Provisional text
OPINION OF ADVOCATE GENERAL
SZPUNAR
delivered on 4 September 2025 (1)
Case C‑312/24 [Darashev] (i)
CL
v
Prokuratura na Republika Bulgaria
(Request for a preliminary ruling from the Sofiyski rayonen sad (Sofia District Court, Bulgaria))
( Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data in criminal matters – Directive (EU) 2016/680 – Processing of data collected in the course of a criminal investigation involving a police officer as a suspect – Storage of data in the personnel file – Regulation (EU) 2016/679 – Lawfulness of processing – Processing necessary for compliance with a legal obligation to which the controller is subject – Objective of public interest – Processing of personal data relating to criminal convictions and offences – Right to erasure (‘right to be forgotten’) – Equal treatment in employment and occupation – Directive 2000/78/EC )
I. Introduction
1. Like any employer, public authorities process personal data concerning their employees. Performing the tasks entrusted to them may lead them to collect simultaneously certain data concerning their staff members in contexts other than personnel management and, in such case, questions arise regarding the basis and purposes of the data processing.
2. Thus, the referring court questions the lawfulness of data processing whereby a public authority stores in the personnel file of one of its officials information relating to a criminal investigation in which that official was the subject of investigative measures, as a suspect. In the present case, the data in question were collected by the same public authority, acting as investigating authority, and were stored in the official’s personnel file even though the criminal investigation was discontinued without the official having been placed under formal investigation or charged.
3. The central question raised by this case concerns the relationship between Regulation (EU) 2016/679 (2) (‘the GDPR’) and Directive (EU) 2016/680 (3) and is aimed at clarifying the basis of and conditions for recourse to the right to the erasure of data that are being stored in such circumstances.
II. Legal framework
A. EU law
1. Directive 2000/78/EC
4. According to Article 1 thereof, the purpose of Directive 2000/78/EC (4) is ‘to lay down a general framework for combating discrimination on the grounds of religion or belief, disability, age or sexual orientation as regards employment and occupation, with a view to putting into effect in the Member States the principle of equal treatment’.
5. In accordance with Article 2(1) of that directive, ‘the “principle of equal treatment” shall mean that there shall be no direct or indirect discrimination whatsoever on any of the grounds referred to in Article 1’ of the directive.
2. The GDPR
6. Recitals 19, 39 and 41 of the GDPR state as follows:
‘(19) … With regard to the processing of personal data by those competent authorities [within the meaning of Directive 2016/680] for purposes falling within scope of this Regulation, Member States should be able to maintain or introduce more specific provisions to adapt the application of the rules of this Regulation. Such provisions may determine more precisely specific requirements for the processing of personal data by those competent authorities for those other purposes, taking into account the constitutional, organisational and administrative structure of the respective Member State. …’
…
(39) … The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. … In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. …
…
(41) Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, without prejudice to requirements pursuant to the constitutional order of the Member State concerned. However, such a legal basis or legislative measure should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of [the Court of Justice] and the European Court of Human Rights [(“ECtHR”)].’
7. Article 2 of the GDPR, entitled ‘Material scope’, provides, in paragraph 1 thereof, that the regulation ‘applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system’. Article 2(2)(d) provides that the regulation does not apply to the processing of personal data ‘by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security’.
8. Article 4 of the GDPR, entitled ‘Definitions’, provides:
‘For the purposes of this Regulation:
(1) “personal data” means any information relating to an identified or identifiable natural person …; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number …;
(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use …;
…
(6) “filing system” means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
(7) “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; …’
9. Article 6 of the GDPR, entitled ‘Lawfulness of processing’, provides:
‘1. Processing shall be lawful only if and to the extent that at least one of the following applies:
…
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
…
3. The basis for the processing referred to in points (c) and (e) of paragraph 1 shall be laid down by:
…
(b) Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis …. That legal basis may contain specific provisions to adapt the application of rules of this Regulation … The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
…’
10. Article 9 of the GDPR provides:
‘1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:
…’
11. In accordance with Article 10 of the GDPR:
‘Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. …’
12. Article 17 of the GDPR, entitled ‘Right to erasure (“right to be forgotten”)’, provides:
‘1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
…
(d) the personal data have been unlawfully processed;
…
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
…
b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject …;
…’
3. Directive 2016/680
13. Article 1(1) of Directive 2016/680 provides:
‘This directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’
14. Article 3 of that directive defines the concepts of ‘personal data’ and ‘processing’ in the same terms as the GDPR.
15. In accordance with Article 3(7) of the directive, ‘competent authority’ means, inter alia, any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
16. Article 9 of the directive, entitled ‘Specific processing conditions’, provides, in paragraph 1 thereof:
‘Personal data collected by competent authorities for the purposes set out in Article 1(1) shall not be processed for purposes other than those set out in Article 1(1) unless such processing is authorised by Union or Member State law. Where personal data are processed for such other purposes, [the GDPR] shall apply unless the processing is carried out in an activity which falls outside the scope of Union law.’
17. Article 16(2) of Directive 2016/680 establishes the situations in which the Member States are to provide for the right of the data subject to obtain from the controller the erasure of personal data concerning him or her.
B. Bulgarian law
1. The ZMVR
18. Article 29(1) and (2) of the Zakon za Ministerstvo na vatreshnite raboti (Law on the Ministry of the Interior) (5) in the version applicable to the dispute in the main proceedings (‘the ZMVR’), provides:
‘(1) The controller responsible for the processing of data shall be the Minister for the Interior, who may entrust the processing of personal data to such officials as he or she may designate.
(2) Rules governing the processing of personal data shall be established by instruction of the Minister for the Interior.’
19. Article 147 of the ZMVR provides:
‘(1) A personnel file shall be drawn up for every official of the Ministry of the Interior.
(2) The rules governing the drawing up, management and keeping of personnel files, as well as the rules governing their use shall be established by instruction of the Minister for the Interior.’
2. The instruction relating to personnel files
20. Instruction No 8121z-532 of 9 September 2014 on the preparation, keeping, storage and use of the personnel files of officials of the Ministry of the Interior, issued by the Minister for the Interior (6) (‘the instruction relating to personnel files’) provides, in Article 3 thereof:
‘Personnel files shall be drawn up and kept by the “human resources” unit of the organisation concerned. They shall be numbered in ascending order, described in a journal and stored at premises (repositories) that meet the storage requirements for materials containing classified information.’
21. In accordance with the second paragraph of Article 5 of that instruction, the processing of information stored in the personnel files is to be carried out, inter alia, for the purposes of the commencement, alteration or cessation of employment or service relationships with officials.
