{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-180-21-62021cj0180","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-180-21-62021cj0180)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-23","fingerprint":"ewai:eu:b67bfc","proof":"sha256:14279a5bd6db89c4a04576152b1db500466d8d291ee2f85870d01afc66c3d963","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-180-21-62021cj0180","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62021CJ0180","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Fifth Chamber)","paragraphs":[]},{"title":"8 December 2022 (\n *1\n )","paragraphs":["para_4","para_5","para_6"]},{"title":"VS","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27","para_28","para_29","para_30","para_31"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_34"]},{"title":"2","paragraphs":["para_36"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"The GDPR","paragraphs":[]},{"title":"3","paragraphs":[]},{"title":"Recitals 19, 45 and 47 of the GDPR state:","paragraphs":["para_42","para_43","para_44","para_45"]},{"title":"(45)","paragraphs":["para_47","para_48"]},{"title":"(47)","paragraphs":["para_50"]},{"title":"4","paragraphs":[]},{"title":"Article 2 of that regulation, entitled ‘Material scope’, provides, in paragraphs 1 and 2:","paragraphs":["para_53"]},{"title":"2.   This Regulation does not apply to the processing of personal data:","paragraphs":[]},{"title":"(a)","paragraphs":["para_56","para_57"]},{"title":"(d)","paragraphs":["para_59"]},{"title":"5","paragraphs":[]},{"title":"Article 4 of the GDPR, entitled ‘Definitions’, provides:","paragraphs":["para_62"]},{"title":"(1)","paragraphs":["para_64"]},{"title":"(2)","paragraphs":["para_66","para_67"]},{"title":"(7)","paragraphs":["para_69","para_70"]},{"title":"6","paragraphs":["para_72","para_73","para_74"]},{"title":"(b)","paragraphs":["para_76"]},{"title":"(c)","paragraphs":["para_78","para_79"]},{"title":"7","paragraphs":[]},{"title":"Under Article 6 of the GDPR, entitled ‘Lawfulness of processing’:","paragraphs":["para_82","para_83"]},{"title":"(c)","paragraphs":["para_85","para_86"]},{"title":"(e)","paragraphs":["para_88"]},{"title":"(f)","paragraphs":["para_90","para_91","para_92","para_93"]},{"title":"(a)","paragraphs":[]},{"title":"Union law; or","paragraphs":[]},{"title":"(b)","paragraphs":["para_97","para_98"]},{"title":"8","paragraphs":[]},{"title":"Article 21 of the GDPR, entitled ‘Right to object’, provides, in paragraph 1:","paragraphs":["para_101"]},{"title":"9","paragraphs":["para_103"]},{"title":"Directive 2016/680","paragraphs":[]},{"title":"10","paragraphs":[]},{"title":"Recitals 8 to 12, 27 and 29 of Directive 2016/680 state:","paragraphs":["para_107","para_108"]},{"title":"(9)","paragraphs":["para_110"]},{"title":"(10)","paragraphs":["para_112"]},{"title":"(11)","paragraphs":["para_114"]},{"title":"(12)","paragraphs":["para_116","para_117"]},{"title":"(27)","paragraphs":["para_119","para_120"]},{"title":"(29)","paragraphs":["para_122"]},{"title":"11","paragraphs":["para_124","para_125"]},{"title":"12","paragraphs":["para_127"]},{"title":"13","paragraphs":[]},{"title":"Under Article 3(7)(a) and (8) of Directive 2016/680:","paragraphs":["para_130","para_131"]},{"title":"(7)   “competent authority” means:","paragraphs":[]},{"title":"(a)","paragraphs":["para_134","para_135","para_136"]},{"title":"14","paragraphs":["para_138","para_139","para_140"]},{"title":"(b)","paragraphs":["para_142"]},{"title":"(c)","paragraphs":["para_144","para_145"]},{"title":"15","paragraphs":[]},{"title":"Article 4(2) of Directive 2016/680 provides:","paragraphs":["para_148"]},{"title":"(a)","paragraphs":["para_150"]},{"title":"(b)","paragraphs":["para_152"]},{"title":"16","paragraphs":["para_154","para_155"]},{"title":"(a)","paragraphs":["para_157"]},{"title":"(b)","paragraphs":["para_159"]},{"title":"(c)","paragraphs":["para_161","para_162"]},{"title":"17","paragraphs":["para_164","para_165","para_166"]},{"title":"Bulgarian law","paragraphs":[]},{"title":"Constitution of the Republic of Bulgaria","paragraphs":[]},{"title":"18","paragraphs":[]},{"title":"Article 127 of the Constitution of the Republic of Bulgaria provides:","paragraphs":["para_171"]},{"title":"1.   directing the investigation and reviewing the lawfulness of its conduct;","paragraphs":[]},{"title":"2.   having the powers to conduct an investigation;","paragraphs":["para_174","para_175"]},{"title":"The ZZLD","paragraphs":[]},{"title":"19","paragraphs":["para_178"]},{"title":"20","paragraphs":["para_180"]},{"title":"21","paragraphs":["para_182"]},{"title":"The Code of Criminal Procedure","paragraphs":[]},{"title":"22","paragraphs":["para_185","para_186"]},{"title":"23","paragraphs":["para_188","para_189"]},{"title":"The Code of Civil Procedure","paragraphs":[]},{"title":"24","paragraphs":["para_192"]},{"title":"25","paragraphs":["para_194","para_195"]},{"title":"The Zakon za otgovornostta na darzhavata i obshtinite za vredi","paragraphs":[]},{"title":"26","paragraphs":["para_198","para_199","para_200","para_201"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"27","paragraphs":["para_204"]},{"title":"28","paragraphs":["para_206"]},{"title":"29","paragraphs":["para_208"]},{"title":"30","paragraphs":["para_210"]},{"title":"31","paragraphs":["para_212"]},{"title":"32","paragraphs":["para_214"]},{"title":"33","paragraphs":["para_216"]},{"title":"34","paragraphs":["para_218"]},{"title":"35","paragraphs":["para_220"]},{"title":"36","paragraphs":["para_222"]},{"title":"37","paragraphs":["para_224"]},{"title":"38","paragraphs":["para_226","para_227","para_228"]},{"title":"(2)","paragraphs":[]},{"title":"(a)","paragraphs":["para_231"]},{"title":"(b)","paragraphs":["para_233"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"The first question","paragraphs":[]},{"title":"39","paragraphs":["para_237"]},{"title":"40","paragraphs":["para_239"]},{"title":"41","paragraphs":["para_241"]},{"title":"42","paragraphs":["para_243"]},{"title":"43","paragraphs":["para_245"]},{"title":"44","paragraphs":["para_247"]},{"title":"45","paragraphs":["para_249"]},{"title":"46","paragraphs":["para_251"]},{"title":"47","paragraphs":["para_253"]},{"title":"48","paragraphs":["para_255"]},{"title":"49","paragraphs":["para_257"]},{"title":"50","paragraphs":["para_259"]},{"title":"51","paragraphs":["para_261"]},{"title":"52","paragraphs":["para_263"]},{"title":"53","paragraphs":["para_265"]},{"title":"54","paragraphs":["para_267"]},{"title":"55","paragraphs":["para_269"]},{"title":"56","paragraphs":["para_271"]},{"title":"57","paragraphs":["para_273"]},{"title":"58","paragraphs":["para_275"]},{"title":"59","paragraphs":["para_277"]},{"title":"60","paragraphs":["para_279"]},{"title":"61","paragraphs":["para_281"]},{"title":"62","paragraphs":["para_283"]},{"title":"63","paragraphs":["para_285"]},{"title":"The second question","paragraphs":[]},{"title":"64","paragraphs":["para_288"]},{"title":"Admissibility","paragraphs":[]},{"title":"65","paragraphs":["para_291"]},{"title":"66","paragraphs":["para_293"]},{"title":"67","paragraphs":["para_295"]},{"title":"68","paragraphs":["para_297"]},{"title":"Substance","paragraphs":["para_299"]},{"title":"69","paragraphs":["para_301"]},{"title":"70","paragraphs":["para_303"]},{"title":"71","paragraphs":["para_305"]},{"title":"72","paragraphs":["para_307"]},{"title":"73","paragraphs":["para_309"]},{"title":"74","paragraphs":["para_311"]},{"title":"75","paragraphs":["para_313"]},{"title":"76","paragraphs":["para_315"]},{"title":"77","paragraphs":["para_317"]},{"title":"78","paragraphs":["para_319"]},{"title":"79","paragraphs":["para_321"]},{"title":"80","paragraphs":["para_323"]},{"title":"81","paragraphs":["para_325"]},{"title":"82","paragraphs":["para_327","para_328"]},{"title":"83","paragraphs":["para_330"]},{"title":"84","paragraphs":["para_332"]},{"title":"85","paragraphs":["para_334"]},{"title":"86","paragraphs":["para_336"]},{"title":"87","paragraphs":["para_338"]},{"title":"88","paragraphs":["para_340"]},{"title":"89","paragraphs":["para_342"]},{"title":"90","paragraphs":["para_344"]},{"title":"91","paragraphs":["para_346"]},{"title":"92","paragraphs":["para_348"]},{"title":"93","paragraphs":["para_350"]},{"title":"94","paragraphs":["para_352"]},{"title":"95","paragraphs":["para_354"]},{"title":"96","paragraphs":["para_356"]},{"title":"97","paragraphs":[]},{"title":"In