CJEU Case C-312/24 / Opinion

CL v Prokuratura na Republika Bulgaria (Darashev)
Deciding body type
Court of Justice of the European Union
Deciding body
Opinion of Advocate General Szpunar
Type
Opinion
Decision date
04/09/2025
ECLI (European case law identifier)
ECLI:EU:C:2025:671

Title VI: Justice

Article 48 - Presumption of innocence and right of defence

Title VII: General provisions

Article 52 - Scope and interpretation

VIEW FULL CASE
  • CJEU Case C-312/24 / Opinion

    Key facts of the case:

    Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data in criminal matters – Directive (EU) 2016/680 – Processing of data collected in the course of a criminal investigation involving a police officer as a suspect – Storage of data in the personnel file – Regulation (EU) 2016/679 – Lawfulness of processing – Processing necessary for compliance with a legal obligation to which the controller is subject – Objective of public interest – Processing of personal data relating to criminal convictions and offences – Right to erasure (‘right to be forgotten’) – Equal treatment in employment and occupation – Directive 2000/78/EC

    Outcome of the case:

    Having regard to all the foregoing considerations, I propose that the Court answer the questions referred by the Sofiyski rayonen sad (Sofia District Court, Bulgaria) for a preliminary ruling as follows:

    1. Article 2(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC and Article 9(1) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA

      must be interpreted as meaning that the GDPR applies to the storing, by a public authority in the personnel file of one of its officials, of data regarding that official’s status as a suspect in a criminal investigation, where the data have been collected by an organisational unit within that public authority in the performance of its duties as a competent authority within the meaning of Directive 2016/680, provided that the storage of that data pursues purposes other than those set out in Article 1(1) of Directive 2016/680.

    2. Article 17(3) of Regulation 2016/679, read in conjunction with Article 6(1)(c) and Article 6(3) thereof

      must be interpreted as meaning that the storage, in a police officer’s personnel file, of personal data relating to a criminal investigation in which that officer was the subject of investigative measures, as a suspect, and which was discontinued, cannot be considered lawful for the purposes of compliance with a legal obligation to which the public authority that is his employer is subject under national law, as controller, merely on account of the nature of the duties which that officer is required to perform.

    3. Article 1 of Council Directive 2000/78/EC of 27 November 2000 establishing a general framework for equal treatment in employment and occupation

      must be interpreted as meaning that that directive does not apply to the denial of an official’s career advancement solely on the ground that the official was a suspect in a criminal investigation that was discontinued.

  • Paragraphs referring to EU Charter

    78. The GDPR does not, therefore, preclude the legal basis of the processing from being defined in a regulatory act adopted in accordance with national constitutional law. However, the leeway allowed cannot be interpreted as permitting arbitrary use of the so-called ‘opening clauses’, such as that in Article 6(3) of the GDPR, which allows the introduction into national law of a legal obligation as a ground for lawfulness of data processing. (30) Indeed, as is stated in the second sentence of recital 41 of the GDPR – reflecting the case-law on Article 52(1) of the Charter, (31) in the light of which Article 6(3) of the GDPR is to be interpreted (32) – the legal basis for the processing must be clear and precise and its application must be foreseeable to persons subject to it

    ...

    89. That, however, would be tantamount to a presumption of guilt, at odds with the principle of the presumption of innocence enshrined in Article 48(1) of the Charter, which corresponds (34) to Article 6(2) of the ECHR. I would emphasise that, according to the case-law of the ECtHR, that principle does not cease to apply upon the closure of criminal proceedings, but aims to protect individuals who have been acquitted of a criminal charge, or in respect of whom criminal proceedings have been discontinued, from being treated in subsequent proceedings by public authorities as though they were in fact guilty of the offence with which they were charged. (35) That interpretation therefore militates in favour of re-establishing, in the event that an investigation is discontinued, the status quo ante in the personnel file.

  • Paragraphs referring to EU Charter (original language)