Summary;Judgment — ECLI:EU:C:2022:967
Date: 2022-12-08
Language of the case: Bulgarian
Court formation: Fifth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Bulgaria

Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged:  
23 March 2021 
Referring court:  
Administrativen sad Blagoevgrad (Bulgaria) 
Date of the decision to refer:  
19 March 2021 
Applicant:  
Mr VS 
Defendant:  
Inspektor v Inspektorata kam Visshia sadeben savet 
  
Subject matter of the case in the main proceedings 
The main proceedings are based on an action brought by Mr VS before the 
Administrative Sad Blagoevgrad (Administrative Court, Blagoevgrad, Bulgaria) 
against the decision of an inspector of the Inspektorat kam Visshia sadeben savet 
(Inspectorate at the Supreme Judicial Council, Bulgaria; ‘the IVSS’), acting on 
behalf of the IVSS as the national supervisory authority for the protection of data 
subjects in the event of violations of their rights under Regulation (EU) 2016/679 
of the European Parliament and of the Council of 27 April 2016 on the protection 
of natural persons with regard to the processing of personal data and on the free 
movement of such data, and repealing Directive 95/46/EC (General Data 
Protection Regulation) (OJ 2016 L 199, p. 1; ‘Regulation 2016/679’). 
The applicant complains of unlawful processing of his personal data, which the 
Rayonna prokuratura – Petrich (District Public Prosecutor’s Office, Petrich, 
Bulgaria; ‘the Petrich RP’) collected from him in his capacity as the victim of a 
crime. He submits that the processing consists in the fact that the Petrich RP 
subsequently used the data to investigate him as an accused person in the same 
preliminary investigation for the same offence. 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-180/21 
 
2  
Mr VS also complained that the Petrich RP unlawfully used his personal data in 
civil proceedings that he had brought against the Prokuratura na Republika 
Bulgaria (Public Prosecutor’s Office of the Republic of Bulgaria) for the payment 
of compensation for the excessive duration of the preliminary investigation 
conducted by the Petrich RP. The personal data concerned by this second 
complaint were collected in various public prosecution investigation files, on the 
basis of which, however, no preliminary investigation was subsequently initiated 
due to the lack of a criminal offence. Those personal data were used in the civil 
proceedings as evidence in support of the Public Prosecutor’s Office’s arguments 
in defence against the action for compensation, according to which the acts 
committed by Mr VS which had been the subject of the Public Prosecutor’s 
Office’s investigation had also affected his state of health. 
Subject matter and legal basis of the request 
Interpretation – pursuant to Article 267 of the Treaty on the Functioning of the 
European Union (TFEU) – of Article 1(1) of Directive (EU) 2016/680 of the 
European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data by competent 
authorities for the purposes of the prevention, investigation, detection or 
prosecution of criminal offences or the execution of criminal penalties, and on the 
free movement of such data, and repealing Council Framework Decision 
2008/977/JHA (OJ 2016 L 119, p. 89; ‘Directive 2016/680’) and of Article 6(1)(f) 
of Regulation 2016/679 
Questions referred for a preliminary ruling 
1. Is Article 1(1) of [Directive 2016/680] to be interpreted as meaning that, 
when stating the objectives of that directive, the terms ‘prevention, 
investigation, detection or prosecution of criminal offences’ are listed as 
aspects of a general objective? 
2. Are the provisions of [Regulation 2016/679] applicable to the Public 
Prosecutor’s Office of the Republic of Bulgaria in view of the fact that 
information concerning a person, which was collected by the Public 
Prosecutor’s Office, in its capacity as ‘controller’ pursuant to point 8 of 
Article 3 of [Directive 2016/680], in an investigation file opened in relation 
to that person with a view to verifying indications of a criminal offence, was 
used in the context of the judicial defence of the Public Prosecutor’s Office 
as a party to civil proceedings – by virtue of the fact that the circumstance of 
that file having been opened was revealed or that the contents of the file 
were presented? 
