Abstract
In the context of criminal law enforcement and cooperation, the fundamental right to the protection of personal data is not complemented by the General Data Protection Regulation (Regulation (EU) 2016/679 – ‘GDPR’), but by the national law implementing Directive (EU) 2016/680 (‘LED’) together with other pieces of EU legislation. The preliminary ruling of the Court of Justice of the European Union in Case C-180/21 Inspektor (Purposes of the Processing of Personal Data – Criminal Investigations) delivered by the Fifth Chamber on 8 December 2022 is the first judgment in which the Court considered the LED beyond its scope of application. It represents an important milestone for data protection law in the area of criminal law enforcement. This paper will provide an analysis of the main findings of the judgment, with particular focus on the concept of “further processing” and a first reflection on the consequences it may have on the work of competent authorities such as public prosecutors.
Keywords
Introduction
In the context of criminal law enforcement and cooperation, the fundamental right to the protection of personal data 1 is not complemented by the General Data Protection Regulation (Regulation (EU) 2016/679 – ‘GDPR’), 2 but by the national law implementing Directive (EU) 2016/680 (‘LED’) 3 together with other pieces of EU legislation. 4 The preliminary ruling of the Court of Justice of the European Union (‘the Court’ or ‘the Court of Justice’) in Case C-180/21 Inspektor (Purposes of the Processing of Personal Data – Criminal Investigations) given by the Fifth Chamber on 8 December 2022 5 is the first judgment in which the Court considered the LED beyond its scope of application. 6 As already noted in earlier academic commentary, 7 this is the first judgment of the Court with ramifications for the interpretation of the substantial provisions of the LED and its relationship with the GDPR. It is an important milestone for data protection law in the area of criminal law enforcement. 8 This paper will provide an analysis of the main findings of the judgment, with particular focus on the concept of “further processing” and a first reflection on the consequences it may have on the work of competent authorities such as public prosecutors. 9
The issue in the main proceedings was that personal data collected at a time when the data subject was considered to be a victim of a criminal offence were used some five years later to prosecute him for a criminal offence. The data subject commenced civil proceedings against the Public Prosecutor’s Office, seeking damages for the excessive duration of the pre-trial proceedings. In the civil proceedings, for the purpose of its defence, the Public Prosecutor’s Office used personal data that had been used for the purpose of prosecution. The data subject unsuccessfully contested the legality of the use of his personal data in the context of both subsequent activities of the Public Prosecutor’s Office before the national data protection supervisory authority competent under the LED. The data subject appealed the decision of that supervisory authority before the referring court.
The Court of Justice clarified the concept of “further processing” by competent authorities under the LED, and gave important indications in assessing its legality requirements in order for the referring court to make a determination. The principle of purpose limitation implies that the processing of personal data in the course of an “investigation” is carried out pursuant to a purpose separate and distinct from that of “prosecution”, which requires a re-evaluation of necessity and proportionality of processing. The other relevant takeaway regards the lawful basis for using personal data originally processed in criminal proceedings by the public prosecution in subsequent civil proceedings for the purposes of defending the Public Prosecutor’s Office in the context of an action for damages before the court with jurisdiction. The Court indicated that the legal basis is the performance of a task in the public interest or the exercise of an official authority vested in that authority tasked with defending the Public Prosecutor’s Office.
Compatible further processing and the LED
Before delving into the findings of the judgment, it is useful to recapitulate the concept of further processing of personal data. Under the GDPR, processing of personal data for purposes other than those for which the personal data were originally collected is called “further processing”. 10 The compatibility of further processing is a requirement established by the principle of purpose limitation in Article 5(1)(b) GDPR and, importantly, is related to the reasonable expectations of the data subjects. 11 Further processing which is “compatible” with the original purposes does not require a legal basis separate from the original legal basis for the collection of the personal data. 12 Article 5(1)(b) establishes a (non-rebuttable) presumption of compatibility when further processing is for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes. 13 Article 6(4) GDPR establishes a (non-rebuttable) presumption of compatibility of further processing with any of the purposes for which personal data were originally collected when such further processing is based on consent given by the data subject, or where it is based on EU or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in Article 23(1) GDPR. If the presumption is not applicable, further processing is only allowed if the controller proves compatibility with the original purpose, in accordance with the requirements of Article 6(4)(a) to (e) GDPR.
