62023CJ0313_RES
Joined Cases C‑313/23, C‑316/23 and C‑332/23
Inspektorat kam Visshia sadeben savet
(Request for a preliminary ruling from the Sofiyski rayonen sad)
Judgment of the Court (First Chamber) of 30 April 2025
(References for a preliminary ruling – Rule of law – Judicial independence – Second subparagraph of Article 19(1) TEU – Effective legal protection in the fields covered by Union law – Judicial body competent to propose the initiation of disciplinary proceedings against judges, public prosecutors and investigating magistrates, with a view to the imposition of disciplinary penalties – Members of the judicial body remaining in office after the expiry of their term of office – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Data security – Access by a judicial body to data relating to the bank accounts of judges and public prosecutors and of their family members – Judicial authorisation for the purpose of lifting banking secrecy – Court authorising the lifting of banking secrecy – Article 4(7) – Concept of ‘controller’ – Article 51 – Concept of ‘supervisory authority’)
Questions referred for a preliminary ruling – Reference to the Court – National court or tribunal within the meaning of Article 267 TFEU – Meaning – To be determined on the basis of criteria relating to the body’s constitution and function – Court seised of a request made by a judicial body that is seeking access to data relating to the bank accounts of judges, public prosecutors and investigating magistrates as well as of their family members – Judicial authorisation for the purpose of lifting banking secrecy – Court performing judicial functions – Included
(Art. 19(1), second subpara., TEU; Art. 267 TFEU; Charter of Fundamental Rights of the European Union, Arts 7 and 8)
(see paragraphs 59-63)
Questions referred for a preliminary ruling – Jurisdiction of the Court – Limits – Obligation on Member States to establish the necessary remedies to ensure effective judicial protection – Questions concerning national rules relating to the organisation and operation of a judicial body – Included
(Art. 19(1), second subpara., TEU; Art. 267 TFEU)
(see paragraphs 71-73)
Member States – Obligations – Provision of remedies sufficient to ensure effective legal protection – Observance of the principle of judicial independence – Members of a judicial body competent to propose the initiation of disciplinary proceedings against judges, public prosecutors and investigating magistrates remaining in office after the expiry of their terms of office – No express legal basis or time limit for that extension – Not permissible
(Arts 2 and 19(1), second subpara., TEU; Charter of Fundamental Rights of the European Union, Art. 47)
(see paragraphs 81-97, operative part 1)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Scope – Exceptions – Processing of data in the course of an activity which falls outside the scope of EU law – Meaning – Disclosure to a judicial body of personal data protected by banking secrecy and concerning judges, public prosecutors and investigating magistrates as well as their family members – Disclosure in the context of the verification of asset declarations – Not included
(European Parliament and Council Regulation 2016/679, Arts 2(1), 2(a) and (3))
(see paragraphs 99-106, operative part 2)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Concept of controller – Court having jurisdiction to authorise, at the request of a judicial body, the disclosure by a bank to that body of data relating to the bank accounts of judges, public prosecutors and investigating magistrates as well as of their family members – Not included
(European Parliament and Council Regulation 2016/679, Art. 4(7))
(see paragraphs 108-117, operative part 3)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – National supervisory authorities – Concept – Court having jurisdiction to authorise, at the request of a judicial body, the disclosure by a bank to that body of data relating to the bank accounts of judges, public prosecutors and investigating magistrates as well as of their family members – Not included
(Art. 16 TFEU; Charter of Fundamental Rights of the European Union, Art. 8(3); European Parliament and Council Regulation 2016/679, Arts 51(1), (2) and (4), 57(1)(a) and (g), and 58)
(see paragraphs 119-123, operative part 4)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Remedies – Court having jurisdiction to authorise disclosure of personal data to a judicial body – Court seised of a request for access to those data made by that body and not of an action brought against a controller – Obligation to ensure of its own motion compliance with the rules relating to data security – None – Infringement, by that body, of those rules in the past – No effect
(Charter of Fundamental Rights of the European Union, Art. 47; European Parliament and Council Regulation No 2016/679, Art. 79(1))
(see paragraphs 128-138, operative part 5)
Résumé
Ruling on a request for a preliminary ruling from the Sofiyski rayonen sad (District Court, Sofia, Bulgaria), the Court of Justice holds that the principle of judicial independence precludes the practice of a Member State which allows the members of a judicial body competent to propose the initiation of disciplinary proceedings against judges, public prosecutors and investigating magistrates to remain in office beyond the legal duration of their terms of office in the absence of an express legal basis or a time limit for that extension. In addition, the Court clarifies the scope of the concepts of ‘controller’ and ‘supervisory authority’, provided for by the General Data Protection Regulation, (
1
) in the context of disclosure of personal data protected by banking secrecy concerning judges, public prosecutors and investigating magistrates and their family members that is authorised by a national court following a request made by that judicial body.