2.1 If that question is answered in the affirmative: 
INSPEKTOR V INSPEKTORATA KAM VISSHIA SADEBEN SAVET 
 
3 
Is the expression ‘legitimate interests’ in Article 6(1)(f) of [Regulation 
2016/679] to be interpreted as including the disclosure, in whole or in part, 
of information concerning a person which has been collected in a public 
prosecution investigation file opened in relation to that person for the 
purposes of the prevention, investigation, detection or prosecution of 
criminal offences, in the case where that disclosure is carried out for the 
purposes of the defence of the controller as a party to civil proceedings, and 
does that expression exclude the consent of the data subject? 
Provisions of EU law and the case-law relied on 
Provisions 
Directive 2016/680 
Recitals 1, 12 (first sentence), 17, 21 (first sentence), 29, 31, 34 (third and fourth 
sentences) 
Article 1(1), Article 2(1) and (2), points (1), (2), (7)(a) and (8) of Article 3, 
Article 4(2) and Article 9(1) 
Regulation 2016/679 
Recitals 4, 15 (first and second sentences), 16, 45 (first to fourth sentences), 46 
(excluding the second sentence), 50 (first to third sentences); 
Article 2(1) and (2), points (1), (2) and (7) of Article 4, Article 6(1)(f) and 
Article 10 
Directive 2012/29/EU of the European Parliament and of the Council of 
25 October 2012 establishing minimum standards on the rights, support and 
protection of victims of crime, and replacing Council Framework Decision 
2001/220/JHA (OJ 2012 L 315, p. 57; ‘Directive 2012/29’). 
Case-law 
In relation to the admissibility of the reference 
Judgment of 2 April 2020, Ruska Federacija (C-897/19 PPU, EU:C:2020:262, 
paragraph 43) 
Judgment of 8 May 2019, PI (C-230/18, EU:C:2019:383, paragraph 42) 
Judgment of 19 December 2018, AREX CZ (C-414/17, EU:C:2018:1027, 
paragraph 34) 
Judgment of 6 November 2003, Lindqvist (C-101/01, EU:C:2003:596, 
paragraphs 40 and 42) 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-180/21 
 
4  
Judgment of 20 May 2003, Österreichischer Rundfunk and Others (C-465/00, 
C-138/01 and C-139/01, EU:C:2003:294, paragraph 42) 
Judgment of 9 July 2020, Land Hessen (C-272/19, EU:C:2020:535, paragraph 68) 
Opinion of Advocate General M. Szpunar of 17 December 2020 in Case C-439/19 
(EU:C:2020:1054, points 53 and 55) 
In relation to the second question referred 
Judgment of 10 July 2018, Jehovan todistajat (C-25/17, EU:C:2018:551, 
paragraphs 57 and 58). 
National provisions 
Zakon za zashtita na lichnite danni (Law on data protection; ‘the ZZLD’) 
According to Article 1 of the ZZLD, the latter lays down rules relating to the 
protection of natural persons with regard to the processing of personal data by the 
Public Prosecutor’s Office and the investigating authorities for the purposes of the 
prevention, investigation, detection or prosecution of criminal offences or the 
execution of criminal penalties, including the safeguarding against and the 
prevention of threats to public order and security (‘purposes of combating crime’) 
and relating to the powers of the IVSS in the context of its supervision of the 
processing of personal data by the Public Prosecutor’s Office and the investigating 
authorities. 
In accordance with Article 38b of the ZZLD, the data subject has the right to 
lodge a complaint with the IVSS in the event of a violation of his or her rights 
under Regulation 2016/679 and under this Law in relation to the processing of 
personal data by the Public Prosecutor’s Office and the investigating authorities 
for the purposes of combating crime. In accordance with Article 38c of the ZZLD, 
complaints under Article 38b(1) are to be examined by an inspector of the IVSS. 