An example of further processing regulated under Article 6(4) GDPR –which is also relevant in the context of law enforcement– is that of controllers who originally collect and process personal data, such as customer data, under the GDPR. 14 They may thereafter be required to disclose such personal data to competent law enforcement authorities, e.g., on the basis of national law safeguarding the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and prevention of threats to public security (Article 23(1)(d) GDPR). When competent authorities “further process” personal data for purposes different from the law enforcement-related purposes for which those data were originally collected, the provisions of the LED become applicable. In contrast to the GDPR, the LED explicitly envisages the possibility of further processing by a different controller, i.e. by a different competent authority. 15
The requirement of “compatibility” of further processing with the original purposes is outlined in Article 4(1)(b) LED, which establishes the purpose limitation principle, as is the case with Article 5(1)(b) GDPR. As the purposes for which personal data may be processed by competent authorities are laid down in law and there is no room for any other purpose for which those data may be processed by competent authorities, the LED regulates only further processing for other law enforcement-related purposes (Article 4(2) LED) and, in principle, prohibits any other further processing unless it is authorised by EU or Member State law (Article 9(1) LED). Advocate General Campos Sánchez-Bordona defined further processing in the LED as an ad intra reallocation of the personal data, 16 when personal data originally collected for a purpose listed under Article 1(1) LED are subsequently processed under another purpose also listed under Article 1(1) LED. It is apparent that, if the requirements laid down in Article 4(2) LED are met, which refer to the already applicable principles of necessity and proportionality, and do not refer to the reasonable expectations of the data subjects, the instance of further processing regulated by Article 4(2) LED is presumed compatible with the original purpose, as the competent authorities do not have to demonstrate satisfaction of compatibility requirements such as those laid down in Article 6(4) GDPR). The concepts of “necessity and proportionality” in Article 4(2) LED, therefore, will play a crucial role in authorising further processing.
The main proceedings in which the referring court requested the preliminary ruling of the Court of Justice involved both further processing pursuant to Article 4(2) LED and further processing pursuant to Article 9(1) LED, in derogation from the prohibition of further processing for non-law enforcement purposes. In the first instance of further processing at issue, the purpose changed from that of “detection and investigation” of criminal offences to the purpose of “prosecution” of criminal offences, an instance of “ad intra reallocation of personal data” regulated by Article 4(2) LED. In the other instance of further processing at issue, the purpose of “prosecution” of criminal offences in criminal proceedings changed to the “defence of the Public Prosecutor’s Office” in civil proceedings, thus constituting an instance of further processing which, in principle, is prohibited under Article 9(1) of the LED. As will soon become apparent, the Court adopted a literal interpretation of the concept of “purposes of processing” under the LED, with important consequences for the notion of “further processing”, and the consequent requirement to assess, inter alia, the necessity and proportionality of the further processing in order to respect the purpose limitation principle.
Background to the main proceedings
In 2013, the District Public Prosecutor’s Office in Petrich, Bulgaria, opened pre-trial proceedings against an unknown person for the commission of a criminal offence, in the context of an incident which took place in a bar 17 (‘the 2013 pre-trial proceedings). VS took part in those proceedings as a victim of that criminal offence. 18 The District Public Prosecutor's Office ordered the criminal proceedings to be dismissed on the ground of time-barring 19 but in 2016, following a number of complaints concerning, inter alia, VS, the District Public Prosecutor’s Office compiled a number of files containing information relating to VS, but did not open any pre-trial proceedings in the absence of evidence that a criminal offence had been committed. 20 In 2018, in the context of the 2013 pre-trial proceedings, the public prosecutor made formal accusations in respect of all the persons who took part in the incident at issue, including VS. 21
VS commenced civil proceedings before the Blagoevgrad Regional Court, Bulgaria, against the Public Prosecutor’s Office seeking damages for the harm allegedly resulting from the excessive duration of 2013 pre-trial proceedings. At a hearing in 2018, for the purposes of defending themselves, a public prosecutor of the District Public Prosecutor’s Office, representing the Public Prosecutor’s Office, obtained a court order that certified copies of the files compiled by the District Public Prosecutor's Office in 2016 be produced in order to demonstrate that the health problems relied on by VS were not, as he claimed, attributable to the 2013 pre-trial proceedings, but had been caused by the checks carried out by the police and by the District Public Prosecutor’s Office in connection with those files. 22