22. Article 6 of the instruction provides:
‘(1) Documents classified into three sections and containing data and information relating to the examination, award and conclusion of employment contracts, to changes of duties and to the termination of employment of officials shall be collected and stored in the personnel files.
…
(4) The third section shall contain documents relating to changes of duties (decisions, records of the commencement and termination of employment, documents relating to disciplinary proceedings …)’.
III. The dispute in the main proceedings, the question referred for a preliminary ruling and the proceedings before the Court of Justice
23. The Ministerstvo na vatreshnite raboti (Ministry of the Interior) (‘the Ministry’) is an administrative authority responsible for maintaining public order. It comprises several directorates-general (‘DGs’). The ‘Internal Security’ DG is responsible for carrying out investigative measures concerning officials of the Ministry in connection with all types of offences. Between 2012 and 2023, the applicant in the main proceedings held various positions as a police officer within the ‘Security Police’ DG and the ‘National Police’ DG.
24. On 1 March 2016, investigative proceedings were commenced concerning an unknown offender in connection with an offence of theft. On 17 May 2016, at a meeting which he attended together with the other police officers in the department in which he worked, the applicant in the main proceedings was arrested, in front of his colleagues, and was required to surrender his service badge, his weapon and his service identity card. After being detained in police custody for 24 hours, he was released. Subsequently, he was neither placed under formal investigation nor charged, but he was the subject of several investigative measures.
25. In the course of 2016, the proceedings against the applicant in the main proceedings were suspended without the offender having been identified. A decision that no further action be taken in the proceedings was subsequently adopted.
26. The applicant in the main proceedings continued his duties as a police officer and took part in selection procedures for promotion to other posts within the Ministry.
27. The applicant in the main proceedings subsequently brought an action before the Sofiyski rayonen sad (Sofia District Court, Bulgaria), the referring court, against the Prokuratura na Republika Bulgaria (Public Prosecutor’s Office of the Republic of Bulgaria; ‘the Public Prosecutor’s Office’). He seeks an order requiring the Public Prosecutor’s Office to pay compensation for non-material damage caused by the measures taken against him in the context of the criminal investigation and by the consequences of those proceedings, namely the fact that he has not been promoted or transferred to other duties on account of his having been a suspect in the investigation. In addition, he asks that his name be erased from the database kept by the Ministry, in which he is mentioned as a suspect.
28. The referring court states that the Ministry is the employer of all staff who work there. Every DG keeps information on its officials in their respective personnel files. Information obtained in the course of an investigation conducted by the ‘Internal Security’ DG is also kept in those personnel files. In the main proceedings, it was noted that the Ministry, in its capacity as employer, stores information about the fact that the applicant in the main proceedings was a suspect and was placed in custody in the context of the investigation in question. The referring court nevertheless entertains doubts as to the compatibility of the storing of that information in the personnel file with the GDPR and Directive 2016/680 and as to the compatibility of the alleged denial of promotion with Directive 2000/78.
29. It is in that context that the Sofiyski rayonen sad (Sofia District Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘Is Article 2(1) of the GDPR to be interpreted as meaning that data processing includes activities within one and the same organisational structure, in which some of its [directorates-general] perform the duties of an employer while one other directorate has the function of an investigating authority in criminal proceedings against employees of the other directorates? If the answer is in the affirmative:
(1) Is the expression “processing of personal data” in Article 4(2) of the GDPR to be interpreted as covering an activity in the context of which information concerning a particular employee which has been obtained by the employer, in its capacity as the investigating authority, through one of its directorates is added to that employee’s personnel file?
(2) Is the expression “filing system” in Article 4(6) of the GDPR to be interpreted as covering the personnel file of an employee or worker working in a directorate of the employer where the information has been collected by another directorate of the employer, which has the status of an investigating authority?
(3) Is Article 9(2)(b) of the GDPR to be interpreted as meaning that an organisational entity of an employer may gather and store data indicating that a particular employee was suspected of, charged with or put on trial for a criminal offence in criminal proceedings if that information was collected by another organisational entity of the employer[,] which has the status of an investigating authority?
(4) Is the “right to be forgotten” within the meaning of Article 17(1)(a) of the GDPR to be interpreted as meaning that an employer is required to erase from the personnel file of the employee any data which it has collected and stored through another of its directorates, which has the status of a public authority for the purposes of investigating its employees, and which indicate that the employee:
– is suspected of, charged with or on trial for a criminal offence in pending criminal proceedings, or
– was suspected of, charged with or put on trial for a criminal offence for which criminal proceedings were stayed or discontinued?
(5) Must personal data “unlawfully processed” within the meaning of Article 17(1)(d) of the GDPR be interpreted as including data which the employer has received, collected and stored through another of its organisational entities which performs investigative functions in criminal proceedings against employees of other organisational entities of the employer, where those data are recorded in the personnel file and relate to the fact that the employee has been suspected of, charged with or on trial for a criminal offence, that is to say:
– is suspected of, charged with or on trial for a criminal offence in pending criminal proceedings, or;
– was suspected of, charged with or put on trial for a criminal offence for which criminal proceedings were stayed or discontinued?
(6) Are “personal data” within the meaning of Article 3(1) of [Directive 2016/680], read in conjunction with Article 52 of the Charter of Fundamental Rights of the European Union [(‘the Charter’)], to be interpreted as [including] data which have been obtained, collected and stored by the employer through one of its organisational entities which performs the functions of an investigating authority in criminal proceedings against an employee serving in another organisational entity of the employer?
(7) Is “processing” within the meaning of Article 3(2) of [Directive 2016/680], read in conjunction with Article 52 of the [Charter], to be interpreted as meaning that it encompasses an activity consisting in the employer storing in the employee’s personal file data which the employer has obtained, collected and stored through one of its organisational entities which performs the duties of an investigating authority in criminal proceedings against any of the employer’s employees serving in another of its organisational entities?
(8) Is Article 9(1) of [Directive 2016/680], read in conjunction with Article 52 of the [Charter], to be interpreted as meaning that it permits the employer to collect and store information on an employee who is suspected of, charged with or on trial for a criminal offence in cases where the employer collected that information through another of its organisational entities[,] which has the status of an investigating authority in criminal proceedings against that employee?
(9) Is Article 16(2) of [Directive 2016/680], read in conjunction with Article 52 of the [Charter], to be interpreted as meaning that the employer must erase from the employee’s personnel file any data which the employer has collected and stored through another of its organisational entities, which has the status of an investigating authority in criminal proceedings against that employee, and which relate to the fact that the employee:
– is suspected of, charged with or on trial for a criminal offence in pending criminal proceedings, or
– was suspected of, charged with or put on trial for a criminal offence for which criminal proceedings were stayed or discontinued?