the light of all the foregoing, the answer to the second question is that:","paragraphs":["para_359","para_360","para_361","para_362"]},{"title":"Costs","paragraphs":[]},{"title":"98","paragraphs":["para_365"]},{"title":"On those grounds, the Court (Fifth Chamber) hereby rules:","paragraphs":["para_367","para_368","para_369","para_370","para_371","para_372","para_373"]},{"title":"Article 6(1) of Regulation 2016/679","paragraphs":["para_375","para_376","para_377"]}],"paragraphs":[{"text":"62021CJ0180","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Fifth Chamber)","paragraph_id":"para_2"},{"text":"8 December 2022 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Articles 2, 4 and 6 – Applicability of Regulation 2016/679 – Concept of ‘legitimate interest’ – Concept of ‘task carried out in the public interest or in th …","paragraph_id":"para_4"},{"text":"In Case C‑180/21,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Administrativen sad – Blagoevgrad (Administrative Court, Blagoevgrad, Bulgaria), made by decision of 19 March 2021, received at the Court on 23 March 2021, in the proceedings","paragraph_id":"para_6"},{"text":"VS","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"Inspektor v Inspektorata kam Visshia sadeben savet,","paragraph_id":"para_9"},{"text":"interested party:","paragraph_id":"para_10"},{"text":"Teritorialno otdelenie – Petrich kam Rayonna prokuratura – Blagoevgrad,","paragraph_id":"para_11"},{"text":"THE COURT (Fifth Chamber),","paragraph_id":"para_12"},{"text":"composed of E. Regan, President of the Chamber, D. Gratsias (Rapporteur), M. Ilešič, I. Jarukaitis, and Z. Csehi, Judges,","paragraph_id":"para_13"},{"text":"Advocate General: M. Campos Sánchez-Bordona,","paragraph_id":"para_14"},{"text":"Registrar: A. Calot Escobar,","paragraph_id":"para_15"},{"text":"having regard to the written procedure,","paragraph_id":"para_16"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"VS, by V. Harizanova,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"Inspektor v Inspektorata kam Visshia sadeben savet, by S. Mulyachka,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the Bulgarian Government, by M. Georgieva and T. Mitova, acting as Agents,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"the Czech Government, by O. Serdula, M. Smolek and J. Vláčil, acting as Agents,","paragraph_id":"para_25"},{"text":"–","paragraph_id":"para_26"},{"text":"the Netherlands Government, by M.K. Bulterman and J.M. Hoogveld, acting as Agents,","paragraph_id":"para_27"},{"text":"–","paragraph_id":"para_28"},{"text":"the European Commission, by H. Kranenborg and I. Zaloguin, acting as Agents,","paragraph_id":"para_29"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 19 May 2022,","paragraph_id":"para_30"},{"text":"gives the following","paragraph_id":"para_31"},{"text":"Judgment","paragraph_id":"para_32"},{"text":"1","paragraph_id":"para_33"},{"text":"This request for a preliminary ruling concerns the interpretation of Article 1(1) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of …","paragraph_id":"para_34"},{"text":"2","paragraph_id":"para_35"},{"text":"The request has been made in proceedings between VS and Inspektor v Inspektorata kam Visshia sadeben savet (Inspector with the Inspectorate at the Supreme Judicial Council, Bulgaria) (‘the IVSS’) concerning the lawfulness of the processing of personal data concerning VS by the District Public Prosecutor’s Office, Petrich (Bulgaria).","paragraph_id":"para_36"},{"text":"Legal context","paragraph_id":"para_37"},{"text":"European Union law","paragraph_id":"para_38"},{"text":"The GDPR","paragraph_id":"para_39"},{"text":"3","paragraph_id":"para_40"},{"text":"Recitals 19, 45 and 47 of the GDPR state:","paragraph_id":"para_41"},{"text":"‘(19)","paragraph_id":"para_42"},{"text":"… Member States may entrust competent authorities within the meaning of [Directive 2016/680] with tasks which are not necessarily carried out for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safegua …","paragraph_id":"para_43"},{"text":"…","paragraph_id":"para_44"},{"text":"…","paragraph_id":"para_45"},{"text":"(45)","paragraph_id":"para_46"},{"text":"Where processing is … necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the processing should have a basis in Union or Member State law. This Regulation does not require a specific law for each individual processing. A law as a basis …","paragraph_id":"para_47"},{"text":"…","paragraph_id":"para_48"},{"text":"(47)","paragraph_id":"para_49"},{"text":"The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into …","paragraph_id":"para_50"},{"text":"4","paragraph_id":"para_51"},{"text":"Article 2 of that regulation, entitled ‘Material scope’, provides, in paragraphs 1 and 2:","paragraph_id":"para_52"},{"text":"‘1.   This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.","paragraph_id":"para_53"},{"text":"2.   This Regulation does not apply to the processing of personal data:","paragraph_id":"para_54"},{"text":"(a)","paragraph_id":"para_55"},{"text":"in the course of an activity which falls outside the scope of Union law;","paragraph_id":"para_56"},{"text":"…","paragraph_id":"para_57"},{"text":"(d)","paragraph_id":"para_58"},{"text":"by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’","paragraph_id":"para_59"},{"text":"5","paragraph_id":"para_60"},{"text":"Article 4 of the GDPR, entitled ‘Definitions’, provides:","paragraph_id":"para_61"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_62"},{"text":"(1)","paragraph_id":"para_63"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;","paragraph_id":"para_64"},{"text":"(2)","paragraph_id":"para_65"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_66"},{"text":"…","paragraph_id":"para_67"},{"text":"(7)","paragraph_id":"para_68"},{"text":"“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;","paragraph_id":"para_69"},{"text":"…’","paragraph_id":"para_70"},{"text":"6","paragraph_id":"para_71"},{"text":"Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, provides, in paragraph 1:","paragraph_id":"para_72"},{"text":"‘Personal data shall be:","paragraph_id":"para_73"},{"text":"…","paragraph_id":"para_74"},{"text":"(b)","paragraph_id":"para_75"},{"text":"collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; … (“purpose limitation”);","paragraph_id":"para_76"},{"text":"(c)","paragraph_id":"para_77"},{"text":"adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);","paragraph_id":"para_78"},{"text":"…’","paragraph_id":"para_79"},{"text":"7","paragraph_id":"para_80"},{"text":"Under Article 6 of the GDPR, entitled ‘Lawfulness of processing’:","paragraph_id":"para_81"},{"text":"‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:","paragraph_id":"para_82"},{"text":"…","paragraph_id":"para_83"},{"text":"(c)","paragraph_id":"para_84"},{"text":"processing is necessary for compliance with a legal obligation to which the controller is subject;","paragraph_id":"para_85"},{"text":"…","paragraph_id":"para_86"},{"text":"(e)","paragraph_id":"para_87"},{"text":"processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;","paragraph_id":"para_88"},{"text":"(f)","paragraph_id":"para_89"},{"text":"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data …","paragraph_id":"para_90"},{"text":"Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.","paragraph_id":"para_91"},{"text":"…","paragraph_id":"para_92"},{"text":"3.   