In 2020, the Bulgarian data protection supervisory authority in law enforcement and criminal justice, the Inspectorate at the Supreme Judicial Council (‘Inspektor’), rejected the complaint brought by VS claiming that the Public Prosecutor’s Office had unlawfully used his personal data, which had been collected when he was considered to be a victim of a criminal offence, in order to prosecute him in the same proceedings and in respect of the same acts, and that the Public Prosecutor’s Office acted unlawfully as regards the processing of personal data in the context of his action for damages against the Public Prosecutor’s Office. VS brought an action against the decision of the Inspector before the referring court, i.e. the Blagoevgrad Administrative Court, Bulgaria. 23
The first question: On further processing under Article 4(2) LED
The Court of Justice, in essence, was asked to interpret Article 1(1) LED, read in conjunction with Article 4(2) and Article 6 thereof, in order to determine “whether the processing of personal data serves a purpose other than that for which those data were collected”, i.e. whether it is further processing and when it is permitted, “where such data were collected for the purposes of the detection and investigation of a criminal offence and the data subject was, at the time of that collection, considered to be a victim, and processing is carried out for the purpose of prosecuting the data subject, following the conclusion of the criminal investigation at issue.” 24 In the first two subsections below, I will single out the reasoning of the Court, and provide my analysis in the following subsection.
Investigation and prosecution of criminal offences constitute different purposes of processing
The Court held that if personal data are collected and processed for the purposes of the detection and investigation of a criminal offence, and following the conclusion of the investigation, those personal data are processed for the purpose of criminal prosecution, the latter processing “serves a purpose other than that for which those data were collected.” 25 In other words, the processing of personal data originally collected for detecting and investigating criminal offences, but for the new purpose of prosecuting criminal offences, constitutes further processing. The Court came to this conclusion regardless of the categorisation of the data subject to whom the personal data processed related as a victim and a suspect thereafter, as in the case at issue. The categorisation obligation, pursuant to Article 6 LED, “is not relevant for the purpose of determining whether the processing of personal data serves a purpose other than that for which those data were collected”. 26
The Court’s literal interpretation of Article 1(1) LED, read in conjunction with 27 and in the context of 28 Article 4(2) and Article 6 LED, was corroborated by the Court’s teleological interpretation 29 and by the consideration of the origin of the provisions at issue. 30 Article 1(1) LED “expressly distinguishes between different categories of processing activities” whose different purposes “correspond to ‘prevention’, ‘detection’, ‘investigation’ and ‘prosecution’ of criminal offences and ‘the execution of criminal penalties’, including the ‘safeguarding’ against ‘threats to public security’ and the ‘prevention’ of such threats.” 31 The terms listed in Article 1(1) LED therefore concern “several separate purposes”. 32 This finding was in contrast to the Opinion of the Advocate General, who distinguished three purposes corresponding to three main phases (prevention, investigation in a broad sense, including prosecution, and execution). 33 The Court noted that the EU legislature on the one hand “sought to adopt rules corresponding to the specific features which characterise the activities carried out by competent authorities”, but at the same time “taking account of the fact that they constitute distinct activities serving purposes specific to them”. 34
Lawfulness of further processing under Article 4(2) LED
The Court held, in essence, that when data collected and processed for one of the purposes listed in Article 1(1) LED are to be processed for another purpose, the further processing is permitted pursuant to Article 4(2) LED, provided it meets the conditions laid down therein. First, the purpose of the further processing must be “among those set out in Article 1(1) LED.” 35 Second, “the controller must be authorised to process such personal data for such a purpose in accordance with EU or Member State law.” 36 Third, further processing “must be necessary and proportionate to that other purpose.” 37 The assessment of compliance with the requirements of Article 4(2) LED by the same controller which collected and processed the personal data for the original purpose or by another controller 38 “must be carried out having regard to each of the purposes referred to in Article 1(1) LED as specific and distinct.” 39 The Court thereafter gave some helpful insights in the assessment of the necessity and proportionality.