In May 2023, after the expiry of the period prescribed for the submission, for 2022, of the annual asset declarations of judges, public prosecutors and investigating magistrates and of their families, the Inspektorat kam Visshia sadeben savet (Inspectorate at the Supreme Judicial Council, Bulgaria; ‘the Inspectorate’) requested the referring court to lift banking secrecy in relation to the bank accounts of several judges and public prosecutors and of their family members. (
2
)
The referring court states that the Inspectorate was established in 2007, following an amendment to the Bulgarian Constitution, and, as a judicial body, is entrusted with investigating the exercise of undue influence over judges, public prosecutors and investigating magistrates, verifying their asset declarations and identifying possible conflicts of interest and violations of the independence of the judiciary. Furthermore, the referring court states that the terms of office of the members of the Inspectorate, elected by the national parliament for a period of four to five years, came to an end in 2020, without new members having been elected. However, according to the case-law of the Konstitutsionen sad (Constitutional Court, Bulgaria), the members of the Inspectorate are to continue to perform their functions until the election of new members, since maintaining the functions entrusted to the Inspectorate outweighs the risks of abuse by its members.
In those circumstances, the referring court asks whether an extension of the terms of office of the members of the Inspectorate is liable to undermine the guarantees of independence of that authority and, if so, what the criteria are for assessing whether and for how long such an extension is permissible.
Furthermore, the referring court is uncertain about the role and obligations of the national courts where they must authorise the Inspectorate to access the personal data of judges, public prosecutors and investigating magistrates. More specifically, it is uncertain whether its activity of authorising the Inspectorate to access personal data covered by banking secrecy comes within the scope of the GDPR and, if so, what impact that would have on the review which it must carry out. In that regard, the referring court asks whether the review which it is required to carry out before authorising the Inspectorate’s access to the data at issue should be purely formal and be limited to ascertaining whether the persons in respect of whom the lifting of banking secrecy is sought have the status of persons who are under an obligation to submit a declaration, that is to say, whether they are judges, public prosecutors or investigating magistrates or persons who have a family relationship or another relationship with them, or whether it should rather ensure the security of the data at issue pursuant to the GDPR.
Findings of the Court
The Court considers, in the first place, that the second subparagraph of Article 19(1) TEU, read in the light of the right to effective judicial protection, (
3
) and more specifically the principle of judicial independence, precludes the practice of a Member State under which the members of a judicial body – who are elected by its parliament for terms of office of a specific duration and are competent to scrutinise the activity of judges, public prosecutors and investigating magistrates in the performance of their functions, to carry out checks in respect of their integrity and the absence of conflicts of interest on their part, as well as to propose to another judicial body the initiation of disciplinary proceedings with a view to the imposition of disciplinary penalties on those persons – continue to perform their functions beyond the legal duration of their term of office as laid down in the Constitution of that Member State, until that parliament elects new members. The foregoing applies where there is no express legal basis in national law containing clear and precise rules such as to circumscribe the performance of those functions and where it is not guaranteed that that extension is, in practice, limited in time.