The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:","paragraph_id":"para_93"},{"text":"(a)","paragraph_id":"para_94"},{"text":"Union law; or","paragraph_id":"para_95"},{"text":"(b)","paragraph_id":"para_96"},{"text":"Member State law to which the controller is subject.","paragraph_id":"para_97"},{"text":"The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. …’","paragraph_id":"para_98"},{"text":"8","paragraph_id":"para_99"},{"text":"Article 21 of the GDPR, entitled ‘Right to object’, provides, in paragraph 1:","paragraph_id":"para_100"},{"text":"‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1) … The controller shall no longer process the personal data unless the controll …","paragraph_id":"para_101"},{"text":"9","paragraph_id":"para_102"},{"text":"Article 23 of that regulation, entitled ‘Restrictions’, states, in paragraph 1, that EU or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22, when such a restric …","paragraph_id":"para_103"},{"text":"Directive 2016/680","paragraph_id":"para_104"},{"text":"10","paragraph_id":"para_105"},{"text":"Recitals 8 to 12, 27 and 29 of Directive 2016/680 state:","paragraph_id":"para_106"},{"text":"‘(8)","paragraph_id":"para_107"},{"text":"Article 16(2) TFEU mandates the European Parliament and the Council [of the European Union] to lay down the rules relating to the protection of natural persons with regard to the processing of personal data and the rules relating to the free movement of personal data.","paragraph_id":"para_108"},{"text":"(9)","paragraph_id":"para_109"},{"text":"On that basis, [the GDPR] lays down general rules to protect natural persons in relation to the processing of personal data and to ensure the free movement of personal data within the Union.","paragraph_id":"para_110"},{"text":"(10)","paragraph_id":"para_111"},{"text":"In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection …","paragraph_id":"para_112"},{"text":"(11)","paragraph_id":"para_113"},{"text":"It is therefore appropriate for those fields to be addressed by a directive that lays down the specific rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecut …","paragraph_id":"para_114"},{"text":"(12)","paragraph_id":"para_115"},{"text":"The activities carried out by the police or other law-enforcement authorities are focused mainly on the prevention, investigation, detection or prosecution of criminal offences, including police activities without prior knowledge if an incident is a criminal offence or not. … Member States may entru …","paragraph_id":"para_116"},{"text":"…","paragraph_id":"para_117"},{"text":"(27)","paragraph_id":"para_118"},{"text":"For the prevention, investigation and prosecution of criminal offences, it is necessary for competent authorities to process personal data collected in the context of the prevention, investigation, detection or prosecution of specific criminal offences beyond that context in order to develop an understanding of criminal activities and to make links between different criminal offences detected.","paragraph_id":"para_119"},{"text":"…","paragraph_id":"para_120"},{"text":"(29)","paragraph_id":"para_121"},{"text":"Personal data should be collected for specified, explicit and legitimate purposes within the scope of this Directive and should not be processed for purposes incompatible with the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal pe …","paragraph_id":"para_122"},{"text":"11","paragraph_id":"para_123"},{"text":"Article 1 of that directive, entitled ‘Subject matter and objectives’, provides, in paragraph 1:","paragraph_id":"para_124"},{"text":"‘This Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’","paragraph_id":"para_125"},{"text":"12","paragraph_id":"para_126"},{"text":"The definitions of the terms ‘personal data’ and ‘processing’ in paragraphs 1 and 2, respectively, of Article 3 of that directive, entitled ‘Definitions’, reproduce those set out in Article 4(1) and (2) of the GDPR.","paragraph_id":"para_127"},{"text":"13","paragraph_id":"para_128"},{"text":"Under Article 3(7)(a) and (8) of Directive 2016/680:","paragraph_id":"para_129"},{"text":"‘For the purposes of this Directive:","paragraph_id":"para_130"},{"text":"…","paragraph_id":"para_131"},{"text":"(7)   “competent authority” means:","paragraph_id":"para_132"},{"text":"(a)","paragraph_id":"para_133"},{"text":"any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; …","paragraph_id":"para_134"},{"text":"…","paragraph_id":"para_135"},{"text":"(8)   “controller” means the competent authority which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law’.","paragraph_id":"para_136"},{"text":"14","paragraph_id":"para_137"},{"text":"Article 4 of Directive 2016/680, entitled ‘Principles relating to processing of personal data’, states, in paragraph 1:","paragraph_id":"para_138"},{"text":"‘Member States shall provide for personal data to be:","paragraph_id":"para_139"},{"text":"…","paragraph_id":"para_140"},{"text":"(b)","paragraph_id":"para_141"},{"text":"collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;","paragraph_id":"para_142"},{"text":"(c)","paragraph_id":"para_143"},{"text":"adequate, relevant and not excessive in relation to the purposes for which they are processed;","paragraph_id":"para_144"},{"text":"…’","paragraph_id":"para_145"},{"text":"15","paragraph_id":"para_146"},{"text":"Article 4(2) of Directive 2016/680 provides:","paragraph_id":"para_147"},{"text":"‘Processing by the same or another controller for any of the purposes set out in Article 1(1) other than that for which the personal data are collected shall be permitted in so far as:","paragraph_id":"para_148"},{"text":"(a)","paragraph_id":"para_149"},{"text":"the controller is authorised to process such personal data for such a purpose in accordance with Union or Member State law; and","paragraph_id":"para_150"},{"text":"(b)","paragraph_id":"para_151"},{"text":"processing is necessary and proportionate to that other purpose in accordance with Union or Member State law.’","paragraph_id":"para_152"},{"text":"16","paragraph_id":"para_153"},{"text":"Under Article 6 of Directive 2016/680, entitled ‘Distinction between different categories of data subject’:","paragraph_id":"para_154"},{"text":"‘Member States shall provide for the controller, where applicable and as far as possible, to make a clear distinction between personal data of different categories of data subjects, such as:","paragraph_id":"para_155"},{"text":"(a)","paragraph_id":"para_156"},{"text":"persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence;","paragraph_id":"para_157"},{"text":"(b)","paragraph_id":"para_158"},{"text":"persons convicted of a criminal offence;","paragraph_id":"para_159"},{"text":"(c)","paragraph_id":"para_160"},{"text":"victims of a criminal offence or persons with regard to whom certain facts give rise to reasons for believing that he or she could be the victim of a criminal offence; …","paragraph_id":"para_161"},{"text":"…’","paragraph_id":"para_162"},{"text":"17","paragraph_id":"para_163"},{"text":"Article 9 of Directive 2016/680, entitled ‘Specific processing conditions’, provides, in paragraphs 1 and 2:","paragraph_id":"para_164"},{"text":"‘1.   Personal data collected by competent authorities for the purposes set out in Article 1(1) shall not be processed for purposes other than those set out in Article 1(1) unless such processing is authorised by Union or Member State law. Where personal data are processed for such other purposes, [the GDPR] shall apply unless the processing is carried out in an activity which falls outside the scope of Union law.","paragraph_id":"para_165"},{"text":"2.   