An action against the inspector’s decision may be brought under the 
Administrativnoprotsesualen kodeks (Code of administrative procedure) within 
14 days of receipt. 
In accordance with Article 45 of the ZZLD, the processing of personal data by the 
controller which initially collected them or by another controller for a purpose 
related to the combating of crime other than that for which the data were initially 
collected is permitted, provided that the controller is authorised to process 
personal data for that other purpose and that the processing for that other purpose 
is necessary and proportionate under EU law or the law of the Republic of 
Bulgaria. Regulation 2016/679 (Article 42 of the ZZLD) applies in such cases. 
The processing under Article 45 of the ZZLD may include archiving in the public 
interest, scientific, statistical or historical use of data, for the purposes of 
INSPEKTOR V INSPEKTORATA KAM VISSHIA SADEBEN SAVET 
 
5 
combating crime, subject to appropriate safeguards for the rights and freedoms of 
data subjects. 
According to Article 47 of that law, the controller must make a clear distinction, 
as far as possible, between personal data of different categories of data subjects 
such as: suspects; persons convicted of a criminal offence; victims; potential 
witnesses; persons possessing information regarding criminal offences; and other 
third parties. 
Article 49 of the ZZLD provides that the processing of personal data is lawful if it 
is necessary for the exercise of the powers of the competent authority for the 
purposes of combating crime and is provided for in EU law or in a legal provision 
which specifies the purposes of the processing and the categories of personal data 
to be processed. 
According to the additional provisions for the ZZLD, the terms used therein 
correspond to the definitions in Article 4 of Regulation 2016/679. The ZZLD lays 
down implementing measures for that regulation and sets out the requirements of 
Directive 2016/680. 
Constitution of the Republic of Bulgaria 
Article 127 of the Constitution of the Republic of Bulgaria establishes the 
exclusive competence of the Public Prosecutor’s Office to conduct investigations, 
charge offenders and bring criminal charges before the courts in the case of 
offences that are the subject of prosecution by the public prosecutor. 
Nakazatelen kodeks (Criminal Code; ‘the NK’) 
Article 325(1) of the NK defines the offence of ‘hooliganism’ as, in particular, the 
commission of disorderly acts that grossly disturb public order. 
Zakon za sadebnata vlast (Law on the judiciary) 
Article 145 of the Zakon za sadebnata vlast (Courts Act) provides that the public 
prosecutor may conduct investigations personally or delegate them to other 
bodies. In accordance with paragraph 2, the public prosecutor is to decide on the 
results of the investigation within one month of receipt. The Ukazaniya na 
Glavniya prokuror (Instructions of the Prosecutor General) of the Republic of 
Bulgaria on the application of Article 145(2) of the Zakon za sadebnata vlast (Law 
on the judiciary) states that the investigation is a non-procedural activity and that 
the time limits under that paragraph are orientational in nature. 
Pravilnik za administratsiata na prokuraturata na Republika Bulgaria, 
izdaden ot Visshia sadeben savet (Statute for the Administration of the Public 
Prosecutor’s Office of the Republic of Bulgaria, issued by the Supreme 
Judicial Council) 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-180/21 
 
6  
In accordance with Article 67 of that statute, the offices, in particular the district 
and regional public prosecutor’s offices, are to keep entry and exit logs and other 
document registers and maintain a unified information system of the Public 
Prosecutor’s Office. 
According to Article 68 of that statute, new entries are to be entered in the entry 
log with a serial number, and entries relating to investigation files already kept are 
to be noted in the appropriate place in the entry log and added to the files without 
being assigned a new number. 
In accordance with Article 71 of that statute, investigation files are to be archived 
after they have been closed and can be requested if they are needed for the work 
of public prosecutors. Where technically possible, an electronic version of all 
orders and documents in the investigation and criminal prosecution files must also 
be created. 
Administrativnoprotsesualen kodeks (Code of administrative procedure) 
Article 145(1) of the Administrativnoprotsesualen kodeks (Code of administrative 
procedure) provides that administrative acts may be challenged before a court as 
to their legality. 