The Court accepted, in principle, that the necessity of further processing arises “where a criminal offence has been identified” in the context of processing for ‘detection’ and ‘investigation’ purposes, “and consequently calls for law enforcement action.” 40 However, personal data necessary for the purposes of crime ‘detection’ and ‘investigation’ where “competent authorities are required to gather any data that are potentially relevant to the determination of the acts constituting the criminal offence at issue, at a stage where those acts have not yet been established”, 41 “will not be systematically necessary for the purposes of crime ‘prosecution’”, 42 where the aim is “to establish that the acts attributed to the accused persons have sufficient probative value and that the classification of those acts under criminal law is accurate, in order to enable the court having jurisdiction to give a ruling.” 43 In particular, the Court held that “the authority responsible for that prosecution must be in a position to rely on the data collected during that investigation as evidence of the acts constituting the offence, in particular those relating to the persons involved therein, provided that those data are necessary to identify those persons and to establish their involvement.” 44
The Court also considered the extent to which the further processing interfered with the rights of the data subjects, which is specifically relevant to the assessment of the proportionality requirement, 45 and noted that “the consequences of further processing for the data subjects might be substantially different as regards, in particular, the degree of interference with their right to the protection of their personal data and the effects on their legal situation in the criminal proceedings”. 46 Also of relevance is the consideration that further processing needs not to be “limited to the processing in connection with the same criminal offence as that warranting the collection of such data” as stated in recital 27 LED. This is because competent authorities need to develop “an understanding of criminal activities and of making links between different criminal offences detected”. 47
Takeaway No. 1: Demonstrating necessity and proportionality under Art 4(2)(b) LED
When the purpose of processing personal data under those listed in Article 1(1) changes from “detection and investigation” to “prosecution”, and the data were collected and originally processed for “detection and investigation” purposes only, the further processing for “prosecution” must be “necessary and proportionate to that other purpose in accordance with Union or Member State law”. Given that every purpose must be considered as specific and separate, competent authorities need to re-assess proportionality and necessity of further processing “in accordance with Union or Member State law” not only in case of change of purpose from “detection and investigation” to “prosecution” but also when the purpose changes from “prosecution” to “execution”, and from “prevention” to “detection and investigation” or even when the original purpose of “detection” changes into that of “investigation”, when the initial processing involved “detection” purposes only. 48
There seems to be little leeway for competent authorities to argue that personal data collected in the course of investigations are, in fact, also collected for the purposes of prosecution, thus rendering each purpose mutually exclusive. The Advocate General, instead suggested a sensible interpretation of Article 1(1) LED with the practicalities of law enforcement, the recognition of three phases, with the investigation encompassing prosecution. 49 The Court ruled that out when it confirmed that Article 1(1) LED expressly distinguishes between different categories of processing activities, each corresponding to different purposes of processing – and if the purpose changes, a re-assessment of necessity and proportionality must also be properly documented, in order to demonstrate compliance with data protection law, in accordance with the principle of accountability (Article 4(4) LED).
It must be underlined that pursuant to Article 4(2)(b) LED, further processing must be necessary and proportionate with respect to the new purpose in accordance with Union or Member State law. Necessity and proportionality are concepts not unknown to Criminal Procedure. 50 When considering the assessment of necessity and proportionality, the Court referred to concepts such as the “relevance to the determination of the acts constituting the criminal offence” and the “sufficient probative value” 51 of the personal data, which find their technical meaning in national criminal procedural law. Contrary to the concepts of “criminal offence” under Article 10 GDPR 52 and “competent authority” under Article 3(7) LED, 53 “probative value” and “relevance to determine criminal acts” do not require an autonomous and uniform interpretation in the EU, given the yet unharmonised landscape of criminal procedural law. However, if national criminal procedural law has not envisaged a necessity and proportionality re-assessment of personal data collected for one purpose and used for another of the purposes listed under Article 1(1) LED, such re-assessment will have to be conducted in accordance with the implementation of the LED at the national level, i.e. in accordance with national data protection law. 54 Re-assessing the necessity and proportionality of further processing every time the purpose of processing changes should not, therefore, be excessively burdensome to demonstrate, if the re-assessment is already performed “in accordance with Union or Member State law”, in other words, in the normal course of the exercise of their investigative and prosecutorial functions, as mandated by relevant national criminal procedural law.