Where competent authorities are entrusted by Member State law with the performance of tasks other than those performed for the purposes set out in Article 1(1), [the GDPR] shall apply to processing for such purposes …, unless the processing is carried out in an activity which falls outside the scope of Union law.’","paragraph_id":"para_166"},{"text":"Bulgarian law","paragraph_id":"para_167"},{"text":"Constitution of the Republic of Bulgaria","paragraph_id":"para_168"},{"text":"18","paragraph_id":"para_169"},{"text":"Article 127 of the Constitution of the Republic of Bulgaria provides:","paragraph_id":"para_170"},{"text":"‘The Public Prosecutor’s Office shall ensure that laws are complied with by:","paragraph_id":"para_171"},{"text":"1.   directing the investigation and reviewing the lawfulness of its conduct;","paragraph_id":"para_172"},{"text":"2.   having the powers to conduct an investigation;","paragraph_id":"para_173"},{"text":"3.   making a formal accusation in respect of persons who have committed criminal offences and prosecuting criminal offences subject to public prosecution;","paragraph_id":"para_174"},{"text":"…’","paragraph_id":"para_175"},{"text":"The ZZLD","paragraph_id":"para_176"},{"text":"19","paragraph_id":"para_177"},{"text":"In accordance with Article 1 thereof, the Zakon za zashtita na lichnite danni (Law on the Protection of Personal Data) (DV No 1 of 4 January 2002; ‘the ZZLD’) seeks to ensure the protection of natural persons with regard to the processing of personal data as governed by the GDPR and with regard to t …","paragraph_id":"para_178"},{"text":"20","paragraph_id":"para_179"},{"text":"In accordance with Article 17(1) of the ZZLD, the IVSS is to monitor and ensure compliance with the GDPR, the ZZLD and acts on the subject of the protection of personal data in the processing of personal data by, inter alia, the Public Prosecutor’s Office and the investigating authorities in the exe …","paragraph_id":"para_180"},{"text":"21","paragraph_id":"para_181"},{"text":"Article 42(2) and (3), Article 45(2) and Article 47 of the ZZLD implement Article 9(1) and (2), Article 4(2) and Article 6 of Directive 2016/680 respectively.","paragraph_id":"para_182"},{"text":"The Code of Criminal Procedure","paragraph_id":"para_183"},{"text":"22","paragraph_id":"para_184"},{"text":"Article 191 of the Nakazatelno-protsesualen kodeks (Code of Criminal Procedure) (DV No 86 of 28 October 2005), in the version applicable to the dispute in the main proceedings, provides:","paragraph_id":"para_185"},{"text":"‘Pre-trial proceedings shall be conducted in respect of criminal offences subject to public prosecution.’","paragraph_id":"para_186"},{"text":"23","paragraph_id":"para_187"},{"text":"Article 192 of the Code of Criminal Procedure, in the version applicable to the dispute in the main proceedings, provides:","paragraph_id":"para_188"},{"text":"‘Pre-trial proceedings shall comprise an investigation and actions of the Public Prosecutor after the investigation has been closed.’","paragraph_id":"para_189"},{"text":"The Code of Civil Procedure","paragraph_id":"para_190"},{"text":"24","paragraph_id":"para_191"},{"text":"Articles 8 and 9 of the Grazhdanski protsesualen kodeks (Code of Civil Procedure) (DV No 59 of 20 July 2007), in the version applicable to the dispute in the main proceedings, implement the principles of audi alteram partem and equality of arms respectively.","paragraph_id":"para_192"},{"text":"25","paragraph_id":"para_193"},{"text":"Article 154 of the Code of Civil Procedure, in the version applicable to the dispute in the main proceedings, entitled ‘Burden of proof’, provides, in paragraph 1:","paragraph_id":"para_194"},{"text":"‘Each party shall be required to establish the facts on which it bases its claims or objections.’","paragraph_id":"para_195"},{"text":"The Zakon za otgovornostta na darzhavata i obshtinite za vredi","paragraph_id":"para_196"},{"text":"26","paragraph_id":"para_197"},{"text":"Article 2b of the Zakon za otgovornostta na darzhavata i obshtinite za vredi (Law on liability of the State and of municipalities for damage) (DV No 60 of 5 August 1988) provides:","paragraph_id":"para_198"},{"text":"‘(1)   The State shall be liable for damage caused to citizens and legal persons by an infringement of the right to have the case examined and disposed of within a reasonable time in accordance with Article 6(1) of the Convention [for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950].","paragraph_id":"para_199"},{"text":"(2)   The actions referred to in paragraph 1 shall be examined in accordance with the Code of Civil Procedure, whereby the court shall take into account the total duration and subject matter of the proceedings, their factual and legal complexity, the conduct of the parties and of their procedural or legal representatives, the conduct of the other parties to the proceedings and of the competent authorities, and other facts relevant to the correct resolution of the dispute.","paragraph_id":"para_200"},{"text":"…’","paragraph_id":"para_201"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_202"},{"text":"27","paragraph_id":"para_203"},{"text":"In 2013, the District Public Prosecutor’s Office, Petrich, opened pre-trial proceedings No 252/2013 against an unknown person for the commission of an offence referred to in Article 325(1) of the Nakazatelen kodeks (Criminal Code), read in conjunction with Article 20(2) thereof, in the context of an incident which took place in a bar. The applicant in the main proceedings, VS, took part in those proceedings as a victim of that criminal offence.","paragraph_id":"para_204"},{"text":"28","paragraph_id":"para_205"},{"text":"In 2016, following a number of complaints concerning, inter alia, VS, the District Public Prosecutor’s Office, Petrich, compiled a number of files containing information relating to that person, but did not open any pre-trial proceedings in the absence of evidence that a criminal offence had been committed.","paragraph_id":"para_206"},{"text":"29","paragraph_id":"para_207"},{"text":"In 2018, in the context of pre-trial proceedings No 252/2013, the public prosecutor made formal accusations in respect of all the persons who took part in the incident at issue in those proceedings, including VS.","paragraph_id":"para_208"},{"text":"30","paragraph_id":"para_209"},{"text":"In civil proceedings, VS brought an action before the Okrazhen sad Blagoevgrad (Regional Court, Blagoevgrad, Bulgaria) against the Public Prosecutor’s Office of the Republic of Bulgaria seeking damages for the harm allegedly resulting from the excessive duration of pre-trial proceedings No 252/2013. …","paragraph_id":"para_210"},{"text":"31","paragraph_id":"para_211"},{"text":"On 12 March 2020, VS lodged a complaint with the IVSS, claiming that the District Public Prosecutor’s Office, Petrich, had infringed the provisions relating to the protection of personal data. By his first claim, he submitted that that public prosecutor’s office had unlawfully used his personal data …","paragraph_id":"para_212"},{"text":"32","paragraph_id":"para_213"},{"text":"On 31 July 2020, VS brought an action before the referring court against that decision, claiming, first, that the processing of his personal data in the course of pre-trial proceedings No 252/2013 is contrary to, inter alia, the principles of Directive 2016/680, and second, that the processing of th …","paragraph_id":"para_214"},{"text":"33","paragraph_id":"para_215"},{"text":"Taking the view, in the light of the Court’s case-law, that the dispute in the main proceedings concerns the processing of personal data in the context of activities coming within the scope of the GDPR and Directive 2016/680, the referring court has doubts as to