(10) Is Article 1 of [Directive 2000/78] to be interpreted as not permitting an employer, one of whose organisational entities undertakes investigative actions against an employee of another organisational entity, to deny an employee promotion on the sole ground that he [or she]:
– is suspected of, charged with or on trial for a criminal offence in pending criminal proceedings, or
– was suspected of, charged with or put on trial for a criminal offence for which criminal proceedings were stayed or discontinued?’
30. The Bulgarian and Hungarian Governments and the European Commission have submitted written observations. The Bulgarian Government and the Commission attended the hearing that was held on 21 May 2025.
IV. Analysis
A. Admissibility of the questions referred for a preliminary ruling
31. The Bulgarian Government argues that the questions referred for a preliminary ruling are, in their entirety, manifestly inadmissible. It puts forward the following reasons.
32. In the first place, it argues that the claim for compensation for harm caused is directed solely at the Public Prosecutor’s Office, which is a judicial authority, whereas the Ministry, which is an organ of the executive and was the employer of the applicant in the main proceedings, alone holds the information in the latter’s personnel file. The applicant in the main proceedings cannot, therefore, request the Public Prosecutor’s Office to erase his data, or hold it responsible for the Ministry’s holding that information, or complain that it has hindered his career advancement.
33. In the second place, the Bulgarian Government states that, in order for the Public Prosecutor’s Office to incur liability, the referring court must determine, in accordance with national legislation governing State liability, whether the rights of the applicant in the main proceedings, as an accused person, have been infringed and whether he was unjustly accused of an offence. However, the case in the main proceedings concerns neither the application of the provisions of the GDPR nor that of the national legislation transposing Directives 2016/680 and 2000/78. The interpretation of those acts of EU law is therefore not necessary for the resolution of the dispute in the main proceedings.
34. I do not share that view.
35. I would point out that questions for a preliminary ruling referred by a national court, in the factual and legislative context which that court is responsible for defining, and the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevance. (7)
36. I do not consider that that presumption can be called into question in the present case. Indeed, it is clear from the order for reference that the dispute in the main proceedings concerns the non-material damage which the applicant in the main proceedings alleges he has suffered, in particular, as a result of being denied promotion on account of his having been a suspect. Moreover, the applicant in the main proceedings seeks the erasure of data held within the Ministry relating to his status as a suspect in the investigation. Those claims are what gave rise to the referring court’s questions about the interpretation of Directive 2000/78 and also the interpretation of the GDPR and Directive 2016/680. (8)
37. Admittedly, the referring court does not explain whether the measures taken by the Ministry subsequently to the criminal investigation may be imputed to the Public Prosecutor’s Office in the context of such a claim for compensation. It merely states that, in accordance with national legislation, a claim for compensation is to be brought against the Public Prosecutor’s Office if it relates to a criminal investigation. However, whether allegedly harmful actions taken by the Ministry may be thus imputed is a question of national law alone. The same applies to the question of the capacity to be made a defendant to a claim for compensation based on State liability in connection with a criminal investigation. The arguments which the Bulgarian Government makes are therefore based on the interpretation and application of national law. However, it should be recalled that it is not for the Court to rule on the interpretation of provisions of national law or to decide whether the interpretation or application of those provisions by the national court is correct, since such an interpretation falls within the exclusive jurisdiction of the national court. (9)
38. Consequently, I do not propose to regard the questions for a preliminary ruling as inadmissible in their entirety.
39. On the other hand, I note that the third, fourth, fifth, eighth, ninth and tenth questions partly address hypothetical situations that do not correspond to the facts of the dispute as set out in the order for reference, namely situations involving a person suspected, charged or prosecuted in pending criminal proceedings or in criminal proceedings that have been stayed or discontinued. However, it is apparent from the order for reference that the criminal investigation was discontinued and that the selection procedures in which the applicant in the main proceedings participated took place after it was decided that no further action be taken in the investigation. In addition, it is common ground that the applicant in the main proceedings was solely a suspect.
40. Accordingly, it must be concluded that the third, fourth, fifth, eighth, ninth and tenth questions referred for a preliminary ruling are inadmissible to the extent that they are hypothetical and address situations other than that of the applicant in the main proceedings.
B. Substance
1. Preliminary observations regarding the scope of the questions referred for a preliminary ruling
41. The national court has referred eleven questions in all, regarding the GDPR (the introductory question and the first to fifth questions referred for a preliminary ruling), Directive 2016/680 (the sixth to ninth questions referred for a preliminary ruling) and Directive 2000/78 (the tenth question referred for a preliminary ruling).
42. It is clear from the present request for a preliminary ruling that the referring court is asking which is the legal act – the GDPR or Directive 2016/680 – that provides the basis for an official, in circumstances such as those in the main proceedings, to request the erasure of data in his personnel file that identify him as a suspect in a criminal investigation that has been discontinued.
43. In the first place, in the interests of clarity, it is necessary to specify the factual premiss on which the questions relating to the GDPR and Directive 2016/680 are based. I note that, while the majority of those questions (10) refer expressly to data stored in the official’s personnel file, some (11) refer more generally to the storage by the employer of data concerning an official who works in one of the employer’s departments that have been collected by a different department responsible for investigations.
44. In the light of the grounds of the order for reference as a whole, those questions all concern the storage of data concerning the official in his personnel file. Although the request for a preliminary ruling also mentions, on occasion, the storage of data in the Ministry’s ‘archives’ or ‘databases’, those references are not developed any further and, in any event, do not appear in the questions referred.
45. Consequently, my analysis will solely address the storage of the data in the personnel file.
46. In the second place, in order to provide the referring court with useful guidance for its ruling on the request for erasure, I think it necessary to combine and reformulate several of the questions. (12) For the reasons which I shall set out below, I shall analyse the questions after regrouping them as follows:
– the introductory question and the first, second, sixth, seventh and eighth questions referred for a preliminary ruling, which are aimed, essentially, at determining the scope of the GDPR;
– the third, fourth and fifth questions referred for a preliminary ruling, which concern essentially the conditions for lawful processing in the context of recourse to the right to erasure under the GDPR;
– the ninth question referred for a preliminary ruling, which concerns the right to erasure under Directive 2016/680;
– the tenth question referred for a preliminary ruling, which concerns Directive 2000/78.
2. The introductory question and the first, second, sixth, seventh and eighth questions referred for a preliminary ruling
(a) Reformulation of the questions
47. By its introductory question, the referring court asks, in substance, whether Article 2(1) of the GDPR is to be interpreted as meaning that that regulation applies to the processing of data by a public authority some of the organisational units of which perform the duties of an employer, while one unit acts as an investigating authority in criminal proceedings against officials in the other units.