In the context of the re-assessment of the proportionality requirement, however, the fundamental right to data protection will require specific consideration. Competent authorities will have to consider “the consequences of the processing of personal data for the data subjects”, “in particular, the degree of interference with the right to the protection of those data” 55 which may be “substantially different” in the case of processing for the purposes of detection and investigation, as opposed to the purposes of prosecution, and therefore differently affect the legality of further processing. This may greatly affect the discretion of those competent authorities vested with prosecutorial functions. It may also affect their independence, as the findings on proportionality with respect to the data protection rights may be open to challenge before the data protection supervisory authorities established under Article 41 LED. However, Article 4(2)(b) LED requires the re-assessment of proportionality to be “in accordance with national law and EU law”, which may include, for example, safeguards to the discretion and independence of the prosecutorial function. Similarly, with reference to the discretion of court in the exercise of their judicial capacity, the Court of Justice recently held that a court is bound to observe the principle of data minimisation stemming from the GDPR when deciding on whether to make an order for disclosure in civil proceedings. 56 Courts, however, are not subject to the supervision of “ordinary” national data protection supervisory authorities.
The second question: On further processing under Article 9 LED
The Court, in essence, was asked to interpret Article 3(8) and Article 9(1) and (2) of the LED and Article 2(1) and (2) of the GDPR in order to determine whether the GDPR is applicable to the processing of personal data by the public prosecutor’s office of a Member State for the purpose of exercising its rights of defence in an action for damages against the State, where it informs the court having jurisdiction of the existence of files concerning a natural person who is a party to that action, opened for the purposes set out in Article 1(1) of the LED, and transmits those files to that court and, second, if that question were to be answered in the affirmative, what the lawful basis of such processing activity would be, in accordance with the GDPR. 57 In the first two subsections below, I will single out the reasoning of the Court, and provide my analysis in the subsection thereafter.
Defence of the public prosecutor’s office in civil proceedings is governed by GDPR
Having rejected the argumentation against the admissibility of the second question referred, 58 the Court of Justice held that the GDPR is applicable to the processing of personal data by the Public Prosecutor’s Office for the purpose of exercising its rights of defence in an action for damages against the State. 59 Importantly, the Court’s findings were regardless of the applicability of Article 9(1) or (2) LED , 60 although the Court confirmed that the processing activity at issue cannot be considered as further processing for any of the purposes of Article 1(1) LED. 61 Consequently, such processing activity is an instance of further processing which is, in principle, prohibited under Article 9(1) LED. The Court deployed its consolidated approach when assessing the applicability of the GDPR, 62 and verified the subsistence of each of the elements of GDPR’s material scope. 63
Firstly, the Court held that information concerning a natural person collected and processed by the Public Prosecutor’s Office for the purposes of Article 1(1) LED constitutes processing of personal data. This is because “both in terms of its content and its purpose and effect, that information is linked to a particular person, who is identifiable both by the party that disclosed it and by the court” 64 when the defendant in civil proceedings informs the court, even succinctly, in its written pleadings or at the hearing, of the opening of files in criminal matters concerning the natural person who had brought the civil proceedings. 65 That activity “involves, at the very least, the ‘use’ and ‘disclosure by transmission’” and therefore constitutes ‘processing of personal data’ within the meaning of the GDPR. 66
Being satisfied that the activity at issue fell under the GDPR’s definition of ‘processing of personal data’, the Court went on to confirm its broad interpretation of the scope of application of the GDPR 67 and the consequent strict interpretation of the exceptions listed in Article 2(2) thereof. 68 The Court excluded the applicability of the exception under Article 2(2)(d) GDPR, as the aim of the State’s defence in an action for damages against the State for alleged misconduct of the Public Prosecutor’s Office in criminal proceedings “is not to perform, as such, that Public Prosecutor’s Office’s tasks for the purposes set out in Article 1(1)”. 69 The Court also excluded the applicability of the exception under Article 2(2)(a) of the GDPR as the State’s defence “does not seek to safeguard national security; nor can it be classified in that same category of activities” 70 , which are the sole exclusions from the scope of the GDPR, according to the Court’s case-law on that exception. 71