the limits laid down by EU law concerning the subsequent processing of personal data that were initially collected by the controller for the purposes of the investigation and detection of a criminal offence.","paragraph_id":"para_216"},{"text":"34","paragraph_id":"para_217"},{"text":"In particular, first, the referring court has doubts whether, in the event that the Public Prosecutor’s Office of the Republic of Bulgaria, as a ‘competent authority’ within the meaning of Article 3(7)(a) of Directive 2016/680, and as a ‘controller’ within the meaning of Article 3(8) of that directi …","paragraph_id":"para_218"},{"text":"35","paragraph_id":"para_219"},{"text":"Second, the referring court states that the reference, in the context of the action for damages brought by VS, to the information relating to that person contained in the files opened in 2016 by the District Public Prosecutor’s Office, Petrich, serves a different purpose from that for which that inf …","paragraph_id":"para_220"},{"text":"36","paragraph_id":"para_221"},{"text":"Furthermore, the referring court considers, in essence, that the dispute in the main proceedings raises the question of reconciling the protection of personal data and the rights of a party to judicial proceedings, where those data have been collected by that party in its capacity as controller with …","paragraph_id":"para_222"},{"text":"37","paragraph_id":"para_223"},{"text":"The referring court considers that the other grounds for lawfulness of the processing of personal data coming within the scope of the GDPR, which are set out in the first subparagraph of Article 6(1) of that regulation, are not relevant in the dispute in the main proceedings. In particular, accordin …","paragraph_id":"para_224"},{"text":"38","paragraph_id":"para_225"},{"text":"In those circumstances, the Administrativen sad – Blagoevgrad (Administrative Court, Blagoevgrad) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_226"},{"text":"‘(1)","paragraph_id":"para_227"},{"text":"Is Article 1(1) of [Directive 2016/680] to be interpreted as meaning that, when stating the objectives of that directive, the terms “prevention, investigation, detection or prosecution of criminal offences [or the execution of criminal penalties]” are listed as aspects of a general objective?","paragraph_id":"para_228"},{"text":"(2)","paragraph_id":"para_229"},{"text":"(a)","paragraph_id":"para_230"},{"text":"Are the provisions of [the GDPR] applicable to the Public Prosecutor’s Office of the Republic of Bulgaria in view of the fact that information concerning a person, which was collected by the Public Prosecutor’s Office, in its capacity as “controller” pursuant to point 8 of Article 3 of [Directive 20 …","paragraph_id":"para_231"},{"text":"(b)","paragraph_id":"para_232"},{"text":"If that question is answered in the affirmative: Is the expression “legitimate interests” in [point (f) of the first subparagraph of Article 6(1) of the GDPR] to be interpreted as including the disclosure, in whole or in part, of information concerning a person which has been collected in a public p …","paragraph_id":"para_233"},{"text":"Consideration of the questions referred","paragraph_id":"para_234"},{"text":"The first question","paragraph_id":"para_235"},{"text":"39","paragraph_id":"para_236"},{"text":"As a preliminary point, it should be noted that, even if the referring court formally confined its first question to the interpretation of Article 1(1) of Directive 2016/680, that circumstance does not prevent the Court from providing it with all the elements of interpretation which may be useful fo …","paragraph_id":"para_237"},{"text":"40","paragraph_id":"para_238"},{"text":"It follows that, by its first question, the referring court seeks, in essence, to ascertain (i) whether Article 1(1) of Directive 2016/680, read in conjunction with Article 4(2) and Article 6 thereof, must be interpreted as meaning that the processing of personal data serves a purpose other than tha …","paragraph_id":"para_239"},{"text":"41","paragraph_id":"para_240"},{"text":"According to settled case-law, it is necessary, for the interpretation of a provision of EU law, that account be taken not only of its wording, but also of its context and the objectives pursued by the rules of which it is part. The origins of a provision of EU law may also provide information relevant to its interpretation (see, to that effect, judgment of 1 October 2019, Planet49, C‑673/17 , EU:C:2019:801 , paragraph  48 and the case-law cited).","paragraph_id":"para_241"},{"text":"42","paragraph_id":"para_242"},{"text":"In the first place, it must be noted, first of all, that the wording of Article 1(1) of Directive 2016/680, which relates to the subject matter of that directive, expressly distinguishes between different categories of activities whose purposes the processing of the relevant personal data may serve. …","paragraph_id":"para_243"},{"text":"43","paragraph_id":"para_244"},{"text":"Next, the wording of Article 4(2) of that directive, which states that processing for ‘any of the purposes set out in Article 1(1) [thereof] other than that for which the personal data are collected’ is to be permitted, subject to compliance with the requirements laid down by that provision, express …","paragraph_id":"para_245"},{"text":"44","paragraph_id":"para_246"},{"text":"It can thus be inferred from the very wording of Article 1(1) of Directive 2016/680, read in conjunction with Article 4(2) thereof, that, where personal data have been collected for the purposes of the ‘detection’ and ‘investigation’ of a criminal offence and have subsequently been processed for the purposes of ‘prosecution’, that collection and that processing serve different purposes.","paragraph_id":"para_247"},{"text":"45","paragraph_id":"para_248"},{"text":"Lastly, it must be observed that, under Article 6 of that directive, Member States are under an obligation to provide for the controller, where applicable and as far as possible, to make a clear distinction between personal data of different categories of data subjects, such as, inter alia, those re …","paragraph_id":"para_249"},{"text":"46","paragraph_id":"para_250"},{"text":"Consequently, a person whose personal data are processed for the purposes of criminal prosecution must be regarded as coming within the category of persons with regard to whom there are serious grounds for believing that they have committed a criminal offence, within the meaning of Article 6(a) of D …","paragraph_id":"para_251"},{"text":"47","paragraph_id":"para_252"},{"text":"That said, it must be stated that neither Article 1(1) of Directive 2016/680 nor Article 4(2) thereof refers to Article 6 of that directive or to its content in order to lay down the purpose of the processing of personal data coming within the scope of that directive.","paragraph_id":"para_253"},{"text":"48","paragraph_id":"para_254"},{"text":"Moreover, as the Advocate General observed, in essence, in point 62 of his Opinion, the expression ‘where applicable and as far as possible’, used in Article 6 of Directive 2016/680, clearly indicates that it is not necessarily possible to draw a clear distinction between such data, in particular wh …","paragraph_id":"para_255"},{"text":"49","paragraph_id":"para_256"},{"text":"It must be inferred from this that Article 6 lays down an obligation that is separate from that laid down in Article 4(2) and, as the Advocate General noted in points 61 to 64 of his Opinion, that obligation is not relevant for the purpose of determining whether the processing of personal data serves a purpose other than that for which those data were collected, within the meaning of that provision.","paragraph_id":"para_257"},{"text":"50","paragraph_id":"para_258"},{"text":"In the second