Opinion of Advocate General Pikamäe delivered on 4 October 2024
Opinion of Advocate General Pikamäe delivered on 4 October 2024
Data
- Case date
- 4 oktober 2024
Uitspraak
Provisional text
OPINION OF ADVOCATE GENERAL
PIKAMÄE
delivered on 4 October 2024 (1)
Joined Cases C‑313/23, C‑316/23 and C‑332/23
Inspektorat kam Visshia sadeben savet
(Requests for a preliminary ruling from the Sofiyski rayonen sad (Sofia District Court, Bulgaria))
( References for a preliminary ruling – Second subparagraph of Article 19(1) TEU – Judicial inspectorate competent to propose the initiation of disciplinary proceedings against judges and public prosecutors – Members of the judicial inspectorate kept in office after the expiry of their statutory term of office – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Concept of ‘controller’ – Determination by the national law of the purposes and means of processing – Security of personal data – Judicial authority authorising the judicial inspectorate to access personal data relating to the bank account balance of judges and public prosecutors and their family members )
I. Introduction
1. The present case offers the Court an opportunity to rule, for the first time, on the compatibility with Article 19 TEU of national legislation which allows members of a judicial inspection body with competence in disciplinary proceedings involving judges and public prosecutors de facto to remain in post indefinitely after the statutory duration of their term of office has expired.
2. It will also enable the Court to continue its work of interpreting Regulation (EU) 2016/679, (2) by clarifying, first, its case-law on the designation by national law of the controller in respect of personal data and, second, the subject matter of the legal action provided for in Article 79(1) of that regulation.
II. Legal context
A. European Union law
3. The following are relevant in the present case: Article 19 TEU; Article 47 of the Charter of Fundamental Rights of the European Union (‘the Charter’); and Articles 4, 5, 32, 33 and 79 of the GDPR.
B. Bulgarian law
1. Constitution of the Republic of Bulgaria
4. Article 117(2) of the Konstitutsia na Republika Bulgaria (Constitution of the Republic of Bulgaria; ‘the Bulgarian Constitution’), in the version applicable to the facts in the main proceedings, provides:
‘The judiciary shall be independent. In carrying out their functions, judges, jurors, public prosecutors and investigating magistrates shall be subject only to the law.’
5. Article 132a of that Constitution, in the version applicable to the facts in the main proceedings, provides:
‘(1) An inspectorate shall be established at the Supreme Judicial Council. It shall be composed of an Inspector General and 10 inspectors.
(2) The Inspector General shall be elected for a five-year term by a majority of two thirds of members of the National Assembly.
(3) The inspectors shall be elected for a four-year term by the National Assembly in accordance with the procedure laid down in paragraph 2.
(4) The Inspector General and the inspectors may be re-elected, although not for two consecutive terms.
…
(6) The Inspectorate shall scrutinise the activities of the judicial authorities without undermining the independence of judges, jurors, public prosecutors and investigating magistrates in the performance of their functions. The Inspectorate shall carry out checks in respect of the integrity and conflicts of interest of judges, public prosecutors and investigating magistrates, the declarations of their assets, and for the purpose of identifying actions which are detrimental to the reputation of the judiciary or which relate to the violation of the independence of judges, public prosecutors and investigating magistrates. The Inspector General and the inspectors shall be independent and shall be subject only to the law in the performance of their functions.
(7) The Inspectorate shall act of its own motion, on the initiative of citizens, legal persons or State bodies, including judges, public prosecutors and investigating magistrates.
…
(10) The conditions and procedure applicable to the election and removal from office of the Inspector General and the inspectors, and to the organisation and activities of the inspectorate, shall be established by law.’
2. Law on the Judiciary
6. Article 46 of the Zakon za sadebnata vlast (Law on the Judiciary) (DV No 64 of 7 August 2007) is worded as follows:
‘The National Assembly shall elect the Inspector General and each of the inspectors individually by a two-thirds majority of members.’
7. Article 54 of that law provides:
‘(1) The Inspectorate
…
2. shall scrutinise the arrangements for initiating and conducting legal proceedings, prosecutions and investigations, in addition to the finalisation of cases within the prescribed time;
…
6. shall propose disciplinary penalties against judges, public prosecutors, investigating magistrates and administrative officials of the judiciary;
7. shall issue alerts, recommendations and reports to other State bodies, including competent judicial authorities;
8. shall carry out checks in respect of the integrity and conflicts of interest of judges, public prosecutors and investigating magistrates, the declarations of their assets, and for the purpose of identifying actions which are detrimental to the reputation of the judiciary or which relate to the violation of the independence of judges, public prosecutors and investigating magistrates;
…
15. shall scrutinise the processing of personal data in the cases referred to in Article 17(1) of the Law on the protection of personal data.