As regards the third and final element of the material scope of the GDPR, namely the existence of a ‘controller’ within the meaning of Article 4(7) thereof, the Court applied by analogy its consolidated case-law on Directive 95/46/EC 72 aimed at ensuring effective and complete protection of the rights of the data subjects. 73 Also within the meaning of Article 3(8) LED, the Public Prosecutor’s Office is a ‘controller’, “in that, alone or jointly with others, it determines the purposes and means of that processing”. 74 It is the Public Prosecutor’s Office, “as a party to the proceedings, which informs the court having jurisdiction of the existence of files opened in criminal matters concerning the other party and which transmits those files to it. Its status as ‘controller’ … is independent of the extent of its involvement and its level of responsibility, which may be different from those of the court having jurisdiction, for which it is to authorise or order such processing”. 75
Lawful basis of processing in the defence of public prosecutor’s office in civil proceedings
As the defence of the Public Prosecutor’s Office in civil proceedings is governed by the GDPR, the Court went on to determine the lawful basis of such processing according to Article 6 GDPR. 76 It held that the defence, in principle, can qualify as processing for the purposes of the performance of a task in the public interest or the exercise of an official authority within the scope of point (e) of the first subparagraph of Article 6(1)GDPR. 77 The defence of the legal and financial interests of the State in an action for damages “preserves the legal certainty of the acts carried out and decisions adopted in the public interest that are being called into question by the applicant” 78 , and prevents “the performance of the tasks carried out in the public interest that are being called into question in the action for damages from being hindered by the prospect of actions for damages, where those tasks are liable to harm the interests of individuals”. 79 On the other hand, the Court held that it is irrelevant that the Public Prosecutor’s Office “is, in its capacity as defendant, on an equal footing with the other parties, as is the case in the performance of its tasks in criminal matters”. 80
The further processing must be necessary “for the purpose of defending the legal and financial interests of the State which falls to the Public Prosecutor’s office in those proceedings”, in accordance with Article 6(3) GDPR, and comply with all the other applicable requirements provided for by the GDPR. 81 The Court of Justice, however, gave no hints to the referring court on how to interpret the necessity requirement. However, in the very last paragraph of its analysis, the Court indicated that the further processing must satisfy in particular the principle of ‘data minimisation’ referred to in Article 5(1)(c) GDPR, “which gives expression to the principle of proportionality”. 82 Further processing must be carried out “in compliance with appropriate safeguards, in particular the possibility of effectively submitting comments on the information and evidence provided in that connection by the Public Prosecutor’s Office, but also, in accordance with Article 21(1) of the GDPR, of objecting to the communication of that information and evidence to the court having jurisdiction, subject to the restrictions on that right of objection provided for by national legislation, in accordance with Article 23(1) of that regulation.” 83
The Court mentioned that the processing at issue could also be based on point (c) of the first subparagraph of Article 6(1) GDPR where, pursuant to the applicable national law, the Public Prosecutor’s Office is required to comply with the request of the court itself for transmission of the files, 84 but that national law must “lay down, first, the basis for processing and, second, the purposes of that processing”. 85 The Court did not mention, however, that the defence of the Public Prosecutor’s Office in civil proceedings could also be carried out by the Public Prosecutor’s Office pursuant to Article 6(4) GDPR in the exercise of the right to defend itself. 86 Processing of personal data in order for State authorities to defend the lawfulness of their actions is amongst the objectives of general public interest mentioned by Article 23(1)(e) GDPR, and may have been implemented by national law provisions which must be necessary and proportionate to achieve that objective. 87
Takeaway No. 2: The lawfulness principle requires compliance with Article 9 LED
The Court’s findings in respect of the use of personal data originally processed for the criminal law purpose of ‘prosecution’ by the Public Prosecutor’s Office for the new purpose of defending the actions of the Public Prosecutor’s Office in civil proceedings against alleged misconduct is relevant particularly for the authority vested with the task of such defence (‘the vested authority’). The lawful basis of the further processing is, according to the Court, pursuant to Article 6(1) first subparagraph, letter e) GDPR, the necessity of performing a task in the public interest vested in the authority designated to defend the actions of the Public Prosecutor of a Member State. However, when processing of personal data originally processed for certain purposes is carried out for the purpose of defence in judicial proceedings, the correct basis for the further processing should be Article 6(4) GDPR. The necessity and proportionality assessment will concern the legislative provision safeguarding the objective of general public interest, not the further processing itself. The further processing would therefore be permitted in principle for such objectives, and necessity and proportionality would be more correctly assessed throughout the defence activity.