Grazhdanski protsesualen kodeks (Code of civil procedure) 
Article 154(1) of the Grazhdanski protsesualen kodeks (Code of civil procedure) 
stipulates that each party bears the burden of proof in respect of the facts on which 
claims are based and in respect of its own objections. 
Zakon za otgovornostta na darzhavata i obshtinite za vredi (Law on the 
liability of the State and municipalities for damages) 
Article 26 of the Zakon za otgovornostta na darzhavata i obshtinite za vredi (Law 
on the liability of the State and municipalities for damages; ‘the ZODOV’) 
provides that the State is liable for damages suffered by citizens and legal persons 
due to a violation of the right to have a trial conducted within a reasonable time 
pursuant to Article 6(1) of the European Convention for the Protection of Human 
Rights and Fundamental Freedoms (‘ECHR’). 
Succinct presentation of the facts and procedure in the main proceedings 
1 The applicant in the main proceedings lodged a complaint with the IVSS on 
12 March 2020. 
2 The first ground of complaint asserted before the IVSS concerns unlawful 
processing of the applicant’s personal data collected by the Petrich RP in public 
prosecution investigation file No 1548/2013, preliminary investigation 
No 252/2013 of the Rayonno upravlenie ‘Politsia’ – Petrich (Petrich District 
INSPEKTOR V INSPEKTORATA KAM VISSHIA SADEBEN SAVET 
 
7 
Police Administration, Bulgaria; ‘Petrich RUP’), within the framework of which 
he was recorded as the victim of a crime under Article 325(1) of the NK. 
According to the applicant, the unlawful processing of his personal data by the 
Petrich RP resides in the fact that the latter subsequently used the data it had 
collected from him in his capacity as the victim of a crime in preliminary 
investigation No 252/2013 with a view to initiating investigations into him as an 
accused person in the same preliminary investigation for the same act, which had 
been identified as a criminal offence under Article 325(1) of the NK. 
3 The second ground of complaint asserted before the IVSS concerns unlawful 
processing of the applicant’s personal data collected under public prosecution 
investigation file Nos 517/2016, 1872/2016, 2217/2016 and 1870/2016. That 
processing consists in the fact that the supervising public prosecutor of the Petrich 
RP made reference to information contained in those files in the course of civil 
proceedings No 144/2018 conducted before the Okrazhen sad – Blagoevgrad 
(Regional Court, Blagoevgrad, Bulgaria). Those civil proceedings were initiated 
by an action brought by the applicant against the Public Prosecutor’s Office of the 
Republic of Bulgaria under Article 26 of the ZODOV. 
4 Regarding the first ground of complaint, the inspector of the IVSS established that 
investigation file No 1548/2013 was opened by decision of the public prosecutor 
of the Petrich RP of 18 May 2013 against an unknown perpetrator, with the 
applicant as the victim of the crime. 
5 The investigations relate to an event that took place in a snack bar (caravan) at 
approximately 11 p.m. on 18 April 2013, in which an unknown perpetrator, 
together with other persons, allegedly assaulted Mr VS. 
6 By decision of 4 April 2018, Mr VS was charged as an accused person in respect 
of an offence under Article 325(1) of the NK in preliminary investigation 
No 252/2013, in which, until then, he had been recorded as a victim of the 
offence. That decision was challenged before the Okrazhna prokuratura – 
Blagoevgrad (District Prosecutor’s Office, Blagoevgrad), which confirmed it. 
7 On 14 October 2019, a public prosecutor of the Petrich RP brought charges 
against the applicant and eight other persons, but the criminal proceedings being 
conducted before the Rayonen sad – Petrich (District Court, Petrich) were 
terminated by that court by order of 10 November 2020 in respect of all the 
defendants, including the applicant in the main proceedings, due to the extinction 
of criminal liability following the expiry of the absolute statute of limitations. 