48. If that question is answered in the affirmative, the referring court asks, by its first and second questions, in substance, whether Article 4(2) and (6) of the GDPR are to be interpreted as meaning that the storage in the personnel file of a public authority official of personal data which the public authority has obtained through another organisational unit acting in its capacity as investigating authority constitutes the ‘processing of personal data’ contained in a ‘filing system’.
49. While, by its first and second questions referred for a preliminary ruling, the referring court is formally asking the Court about the interpretation to be given to those two concepts, I do not think that is the real point of these questions. Since they refer to the dual capacity in which a public authority, such as the Ministry, processes data concerning its officials (collecting data in the capacity of investigating authority and storing data in the capacity of employer), these questions must be understood as the premiss of the reasoning aimed at determining the scope of the GDPR. That interpretation is, I think, borne out by the fact that the referring court raises no specific doubts about the interpretation of the two concepts in the reasoning underlying these same questions.
50. As regards the eighth question referred for a preliminary ruling, that, to my mind, arises from the same line of reasoning and is aimed, in substance, at establishing whether Article 9(1) of Directive 2016/680 (13) is to be interpreted as permitting a public authority to store information regarding the status of one of its officials as a suspect in a criminal investigation where that authority has collected that information through the intermediary of one of its organisational units acting in its capacity as investigating authority.
51. It is apparent from the wording of the eighth question, and from the grounds for the request for a preliminary ruling, that the referring court entertains doubts, more specifically, about how the scope of the GDPR fits with that of Directive 2016/680 in the case where data stored in the personnel file have been collected by one of the employer’s organisational units in the performance of its duties as a ‘competent authority’ within the meaning of Article 3(7) of that directive. As I shall subsequently explain in this Opinion, Article 9 of the directive establishes precisely the link between that directive and the GDPR in the case where data collected by a competent authority is the subject of further processing.
52. The sixth and seventh questions referred for a preliminary ruling are aimed, in substance, at establishing whether the storing in the personnel file of a public authority official of personal data that the authority has obtained through the intermediary of one of its organisational units acting in its capacity as investigating authority constitutes the ‘processing of personal data’ within the meaning of Article 3(1) and (2) of Directive 2016/680.
53. I consider that those two questions, like the first and second questions referred for a preliminary ruling, do not really raise any issue regarding the interpretation of the concepts of ‘processing’ and ‘personal data’. They are purely instrumental in determining which act of EU law – the GDPR or Directive 2016/680 – applies. In any event, the two concepts are defined in the same terms as in Directive 2016/680, (14) and so they cannot constitute a differentiating factor.
54. For these reasons, I suggest that, by its introductory question and its first, second, sixth, seventh and eighth questions, taken together, the referring court is asking, in substance, whether Article 2(1) of the GDPR and Article 9(1) of Directive 2016/680 are to be interpreted as meaning that the GDPR applies to the storing, by a public authority in the personnel file of one of its officials, of data regarding that official’s status as a suspect in a criminal investigation, where the data have been collected by an organisational unit within that public authority in the performance of its duties as a competent authority within the meaning of Directive 2016/680.
(b) Analysis
55. In the first place, I would observe that Article 2(1) of the GDPR defines broadly the material scope of that regulation, which includes any ‘processing of personal data wholly or partly by automated means and … the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system’. (15)
56. It does not appear to be in dispute in the main proceedings that the information regarding the status of suspect that is stored in the personnel file of the applicant in the main proceedings constitutes personal data within the meaning of Article 4(1) of the GDPR.
57. In addition, the recording and the storing of data concerning officials in their personnel file most certainly constitute ‘processing’ as defined in Article 4(2) of the GDPR, and there seems no question that the Minister of the Interior is the controller within the meaning of Article 4(7) of that regulation. (16)
58. As for the concept of ‘filing system’, I would point out that that concept is relevant only where there is no processing at least in part by automated means. (17) Article 4(6) of the GDPR defines a ‘filing system’ as ‘any structured set of personal data which are accessible according to specific criteria …’. The specific manner in which a filing system must be structured and the form it must take are not prescribed, nor is it specified whether the data must be contained in an electronic database or in a physical file or register. (18) Therefore, a personnel file in which data concerning officials and employees are collected in a structured manner falls within the concept of a ‘filing system’. Subject to verification by the referring court, that seems to be the case in this instance. (19)
59. In the second place, Article 2(2)(d) of the GDPR provides that that regulation does not apply to the processing of personal data by competent authorities for the purposes of, inter alia, the prevention, detection and investigation of criminal offences. As is clear from recital 19 of the GDPR and Article 1(1) of Directive 2016/680, such processing is governed by Directive 2016/680, as lex specialis. (20)
60. In the third place, both the GDPR and Directive 2016/680 lay down the principle of ‘purpose limitation’, (21) in accordance with which personal data must be collected for specified, explicit and legitimate purposes and must not be processed in a manner that is incompatible with those purposes. That principle, however, does not apply in every instance. (22) Indeed, Article 9(1) of Directive 2016/680 provides that data may be processed for purposes other than those set out in Article 1(1) thereof and for which they were collected and that the GDPR is to apply to such processing, (23) provided that such processing ‘is authorised by Union or Member State law’. That proviso simply means that the lawfulness of such processing for other purposes must be assessed in the light of the GDPR. (24)
61. In the present case, there is no doubt that the Ministry collected and processed, through the intermediary of its department responsible for investigative measures concerning its officials, the data concerning the applicant in the main proceedings for purposes set out in Article 1(1) of Directive 2016/680, as a competent authority within the meaning of Article 3(7) of that directive.
62. As regards the storage of those data in the applicant’s personnel file, the referring court offers no indication of the purposes pursued. However, according to the explanations provided by the Bulgarian Government, (25) subject to verification by the referring court, the storage of the data in the personnel file was not for purposes set out in Article 1(1) of Directive 2016/680. Given that, I take the view, like all the participants in these proceedings that have submitted written observations, that the GDPR applies to the processing, in the personnel file, of data such as those at issue in the main proceedings.
63. I therefore propose that the Court’s answer to the introductory question and the first, second, sixth, seventh and eighth questions referred for a preliminary ruling should be that Article 2(1) of the GDPR and Article 9(1) of Directive 2016/680 are to be interpreted as meaning that the GDPR applies to the storing, by a public authority in the personnel file of one of its officials, of data regarding that official’s status as a suspect in a criminal investigation, where the data have been collected by an organisational unit within that public authority in the performance of its duties as a competent authority within the meaning of Directive 2016/680, provided that the storage of that data pursues purposes other than those set out in Article 1(1) of Directive 2016/680.
