CJEU Case C-312/24 / Judgment

CL v Prokuratura na Republika Bulgaria (Darashev)
Deciding body type
Court of Justice of the European Union
Deciding body
Court (Fifth Chamber)
Type
Decision
Decision date
04/06/2026
ECLI (European case law identifier)
ECLI:EU:C:2026:449

Title II: Freedoms

Article 7 - Respect for private and family life

Title II: Freedoms

Article 8 - Protection of personal data

Title VII: General provisions

Article 52 - Scope and interpretation

VIEW FULL CASE
  • CJEU Case C-312/24 / Judgment

    Key facts of the case:

    Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data in criminal matters – Regulation (EU) 2016/679 – Directive (EU) 2016/680 – Scope – Processing of data collected in the course of an investigation against a police officer as a person suspected of a criminal offence – Recording of data relating to this investigation in the police officer’s personnel file – Lawfulness of processing – Point (c) of the first subparagraph of Article 6(1) and Article 6(3) of that regulation – Processing necessary for compliance with a legal obligation – Legal basis for the processing – Article 17 of that regulation – Right to erasure.

    Outcome of the case:

    On those grounds, the Court (Fifth Chamber) hereby rules:

    1. Article 2(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and Article 9(1) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA

      must be interpreted as meaning that that regulation applies to the activity carried out by the directorate of a public authority, consisting in storing in the personnel file of one of its officers data relating to his status as a suspect in a criminal investigation. It is irrelevant in that regard that that directorate obtained those data through another directorate belonging to the same public authority, the latter directorate being empowered to conduct that type of investigation.

    2. Article 17(3)(b) of Regulation 2016/679, read in conjunction with point (c) of the first subparagraph of Article 6(1)and Article 6(3) thereof, and in the light of Article 52(1) of the Charter of Fundamental Rights of the European Union,

      must be interpreted as meaning that the storage, in the personnel file of a police officer, for the purposes of the management of his career and the monitoring of compliance, by that staff member, with the rules inherent in his or her duties, of personal data relating to his or her status as a suspect in a suspended criminal investigation, where that officer has not been accused of or faced criminal charges for the offence concerned, may be regarded as justified for the purposes of compliance with a legal obligation to which the public authority, the employer of that officer, is subject on the basis of national law, provided that that legal basis is clear and precise, that its application is foreseeable for data subjects and that that obligation meets an objective of public interest and is proportionate to that objective.

    3. Article 1 of Council Directive 2000/78/EC of 27 November 2000 establishing a general framework for equal treatment in employment and occupation

      must be interpreted as meaning that that directive is not applicable where a public authority, one directorate of which is responsible for conducting criminal investigations concerning officers employed by that authority, refuses, in its capacity as employer, to promote one of its officers on the sole ground that he or she had the status of suspect in such an investigation that was ultimately suspended, where that officer has not been accused of or faced criminal charges for the offence concerned

  • Paragraphs referring to EU Charter

    82. The Court has already held that, assuming that the processing of the personal data satisfies the ground for lawfulness laid down in point (c) of the first subparagraph of Article 6(1) of the GDPR, that regulation, and in particular the second subparagraph of Article 6(3) thereof, expressly lays down the requirement to strike a balance between, on the one hand, the fundamental rights to respect for private life and the protection of personal data, enshrined in Articles 7 and 8 of the Charter, and, on the other hand, the objectives legitimately pursued by EU law or the law of the Member States forming the basis of the legal obligation in respect of which processing is necessary to ensure compliance therewith (see, to that effect, judgment of 4 October 2024, Agentsia po vpisvaniyata, C‑200/23, EU:C:2024:827, paragraph 124 and the case-law cited).

    83. In that context, it should be recalled that Article 52(1) of the Charter accepts that limitations may be imposed on the exercise of rights such as those set forth in Articles 7 and 8 of the Charter, as long as the limitations are provided for by law, respect the essence of those rights and freedoms and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others (judgment of 24 September 2019, GC and Others (De-referencing of sensitive data), C‑136/17, EU:C:2019:773, paragraph 58 and the case-law cited).

    84. In those circumstances and having regard to the case-law set out in paragraph 64 above, it must be held that, by its fifth and sixth questions, the referring court asks, in essence, whether Article 17(3)(b) of the GDPR, read in conjunction with point (c) of the first subparagraph of Article 6(1) and Article 6(3) of that regulation and in the light of Article 52(1) of the Charter, must be interpreted as meaning that storage, in the personnel file of a police officer, for the purposes of managing his or her career and checking that that officer complies with the rules inherent in his or her duties, of personal data relating to his or her status as a suspect in the context of a suspended criminal investigation, where that officer has not been accused of or faced criminal charges for the offence concerned, may be regarded as justified for the purposes of compliance with a legal obligation to which the public authority, the employer of that police officer, is subject on the basis of national law.

    85. It should be noted at the outset that, under Article 1(2) of the GDPR, read in conjunction with recitals 4 and 10, that regulation has the objective in particular of ensuring a high level of protection of the fundamental rights and freedoms of natural persons with respect to the processing of personal data; that right is also recognised in Article 8 of the Charter and is closely connected to the right to respect for private life, enshrined in Article 7 of the Charter (see, to that effect, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20, EU:C:2022:601, paragraph 61).

    ...

    109. In the light of the foregoing, the answer to the fifth and sixth questions is that Article 17(3)(b) of the GDPR, read in conjunction with point (c) of the first subparagraph of Article 6(1) and Article 6(3) of that regulation and in the light of Article 52(1) of the Charter, must be interpreted as meaning that the storage, in the personnel file of a police officer, for the purposes of the management of his career and the monitoring of compliance, by that staff member, with the rules inherent in his or her duties, of personal data relating to his or her status as a suspect in a suspended criminal investigation, where that officer has not been accused of or faced criminal charges for the offence concerned, may be regarded as justified for the purposes of compliance with a legal obligation to which the public authority, the employer of that officer, is subject on the basis of national law, provided that that legal basis is clear and precise, that its application is foreseeable for data subjects and that that obligation meets an objective of public interest and is proportionate to that objective.

  • Paragraphs referring to EU Charter (original language)