8 As regards the second ground of the complaint of 12 March 2020, the inspector of 
the IVSS established the following. 
9 Public prosecution investigation file No 517/2016 of the Petrich RP was opened 
on 5 April 2016 due to a complaint filed against Mr VS. On 11 May 2016, the 
supervising public prosecutor decided not to open a preliminary investigation 
because there was no evidence of a criminal offence. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-180/21 
 
8  
10 Public prosecution investigation file No 1870/2016 of the Petrich RP was opened 
on 26 October 2016 due to a complaint filed against four persons, one of whom 
was Mr VS. On 22 February 2017, the supervising public prosecutor decided not 
to open a preliminary investigation, since there was no evidence of a criminal 
offence, which was confirmed by the District Prosecutor’s Office, Blagoevgrad. 
11 Public prosecution investigation file No 1872/2016 of the Petrich RP was opened 
on 26 October 2016 due to a complaint filed against four persons, one of whom 
was the applicant Mr VS. On 22 February 2017, the supervising public prosecutor 
of the Petrich RP decided not to open a preliminary investigation, since there was 
no evidence of a criminal offence (offence that is the subject of prosecution by the 
public prosecutor). 
12 In the court hearing of 15 October 2018 before the Regional Court, Blagoevgrad 
in the civil case of Mr VS against the Public Prosecutor’s Office of the Republic 
of Bulgaria, the public prosecutor of the Petrich RP requested the production of 
investigation files No 517/2016 and No 1872/2016 of the Petrich RP. The public 
prosecutor’s request was made in the context of the defence against Mr VS’s 
claim for compensation owing to the excessive duration of preliminary 
investigation No 252/2013, by providing evidence that the acts committed by 
Mr VS and investigated by the Petrich RUP and the Petrich RP had also had an 
impact on his state of health. 
13 By order of 15 October 2018, the Regional Court, Blagoevgrad obliged the Petrich 
RP to submit certified copies of the contents of public prosecution investigation 
file Nos 517/2016 and 1872/2016 in those civil proceedings. 
14 On 22 June 2020, the inspector of the IVSS, Ms QR, issued a decision on Mr VS’s 
complaint of 12 March 2020, against which the action in the main proceedings 
was brought. 
15 She dismissed Mr VS’s complaint as unfounded with regard to the first ground of 
complaint concerning an infringement of Article 42(2) of the ZZLD in the 
processing of his personal data in public prosecution investigation file 
No 1548/2013 and as inadmissible with regard to the second ground of complaint 
concerning an infringement of the provisions of the ZZLD and Regulation 
2016/679 in the processing of his personal data in public prosecution investigation 
file No 517/2016, No 1870/2016, No 1872/2016 and No 2217/2016, admitted as 
evidence in the civil proceedings before the Regional Court, Blagoevgrad. 
16 On 31 July 2020, Mr VS brought an action before the Administrative Court, 
Blagoevgrad against the decision of the inspector of the IVSS, Ms QR, of 22 June 
2020, that action forming the basis of the main proceedings. 
INSPEKTOR V INSPEKTORATA KAM VISSHIA SADEBEN SAVET 
 
9 
Essential arguments of the parties in the main proceedings 
17 By his action, Mr VS alleges infringements by the national supervisory authority 
of Article 49 of the ZZLD, Directive 2016/680 and Regulation 2016/679. 
18 In particular, the applicant submits that his personal data, pertaining to him as the 
victim of a crime, were unlawfully processed by the supervising public prosecutor 
in preliminary investigation No 252/2013 with a view to investigating him as an 
accused person in the same proceedings – in violation of his rights as a ‘victim’ 
under Directive 2012/29 and the principles of Directive 2016/680 – that is to say, 
for a purpose other than that for which they were initially collected. 