3. The third, fourth and fifth questions referred for a preliminary ruling
(a) Reformulation of the questions
64. By its third question, the referring court asks, in substance, whether Article 9(2)(b) of the GDPR is to be interpreted as meaning that an organisational unit within a public authority may collect and store data regarding the fact that one of its officials was a suspect in criminal proceedings if that information was collected by another unit within that authority that has the status of an investigating authority.
65. The fourth question referred for a preliminary ruling is aimed at establishing whether Article 17(1)(a) of the GDPR is to be interpreted as meaning that a public authority must erase, in its capacity as employer, all data in the personnel file of one of its officials relating to his status as a suspect in a criminal investigation that has been discontinued, where that data was collected by a unit within that authority that has the status of an investigating authority in proceedings against that official.
66. Further, the fifth question referred for a preliminary ruling is aimed at establishing, in substance, whether Article 17(1)(d) of the GDPR is to be interpreted as meaning that such data have been ‘unlawfully processed’.
67. In so far as concerns the provision referred to in the third question referred for a preliminary ruling, I should point out that Article 9 of the GDPR governs, as is clear from paragraph 1 thereof, the processing of special categories of data. There is nothing in the order for reference to suggest that, in this case, the data resulting from the criminal investigation that are stored in the personnel file correspond to one of those categories. Accordingly, Article 9(2)(b) of the GDPR cannot provide a basis for the storage of the data at issue in this case. As I shall go on to explain in this Opinion, the basis of the lawfulness thereof must be sought in other provisions of the GDPR that are not mentioned in the questions referred by the national court. (26)
68. The provisions of Article 17(1)(a) and (d) of the GDPR, which are the subject of the fourth and fifth questions referred for a preliminary ruling, provide for the erasure of data on the ground that they ‘are no longer necessary in relation to the purposes for which they were collected or … processed’ (subparagraph (a)) or ‘have been unlawfully processed’ (subparagraph (d)).
69. It is clear from a combined reading of those two questions and the grounds of the request for a preliminary ruling that, by those questions, the referring court is seeking to establish, more fundamentally, as a premiss for its ruling on the request for erasure, whether the storage of the data at issue in the personnel file is lawful.
70. While the referring court does not suggest what ground of lawfulness might be relevant in this instance and provides no information about the applicable national legal framework, both the Commission and the Bulgarian Government have referred, in their written observations, to Article 6(1)(c) of the GDPR.
71. Under that provision, processing is lawful when it is necessary for compliance with a legal obligation to which the controller is subject. Article 6(3) of the GDPR specifies, inter alia, that the Member State law to which the controller is subject and which lays down the basis for the processing must meet an objective of public interest and be proportionate to the legitimate aim pursued. That ground of lawfulness is mirrored in Article 17(3)(b) of the GDPR, which excludes the right to erasure provided for in Article 17(1) thereof where the processing of data is necessary for compliance with such a legal obligation. (27)
72. In this connection, the Bulgarian Government has stated that the processing of personal data for the purposes of the preparation, keeping, storage and use of personnel files of officials of the Ministry is carried out pursuant to the instruction relating to personnel files issued by the Minister for the Interior on the basis of Article 147(2) of the ZMVR. That instruction provides for the storage, inter alia, of all data relating to ‘changes of duties’ of officials, such as those connected with disciplinary proceedings. (28) On this point, the Bulgarian Government has stated that, according to the provisions which apply to the disciplinary liability of officials of the Ministry, for any incident relating to a criminal offence within the Ministry, a copy of the report of the outcome of the investigation and on whether the official should incur disciplinary liability is placed in the personnel file. In the Bulgarian Government’s view, it follows that the storage of such data in the personnel file is justified by the particular duties of police officers, the aim of which is maintaining public order.
73. It is on the basis of those premisses, arrived at from the observations submitted to the Court, (29) that I propose to reformulate the third, fourth and fifth questions referred for a preliminary ruling so that they seek to establish whether Article 17(3) of the GDPR, read in conjunction with Article 6(1)(c) and Article 6(3) thereof, is to be interpreted as meaning that the storage, in a police officer’s personnel file, of personal data relating to a criminal investigation in which that officer was the subject of investigative measures, as a suspect, and which was discontinued, may be considered lawful for the purposes of compliance with a legal obligation to which the public authority that is his employer is subject under national law, as controller, merely on account of the nature of the duties which that officer is required to perform.
(b) Analysis
74. It seems from the explanations provided by the Bulgarian Government that the legal basis for the storage of the data at issue arises from a combination of a number of provisions in an ‘instruction’ issued by the Minister for the Interior on the basis of the ZMVR, which provides for the express delegation of regulatory powers to that Minister.
75. In this regard, the immediate question that arises is whether the basis for the processing, within the meaning of Article 6(3) of the GDPR, may be defined by a regulatory act adopted by a public authority of a Member State on the basis of a statutory authorisation provided for in an act of national legislation.
76. The first sentence of recital 41 of the GDPR states that the requirement for a legal basis does not necessarily mean that a legislative act adopted by a parliament is required, without prejudice to requirements of the constitutional order of the Member State concerned. It follows that the EU legislature did not intend to exclude the possibility of a legal obligation relating to processing being defined in national law in a legal basis other than a law strictu sensu, albeit in accordance with national constitutional law.
77. In addition, it should be noted that, according to recital 19 of the GDPR, the Member States should be allowed a certain leeway as regards the processing of data that is carried out, as in the present case, by a competent authority within the meaning of Directive 2016/680 for purposes falling within the scope of the GDPR. Thus, the Member States should be able to maintain or introduce more specific provisions to adapt the application of the GDPR to such data processing, ‘taking into account the constitutional, organisational and administrative structure of the … Member State [concerned]’.
78. The GDPR does not, therefore, preclude the legal basis of the processing from being defined in a regulatory act adopted in accordance with national constitutional law. However, the leeway allowed cannot be interpreted as permitting arbitrary use of the so-called ‘opening clauses’, such as that in Article 6(3) of the GDPR, which allows the introduction into national law of a legal obligation as a ground for lawfulness of data processing. (30) Indeed, as is stated in the second sentence of recital 41 of the GDPR – reflecting the case-law on Article 52(1) of the Charter, (31) in the light of which Article 6(3) of the GDPR is to be interpreted (32) – the legal basis for the processing must be clear and precise and its application must be foreseeable to persons subject to it.