place, as regards the context of the legislation at issue, it should be noted that Article 4(1)(b) and (c) of Directive 2016/680 provides, first, that personal data must be collected for specified, explicit and legitimate purposes and not be processed in a manner that is incompatible w …","paragraph_id":"para_259"},{"text":"51","paragraph_id":"para_260"},{"text":"That said, it must be observed that Article 4(2) of that directive, in the light of recital 29 thereof, authorises subsequent processing of personal data for a purpose other than that for which those data were collected, where that purpose is among those set out in Article 1(1) of that directive and …","paragraph_id":"para_261"},{"text":"52","paragraph_id":"para_262"},{"text":"In particular, personal data collected for the purposes of the ‘prevention’ and ‘detection’ or ‘investigation’ of criminal offences may be processed subsequently, where appropriate, by different competent authorities, for the purposes of ‘prosecution’ or the ‘execution of criminal penalties’, where a criminal offence has been identified and consequently calls for law enforcement action.","paragraph_id":"para_263"},{"text":"53","paragraph_id":"para_264"},{"text":"However, in the context of the collection of personal data for the purposes of the ‘detection’ and ‘investigation’ of criminal offences, the competent authorities are required to gather any data that are potentially relevant to the determination of the acts constituting the criminal offence at issue …","paragraph_id":"para_265"},{"text":"54","paragraph_id":"para_266"},{"text":"Consequently, first, personal data necessary for the purposes of the ‘detection’ and ‘investigation’ of a criminal offence will not be systematically necessary for the purposes of ‘prosecution’. Second, the consequences of the processing of personal data for the data subjects might be substantially …","paragraph_id":"para_267"},{"text":"55","paragraph_id":"para_268"},{"text":"In addition, it should be noted that the scope of Article 4(2) is not limited to the processing of personal data in connection with the same criminal offence as that warranting the collection of those data. As stated in recital 27 of Directive 2016/680, that directive takes account of the need for t …","paragraph_id":"para_269"},{"text":"56","paragraph_id":"para_270"},{"text":"It follows from the foregoing that, in order to meet the requirements referred to in Article 4(2)(a) and (b) of Directive 2016/680, the assessment of compliance with those requirements in the processing, by the same or by another controller, of personal data for one of the purposes set out in Article 1(1), other than that for which those data were collected, must be carried out by regarding each of the purposes referred to in Article 1(1) as specific and distinct.","paragraph_id":"para_271"},{"text":"57","paragraph_id":"para_272"},{"text":"In the third place, as regards the objectives of the legislation at issue, it should be noted that, as is apparent from recitals 10 and 11 of Directive 2016/680, the EU legislature sought to adopt rules which take account of the specific nature of the field covered by that directive.","paragraph_id":"para_273"},{"text":"58","paragraph_id":"para_274"},{"text":"In that regard, recital 12 states that the activities carried out by the police or other law-enforcement authorities are focused mainly on the prevention, investigation, detection or prosecution of criminal offences, including police activities without prior knowledge if an incident is a criminal offence or not.","paragraph_id":"para_275"},{"text":"59","paragraph_id":"para_276"},{"text":"It follows from this that the EU legislature sought to adopt rules corresponding to the specific features which characterise the activities carried out by the competent authorities in the field governed by that directive, while taking account of the fact that they constitute distinct activities serving purposes specific to them.","paragraph_id":"para_277"},{"text":"60","paragraph_id":"para_278"},{"text":"This interpretation, in the light of the context of the provision at issue and the objectives pursued by the legislation of which it is part, is borne out by its origins, in particular by the statement of the Council’s reasons concerning Council Position (EU) No 5/2016 at first reading with a view t …","paragraph_id":"para_279"},{"text":"61","paragraph_id":"para_280"},{"text":"It is therefore for the referring court to determine, with a view to resolving the dispute in the main proceedings, whether the processing of personal data concerning VS by the District Public Prosecutor’s Office, Petrich, for the purpose of prosecuting that person, could be permitted in the light o …","paragraph_id":"para_281"},{"text":"62","paragraph_id":"para_282"},{"text":"In that regard, it should be noted that, for the purpose of assessing whether that processing is necessary and proportionate, the referring court may, where appropriate, take account of the fact that the authority responsible for that prosecution must be in a position to rely on the data collected d …","paragraph_id":"para_283"},{"text":"63","paragraph_id":"para_284"},{"text":"In the light of all the foregoing, the answer to the first question is that Article 1(1) of Directive 2016/680, read in conjunction with Article 4(2) and Article 6 thereof, must be interpreted as meaning that (i) the processing of personal data serves a purpose other than that for which those data w …","paragraph_id":"para_285"},{"text":"The second question","paragraph_id":"para_286"},{"text":"64","paragraph_id":"para_287"},{"text":"By its second question, the referring court asks, in essence, first, whether Article 3(8) and Article 9(1) and (2) of Directive 2016/680 and Article 2(1) and (2) of the GDPR must be interpreted as meaning that that regulation is applicable to the processing of personal data by the public prosecutor’ …","paragraph_id":"para_288"},{"text":"Admissibility","paragraph_id":"para_289"},{"text":"65","paragraph_id":"para_290"},{"text":"In its written observations, the IVSS disputes the admissibility of the second question on the ground that it was raised by the referring court in the context of the examination of a claim put forward by VS which had been rejected as inadmissible by the decision that is the subject matter of the dispute in the main proceedings, on account of the expiry of the statutory time limit for raising it.","paragraph_id":"para_291"},{"text":"66","paragraph_id":"para_292"},{"text":"According to the Court’s settled case-law, questions on the interpretation of EU law referred by a national court in the factual and legislative context which that court is responsible for defining, and the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevanc …","paragraph_id":"para_293"},{"text":"67","paragraph_id":"para_294"},{"text":"In the present case, it should be noted, as the Advocate General observed in points 76 and 77 of his Opinion, that the matter of the admissibility of the claims raised by VS in his complaint before the IVSS comes entirely within the jurisdiction of the referring court. Moreover, in the order for ref …","paragraph_id":"para_295"},{"text":"68","paragraph_id":"para_296"},{"text":"It follows that the second question is admissible.","paragraph_id":"para_297"},{"text":"Substance","paragraph_id":"para_298"},{"text":"–  The application of the GDPR to the processing of personal data by the public prosecutor’s office of a Member State for the purpose of exercising its rights of defence in an action for damages against the State","paragraph_id":"para_299"},{"text":"69","paragraph_id":"para_300"},{"text":"In the first place, it is necessary to determine whether the use, by the public prosecutor’s office of a Member State, of