(2) When engaging in the scrutiny referred to in Article 54(1)(15), the Inspectorate shall carry out the tasks and exercise the powers provided for by the Law on the protection of personal data.
…’
8. Article 175a(1) of that law provides:
‘Judges, public prosecutors and investigating magistrates shall submit the following declarations to the [Inspectorate]:
1. a declaration of assets and interests in two parts;
2. a declaration of a change in the circumstances declared in the declaration referred to in subparagraph 1 in the part concerning the interests referred to in Article 175b(1)(11) to (13) and of the origin of funds in the event of early repayment of debts and loans.
…’
9. Article 175b(4) of that law is worded as follows:
‘Judges, public prosecutors and investigating magistrates shall declare the assets and liabilities and income of their spouse or persons with whom they live together as a couple and their minor children.’
10. Article 175e of the Law on the Judiciary provides:
‘(1) Within six months of the expiry of the time limit for submitting the declaration, the [Inspectorate] shall review the accuracy of the facts declared.
…
(6) The [Inspectorate] may obtain information from the information systems referred to in Articles 56 and 56a of the Law on Credit Institutions. The Inspector General and the inspectors from the [Inspectorate] may apply to the rayonen sad [(district court)] in whose jurisdiction the data subject is domiciled for the banking secrecy to be lifted, except in those cases where consent has been given pursuant to Article 62(5)(1) of the Law on Credit Institutions. Consent shall be given to the [Inspectorate] in writing, without notarial certification of the signature, on a form approved by the Inspector General.’
3. Law on Credit Institutions
11. Article 62 of the Zakon za kreditnite institutsii (Law on Credit Institutions) (DV No 59 of 21 July 2006) provides, in the version applicable to the facts in the main proceedings:
‘(1) Bank employees, members of the management and supervisory bodies of banks, officials from the Bulgarian National Bank (BNB), employees and members of the board of directors of the Deposit Insurance Fund, liquidators, temporary administrators and administrators, and any other person working for a bank, shall be prohibited from disclosing or using for their own personal gain or for the benefit of their family members information covered by banking secrecy.
(2) Banking secrecy consists of the facts and circumstances affecting the balances and transactions on the accounts and deposits held by the bank’s customers.
…
(5) Except to the BNB and for the purposes and under the conditions provided for in Article 56, the bank may provide the information referred to in paragraph 2 concerning individual customers only:
1. with their consent;
2. pursuant to a court decision adopted in accordance with paragraphs 6 and 7;
…
(6) The court may order the disclosure of the information referred to in paragraph 2 also at the request:
…
12. of the Inspector General or of an inspector from the [Inspectorate].
(7) The judge of the rayonen sad [(district court)] shall rule in closed session by reasoned decision on the request referred to in paragraph 6, at the latest within 24 hours of its receipt, specifying the period to which the information referred to in paragraph 1 pertains. The decision of the court cannot be appealed.
…’
4. Law on the protection of personal data
12. Article 17 of the Zakon za zashtita na lichnite danni (Law on the protection of personal data) (DV No 1 of 4 January 2002) provides:
‘(1) The [Inspectorate] shall monitor and ensure compliance with the [GDPR], the present law and the normative acts relating to the protection of personal data, where personal data is processed by:
1. a court in the performance of its functions as a judicial authority, and
2. the public prosecutor’s office and the investigating authorities in the performance of their functions as judicial authorities, for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal law penalties.
…’
13. Article 39(1) of that law is worded as follows:
‘In the event of an infringement of his or her rights under [the GDPR] and the present law, the data subject may challenge the acts and actions of the controller and the processor before a court in accordance with the procedure provided for by the Code of Administrative Procedure.’
III. Facts, national proceedings and the questions referred
14. On 15 May 2023, the Inspektorat kam Visshia sadeben savet (Inspectorate at the Supreme Judicial Council, Bulgaria; ‘the Inspectorate’) applied to the Sofiyski rayonen sad (Sofia District Court, Bulgaria) for banking secrecy to be lifted in relation to the assets of several judges and public prosecutors as well as their family members.
