragraph_id":"para_422"},{"text":"By its second question, the referring court seeks, in essence, to ascertain whether Article 2 of the GDPR must be interpreted as meaning that disclosure, to a judicial body, of personal data that are protected by banking secrecy and that concern judges, public prosecutors and investigating magistrat …","paragraph_id":"para_423"},{"text":"99","paragraph_id":"para_424"},{"text":"According to settled case-law, Article 2(1) of the GDPR gives a very broad definition of its material scope. Subject to the cases referred to in Article 2(2) and (3) thereof, the GDPR applies to processing carried out both by private persons and by public authorities, including, as recital 20 thereo …","paragraph_id":"para_425"},{"text":"100","paragraph_id":"para_426"},{"text":"Furthermore, the Court has previously held that neither the fact that the information which is the subject of the national provisions relates to judges nor the fact that that information might have certain links with the performance of their duties is, in itself, such as to remove those national provisions from the scope of the GDPR (judgment of 5 June 2023, Commission v Poland (Independence and private life of judges), C‑204/21 , EU:C:2023:442 , paragraph  315 ).","paragraph_id":"para_427"},{"text":"101","paragraph_id":"para_428"},{"text":"Article 2 of the GDPR sets out, in paragraphs 2 and 3 thereof, in exhaustive terms, the exceptions to the rule determining the material scope of that regulation laid down in paragraph 1 thereof; those exceptions, in particular the ones provided for in paragraph 2, must be interpreted strictly (see, …","paragraph_id":"para_429"},{"text":"102","paragraph_id":"para_430"},{"text":"Article 2(2)(a) of the GDPR, which is the specific subject of the second question referred for a preliminary ruling, provides that that regulation does not apply to the processing of personal data ‘in the course of an activity which falls outside the scope of Union law’.","paragraph_id":"para_431"},{"text":"103","paragraph_id":"para_432"},{"text":"In accordance with settled case-law, that provision, read in the light of recital 16 of the GDPR, has the sole purpose of excluding from the scope of that regulation the processing of personal data carried out by State authorities in the course of an activity which is intended to safeguard national …","paragraph_id":"para_433"},{"text":"104","paragraph_id":"para_434"},{"text":"Although ensuring the proper administration of justice in the Member States and, in particular, the enactment of rules applicable to the status of judges, public prosecutors and investigating magistrates, more specifically judges, and to the performance of their functions come within the competence …","paragraph_id":"para_435"},{"text":"105","paragraph_id":"para_436"},{"text":"Furthermore, it must be noted that disclosure to a judicial body of personal data that are protected by banking secrecy and that concern judges, public prosecutors and investigating magistrates as well as their family members, with a view to the verification of the declarations which relate to the a …","paragraph_id":"para_437"},{"text":"106","paragraph_id":"para_438"},{"text":"The answer to the second question referred is therefore that Article 2 of the GDPR must be interpreted as meaning that disclosure, to a judicial body, of personal data that are protected by banking secrecy and that concern judges, public prosecutors and investigating magistrates as well as their fam …","paragraph_id":"para_439"},{"text":"The third question","paragraph_id":"para_440"},{"text":"107","paragraph_id":"para_441"},{"text":"By its third question, the referring court asks whether Article 4(7) of the GDPR must be interpreted as meaning that a court having jurisdiction to authorise, at the request of another judicial body, disclosure by a bank to that body of data relating to the bank accounts of judges, public prosecutors and investigating magistrates as well as of their family members, may be classified as a controller within the meaning of that provision.","paragraph_id":"para_442"},{"text":"108","paragraph_id":"para_443"},{"text":"Under Article 4(7) of the GDPR, the concept of ‘controller’ covers natural or legal persons, public authorities, agencies or other bodies which, alone or jointly with others, determine the purposes and means of the processing of personal data. That provision also states that, where the purposes and means of such processing are determined, inter alia, by Member State law, the controller or the specific criteria for its nomination may be provided for by that law.","paragraph_id":"para_444"},{"text":"109","paragraph_id":"para_445"},{"text":"In accordance with the Court’s settled case-law, that provision seeks to ensure, through a broad definition of the concept of ‘controller’, in accordance with the objective pursued by the GDPR, effective and complete protection of the fundamental rights and freedoms of natural persons and, in partic …","paragraph_id":"para_446"},{"text":"110","paragraph_id":"para_447"},{"text":"In order to establish whether a person or entity is to be classified as a controller within the meaning of Article 4(7) of the GDPR, it must therefore be examined whether that person or entity determines, alone or jointly with others, the purposes and means of the processing or whether those purpose …","paragraph_id":"para_448"},{"text":"111","paragraph_id":"para_449"},{"text":"It is also important to state that, having regard to the broad definition of the concept of ‘controller’ within the meaning of Article 4(7) of the GDPR, the determination of the purposes and means of the processing and, where appropriate, the nomination of that controller by national law may not onl …","paragraph_id":"para_450"},{"text":"112","paragraph_id":"para_451"},{"text":"The protection of the data subjects would be undermined if point 7 of Article 4 of the GDPR were interpreted restrictively to cover only those cases in which the purposes and means of the data processing performed by a person, a public authority, an agency or a body are expressly determined by natio …","paragraph_id":"para_452"},{"text":"113","paragraph_id":"para_453"},{"text":"In the present case, the referring court is uncertain whether it must be regarded as the controller in respect of the processing at issue in the main proceedings, namely disclosure to the Inspectorate of personal data that are covered by banking secrecy, on account of the fact that it is legally responsible for authorising such disclosure.","paragraph_id":"para_454"},{"text":"114","paragraph_id":"para_455"},{"text":"In that regard, under the national legislation applicable to the cases in the main proceedings, the Inspectorate is competent to carry out, inter alia, checks in respect of the integrity and absence of conflicts of interest on the part of judges, public prosecutors and investigating magistrates, as …","paragraph_id":"para_456"},{"text":"115","paragraph_id":"para_457"},{"text":"It thus appears that it is the national legislation applicable to the cases in the main proceedings which determines the circle of persons and the data which may be the subject of the processing, lays down the purposes of that processing and designates the competent body, namely the Inspectorate, wi …","paragraph_id":"para_458"},{"text":"116","paragraph_id":"para_459"},{"text":"Thus, although it is for that court to examine whether and to what extent the conditions governing the legality of the processing are satisfied in a given case, it does not determine of its own accord either the purpose of the processing or the persons and data concerned. In those circumstances, it is not that court but the body competent to achieve the purposes pursued that is the controller within the meaning of Article 4(7) of the GDPR.","paragraph_id":"para_460"},{"text":"117","paragraph_id":"para_461"},{"text":"In the light of the foregoing considerations, the answer to the third question is that Article 4(7) of the GDPR must be interpreted as meaning that a court having jurisdiction to authorise, at the request of another judicial body, disclosure by a bank to that body of data relating to the bank accounts of judges, public prosecutors and investigating magistrates as well as of their family members, cannot be classified as a controller within the meaning of that provision.","paragraph_id":"para_462"},{"text":"The fourth question","paragraph_id":"para_463"},{"text":"118","paragraph_id":"para_464"},{"text":"By its fourth question, the referring court asks, in essence, whether Article 51 of the GDPR must be interpreted as meaning that a court having jurisdiction to authorise disclosure of personal data to another judicial body constitutes a supervisory authority within the meaning of that article.","paragraph_id":"para_465"},{"text":"119","paragraph_id":"para_466"},{"text":"Article 51(1) of the GDPR requires Member States to provide for one or more independent public authorities which are to be responsible for monitoring the application of that regulation. The establishment of such authorities, which is also provided for by primary EU law, namely Article 8(3) of the Ch …","paragraph_id":"para_467"},{"text":"120","paragraph_id":"para_468"},{"text":"Those authorities have the primary task, under Article 51(1) and (2) and Article 57(1)(a) and (g) of the GDPR, to monitor and enforce the application of that regulation, while contributing to its consistent application within the European Union, in order to protect the fundamental rights and freedom …","paragraph_id":"para_469"},{"text":"121","paragraph_id":"para_470"},{"text":"Member States are required, in accordance with Article 51(4) of the GDPR, to notify to the Commission the provisions of their law and any subsequent amendments that they adopt pursuant to Chapter VI of that regulation, in particular those concerning the supervisory authority or authorities which they have entrusted with the task of monitoring the application of that regulation.","paragraph_id":"para_471"},{"text":"122","paragraph_id":"para_472"},{"text":"In the present case, it is not apparent from any of the documents in the file before the Court that the referring court is entrusted, by Bulgarian law, with the task of monitoring the application of the GDPR or, in particular, that it has the powers which a supervisory authority must have under Article 58 of that regulation.","paragraph_id":"para_473"},{"text":"123","paragraph_id":"para_474"},{"text":"The answer to the fourth question is therefore that Article 51 of the GDPR must be interpreted as meaning that a court having jurisdiction to authorise disclosure of personal data to another judicial body does not constitute a supervisory authority within the meaning of that article, where