Official Journal of the European Union

C series

—

C/2025/3239

24.6.2025

(Joined Cases C-313/23, C-316/23 and C-332/23,

Inspektorat kam Visshia sadeben savet)

(References for a preliminary ruling - Rule of law - Judicial independence - Second subparagraph of Article 19(1) TEU - Effective legal protection in the fields covered by Union law - Judicial body competent to propose the initiation of disciplinary proceedings against judges, public prosecutors and investigating magistrates, with a view to the imposition of disciplinary penalties - Members of the judicial body remaining in office after the expiry of their term of office - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Data security - Access by a judicial body to data relating to the bank accounts of judges and public prosecutors and of their family members - Judicial authorisation for the purpose of lifting banking secrecy - Court authorising the lifting of banking secrecy - Article 4(7) - Concept of ‘controller’ - Article 51 - Concept of ‘supervisory authority’)

(C/2025/3239)

Language of the case: Bulgarian

Referring court

Parties to the main proceedings

Applicant: Inspektorat kam Visshia sadeben savet

Operative part of the judgment

The second subparagraph of Article 19(1) TEU, read in conjunction with Article 47 of the Charter of Fundamental Rights of the European Union,

must be interpreted as meaning that the principle of judicial independence precludes a Member State’s practice under which the members of a judicial body of that Member State – who are elected by its parliament for terms of office of a specific duration and are competent to scrutinise the activity of judges, public prosecutors and investigating magistrates in the performance of their functions, to carry out checks in respect of their integrity and the absence of conflicts of interest on their part, as well as to propose to another judicial body the initiation of disciplinary proceedings with a view to the imposition of disciplinary penalties on those persons – continue to perform their functions beyond the legal duration of their terms of office as laid down in the Constitution of that Member State, until that parliament elects new members, where the extension of the expired terms of office does not have an express legal basis in national law containing clear and precise rules such as to circumscribe the performance of those functions and where it is not guaranteed that that extension is, in practice, limited in time.

Article 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that disclosure, to a judicial body, of personal data that are protected by banking secrecy and that concern judges, public prosecutors and investigating magistrates as well as their family members, with a view to the verification of the declarations which are submitted by those judges, public prosecutors and investigating magistrates concerning their assets and those of their family members and which are published, constitutes processing of personal data that comes within the material scope of that regulation.

Article 4(7) of Regulation 2016/679

must be interpreted as meaning that a court having jurisdiction to authorise, at the request of another judicial body, disclosure by a bank to that body of data relating to the bank accounts of judges, public prosecutors and investigating magistrates as well as of their family members, cannot be classified as a controller within the meaning of that provision.

Article 51 of Regulation 2016/679

must be interpreted as meaning that a court having jurisdiction to authorise disclosure of personal data to another judicial body does not constitute a supervisory authority within the meaning of that article, where that court is not entrusted by the Member State in which it is situated with monitoring the application of that regulation in order to protect, in particular, the fundamental rights and freedoms of natural persons in relation to the processing of their personal data.

Article 79(1) of Regulation 2016/679, read in conjunction with Article 47 of the Charter of Fundamental Rights,

must be interpreted as meaning that a court having jurisdiction to authorise disclosure of personal data to another judicial body is not required, where an action pursuant to that provision has not been brought before it, to ensure of its own motion the protection of the persons whose data are concerned as regards compliance with the provisions of that regulation relating to the security of personal data, including where it is known that that body has, in the past, infringed those provisions.

—

OJ C 304, 28.8.2023.

ELI: http://data.europa.eu/eli/C/2025/3239/oj

ISSN 1977-091X (electronic edition)

—