In that regard, the Court recalls its settled case-law, according to which the requirement of judicial independence (
4
) means that the disciplinary regime in respect of judges must provide the necessary guarantees in order to prevent its being used as a system of political control of the content of judicial decisions. In that regard, rules which define both conduct amounting to disciplinary offences and the penalties actually applicable, provide for the involvement of an independent body in accordance with a procedure which fully safeguards the right to an effective judicial protection and the rights of the defence, (
5
) and lay down the possibility of bringing legal proceedings challenging the disciplinary bodies’ decisions constitute such guarantees.
It is essential that such bodies should act objectively and impartially in the performance of their duties and, to that end, be free from any external influence. That applies in particular to a judicial body which, like the Inspectorate, has broad powers to scrutinise the activity of judges, public prosecutors and investigating magistrates in the performance of their functions, to carry out checks in respect of their integrity and the absence of conflicts of interest on their part, as well as to propose to another judicial body (in the present case, the Bulgarian Supreme Judicial Council), following such checks, the initiation of disciplinary proceedings with a view to the imposition of disciplinary penalties on those persons. That is why all the rules governing the organisation and operation of such a body, including those governing the procedure for the appointment of its members, must be designed in such a way that there can be no reasonable doubt, in the minds of individuals, that the powers and functions of such a body will not be used as an instrument to exert pressure on, or political control over, judicial activity.
As regards the terms of offices of the members of the Inspectorate, which expired without the national parliament having elected new members, the Court points out that the national legislation does not appear to contain any rule as to whether they may continue to perform their functions beyond the duration of their term of office. While it is true that, in accordance with the case-law of the Constitutional Court, the members of the Inspectorate are to continue to perform their functions until new members are elected, it is also true that that national legislation does not contain any rules such as to circumscribe the performance of those functions extended in that manner or any legal provisions under which a potential deadlock in the process for the appointment of new members of the Inspectorate can be resolved. Thus, the extension of the terms of office of the former members of the Inspectorate appears, in practice, to be capable of continuing indefinitely.
In that context, it is for the Member States alone to decide whether or not to authorise the performance of the functions, beyond the legal duration of their term of office, of members of a judicial body which is competent to scrutinise the activity of judges, public prosecutors and investigating magistrates as well as to propose the initiation of disciplinary proceedings against those persons, in order to ensure continuity in the functioning of that body. However, when opting for such an extension of terms of office, those Member States are required to ensure that the performance of functions after the expiry of the term of office has an express legal basis in domestic law containing clear and precise rules such as to circumscribe that performance. They must also ensure that the conditions and detailed rules to which that performance is subject are designed in such a way as to enable the relevant members of the judicial body to act objectively and impartially in the performance of their duties. Therefore, although, in certain circumstances, the extension of the terms of office may prove necessary, in view of the importance of the functions performed by the judicial body concerned, it is only exceptionally and on condition that it is circumscribed by clear and precise rules excluding, in practice, the possibility that it may be indefinite in its duration, that that extension may be conceivable.
In the second place, the Court finds that disclosure, to a judicial body, of personal data that are protected by banking secrecy and that concern judges, public prosecutors and investigating magistrates as well as their family members, with a view to the verification of the declarations which are submitted by those judges, public prosecutors and investigating magistrates concerning their assets and those of their family members and which are published, constitutes processing of personal data that comes within the material scope of that regulation.
In reaching that conclusion, the Court notes that although the enactment of rules applicable to the status of judges, public prosecutors and investigating magistrates and to the performance of their functions comes within the competence of the Member States, the fact remains that data processing the objective of which is to scrutinise the integrity of judges, public prosecutors and investigating magistrates, and to ascertain whether there are any conflicts of interest on their part, is not covered by the exceptions to the material scope of the GDPR, (
6
) since it is neither an activity intended to safeguard national security nor an activity which can be classified in the same category. Disclosure to a judicial body of personal data that are protected by banking secrecy and that concern judges, public prosecutors and investigating magistrates as well as their family members constitutes the making available of those personal data to that body.