that cour …","paragraph_id":"para_475"},{"text":"The fifth question","paragraph_id":"para_476"},{"text":"124","paragraph_id":"para_477"},{"text":"The fifth question is asked only in the event that the Court answers the third or fourth question in the affirmative. As has been found in paragraphs 117 and 123 above, the third and fourth questions must be answered in the negative.","paragraph_id":"para_478"},{"text":"125","paragraph_id":"para_479"},{"text":"Accordingly, there is no need to answer the fifth question referred for a preliminary ruling.","paragraph_id":"para_480"},{"text":"The sixth question","paragraph_id":"para_481"},{"text":"126","paragraph_id":"para_482"},{"text":"By its sixth question, the referring court asks, in essence, whether Article 79(1) of the GDPR, read in the light of Article 47 of the Charter, must be interpreted as meaning that a court having jurisdiction to authorise disclosure of personal data to another judicial body is required, without an ac …","paragraph_id":"para_483"},{"text":"127","paragraph_id":"para_484"},{"text":"In that regard, the referring court states that that question is raised in so far as the proceedings before it are conducted without the participation of the persons whose personal data are concerned and the judicial authorisation of the disclosure of those data to the Inspectorate is intended as a …","paragraph_id":"para_485"},{"text":"128","paragraph_id":"para_486"},{"text":"In that regard, it must be recalled that the GDPR establishes a set of substantive and procedural rules relating to the security of data which must be observed by the controller, while providing, in Chapter VIII thereof, remedies which are intended to protect the rights of individuals whose personal …","paragraph_id":"para_487"},{"text":"129","paragraph_id":"para_488"},{"text":"Since the level of protection provided for by the GDPR is dependent on the security measures adopted by controllers of personal data, those controllers must be encouraged to do everything in their power to prevent the occurrence of processing operations that do not comply with that regulation, given …","paragraph_id":"para_489"},{"text":"130","paragraph_id":"para_490"},{"text":"Ensuring compliance with the requirements as regards security that are imposed by the GDPR is a matter, first, for the supervisory authorities, and second, the national courts hearing an action under Article 78(1) or under Article 79(1) of the GDPR.","paragraph_id":"para_491"},{"text":"131","paragraph_id":"para_492"},{"text":"As regards the supervisory authorities, their main task, as recalled in paragraph 120 above, is to monitor the application of the GDPR and ensure compliance with that regulation. In particular, they must be informed, pursuant to Article 33 of that regulation, of personal data breaches by the controllers.","paragraph_id":"para_493"},{"text":"132","paragraph_id":"para_494"},{"text":"Furthermore, Article 58(1) and (2) of the GDPR confers on those authorities significant powers of investigation and various corrective powers. It must be pointed out, in that regard, that they are required to take action where the exercise of one or more of the corrective powers provided for in Arti …","paragraph_id":"para_495"},{"text":"133","paragraph_id":"para_496"},{"text":"In addition, it is of particular importance that the supervisory authorities have genuine powers to take effectual action against infringements of the GDPR, and in particular to bring them to an end, including in situations where data subjects have not been informed that their personal data have bee …","paragraph_id":"para_497"},{"text":"134","paragraph_id":"para_498"},{"text":"Those authorities must, like the national courts hearing an action under Article 78(1) or under Article 79(1) of the GDPR, make sure that the technical and organisational measures adopted by the controller are appropriate in order to ensure a level of security appropriate to the risk, as required by …","paragraph_id":"para_499"},{"text":"135","paragraph_id":"para_500"},{"text":"By contrast, national courts which are not seised of an action under Article 78(1) or under Article 79(1) of the GDPR are not, in the absence of rules expressly conferring supervisory powers on them, required to ensure compliance with the substantive provisions of that regulation in order to ensure their effectiveness.","paragraph_id":"para_501"},{"text":"136","paragraph_id":"para_502"},{"text":"Since the referring court is uncertain, in particular, as regards the effectiveness of the judicial remedy provided for in Article 79(1) of the GDPR, it must also, in order to give it a useful answer, be pointed out that the Member States must ensure that the practical arrangements for the exercise …","paragraph_id":"para_503"},{"text":"137","paragraph_id":"para_504"},{"text":"To that end, it is important that the controller, namely the competent judicial body to which access to personal data has been granted, provide the persons whose data are concerned with the information listed in Article 14(1) and (2) of the GDPR, in accordance with the modalities referred to in Arti …","paragraph_id":"para_505"},{"text":"138","paragraph_id":"para_506"},{"text":"In the light of the foregoing considerations, the answer to the sixth question is that Article 79(1) of the GDPR, read in the light of Article 47 of the Charter, must be interpreted as meaning