View source for CJEU - C-180/21 - Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation)

{{CJEUdecisionBOX

|Case_Number_Name=C-180/21 Inspektor v Inspektorata kam Visshia sadeben savet
|ECLI=

|Opinion_Link=
|Judgement_Link=https://curia.europa.eu/juris/document/document.jsf?text=&docid=241816&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=10583803

|Date_Decided=
|Year=

|GDPR_Article_1=Article 6(1)(f) GDPR
|GDPR_Article_Link_1=Article 6 GDPR#1f

|EU_Law_Name_1=Article 1 Directive 2016/680
|EU_Law_Link_1=https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0089.01.ENG


|Party_Name_1=VS
|Party_Link_1=
|Party_Name_2=Inspektor v Inspektorata kam Visshia sadeben savet
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=
|Party_Name_5=
|Party_Link_5=

|Reference_Body=Administrative Court - Blagoevgrad
|Reference_Case_Number_Name=

|Initial_Contributor=n/a
|
}}

See Holding for questions referred.

==English Summary==
[to be updated]

=== Facts ===
In 2013, the District Public Prosecutor’s Office in Petrich (Bulgaria) opened pre-trial proceedings (No 252/2013) against an unknown person for the commission of a crime. The applicant in the case in question (VS) took part in those proceedings as a victim.

In 2016, the District Public Prosecutor’s Office in Petrich, compiled a number of criminal files containing information relating to VS, [after receiving a number of complaints concerning, inter alia, VS]. However, the Public Prosecutor's Office did not open any pre-trial proceedings in the absence of evidence.

In 2018, the public prosecutor made formal accusations in respect of all the persons who took part in the incident at issue in the pre-trial proceedings (No 252/2013), including VS.

VS brought an action before the Regional Court in Blagoevgrad (Bulgaria) against the Public Prosecutor’s Office of the Republic of Bulgaria seeking damages for the harm allegedly resulting from the excessive duration of the pre-trial proceedings (No 252/2013). At the hearing, the Public Prosecutor's Office requested that the files opened in 2016, concerning VS, be produced for the purposes of defending the public prosecutor's office against claims made by VS. The Regional Court ordered that public prosecutor's office to produce certified copies of the documents in the files in question.

In March 2020, VS lodged a complaint with the Supreme Judicial Council, Bulgaria (‘the IVSS’), claiming that the District Public Prosecutor’s Office in Petrich, had infringed the data protection legislation. VS claimed, firstly, that that public prosecutor’s office had unlawfully used his personal data collected when he was considered to be a victim of a crime, in order to prosecute him in the same proceedings. Secondly, VS alleged that the public prosecutor’s office acted unlawfully as regards the processing of personal data that were collected in the files, in 2016, in the context of his action for damages against the Public Prosecutor’s Office of the Republic of Bulgaria. The IVSS rejected that complaint.

In July 2020, VS brought an action before the Administrative Court in Blagoevgrad (Bulgaria) against that decision, claiming, first, that the processing of his personal data in the course of pre-trial proceedings (No 252/2013) is contrary to, inter alia, the principles of the Law Enforcement Directive 2016/680 ("LED 2016/680"), and second, that the processing of the data collected in the files, in 2016, after the Public Prosecutor’s Office had refused to initiate pre-trial proceedings, infringes the principles of the GDPR.

The Administrative Court decided to stay the proceedings and to refer to the CJEU for a preliminary ruling.

=== Holding ===
After assessing the wording of Articles 1(1) and 4(2) of LED 2016/680, the CJEU found that it can be inferred from Article 1(1), read in conjunction with Article 4(2), that where personal data have been collected for the purposes of the 'detection' and 'investigation' of a criminal offence and have subsequently been processed for the purposes of 'prosection' that collection and that processing serve different purposes. 

Consequently, the CJEU held, that when a person had initially been considered to be a victim of a criminal offence, within the meaning of Article 6(c) of LED 2016/680, the controller should take into account that that processing reflects a change in that person’s category within the meaning of Article 6(a) of LED 2016/680, and to make a clear distinction between data of different categories of persons.

[to be updated]

'''Questions referred:'''

'''1.''' Is Article 1(1) of Directive 2016/680 to be interpreted as meaning that, when stating the objectives of that directive, the terms ‘prevention, investigation, detection or prosecution of criminal offences’ are listed as aspects of a general objective?

'''2.''' Are the provisions of Regulation 2016/679 applicable to the Public Prosecutor’s Office of the Republic of Bulgaria in view of the fact that information concerning a person, which was collected by the Public Prosecutor’s Office, in its capacity as ‘controller’ pursuant to point 8 of Article 3 of Directive 2016/680, in an investigation file opened in relation to that person with a view to verifying indications of a criminal offence, was used in the context of the judicial defence of the Public Prosecutor’s Office as a party to civil proceedings – by virtue of the fact that the circumstance of that file having been opened was revealed or that the contents of the file were presented?

'''2.1''' If that question is answered in the affirmative:

Is the expression ‘legitimate interests’ in Article 6(1)(f) of Regulation 2016/679 to be interpreted as including the disclosure, in whole or in part, of information concerning a person which has been collected in a public prosecution investigation file opened in relation to that person for the purposes of the prevention, investigation, detection or prosecution of criminal offences, in the case where that disclosure is carried out for the purposes of the defence of the controller as a party to civil proceedings, and does that expression exclude the consent of the data subject?

== Comment ==
''This decision represents an important milestone case for data protection in the context of law enforcement.''

== Further Resources ==
''Share blogs or news articles here!''