19 He also complains of unlawful processing of personal data collected in public 
prosecution investigation file Nos 517/2016, 1870/2016, and 1872/2016 of the 
Petrich RP, for purposes other than those for which they were collected, contrary 
to the principles of Regulation 2016/679, after it had been decided not to open a 
preliminary investigation in those cases. In the alternative, he requests that the 
referring court refer the matter to the Court of Justice of the European Union for a 
preliminary ruling on the interpretation of Article 4(2) of Directive 2016/680 and 
Articles 4 and 50 of the Charter of Fundamental Rights of the European Union. 
20 The defendant in the main proceedings, the inspector of the IVSS, confirms the 
reasoning of the decision which dismissed the complaint and is the subject matter 
of the main proceedings. 
21 The defendant submits that, in particular, Article 42 of the ZZLD and the 
provisions of Directive 2016/680, which allow for the processing of personal data 
by national competent authorities, do not ‘divide’ the purposes of combating 
crime into groups. The defendant asserts that, while a distinction is made between 
categories of data subjects under Article 47 of the ZZLD, it does not follow that 
the processing of their personal data pursues different purposes, nor can the 
processing of the personal data of a person collected from him or her in his or her 
capacity as a ‘victim’ with a view to initiating investigations into him or her as a 
‘defendant’ be categorised as ‘unlawful further processing’ for a purpose other 
than that for which they were initially collected. 
22 With regard to the processing of the applicant’s personal data in the main 
proceedings, which were collected in the closed public prosecution investigation 
files, the supervisory authority submits that the considerations set out in the 
complaint lodged with the IVSS do not substantiate the infringements of 
Regulation 2016/679 alleged by Mr VS. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
Admissibility of the request for a preliminary ruling 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-180/21 
 
10  
23 The dispute in the main proceedings primarily concerns the application of the 
provisions of Directive 2016/680 and Regulation 2016/679, with the result that it 
is necessary for those provisions to be interpreted by the Court of Justice of the 
European Union in the light of the circumstances of the main proceedings. 
24 The referring court emphasises that it is for the Court of Justice to interpret all 
provisions of EU law which national courts require in order to decide the actions 
pending before them (Ruska Federacija [C-897/19 PPU]; PI [C-230/18]; AREX 
CZ [C-414/17]). It points out that Directive 2016/680 provides for a 
comprehensive system for the protection of personal data, and its scope includes 
the processing of personal data by law enforcement authorities and is not limited 
to the exchange of such data between Member States. 
25 With regard to the expression ‘activities which fall outside the scope of Union 
law’, the referring court states that the Court of Justice made clear in Lindqvist 
(C-101/01) that that expression was not to be interpreted as meaning that as 
having a scope which would require it to be determined in each individual case 
whether the specific activity at issue directly affected freedom of movement 
between Member States, and, in Österreichischer Rundfunk (C-465/00), that the 
applicability of EU law cannot depend on whether there is a sufficient link with 
the exercise of the fundamental freedoms guaranteed by the Treaty. It notes that, 
in Land Hessen (C-272/19), the Court of Justice confirmed that that definition 
must be interpreted restrictively. Lastly, the referring court refers, in particular, to 
the Opinion of the Advocate General in Case C-439/19, according to which 
‘“processing of personal data relating to criminal convictions and offences or 
related security measures based on Article 6(1)” of the GDPR […] cannot have 
the accessory function which is proper to the Charter’ (point 53). 
The relevance of the questions referred 
26 The ZZLD provides for remedies for individuals in relation to the processing of 
personal data in accordance with Regulation 2016/679 and the processing of such 
data by competent authorities for the purposes of combating crime. 
The first question referred 
27 In the main proceedings, it is for the referring court to assess whether the further 
use of the applicant’s personal data – which had been collected from him in his 
capacity as the victim of a crime in the course of preliminary investigation 
No 252/2013 – with a view to opening investigations into him in the same 
preliminary investigation constitutes unlawful processing of personal data. 