information concerning a natural person that it has collected and processed for purposes coming within the scope of Article 1(1) of Directive 2016/680, with a view to exercising its rights of defence in civil proceedings, constitutes ‘processing’ of ‘personal data’ within the meaning of Article 4(1) and (2) of the GDPR.","paragraph_id":"para_301"},{"text":"70","paragraph_id":"para_302"},{"text":"First of all, it must be borne in mind that ‘personal data’, within the meaning of Article 4(1) of the GDPR, means ‘any information relating to an identified or identifiable natural person’, it being understood that, according to the case-law, that definition is applicable where, by reason of its co …","paragraph_id":"para_303"},{"text":"71","paragraph_id":"para_304"},{"text":"In that regard, first, the fact that the defendant in civil proceedings informs the court having jurisdiction, even succinctly, in its written pleadings or at the hearing, of the opening of files concerning the natural person who has brought those proceedings, in particular for the purposes of the ‘ …","paragraph_id":"para_305"},{"text":"72","paragraph_id":"para_306"},{"text":"Second, the fact that that defendant produces, at the request of the court having jurisdiction, files relating to procedures concerning that natural person involves, at the very least, the ‘use’ and ‘disclosure by transmission’ of ‘personal data’ within the meaning of Article 4(1) and (2) of the GDPR.","paragraph_id":"para_307"},{"text":"73","paragraph_id":"para_308"},{"text":"In the second place, it must be borne in mind that Article 2(1) of the GDPR defines broadly the material scope of that regulation (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19 , EU:C:2021:504 , paragraph  61 ), which includes any ‘processing of personal data wholly …","paragraph_id":"para_309"},{"text":"74","paragraph_id":"para_310"},{"text":"In that regard, the Court has held that, as follows from recital 19 of that regulation, the reason for that exception is that the processing of personal data by the competent authorities for the purposes set out in Article 2(2)(d) of the GDPR is governed by a specific EU legal act, namely Directive …","paragraph_id":"para_311"},{"text":"75","paragraph_id":"para_312"},{"text":"As is apparent from recital 12 of Directive 2016/680, the EU legislature laid down, in Article 9 of that directive, rules relating to the processing of personal data for purposes other than those set out in Article 1(1) of that directive, for which those data were collected.","paragraph_id":"para_313"},{"text":"76","paragraph_id":"para_314"},{"text":"In that regard, Article 9(1) of Directive 2016/680 provides, first, that such processing of personal data cannot, in principle, be carried out, unless it is authorised by EU or Member State law and, second, that the GDPR is to apply to that processing, unless the processing is carried out in an acti …","paragraph_id":"para_315"},{"text":"77","paragraph_id":"para_316"},{"text":"In the situations referred to in paragraphs 71 and 72 of this judgment, the collection and processing of personal data by the public prosecutor’s office of a Member State for the purposes of the ‘prevention’, ‘detection’, ‘investigation’ or ‘prosecution’ of a criminal offence certainly constitute processing of personal data for the purposes set out in Article 1(1) of Directive 2016/680, within the meaning of Article 9(1) and (2) of that directive.","paragraph_id":"para_317"},{"text":"78","paragraph_id":"para_318"},{"text":"However, even where the bringing of an action for damages against the State arises from alleged misconduct on the part of the public prosecutor’s office in the course of criminal proceedings, such as, as in the present case, alleged infringements of the right to be tried within a reasonable time, the aim of the State’s defence in such an action is not to perform, as such, that public prosecutor office’s tasks for the purposes set out in Article 1(1) of Directive 2016/680.","paragraph_id":"para_319"},{"text":"79","paragraph_id":"para_320"},{"text":"Furthermore, in the light of the principle that exceptions to the application of the GDPR must be interpreted strictly, that processing of personal data cannot be regarded as being carried out ‘in an activity which falls outside the scope of Union law’, within the meaning of Article 2(2)(a) of the G …","paragraph_id":"para_321"},{"text":"80","paragraph_id":"para_322"},{"text":"In the third place, it should be noted that, for the purpose of applying the GDPR to the data processing referred to in paragraphs 71 and 72 of this judgment, the public prosecutor’s office must be considered to be a ‘controller’, within the meaning not only of Article 4(7) of the GDPR, but also of …","paragraph_id":"para_323"},{"text":"81","paragraph_id":"para_324"},{"text":"Irrespective of whether the data processing referred to in paragraph 80 of this judgment comes within the scope of Article 9(1) or (2) of Directive 2016/680, it is apparent from the wording of those paragraphs and the relationship between them that the GDPR applies to any processing of personal data …","paragraph_id":"para_325"},{"text":"82","paragraph_id":"para_326"},{"text":"In the light of all the foregoing, it must be held that the GDPR is applicable to the processing of personal data by the public prosecutor’s office of a Member State for the purpose of exercising its rights of defence in an action for damages against the State, where, first, it informs the court hav …","paragraph_id":"para_327"},{"text":"–  The lawfulness of the processing of personal data by the public prosecutor’s office of a Member State for the purpose of exercising its rights of defence in an action for damages against the State","paragraph_id":"para_328"},{"text":"83","paragraph_id":"para_329"},{"text":"It must be borne in mind that Article 6 of the GDPR lists, in a restrictive manner, the cases in which processing of personal data can be regarded as lawful (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19 , EU:C:2021:504 , paragraph  99 ).","paragraph_id":"para_330"},{"text":"84","paragraph_id":"para_331"},{"text":"Those cases include point (e) of the first subparagraph of Article 6(1) of the GDPR, which makes provision for processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, and point (f) of the first s …","paragraph_id":"para_332"},{"text":"85","paragraph_id":"para_333"},{"text":"It should be noted that, as the Commission correctly stated in its written observations, it is clear from the wording of the second subparagraph of Article 6(1) of the GDPR that the processing of personal data by a public authority in the performance of its tasks cannot come within the scope of poin …","paragraph_id":"para_334"},{"text":"86","paragraph_id":"para_335"},{"text":"It is therefore necessary, before considering the matter of the application of point (f) of the first subparagraph of Article 6(1) of the GDPR, to determine whether the processing, by the public prosecutor’s office of a Member State, of personal data initially collected for one or more of the purpos …","paragraph_id":"para_336"},{"text":"87","paragraph_id":"para_337"},{"text":"As the Advocate General observed, in essence, in points 94 and 100 of his Opinion, where it is for the public prosecutor’s office to defend the legal and financial interests of the State in an action for damages which calls into question the acts or conduct of that public authority in its performanc …","paragraph_id":"para_338"},{"text":"88","paragraph_id":"para_339"},{"text":"First, by exercising the procedural rights that it enjoys as defendant, that public authority preserves the legal certainty of the acts carried out and decisions adopted in the public interest that are being called