79. In this instance, it is apparent from the case file that ministerial instructions are issued, as regulatory acts, pursuant to the statutory authorisation provided for in the ZMVR and that they are also published in the Darzhaven vestnik (Official Journal). They are therefore not purely internal instructions, which, obviously, could not be regarded as constituting ‘laws’ in substantive terms. (33)
80. Nevertheless, the provisions to which the Bulgarian Government has referred raise questions, in my view, regarding the foreseeability of the processing of data derived from a criminal investigation. More specifically, I harbour doubts as to the foreseeability of the purposes of the processing, which, in accordance with Article 6(3) of the GDPR, must be determined by the legal basis for the processing.
81. According to the information provided by the Bulgarian Government, those purposes, which seem to be listed exhaustively in Article 5(2) of the instruction relating to personnel files, include that relating to ‘changes … of the duties of an official’ to which the storage of the data at issue corresponds. According to Article 6(4) of that instruction, the data stored for reasons of ‘change of duties’ may include, in particular, ‘documents relating to disciplinary proceedings’.
82. However, considering the content of the data at issue, it appears that that purpose is understood to include, in a very broad fashion and despite its wording, even the storage of data about the absence of such disciplinary proceedings following an investigation, as in the present case, and which therefore record no change in the duties of the official concerned.
83. Subject to any other provisions that the referring court should consider relevant, such a broad interpretation of the provisions in question of the instruction relating to personnel files does not seem to me to comply with the requirements set out in point 78 of this Opinion.
84. If the Court does not agree with me that there is a lack of foreseeability in the legal basis, I consider that that legal basis, which serves as the basis for the storage of the data, does not, in any event, appear to meet an objective of public interest, for the purposes of Article 6(3) of the GDPR.
85. On this point, the Bulgarian Government argued at the hearing that, if no disciplinary proceedings are instituted after an investigation, the data relating to the investigation would not subsequently be used in the management of the official’s career. It submits that it would nevertheless be in the public interest to store such data, since they concern individuals entrusted with specific activities aimed at ensuring public order and defending the public.
86. Admittedly, it is generally accepted that the role of a police officer calls for the observance of rules of conduct and behaviour of a higher standard than for other officials or employees. That said, it is common ground that, in the case currently before the Court, the investigation was discontinued, for want of evidence, and that no disciplinary proceedings were instituted against the official concerned. Therefore, I fail to see how the nature of the duties of maintaining public order, which fall to that official, could justify the storage of the data at issue in his personnel file.
87. Moreover, the Bulgarian Government clarified at the hearing that the storage of data resulting from a criminal investigation is linked to the storage of data relating to the disciplinary liability of officials, inasmuch as the outcome of a criminal investigation will be decisive in determining whether such disciplinary liability should be incurred. Accordingly, the personnel file of the applicant in the main proceedings records that the criminal investigation in which he was a suspect concluded that there was no evidence against him, such that no disciplinary proceedings were instituted. However, I consider that to be circular reasoning which equates the storage of data with a public interest objective. Following that logic, any storage of data would be justified in itself, which would render the requirement for an objective of public interest superfluous.
88. Furthermore, if that argument is followed to its logical conclusion, the storage of certain data for the purpose of demonstrating the absence of any charge, conviction or disciplinary sanction – which could equally well be demonstrated without including any information regarding a criminal investigation or disciplinary liability in the personnel file – would mean that, if such data is not stored, the absence of such a record could not be proven.
89. That, however, would be tantamount to a presumption of guilt, at odds with the principle of the presumption of innocence enshrined in Article 48(1) of the Charter, which corresponds (34) to Article 6(2) of the ECHR. I would emphasise that, according to the case-law of the ECtHR, that principle does not cease to apply upon the closure of criminal proceedings, but aims to protect individuals who have been acquitted of a criminal charge, or in respect of whom criminal proceedings have been discontinued, from being treated in subsequent proceedings by public authorities as though they were in fact guilty of the offence with which they were charged. (35) That interpretation therefore militates in favour of re-establishing, in the event that an investigation is discontinued, the status quo ante in the personnel file.
90. Regardless of that last consideration, I consider that the information at the Court’s disposal is insufficient to establish that the requirements laid down in Article 6(1)(c) and Article 6(3) of the GDPR have been observed. To the extent that none of the other grounds of lawfulness listed in Article 6(1) of the GDPR applies, which it is for the referring court to verify, (36) it should be held that the storage of the data at issue is not lawful and that the official therefore has the right to have them erased, pursuant to Article 17(1)(d) of the GDPR.
91. That being so, and in the absence of any other information regarding the legitimate aim pursued, it is not possible to assess the proportionality of the period for which data is stored in the personnel files, which, according to the information provided by the Bulgarian Government at the hearing, extends until the official reaches 100 years of age. However, the indiscriminate application of that period to all information regarding a criminal investigation, regardless of the outcome thereof and whether or not disciplinary sanctions have been applied, is equally incapable of being justified by a simple reference to the duties of police officers. (37)
92. In conclusion, I propose that the Court’s answer to the third, fourth and fifth questions referred for a preliminary ruling should be that Article 17(3) of the GDPR, read in conjunction with Article 6(1)(c) and Article 6(3) thereof, is to be interpreted as meaning that the storage, in a police officer’s personnel file, of personal data relating to a criminal investigation in which that officer was the subject of investigative measures, as a suspect, and which was discontinued, cannot be considered lawful for the purposes of compliance with a legal obligation to which the public authority that is his employer is subject under national law, as controller, merely on account of the nature of the duties which that officer is required to perform.
(c) Additional considerations
93. I would like to turn briefly to Article 10 of the GDPR, about which the national court has not referred a question, but in relation to which the Bulgarian Government expressed its position at the hearing in response to a question asked by the Court.
94. This provision establishes the specific conditions which apply to the processing of data ‘relating to criminal convictions and offences’. It provides, in particular, that the processing of such data based on Article 6(1) of the GDPR may be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. As is clear from the wording of that provision, it applies only to processing that satisfies one of the grounds of lawfulness laid down in Article 6(1) of the GDPR. Accordingly, the referring court should not take Article 10 of the GDPR into account unless it concludes that the storage of the data at issue is lawful.
95. That said, if that were the case, I consider that, in the circumstances of the present case, the further requirements laid down by Article 10 of the GDPR would in any event be fulfilled.