15. The referring court considers that it is necessary, in the first place, to ascertain whether the Inspectorate is competent to apply to that court for the banking secrecy to be lifted. In that regard, the referring court states that that authority, which was created by an amendment to the Bulgarian Constitution in 2007, is composed of an Inspector General for the judiciary and 10 inspectors who are elected by Parliament for a five- and four-year term, respectively. In the present case, the terms of office of the Inspector General and of all the inspectors expired in 2020 without new members being elected by Parliament.
16. The referring court states that, by judgment of 27 September 2022, the Konstitutsionen sad (Constitutional Court, Bulgaria) ruled that, when the term of office of members of the Inspectorate expires, they remain in post until new members are elected. That being the case, the referring court enquires whether, having regard to EU law, the extension of the terms of office of those members could undermine the independence of that authority, inasmuch as it is empowered to bring disciplinary proceedings against judges. If so, the referring court wishes to ascertain the criteria for determining whether such an extension is permissible.
17. In the second place, the referring court is uncertain about the role and obligations of the national courts in authorising the Inspectorate to access the personal data of judges and public prosecutors.
18. On that point, the referring court states that, in 2019, personal data relating to the addresses of several judges and public prosecutors and the identity of their family members were published on the Inspectorate’s website. After finding that the data had been unlawfully disseminated, the Komisia za zashtita na lichnite danni (Commission for Personal Data Protection, Bulgaria) imposed a fine on the Inspectorate.
19. In that context, the referring court is uncertain whether, assuming the GDPR were applicable, it must be classified as a controller within the meaning of Article 4(7) of that regulation. More specifically, the referring court notes that, according to the interpretation of national law prevailing in Bulgaria, its review is confined to determining whether individuals in respect of whom a request has been made for banking secrecy to be lifted are under an obligation to make a declaration as provided for in the Law on the Judiciary. It points out that, if the classification of controller were applied to the court considering such a request, that court would have to be responsible for data security pursuant to Articles 32 to 34 of the GDPR.
20. Furthermore, the referring court seeks to ascertain whether a judicial authority which grants a State entity access to data covered by banking secrecy may be regarded as a supervisory authority within the meaning of Article 51 of the GDPR.
21. Lastly, according to the referring court, it must be established whether, before authorising access to the data, the judiciary must be satisfied that the measures taken by the Inspectorate are sufficient to ensure that the data are processed in accordance with the law. The referring court is uncertain whether, regardless of its classification as controller or supervisory authority, it is required of its own motion to perform such checks in order to ensure effective judicial protection as provided for in Article 79 of the GDPR.
22. In those circumstances, the Sofiyski rayonen sad (Sofia District Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Must the second subparagraph of Article 19(1) TEU, read in conjunction with the second paragraph of Article 47 of [the Charter], be interpreted as meaning that it is per se or under certain conditions an infringement of the obligation incumbent on Member States to provide effective remedies sufficient to ensure independent judicial review for the functions of an authority which can impose disciplinary penalties on judges and has powers to collect data relating to their assets and liabilities to be indefinitely extended after the constitutionally stipulated term of office of that body comes to an end? If such an extension is permissible, under what conditions is that the case?
(2) Must Article 2(2)(a) of [the GDPR] be interpreted as meaning that the disclosure of data covered by banking secrecy for the purposes of verifying assets and liabilities of judges and public prosecutors which are subsequently made public constitutes an activity which falls outside the scope of [EU] law? Is the answer different where that activity also includes the disclosure of data relating to family members of those judges and public prosecutors who are not judges or public prosecutors themselves?
(3) If the answer to the second question is that [EU] law is applicable, must Article 4(7) of [the GDPR] be interpreted as meaning that a judicial authority which allows another State authority to access data concerning the account balances of judges and public prosecutors and their family members determines the purposes or means of the processing of personal data and is therefore a “controller” for the purposes of the processing of personal data?
(4) If the answer to the second question is that [EU] law is applicable and the third question is answered in the negative, must Article 51 of [the GDPR] be interpreted as meaning that a judicial authority which allows another State authority to access data concerning the account balances of judges and public prosecutors and their family members is responsible for monitoring the application of that regulation and must therefore be classified as a “supervisory authority” in relation to those data?
(5) If the answer to the second question is that [EU] law is applicable and either the third or the fourth questions are answered in the affirmative, must Article 32(1)(b) of [the GDPR] and Article 57(1)(a) of that regulation be interpreted as meaning that a judicial authority which allows another State authority to access data concerning the account balances of judges and public prosecutors and their families, is obliged, in the presence of information concerning a personal data breach committed in the past by the authority to which such access is to be granted, to obtain information on the data protection measures taken and to take into account the appropriateness of those measures in its decision to permit access?
