CJEU - C-118/22 - Direktor na Glavna direktsia "Natsionalna politsia" pri MVR - Sofia
| CJEU - C-118/22 Direktor na Glavna direktsia "Natsionalna politsia" pri MVR - Sofia | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 5(1)(e) GDPR Article 17 GDPR Directive (EU) 2016/680, the data protection law enforcement directive (LED) |
| Decided: | 30.01.2024 |
| Parties: | |
| Case Number/Name: | C-118/22 Direktor na Glavna direktsia "Natsionalna politsia" pri MVR - Sofia |
| European Case Law Identifier: | ECLI:EU:C:2024:97 |
| Reference from: | Varhoven administrativen sad (Supreme Administrative Court, Bulgaria) |
| Language: | 24 EU Languages |
| Original Source: | AG Opinion Judgement |
| Initial Contributor: | sh |
The CJEU decided that the LED does not allow for data to be stored and processed indefinitely. The controller has an obligation to review periodically whether the data is necessary and must grant the data subject their rights when the data is no longer necessary for the purpose.
English Summary
Facts
Following an investigation, an entry was made into the police records about a data subject. The data subject was convicted and given a one year suspended sentence. After serving the sentence the data subject was legally rehabilitated according to national law. Due to this, the data subject requrested the erasure of the entry concerning him in the police records. The police refused on the grounds that legal rehabilitation is not one of the grounds for erasure in the police records under national law.
The administrative court of Sofia in Bulgaria upheld the police's decision. Therefore, the data subject brought an appeal before the Supreme Administrative Court, Bulgaria. The data subject argued that Article 5,13 and 14 LED (the rougly equivalent GDPR articles would be Article 5(1)(e), 13 and 15 GDPR) do not permit the police to indefinitely process his data. This is de facto the data subject's current case, as without a ground for removal, they will never be able to obtain erasure from the police register.
The Supreme Administrative Court, Bulgaria referred the following question to the CJEU:
1) Does Article 5 and 13(2)(b) and 13(3) LED allow national law which leads to a virtually unrestricted right for authorities to process personal data and does this allow the elimination of the data subjectt's right to restricted processing or erasure?
Holding
The CJEU held that the LED precluded national legislation and did not allow the police to process the data indefinitely.
First, the CJEU broadened the question that was being refferred to it by reforumlating it (as is allowed under C-742/19 Ministrtsvo za obramo). It included into the scope of the question special categories of data, as the national legislation on storage also includes biometric and genetic data. It also broadened the relevant LED Articles in question to include 4(1)(c) and (e), 10, 16(2) and (3). The question was therefore, whether these articles preclude more restrictive national law in light of Articles 7 and 8 of the Charter of Fundamental Rights.
Comment
This case is decided on the LED (Law Enforcement Directive). It is nonethless still relevant from the perspective of the GDPR as the concepts and requirements for personal data are more or less the same.
Further Resources
Share blogs or news articles here!