96. I would immediately point out that, according to the case-law, Article 10 of the GDPR applies to data regarding criminal offences regardless of whether or not the offence for which the individual was prosecuted was proven in the course of the criminal proceedings. (38)
97. In the present case, it is common ground that the applicant in the main proceedings was neither prosecuted nor charged, but that the data stored in his personnel file record that he was the subject of investigative measures, as a suspect. In addition, that data, in my view, constitutes data ‘relating to’ criminal offences. (39) Indeed, the objective pursued by Article 10 of the GDPR (40) pleads in favour of the application of that provision to personal data which records that suspicions of the commission of a criminal offence have given rise to investigative measures, adopted by the competent authority, with regard to the data subject. (41) Even if the investigation does not lead to a conviction, the fact that data of this kind appear in the personnel file may have adverse consequences.
98. Where the controller is a public authority, the processing of personal data is, in any event, carried out ‘under the control of official authority’. (42) In the present case, the data concerning the applicant in the main proceedings was processed exclusively within departments of the Ministry, as controller. It is therefore not necessary to consider whether national law provides for appropriate safeguards for the rights and freedoms of data subjects, as mentioned in Article 10 of the GDPR.
4. The ninth question referred for a preliminary ruling
99. By its ninth question, the referring court asks, in substance, whether Article 16(2) of Directive 2016/680 is to be interpreted as meaning that a public authority, acting in its capacity as employer, must erase from an official’s personnel file any data that have been collected and stored through the intermediary of its organisational unit that has the status of an investigating authority, where the data relate to the fact that the official was a suspect in a criminal investigation that has been discontinued.
100. Since it is clear from the foregoing analysis that the GDPR applies to the storage of data such as those at issue in the main proceedings and that Directive 2016/680 does not apply, there is no need to answer the ninth question referred for a preliminary ruling.
5. The tenth question referred for a preliminary ruling
101. By its tenth question, the referring court asks, in substance, if Article 1 of Directive 2000/78 is to be interpreted as meaning that that directive precludes a public authority, one organisational unit of which carries out investigative measures concerning an official in another unit, from refusing, in its capacity as employer, to promote that official solely because he was a suspect in a criminal investigation that was discontinued.
102. First of all, in so far as concerns the factual assumptions on which this question is based, the Bulgarian Government stated at the hearing, in reply to questions asked by the Court, that, in the period following the criminal investigation, the applicant in the main proceedings, contrary to his assertion, was promoted to more senior duties. Nevertheless, the presumption of relevance enjoyed by questions referred for a preliminary ruling cannot be rebutted by the simple fact that one of the parties to the main proceedings contests certain facts the accuracy of which is not a matter for the Court to determine, and on which the delimitation of the subject matter of those proceedings depends. (43)
103. Next, I would point out that Directive 2000/78 lists exhaustively, in Article 1 thereof, the grounds of discrimination which it prohibits, which are religion or belief, disability, age and sexual orientation. (44) The fact of having been a suspect in a criminal investigation that has been discontinued fits with none of those grounds. A denial of career advancement on account of that fact alone therefore does not fall within the scope of Directive 2000/78.
104. That being so, the fact that the data relating to the status of suspect were collected by an organisational unit of the employer other than the one to which the official was assigned is irrelevant.
105. Nor does Directive 2000/78 apply to the denial of promotion on account of being a suspect as a police officer. Indeed, it is clear from the Court’s case-law that discrimination based on the employment relationship itself, and in particular on membership of a socio-professional category or on the place of work, falls outside the scope of that directive. (45)
106. Therefore, I propose that the answer to the tenth question referred for a preliminary ruling should be that Article 1 of Directive 2000/78 is to be interpreted as meaning that that directive does not apply to the denial of an official’s career advancement solely on the ground that the official was a suspect in a criminal investigation that was discontinued.
V. Conclusion
107. Having regard to all the foregoing considerations, I propose that the Court answer the questions referred by the Sofiyski rayonen sad (Sofia District Court, Bulgaria) for a preliminary ruling as follows:
1. Article 2(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC and Article 9(1) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA
must be interpreted as meaning that the GDPR applies to the storing, by a public authority in the personnel file of one of its officials, of data regarding that official’s status as a suspect in a criminal investigation, where the data have been collected by an organisational unit within that public authority in the performance of its duties as a competent authority within the meaning of Directive 2016/680, provided that the storage of that data pursues purposes other than those set out in Article 1(1) of Directive 2016/680.
2. Article 17(3) of Regulation 2016/679, read in conjunction with Article 6(1)(c) and Article 6(3) thereof
must be interpreted as meaning that the storage, in a police officer’s personnel file, of personal data relating to a criminal investigation in which that officer was the subject of investigative measures, as a suspect, and which was discontinued, cannot be considered lawful for the purposes of compliance with a legal obligation to which the public authority that is his employer is subject under national law, as controller, merely on account of the nature of the duties which that officer is required to perform.
3. Article 1 of Council Directive 2000/78/EC of 27 November 2000 establishing a general framework for equal treatment in employment and occupation
must be interpreted as meaning that that directive does not apply to the denial of an official’s career advancement solely on the ground that the official was a suspect in a criminal investigation that was discontinued.
1 Original language: French.
i The name of this case is a fictitious name. It does not correspond to the real name of any party to the proceedings
2 Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).
3 Directive of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89).
4 Council Directive of 27 November 2000 establishing a general framework for equal treatment in employment and occupation (OJ 2000 L 303, p. 16).
5 DV No 53 of 27 June 2014.
6 DV No 78 of 19 September 2014, amended and supplemented in DV No 27 of 14 April 2015, amended and supplemented in DV No 53 of 25 June 2021.
7 See, to that effect, judgment of 8 May 2025, Stadt Wuppertal (C‑130/24, EU:C:2025:340, paragraph 42).
8 Although the criminal investigation took place in 2016, before the GDPR and Directive 2016/680 entered into force, the applicant in the main proceedings seeks the erasure of data concerning him that are still being stored by the Ministry. Given that, I am in no doubt that the GDPR and Directive 2016/680 apply ratione temporis to the dispute in the main proceedings.
9 See, to that effect, judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone) (C‑548/21, EU:C:2024:830, paragraph 53).
10 The first, second, fourth, fifth, seventh and ninth questions referred for a preliminary ruling.
11 The third, sixth and eighth questions referred for a preliminary ruling.
12 On the reformulation of questions, see judgment of 3 June 2025, Kinsa (C‑460/23, EU:C:2025:392, paragraph 34 and the case-law cited).
13 Article 52 of the Charter, which the eighth question also mentions, governs limitations on fundamental rights and is not, to my mind, relevant in the context of the delimitation of the scope of the GDPR and that of Directive 2016/680.
14 The interpretation of these concepts provided in connection with the GDPR should therefore apply, by analogy, to Directive 2016/680. See, on the concept of ‘processing’, judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone) (C‑548/21, EU:C:2024:830, paragraph 71).