(6) If the answer to the second question is that [EU] law is applicable, and irrespective of the answers to the third and fourth questions, must Article 79(1) of [the GDPR], read in conjunction with Article 47 of [the Charter], be interpreted as meaning that, where the national law of a Member State provides that certain categories of data may be disclosed only after permission to do so has been granted by a court, the court so competent must of its own motion grant legal protection to the persons whose data are to be disclosed, by requiring the authority which has applied for access to the data in question and which is known to have committed a personal data breach in the past to provide information on the measures taken pursuant to Article 33(3)(d) of [the GDPR] and their effective application?’
IV. Procedure before the Court
23. Written observations were submitted by the Inspectorate, the Bulgarian and Polish Governments and the European Commission.
V. Assessment
24. In accordance with the Court’s request, this Opinion will focus on the first, third and sixth questions referred for a preliminary ruling.
A. The first question referred
25. By its first question, the referring court asks, in essence, whether the second subparagraph of Article 19(1) TEU, read in conjunction with Article 47 of the Charter, must be interpreted as precluding national legislation or a national practice authorising the continuation of the activity of the Inspectorate’s members, who have competence in disciplinary proceedings against judges and public prosecutors, beyond the statutory duration of their term of office. In their written observations, the Bulgarian and Polish Governments and the Inspectorate have argued that the Court of Justice lacks jurisdiction to hear the case and that it is inadmissible. It is also important to bear in mind that, according to settled case-law, the Court itself must examine the circumstances in which cases are referred to it by the national court in order to assess whether it has jurisdiction or whether the request submitted to it is admissible. (3)
1. Jurisdiction
26. According to settled case-law, the Court does not have jurisdiction to reply to a question referred for a preliminary ruling where it is obvious that the provision of EU law referred to the Court for interpretation is incapable of applying. (4) Where a legal situation does not come within the scope of EU law, the Court has no jurisdiction to rule on it and any provisions of the Charter relied upon cannot, of themselves, form the basis for such jurisdiction. (5)
27. In the first place, as regards the application of the second subparagraph of Article 19(1) TEU, it must be recalled that, under that provision, Member States are to provide remedies sufficient to ensure effective judicial protection for individuals in the fields covered by EU law. It is therefore for the Member States to establish a system of legal remedies and procedures ensuring effective judicial review in those fields. It follows from the Court’s case-law that, as regards the scope of the second subparagraph of Article 19(1) TEU, that provision refers to the ‘fields covered by Union law’, irrespective of whether the Member States are implementing Union law within the meaning of Article 51(1) of the Charter. (6)
28. The second subparagraph of Article 19(1) TEU is intended inter alia to apply to any national body which can rule, as a court or tribunal, on questions concerning the application or interpretation of EU law and which therefore fall within the fields covered by that law. This seems to be the case of the referring court, which may be called upon, in its capacity as an ordinary Bulgarian court, to rule on questions relating to the application or interpretation of EU law and, as ‘a court or tribunal’ within the meaning of EU law, comes under the Bulgarian system of remedies in the ‘fields covered by Union law’, within the meaning of the second subparagraph of Article 19(1) TEU, such that that court must meet the requirements of effective judicial protection. Furthermore, it must be recalled that although, as the Polish Government observes, the organisation of justice in the Member States falls within the competence of those Member States, the fact remains that, when exercising that competence, the Member States are required to comply with their obligations deriving from EU law and, in particular, from the second subparagraph of Article 19(1) TEU. (7)
29. It is clear from the requests for a preliminary ruling that the Inspectorate’s members, whose term of office had expired several years previously, requested the referring court to authorise the lifting of banking secrecy covering data relating to the bank accounts of several judges and public prosecutors and their family members. The referring court considers that, given the duties and powers of that body in disciplinary matters, that situation, the lawfulness of which has been confirmed by the Konstitutsionen sad (Constitutional Court), is likely to raise questions regarding the requirement of independence of the judicial system of the Member States laid down by EU law, which warrants the questions addressed to the Court. The second subparagraph of Article 19(1) TEU is intended to apply in the context of proceedings raising the question of the conformity with EU law of national legislation or a national practice liable to affect judicial independence. It is important to emphasise, in that respect, that it is for every Member State, under the abovementioned article, to ensure that the disciplinary regime applicable to judges of the national courts which come within their judicial systems in the fields covered by EU law observe the principle of the independence of judges, inter alia by providing for the involvement of bodies which themselves meet the requirements inherent in effective judicial protection. (8)
