Judgment of the Court (Fifth Chamber) of 8 December 2022 (request for a preliminary ruling from the Administrativen sad – Blagoevgrad – Bulgaria) – VS v Inspektor v Inspektorata kam Visshia sadeben savet
(Case C-180/21) 1
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Articles 2, 4 and 6 – Applicability of Regulation 2016/679 – Concept of ‘legitimate interest’ – Concept of ‘task carried out in the public interest or in the exercise of official authority’ – Directive (EU) 2016/680 – Articles 1, 3, 4, 6 and 9 – Lawfulness of the processing of personal data collected in the course of a criminal investigation – Subsequent processing of data relating to a presumed victim of a criminal offence for the purpose of making a formal accusation in respect of him or her – Concept of purpose ‘other than that for which the personal data are collected’ – Data used by the public prosecutor’s office of a Member State for the purposes of its defence in an action for damages against the State)
Language of the case: Bulgarian
Referring court
Administrativen sad – Blagoevgrad
Parties to the main proceedings
Applicant: VS
Defendant: Inspektor v Inspektorata kam Visshia sadeben savet
Interested party: Teritorialno otdelenie – Petrich kam Rayonna prokuratura – Blagoevgrad
Operative part of the judgment
Article 1(1) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Article 4(2) and Article 6 thereof,
must be interpreted as meaning that (i) the processing of personal data serves a purpose other than that for which those data were collected, where such data were collected for the purposes of the detection and investigation of a criminal offence, but that processing is carried out for the purpose of prosecuting a person following the conclusion of the criminal investigation at issue, irrespective of the fact that that person was considered to be a victim at the time of that collection, and that (ii) such processing is permitted pursuant to Article 4(2) of that directive, provided that it meets the conditions laid down in that provision.
Article 3(8) and Article 9(1) and (2) of Directive 2016/680 and Article 2(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
must be interpreted as meaning that that regulation is applicable to the processing of personal data by the public prosecutor’s office of a Member State for the purpose of exercising its rights of defence in an action for damages against the State, where, first, it informs the court having jurisdiction of the opening of files relating to a natural person who is a party to that action for the purposes set out in Article 1(1) of Directive 2016/680 and, second, it transmits those files to that court.
Article 6(1) of Regulation 2016/679
must be interpreted as meaning that where an action for damages against the State is based on alleged misconduct on the part of the public prosecutor’s office in the performance of its tasks in criminal matters, such processing of personal data may be regarded as lawful if it is necessary for the performance of a task carried out in the public interest, within the meaning of point (e) of the first subparagraph of Article 6(1) of that regulation, for the purpose of defending the legal and financial interests of the State which falls to the public prosecutor’s office in those proceedings, provided that that processing of personal data complies with all the applicable requirements provided for by that regulation.
____________
1 OJ C 206, 31.5.2021.