15 See, to that effect, judgment of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation) (C‑180/21, EU:C:2022:967, paragraph 73).
16 See Article 29(1) of the ZMVR. On the designation of the controller under national law, see judgment of 11 January 2024, État belge (Data processed by an official journal) (C‑231/22, EU:C:2024:7, paragraphs 29 and 30).
17 Article 2(1) of the GDPR.
18 See, to that effect, judgment of 7 March 2024, Endemol Shine Finland (C‑740/22, EU:C:2024:216, paragraphs 37 and 38).
19 According to the information provided by the Bulgarian Government, under Article 147(1) of the ZMVR and Articles 3 and 6 of the instruction relating to personnel files, such files are to be numbered in ascending order and stored in a special repository and the personal data stored in those files are to be classified into three predefined sections.
20 See, to that effect, judgment of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation) (C‑180/21, EU:C:2022:967, paragraph 74).
21 Article 5(1)(b) of the GDPR and Article 4(1)(b) of Directive 2016/680.
22 See, to that effect, the Opinion of Advocate General Campos Sánchez-Bordona in Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation) (C‑180/21, EU:C:2022:406, points 37, 38, 70 and 71).
23 Except in the case of activities which fall outside the scope of EU law, which is to say, an activity having the aim of safeguarding national security or one that can be classified in the same category, which does not appear to be the case here; see judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C‑439/19, EU:C:2021:504, paragraphs 66 to 68).
24 See, to that effect, the Opinion of Advocate General Campos Sánchez-Bordona in Lietuvos Respublikos generalinė prokuratūra (C‑162/22, EU:C:2023:266, points 83 and 84).
25 See, more specifically, point 72 of this Opinion.
26 That fact does not prevent the Court from taking such provisions into consideration when reformulating questions: see judgment of 13 March 2025, Alsen (C‑137/23, EU:C:2025:179, paragraph 46 and the case-law cited).
27 See, to that effect, the Opinion of Advocate General Medina in Agentsia po vpisvaniyata (C‑200/23, EU:C:2024:445, points 62 and 63).
28 Article 5(2) and Article 6(4) of the instruction relating to personnel files.
29 On the taking into account of such information, see judgment of 13 July 2023, Ferrovienord (C‑363/21 and C‑364/21, EU:C:2023:563, paragraph 58 and the case-law cited).
30 See, to that effect, the Opinion of Advocate General Pikamäe in SCHUFA Holding and Others (Scoring) (C‑634/21, EU:C:2023:220, point 69).
31 See, inter alia, judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes) (C‑175/20, EU:C:2022:124, paragraphs 54 to 56).
32 See, to that effect, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija (C‑184/20, EU:C:2022:601, paragraphs 69 and 70).
33 As regards what constitutes a law for the purposes of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed at Rome on 4 November 1950, see ECtHR, 25 March 1983, Silver and Others v. United Kingdom, CE:ECHR:1983:0325JUD000594772, § 26 and §§ 86 to 88.
34 See, in particular, judgment of 2 February 2021, Consob (C‑481/19, EU:C:2021:84, paragraph 37).
35 For an example of this line of case-law, see ECtHR, Grand Chamber, 11 June 2024, Nealon and Hallam v. United Kingdom, CE:ECHR:2024:0611JUD003248319, §§ 102 to 109 and §§ 122 to 125, and, with regard to the civil service more specifically, ECtHR, 16 February 2017, Yildiz v. Turkey, CE:ECHR:2017:0124DEC006518210, §§ 30 to 34. In this case, a police officer alleged that a negative appraisal report implied a presumption that he was guilty of a criminal offence, even though he had been acquitted. The ECtHR nevertheless concluded that Article 6(2) of the ECHR was inapplicable because the applicant had not proven that his treatment demonstrated a link between the criminal proceedings and the subsequent administrative proceedings.
36 The Commission referred in its written observations to Article 6(1)(e) of the GDPR, which addresses processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. While that is indeed a ground for lawfulness capable of applying to a public authority, it too is subject to the requirements of Article 6(3) of the GDPR. The question of the existence of an objective of public interest therefore arises all the same.
37 I would point out that, in accordance with the principle of data minimisation enshrined in Article 5(1)(c) of the GDPR, personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. According to recital 39 of the GDPR, this principle renders it necessary to ensure that the period for which personal data are stored is limited to a strict minimum.
38 Judgment of 24 September 2019, GC and Others (De-referencing of sensitive data) (C‑136/17, EU:C:2019:773, paragraph 72).
39 The Bulgarian Government explained at the hearing that the status of suspect does not entail any particular legal status under Bulgarian law. However, the Court has already held that the concept of ‘offence’ must be given an autonomous and uniform interpretation (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C‑439/19, EU:C:2021:504, paragraphs 80 to 85)). That should, in my view, apply to all of the elements that fall within the scope of Article 10 of the GDPR.
40 Namely, to ensure enhanced protection as regards processing which, because of the particular sensitivity of the data at issue, is liable to constitute a particularly serious interference with the private or professional life of the data subject: see judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C‑439/19, EU:C:2021:504, paragraphs 74 and 75).
41 This view is shared by Bäcker, M., ‘Art. 10’, in BeckOK Datenschutzrecht, 51st edition, Wolff, H.A., Brink, S., and von Ungern-Sternberg, A., C.H. Beck, 2024, paragraph 3. See also Georgieva, L., ‘Article 10’, in The EU General Data Protection Regulation (GDPR). A Commentary, Kuner, C., Bygrave, L.A., and Docksey, C., Oxford University Press, 2020, p 389.
42 See, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C‑439/19, EU:C:2021:504, paragraph 101).
43 Judgment of 5 December 2006, Cipolla and Others (C‑94/04 and C‑202/04, EU:C:2006:758, paragraph 26).
44 See, to that effect, judgments of 17 July 2008, Coleman (C‑303/06, EU:C:2008:415, paragraphs 38 and 46); of 7 July 2011, Agafiţei and Others (C‑310/10, EU:C:2011:467, paragraph 34), and of 20 October 2022, Curtea de Apel Alba Iulia and Others (C‑301/21, EU:C:2022:811, paragraphs 64 and 69 and the case-law cited).
45 Judgments of 7 July 2011, Agafiţei and Others (C‑310/10, EU:C:2011:467, paragraphs 31 to 33), of 9 March 2017, Milkova (C‑406/15, EU:C:2017:198, paragraph 44) and of 17 October 2024, Zetschek (C‑349/23, EU:C:2024:889, paragraph 25 and the case-law cited).