30. I note that the Inspectorate argues that, contrary to what the referring court states, the data relating to the bank accounts of the judges and public prosecutors concerned – the subject matter of the main proceedings – are not used in conjunction with its powers to issue alerts for the purpose of establishing their disciplinary liability and that it does not have the power to impose disciplinary penalties or to initiate proceedings of that nature, an observation also made by the Bulgarian Government and the Commission. In that regard, it is appropriate to recall that the Court must take into account, under the division of jurisdiction between the Courts of the European Union and national courts, the factual and legal context, as set out in the orders for reference, of the questions referred for a preliminary ruling. Accordingly, a reference for a preliminary ruling cannot be examined in the light of the interpretation of national law relied on by a party to the main proceedings or the government of a Member State. (9)
31. However, it is common ground that the orders for reference pose an inherent contradiction as regards – and only on that point – the scope of the Inspectorate’s powers in disciplinary proceedings against judges and public prosecutors. Thus, although the Sofiyski rayonen sad (Sofia District Court) refers, in the first question referred for a preliminary ruling, to the Inspectorate’s power to impose disciplinary penalties on judges, it cites also Article 54(1)(5) and (6) of the Law on the Judiciary, according to which the Inspectorate ‘alerts’ the competent commission of the Supreme Judicial Council (‘the SJC’) in the event of infringements and ‘proposes’ such penalties, and refers to its ‘power to issue alerts for the initiation of disciplinary proceedings’, (10) a competence that is in fact described by that body and the Bulgarian Government in their respective observations. It can thus be accepted that the Inspectorate certainly has competence in disciplinary proceedings against Bulgarian judges and public prosecutors, that is to say, and at the very least, the power to propose the initiation of disciplinary proceedings in the light of the facts uncovered during its inspections. Furthermore, the Court must confine itself to the content of the orders for reference as regards the possible disciplinary action (11) following verification of the bank data obtained after banking secrecy is lifted. (12)
32. As regards, in the second place, Article 47 of the Charter, it must be pointed out that the recognition of the right to an effective remedy, in a given case, presupposes that the person invoking that right is relying on rights or freedoms guaranteed by EU law, or that that person is the subject of proceedings constituting an implementation of EU law, within the meaning of Article 51(1) of the Charter. It is undisputed that the main proceedings (i) are not adversarial in nature, in so far as the persons whose data are the subject of the access request are not parties to those proceedings and therefore cannot allege the infringement of any right, and (ii) are not proceedings brought against those persons constituting an implementation of EU law. In those circumstances, Article 47 of the Charter is not, as such, applicable to the case in the main proceedings. However, since the second subparagraph of Article 19(1) TEU requires all Member States to provide remedies sufficient to ensure effective judicial protection in the fields covered by EU law, within the meaning in particular of Article 47 of the Charter, that latter provision must be duly taken into consideration for the purpose of interpreting that article. (13)
2. Admissibility
33. It must be noted that, contrary to the Inspectorate’s claims, the requirements of Article 94 of the Rules of Procedure of the Court of Justice, particularly as provided for in Article 94(c), are satisfied in the present case. The orders for reference contain sufficient information to enable the Court to understand the reasons why the referring court seeks an interpretation of the second subparagraph of Article 19(1) TEU and Article 47 of the Charter for the purposes of the main proceedings. By its first question, the referring court asks, in essence, whether those provisions preclude national legislation having constitutional status, as interpreted by the Konstitutsionen sad (Constitutional Court), pursuant to which the Inspectorate’s members have remained in post beyond the statutory duration of their term of office. The referring court thus wishes to be instructed as regards a question of a procedural nature which it must answer in limine litis, since it relates to the lawfulness of having proceedings brought before it by a body acting outside the legal framework governing its operation, and therefore to the jurisdiction of that court to hear the request made by that body. As follows from the Court’s case-law, questions referred for a preliminary ruling which seek in that way to enable a referring court to settle, in limine litis, procedural difficulties such as those relating to its own jurisdiction to hear and determine a case pending before it, or which concern the legal effects which must or must not be conferred on a judicial decision which potentially precludes the continuation of the examination of such a case by that court, are admissible under Article 267 TFEU. (14)