that a court having jurisdiction to authorise disclosure of personal data to another judicial body is not r …","paragraph_id":"para_507"},{"text":"Costs","paragraph_id":"para_508"},{"text":"139","paragraph_id":"para_509"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_510"},{"text":"On those grounds, the Court (First Chamber) hereby rules:","paragraph_id":"para_511"},{"text":"1.","paragraph_id":"para_512"},{"text":"The second subparagraph of Article 19(1) TEU, read in conjunction with Article 47 of the Charter of Fundamental Rights of the European Union,","paragraph_id":"para_513"},{"text":"must be interpreted as meaning that the principle of judicial independence precludes a Member State’s practice under which the members of a judicial body of that Member State – who are elected by its parliament for terms of office of a specific duration and are competent to scrutinise the activity o …","paragraph_id":"para_514"},{"text":"2.","paragraph_id":"para_515"},{"text":"Article 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),","paragraph_id":"para_516"},{"text":"must be interpreted as meaning that disclosure, to a judicial body, of personal data that are protected by banking secrecy and that concern judges, public prosecutors and investigating magistrates as well as their family members, with a view to the verification of the declarations which are submitte …","paragraph_id":"para_517"},{"text":"3.","paragraph_id":"para_518"},{"text":"Article 4(7) of Regulation 2016/679","paragraph_id":"para_519"},{"text":"must be interpreted as meaning that a court having jurisdiction to authorise, at the request of another judicial body, disclosure by a bank to that body of data relating to the bank accounts of judges, public prosecutors and investigating magistrates as well as of their family members, cannot be classified as a controller within the meaning of that provision.","paragraph_id":"para_520"},{"text":"4.","paragraph_id":"para_521"},{"text":"Article 51 of Regulation 2016/679","paragraph_id":"para_522"},{"text":"must be interpreted as meaning that a court having jurisdiction to authorise disclosure of personal data to another judicial body does not constitute a supervisory authority within the meaning of that article, where that court is not entrusted by the Member State in which it is situated with monitor …","paragraph_id":"para_523"},{"text":"5.","paragraph_id":"para_524"},{"text":"Article 79(1) of Regulation 2016/679, read in conjunction with Article 47 of the Charter of Fundamental Rights,","paragraph_id":"para_525"},{"text":"must be interpreted as meaning that a court having jurisdiction to authorise disclosure of personal data to another judicial body is not required, where an action pursuant to that provision has not been brought before it, to ensure of its own motion the protection of the persons whose data are conce …","paragraph_id":"para_526"},{"text":"[Signatures]","paragraph_id":"para_527"},{"text":"(\n *1\n ) Language of the case: Bulgarian.","paragraph_id":"para_528"}],"word_count":16083,"cites":["C-313/23","C-316/23","C-332/23","C-817/21","C-157/23","C-132/20","C-115/22","C-453/20","C-245/19","C-246/19","C-235/02","C-118/22","C-181/21","C-269/21","C-357/19","C-379/19","C-547/19","C-811/19","C-840/19","C-638/22","C-107/23","C-83/19","C-127/19","C-195/19","C-291/19","C-355/19","C-397/19","C-554/21","C-622/21","C-727/21","C-896/19","C-245/20","C-33/22","C-204/21","C-439/19","C-180/21","C-683/21","C-604/22","C-638/23","C-231/22","C-288/12","C-252/21","C-132/21","C-340/21","C-768/21","C-46/23","C-169/23","C-579/21"],"cited_by":[],"sha256":"6e5c8627a9c780623d9655779790f61090f6a909cef128882588284fb6627469","source_url":"https://publications.europa.eu/resource/celex/62023CJ0313.ENG.xhtml.ECR_62023CJ0313_EN_01.html","fetched_at":"2026-10-01T14:27:29.127+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/62023cj0313","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:62023cj0313","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:62023cj0313","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:62023cj0313","verification":{"stored_sha256":"6e5c8627a9c780623d9655779790f61090f6a909cef128882588284fb6627469","recomputed_sha256":"6e5c8627a9c780623d9655779790f61090f6a909cef128882588284fb6627469","intact":true,"checked_at":"2026-10-24T10:38:14.968Z"}},"hash":"sha256:af59759d31aa02483b99e51a8efe0fdca2a5be15be8050ed65e998df96d4aad8","version":"legal-2026-10-23","expires":"2026-10-25T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-23+legal-2026-10-23+2026-10-23T14:34:08","content_hash":"sha256:af59759d31aa02483b99e51a8efe0fdca2a5be15be8050ed65e998df96d4aad8","revalidate_after":"2026-10-24T11:38:15.309Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:62023cj0313","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:62023cj0313"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:62023cj0313"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:62023cj0313"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/62023cj0313","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-3f2cb563952fb72324d8e33bbdcf3447","response_hash":"sha256:af59759d31aa02483b99e51a8efe0fdca2a5be15be8050ed65e998df96d4aad8"}},"freshness":{"freshness_class":"live","as_of":"2026-11-03T07:19:31.300Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3A62023cj0313&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":32443}}