28 The Public Prosecutor’s Office of the Republic of Bulgaria is a ‘competent 
authority’ within the meaning of point (7)(a) of Article 3 and a ‘controller’ within 
the meaning of point (8) of Article 3 of Directive 2016/680. The collection of 
information about a person in the context of a preliminary investigation falls 
within the scope of Article 2(1) of Directive 2016/680, and the information 
INSPEKTOR V INSPEKTORATA KAM VISSHIA SADEBEN SAVET 
 
11 
constitutes ‘personal data’ within the meaning of point (1) of Article 3 of that 
directive. 
29 At the same time, it is not clear whether the processing by the same controller of a 
person’s personal data collected from him or her in his or her capacity as a victim 
of a crime in a preliminary investigation with a view to initiating an investigation 
into that person constitutes processing for a purpose other than that for which it 
was initially collected, taking into account recital 31 of the directive: ‘… a clear 
distinction should, where applicable and as far as possible, be made between 
personal data of different categories of data subjects such as: suspects; [and] 
victims’. 
30 In that regard, since recital 29 and Article 4(2) of Directive 2016/680 concern the 
processing of personal data for a purpose falling within the scope of that directive 
(Article 1(1)) but other than that for which they were collected, the referring court 
considers it necessary to ask whether the list in Article 1(1) – ‘the prevention, 
investigation, detection or prosecution of criminal offences’ – refers to individual 
aspects of a general purpose or whether it is to be interpreted as a list of different 
purposes. 
The second question referred 
31 The second plea in law raised by the applicant in the main proceedings concerns 
the ‘unlawful processing’ by the Public Prosecutor’s Office of the Republic of 
Bulgaria of his personal data, which had been collected in the public prosecution 
investigation files held against him, which were closed without a preliminary 
investigation being initiated. The personal data were admitted as evidence in a 
civil case for the payment of damages that the applicant brought against the Public 
Prosecutor’s Office of the Republic of Bulgaria under the ZODOV. 
32 In that regard, the referring court will assess, first, whether the controller’s 
transmission to the civil court of information regarding the fact that public 
prosecution investigation files concerning the applicant had been opened and 
closed, or the disclosure to the civil court of the contents of those files, constitutes 
‘processing’ of ‘personal data’ within the meaning of points (1) and (2) of 
Article 4 of Regulation 2016/679 within the scope of Article 2(1) of that 
regulation. Second, the referring court will assess whether, in the circumstances of 
the main proceedings, the transmission of the personal data constitutes lawful 
processing within the meaning of Article 6(1)(f) of Regulation 2016/679 in view 
of the fact that the Public Prosecutor’s Office is a party to the civil proceedings 
and has a right to all procedural means of defence and evidence. 
33 The referring court sets out the following considerations. 
34 Article 9(1) of Directive 2016/680 states that Regulation 2016/679 applies to the 
processing of personal data collected for one of the purposes of combating crime 
but for purposes other than those of the directive. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-180/21 
 
12  
35 With regard to the requirement in Article 2(1) of Regulation 2016/679, according 
to which the latter is to apply to the processing of personal data which form part of 
a filing system, the referring court refers to the judgment in Jehovan todistajat 
(C-25/17), in which the Court of Justice clarifies that ‘the requirement that the set 
of personal data must be “structured according to specific criteria” is simply 
intended to enable personal data to be easily retrieved’, and that it cannot be 
inferred that the personal data at issue ‘must be contained in data sheets or specific 
lists or in another search method’. 
36 In the exercise of its statutory functions, the Public Prosecutor’s Office may 
conduct investigations that are non-procedural activities in accordance with the 
Ukazanieto otnosno prilaganeto na chlen 145, alineya 2 ot Zakona za sadebnata 
vlast (Instruction on the application of Article 145(2) of the Law on the judiciary). 
Data on persons contained in the public prosecution investigation files are 
collected for the purposes of combating crime, and the records are archived if no 
preliminary investigation is initiated. 
