Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
In Inspektor v Inspektorata kam Visshia sadeben savet (Case C-180/21, CJEU, 8 December 2022), the CJEU considered the question of whether and how law enforcement bodies may use personal data gathered in the context of criminal investigations to defend themselves in civil claims.
The facts were that the Bulgarian authorities had brought criminal proceedings in relation to ‘an incident which took place in a bar’. VS was initially identified as a victim in those proceedings, but subsequently also charged. He then brought a civil claim against the Public Prosecutor’s Office (the PPO) seeking damages for the harm arising from the excessive duration of the criminal proceedings. The PPO sought to make use of the information gathered about VS in the criminal proceedings to defend the civil claim. VS brought further claims alleging, first, that using his personal data collected as a victim to bring criminal charges against him was not consistent with the Law Enforcement Directive (LED), and second, that it infringed his data protection rights under the EU GDPR to use information gathered for law enforcement purposes for the ulterior purpose of defending his civil claim.
The Bulgarian court referred three questions to the CJEU. The first was whether the law enforcement purposes in the LED (which in UK law appear at s.29 Data Protection Act 2018) ‘are listed as aspects of a general objective’, such that information collected from an individual as a victim can be put to the different purpose of prosecuting that person. The second was whether the GDPR applies to the use of personal data for defending a civil claim in these circumstances. The third was whether the ‘legitimate interest’ gateway in Art 6(1)(f) GDPR applied in these circumstances.
On the first question, the CJEU held that the law enforcement purposes were ‘specific and distinct’ (§56), so that using personal data gathered about an individual who was a victim to prosecute the same individual does amount to processing it for a purpose other than which it was collected. But it also held that this was permissible under Article 4(2) LED (equivalent to s.36(2) DPA 2018) so long as that further processing was authorised by law and necessary and proportionate to that new purpose.
On the second and third questions, the CJEU held, unsurprisingly, that the GDPR does apply to the use of personal data to defend a civil claim, even when that information has been gathered for law enforcement processing. It held that legitimate interest was not the applicable gateway, but that where the claim was based on allegations of misconduct on part of a public official, defending the legal and financial interests of the State is ‘the performance of a task carried out in the public interest or in the exercise of official authority’, and so falls within Art 6(1)(e) GDPR. It might also, where there was a legal obligation to disclose or provide information, fall within Art 6(1)(c) GDPR. The CJEU emphasised that the other requirements of the GDPR – such as data minimisation – still needed to be complied with.
This judgment provides useful clarity both on re-purposing information collected within an investigation for law enforcement purposes, and on the lawful basis for law enforcement bodies using personal data from investigations to defend themselves against civil actions. While not a binding judgment in the UK, there is little doubt that it will be highly persuasive if and when the point is raised in proceedings here.
Related documents: judgment in Inspektor v Inspektorata kam Visshia sadeben savet
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