into question by the applicant. The public authority’s submissions concerning the app …","paragraph_id":"para_340"},{"text":"89","paragraph_id":"para_341"},{"text":"Second, by its claims and arguments in defence, that public authority is capable of pointing, where such is the case, to the potentially unfounded or excessive nature of the applicant’s claims for compensation, with a view, in particular, to preventing the performance of the tasks carried out in the …","paragraph_id":"para_342"},{"text":"90","paragraph_id":"para_343"},{"text":"In that regard, it is irrelevant that, in an action for damages against the State, the public prosecutor’s office is, in its capacity as defendant, on an equal footing with the other parties, and does not exercise public powers, as is the case in the performance of its tasks in criminal matters.","paragraph_id":"para_344"},{"text":"91","paragraph_id":"para_345"},{"text":"In the present case, it is apparent from the order for reference and from the information provided by the Bulgarian Government in response to the questions put by the Court that the action for damages, which is, in part, at the origin of the dispute in the main proceedings, is based on the Law on li …","paragraph_id":"para_346"},{"text":"92","paragraph_id":"para_347"},{"text":"Thus, the role of the authority that caused the harm alleged in such an action for damages is different from that of the defendant in an action for indemnity by the State against the public official who is personally liable on account of shortcomings in the exercise of his or her office, since, in t …","paragraph_id":"para_348"},{"text":"93","paragraph_id":"para_349"},{"text":"Therefore, in the light of the foregoing considerations, it should be considered that the processing, by the public prosecutor’s office of a Member State, of personal data initially collected and processed for one or more of the purposes set out in Article 1(1) of Directive 2016/680, for the purpose …","paragraph_id":"para_350"},{"text":"94","paragraph_id":"para_351"},{"text":"Moreover, it cannot be ruled out that, where, for the purpose of defending the State in an action for damages, the public prosecutor’s office of a Member State transmits personal data to the court having jurisdiction at that court’s request, that transmission is also liable to come within the scope …","paragraph_id":"para_352"},{"text":"95","paragraph_id":"para_353"},{"text":"In those circumstances, for the purpose of establishing that processing of personal data such as that at issue in the main proceedings comes within the scope of the provisions of the first subparagraph of Article 6(1) of the GDPR, it is for the referring court to verify whether, in accordance with A …","paragraph_id":"para_354"},{"text":"96","paragraph_id":"para_355"},{"text":"It is, moreover, for the referring court to determine whether the disclosure, by the public prosecutor’s office, of information concerning the person who has brought the action for damages, contained in files opened in cases other than that giving rise to that action, satisfies the other requirement …","paragraph_id":"para_356"},{"text":"97","paragraph_id":"para_357"},{"text":"In the light of all the foregoing, the answer to the second question is that:","paragraph_id":"para_358"},{"text":"–","paragraph_id":"para_359"},{"text":"Article 3(8) and Article 9(1) and (2) of Directive 2016/680 and Article 2(1) and (2) of the GDPR must be interpreted as meaning that that regulation is applicable to the processing of personal data by the public prosecutor’s office of a Member State for the purpose of exercising its rights of defenc …","paragraph_id":"para_360"},{"text":"–","paragraph_id":"para_361"},{"text":"Article 6(1) of the GDPR must be interpreted as meaning that, where an action for damages against the State is based on alleged misconduct on the part of the public prosecutor’s office in the performance of its tasks in criminal matters, such processing of personal data may be regarded as lawful if …","paragraph_id":"para_362"},{"text":"Costs","paragraph_id":"para_363"},{"text":"98","paragraph_id":"para_364"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_365"},{"text":"On those grounds, the Court (Fifth Chamber) hereby rules:","paragraph_id":"para_366"},{"text":"1.","paragraph_id":"para_367"},{"text":"Article 1(1) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal …","paragraph_id":"para_368"},{"text":"must be interpreted as meaning that (i) the processing of personal data serves a purpose other than that for which those data were collected, where such data were collected for the purposes of the detection and investigation of a criminal offence, but that processing is carried out for the purpose o …","paragraph_id":"para_369"},{"text":"2.","paragraph_id":"para_370"},{"text":"Article 3(8) and Article 9(1) and (2) of Directive 2016/680 and Article 2(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)","paragraph_id":"para_371"},{"text":"must be interpreted as meaning that that regulation is applicable to the processing of personal data by the public prosecutor’s office of a Member State for the purpose of exercising its rights of defence in an action for damages against the State, where, first, it informs the court having jurisdict …","paragraph_id":"para_372"},{"text":"3.","paragraph_id":"para_373"},{"text":"Article 6(1) of Regulation 2016/679","paragraph_id":"para_374"},{"text":"must be interpreted as meaning that where an action for damages against the State is based on alleged misconduct on the part of the public prosecutor’s office in the performance of its tasks in criminal matters, such processing of personal data may be regarded as lawful if it is necessary for the pe …","paragraph_id":"para_375"},{"text":"[Signatures]","paragraph_id":"para_376"},{"text":"(\n *1\n ) Language of the case: Bulgarian.","paragraph_id":"para_377"}],"word_count":12076,"cites":["C-485/19","C-673/17","C-73/16","C-434/16","C-175/20","C-439/19","C-40/17","C-83/19","C-127/19","C-195/19","C-291/19","C-355/19","C-397/19"],"sha256":"6a40070cf2fe242d7ba80eb8d62c47c14a5a0e10a329de0b3b4cab796500b930","source_url":"https://publications.europa.eu/resource/celex/62021CJ0180.ENG.xhtml.ECR_62021CJ0180_EN_01.html","fetched_at":"2026-10-03T08:44:21.797+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-180-21-62021cj0180","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-180-21-62021cj0180","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-180-21-62021cj0180","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-180-21-62021cj0180"},"hash":"sha256:14279a5bd6db89c4a04576152b1db500466d8d291ee2f85870d01afc66c3d963","version":"legal-2026-10-23","expires":"2026-10-25T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-23+legal-2026-10-23+2026-10-23T14:34:08","content_hash":"sha256:14279a5bd6db89c4a04576152b1db500466d8d291ee2f85870d01afc66c3d963","revalidate_after":"2026-10-24T17:04:11.484Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-180-21-62021cj0180","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-180-21-62021cj0180"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-180-21-62021cj0180"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-180-21-62021cj0180"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":7},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-180-21-62021cj0180","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-c9d5bfb4faa32a2f432901530deef056","response_hash":"sha256:14279a5bd6db89c4a04576152b1db500466d8d291ee2f85870d01afc66c3d963"}},"freshness":{"freshness_class":"stable","as_of":"2026-11-03T05:31:36.681Z","valid_for":604800,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-180-21-62021cj0180","note":"Oföränderligt objekt med hash. Får cachas länge.","tokens":23628}}