37 In view of the above considerations and Article 10 of Regulation 2016/679, 
information concerning a person, irrespective of how it is structured, falls within 
the scope of Article 2(1) of that regulation if it has been collected in the context of 
a public prosecution investigation file opened as a result of a complaint filed 
against that person. In addition, the information collected within the framework of 
a public prosecution investigation file is stored in the electronic database of the 
Public Prosecutor’s Office of the Republic of Bulgaria, with the result that it is 
possible for the person concerned to be identified. 
38 Having regard to the jurisdiction of the Court of Justice of the European Union in 
respect of the interpretation of EU law, the referring court wishes to ascertain 
whether it already constitutes ‘processing’ of ‘personal data’ within the meaning 
of Article 4(1) and (2) of Regulation 2016/679, which falls within the scope of 
Article 2(1) of that regulation, if the controller informs the civil court that the 
Public Prosecutor’s Office has opened and closed investigation files on the 
applicant or provides it with that information. 
39 The reference in the civil proceedings to information regarding the fact that public 
prosecution investigation files have been opened in relation to the applicant in the 
main proceedings is made for a purpose other than that for which the information 
was collected. This raises the question as to the ‘lawful processing’ of that 
information within the meaning of Article 6(1)(f) of Regulation 2016/679. 
40 The reason why the Public Prosecutor’s Office of the Republic of Bulgaria 
forwarded the information regarding the public prosecution investigation files 
opened in relation to the applicant was to defend itself against the action brought 
against it. As a party to the civil proceedings, it is entitled to all the procedural 
means of defence and evidence, and the request for the public prosecution 
investigation files to be admitted as evidence in the civil proceedings is 
permissible under the national Code of civil procedure. 
INSPEKTOR V INSPEKTORATA KAM VISSHIA SADEBEN SAVET 
 
13 
41 Article 45 of the ZZLD provides that the processing of personal data by the 
controller which initially collected them, for a purpose related to the combating of 
crime other than that for which the data were initially collected is permitted, 
provided that the controller is authorised under EU law or the law of the Republic 
of Bulgaria to process personal data for such a purpose and that the processing for 
that other purpose is necessary and proportionate under EU law or under the law 
of the Republic of Bulgaria. 
42 At the same time, as stated in recital 50 of Regulation 2016/679, the subsequent 
processing of personal data for purposes other than those for which those data 
were initially collected is allowed where the processing is compatible with the 
purposes for which the personal data were initially collected. The referring court 
proceeds on the assumption that the cases referred to in Article 6(1)(c), (d) and (e) 
are clearly not applicable. 
43 It points out that, in accordance with recital 4 of Regulation 2016/679, the scope 
of Article 10 of that regulation must be determined in consideration of the 
function of fundamental rights in society. In this regard, it states that the European 
Court of Human Rights (ECtHR) accepts that information contained in a police 
report concerning acts for which the person has not been convicted falls within the 
scope of Article 8 ECHR when it is presented in court in other criminal 
proceedings (ECtHR, judgment of 18 November 2008, Cemalettin Canli v. 
Turkey, No 22427/04, §§ 33 and 42-43), and that the storage of information about 
a person in a police database containing convicted persons, defendants and 
victims, allowing conclusions to be drawn about his or her identity, constitutes an 
interference with the right to respect for private life (ECtHR, judgment of 
18 September 2014, Brunet v. France, No 21010/10, §§ 42-45). The referring 
court also states that the telephone records of a person ordered in the course of a 
criminal investigation were subsequently used unlawfully in the context of 
disciplinary proceedings following a decision not to initiate criminal proceedings 
(ECtHR, judgment of 7 June 2016, Karabeyoğlu v. Turkey, No 30083/10, §§ 117-
121). 
44 Since, in the view taken by the referring court, the issue in the present case 
concerns the compatibility of data protection with the rights of the controller as a 
party to legal proceedings, the referring court has decided to refer the matter to the 
Court of Justice under Article 267 TFEU.