In the third place, the Court rules on the interpretation of the concepts of ‘controller’ and ‘supervisory authority’ within the meaning of the GDPR. (
7
)
As regards the concept of ‘controller’, the Court considers that that concept does not cover a court having jurisdiction to authorise, at the request of another judicial body, disclosure by a bank to that body of data relating to the bank accounts of judges, public prosecutors and investigating magistrates as well as of their family members.
Under national legislation, the Inspectorate is competent to carry out, inter alia, checks concerning the integrity and absence of conflicts of interest on the part of judges, public prosecutors and investigating magistrates, as well as to verify their asset declarations. To that end, that legislation provides the Inspectorate, first, with the possibility of requesting access to data relating to the bank accounts of judges, public prosecutors and investigating magistrates as well as of their family members, and second, with the power to request prior judicial authorisation in order to access those data, where the data subjects have not given consent to such access. The court considering a request for authorisation of disclosure thus takes action only at the request of the Inspectorate and confines itself to ascertaining whether the conditions of legality laid down by the national law are satisfied. Similarly, it is not that court but the Inspectorate that determines, on the basis of the applicable national rules, the persons whose data it is seeking to access for the purpose of exercising its powers and in relation to whom it submits a request for authorisation to that court. Thus, although the court is to examine whether and to what extent the conditions governing the legality of the processing are satisfied in a given case, it does not determine of its own accord either the purpose of the processing or the persons and data concerned. In those circumstances, it is not that court but the body competent to achieve the purposes pursued that is the controller.
As regards the concept of ‘supervisory authority’, a court having jurisdiction to authorise disclosure of personal data to another judicial body is not, according to the Court of Justice, covered by that concept where that court is not entrusted by the Member State in which it is situated with monitoring the application of the GDPR in order to protect, in particular, the fundamental rights and freedoms of natural persons in relation to the processing of their personal data.
In the last place, the Court considers that a court having jurisdiction to authorise disclosure of personal data to another judicial body is not required, where an action against a controller has not been brought before it, (
8
) to ensure of its own motion the protection of the persons whose data are concerned as regards compliance with the provisions of that regulation relating to the security of personal data. The same applies where that body has, in the past, infringed those provisions.
The Court of Justice states that national courts which are not seised of an action brought against a supervisory authority or an action brought against a controller (
9
) are not required, in the absence of rules expressly conferring supervisory powers on them, to ensure compliance with the substantive provisions of the GDPR. In order to ensure the effectiveness of such an action, the Member States must ensure that the practical arrangements for the exercise of the remedies provided by the GDPR effectively meet the requirements arising from the right to an effective remedy. (
10
) To do so, the controller, namely the competent judicial body to which access to personal data has been granted, must provide the persons whose data are concerned with the information listed in Article 14 of the GDPR, (
11
) since that information is necessary to enable those persons to exercise, where appropriate, their right to object to their personal data being processed (
12
) and their right of action where they suffer damage. (
13
)
(
1
)	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
(
2
)	Pursuant to Article 62(6)(12) of the Zakon za kreditnite institutsii (Law on credit institutions) (DV No 59 of 21 July 2006).
(
3
)	Article 47 of the Charter of Fundamental Rights of the European Union (‘the Charter’).
(
4
)	As follows from the second subparagraph of Article 19(1) TEU.
(
5
)	Articles 47 and 48 of the Charter.
(
6
)	In particular the exception laid down in Article 2(2)(a) of the GDPR, which provides that that regulation does not apply to the processing of personal data ‘in the course of an activity which falls outside the scope of Union law’. That exception is intended to exclude from the scope of that regulation the processing of personal data carried out by State authorities in the course of an activity which is intended to safeguard national security or of an activity which can be classified in the same category.
(
7
)	Within the meaning of Article 4(7) and Article 51(1) of the GDPR.
(
8
)	Under Article 79(1) of the GDPR.
(
9
)	Article 78(1) and Article 79(1) of the GDPR.
(
10
)	Article 47 of the Charter.
(
11
)	More specifically, in paragraphs 1 and 2 of that provision.
(
12
)	Article 21 of the GDPR.
(
13
)	Articles 79 and 82 of the GDPR.