Further processing must comply with all the principles relating to processing of personal data under the GDPR. 88 The vested authority –in the case at issue, the Public Prosecutor’s Office itself– will have to demonstrate the necessity of further processing under Article 6(3) GDPR. Existing case-law of the Court will require to be adapted, however, to the particular objective of the further processing, i.e. the defence in civil proceedings, where necessity may vary in accordance, for example, to new elements that may arise in the course of proceedings. As regards proportionality, the safeguards to the right of the other party to a fair trial may also achieve proportionality of further processing. The Court stated that to provide appropriate safeguards would require the possibility of effectively submitting comments on the information and evidence provided, 89 and the possibility of objecting to the communication of information and evidence to the court having jurisdiction, pursuant to Article 21(1) GDPR. 90 This may be a challenge, however, when the data subjects do not coincide with any party to the proceedings.
The Court found that the applicability of Article 9(1) LED is not relevant for assessing the material scope of the GDPR and determining the lawful basis for processing under Article 6(1) thereof. However, competent authorities such as the Public Prosecutor’s Office of a Member State providing vested authorities with personal data collected for the purposes of their prosecutorial activities for the different purpose of defending their actions in civil proceedings are, in fact, conducting further processing of personal data collected in the context of criminal law enforcement which, in general, is prohibited under Article 9(1) LED. Competent authorities will have ensure that the prohibition does not apply, in accordance with Article 9(2)to 4) LED itself. 91 The transmission must be authorised under Union or Member State law. Competent authorities would therefore benefit from an assessment of the status of national law related to the tasks and powers vested in them for purposes other than those listed under Article 1(1) LED, but also the national law on information related to criminal law enforcement more generally.
Conclusion
This judgment outlines the importance of differentiating the general data protection regime when facing the peculiarities of law enforcement in general, and corroborates the decision of the EU legislator to enact a separate data protection regime in the area of criminal law enforcement in particular. In a data processing environment such as that of criminal law enforcement, where the purposes of processing are determined by Article 1(1) LED, and by the national law implementing it, the Court has clarified that “prevention”, “detection”, “investigation”, “prosecution” and “execution of criminal penalties” must be considered as separate and distinct processing activities when considering if there has been a change of purpose, in accordance with the objectives of the EU legislator when it enacted the LED. The re-assessment of the necessity and proportionality of processing that is required under data protection law in the event of a change of purpose can be demonstrated by competent authorities in the normal course of business where the respective national criminal procedural law framework embeds a re-assessment of necessity and proportionality in criminal procedural law. The requirement to consider the interference of the further processing with the fundamental right to data protection at the moment of re-assessment of proportionality will not alter the discretion of the prosecutorial and investigative functions of competent authorities because the re-assessment must be “in accordance with Union or Member State law” (Article 4(2)(b) LED).
On a more practical level, in order to comply with the findings of the judgment of the Court and apply all the relevant provisions of data protection law in their daily practice, in particular the principle of purpose limitation, competent authorities may benefit from a thorough mapping of the data flow in their investigative and prosecutorial activities, which would enable them to individuate when the purpose of an activity changes to another under the respectively applicable national criminal procedural laws. It is at that point that a re-assessment of the necessity and proportionality of the processing will be required (also) under Article 4(2) LED. 92 If the mapping of the data flow outlines that personal data collected and used in investigations and prosecutions are provided to the authority vested with the task to defend competent authorities in civil proceedings, thus, for purposes other than those outlined in Article 1(1) LED, competent authorities must ensure that they are authorised to provide the personal data to the vested authority pursuant to national or EU law under Article 9(1) LED. The necessity and proportionality test pursuant to the GDPR with respect of using such personal data will be for the vested authority to demonstrate. 93
Footnotes
Acknowledgements
I would like to express my gratitude to Steven Ryder, Data Protection Officer of the European Public Prosecutor’s Office, and the anonymous reviewer(s) for their comments and suggestions on earlier drafts. The views expressed are entirely and solely my own and do not necessarily reflect the official opinion of the European Public Prosecutor’s Office.
Declaration of Conflicting Interests
The author declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The author received no financial support for the research, authorship, and/or publication of this article.