34. The fact remains that the necessity, within the meaning of Article 267 TFEU, of the interpretation sought from the Court for a preliminary ruling means that the referring court must be able to infer the consequences of that interpretation by assessing, in the light of that interpretation, the lawfulness of the act of bringing the action before it and, where appropriate, by declaring the latter unlawful. In the present case, although it is not apparent from the orders for reference that, under the rules of national law, the referring court may act in that way, the content of the observations of the Bulgarian Government suggests that that could be the case. It is specified that, in the context of the review that it is required to carry out under the Law on Credit Institutions, the court having jurisdiction must verify that the request for the lifting of banking secrecy comes from a public authority or a public body authorised for that purpose and therefore, in the case in the main proceedings, whether the request emanates from the Inspector General or from the inspectors of the Inspectorate. That clarification of the nature of the powers of the court with jurisdiction is such as to confirm that that court could take into consideration any answers which the Court might give to its first question referred for a preliminary ruling and that the interpretation of the provisions of EU law requested therein does meet an objective need linked to a decision which the referring court might take in the case in the main proceedings. (15)
3. Substance
(a) Preliminary observations
35. As is apparent from the Court’s case-law, the requirement of judicial independence arising from the second subparagraph of Article 19(1) TEU means that the rules governing the disciplinary regime of judges must provide the necessary guarantees in order to prevent any risk of its being used as a system of political control of the content of judicial decisions. Rules which define, in particular, both conduct amounting to disciplinary offences and the penalties actually applicable, provide for the involvement of an independent body in accordance with a procedure fully safeguarding the rights enshrined in Articles 47 and 48 of the Charter, in particular the rights of the defence, and lay down the possibility of bringing legal proceedings challenging the disciplinary bodies’ decisions constitute a set of guarantees that are essential for safeguarding the independence of the judiciary. Furthermore, since the prospect of opening a disciplinary investigation is, as such, liable to exert pressure on those who have the task of adjudicating in a dispute, it is essential that a body competent to conduct investigations and bring disciplinary proceedings, including by proposing the opening of proceedings of that nature, should act objectively and impartially in the performance of its duties and, to that end, be free from any external influence. (16)
36. In the present case, the referring court has doubts as regards the conformity with the principle of judicial independence, enshrined in the second subparagraph of Article 19(1) TEU, of national rules and a national practice authorising the Inspectorate’s members to remain in post beyond the statutory duration of their term of office provided for by the Bulgarian Constitution, in view of the scope of that body’s duties and competences. As is apparent from the requests for a preliminary ruling, the referring court is uncertain as regards the risk, in such a situation, of external influence on the activities of the Inspectorate or undue pressure by it on the judiciary.
37. As with the extension of the period of judicial activity beyond normal retirement age, (17) it appears to me that it is for the Member States alone to decide whether or not to authorise an extension of the expired terms of office of the members of a constitutional body responsible for scrutinising the activity of the judiciary, assessing the integrity of judges and public prosecutors and any conflicts of interest they may have and, as the case may be, proposing to the SJC the initiation of disciplinary proceedings against them. Nevertheless, in choosing their respective constitutional model, the Member States are required to comply, inter alia, with the requirement of independence of the courts derived from Article 2 and the second subparagraph of Article 19(1) TEU. They are thus required to ensure that, in the light of the value of the rule of law, any regression of their laws on the organisation of justice is prevented, by refraining from adopting rules which would undermine the independence of judges. (18)
38. I consider, in that regard, that an extension of the terms of office of the members of an inspection body scrutinising judges and public prosecutors, on the grounds of there being an objective of public interest consisting in the need for institutional continuity, is not, as such, sufficient indication that the abovementioned principle of independence has been undermined, (19) especially since that body’s officials are called upon not to settle disputes as judges, but to conduct investigations and propose the initiation of disciplinary proceedings, with the result that they do not necessarily have to satisfy all the requirements of independence and impartiality applicable to judges. (20)
39. However, the extension of the expired terms of office of the Inspectorate’s members, following a deadlock in the election process for the appointment of their successors, took place within a particular regulatory framework. In addition to the absence of any legal basis (both on the principle of the extension and its duration), (21) it is important to emphasise the fact that the Inspector General and the inspectors may be re-elected, ‘although not for two consecutive terms’, and that, in the performance of their functions, they are ‘subject only to the law’. It thus appears that the effect was to extend the terms of office of members of a constitutional body whose legitimacy, derived from an initial election for a fixed term, is henceforth based solely on a statutory framework and respect for the principle of legality, even though there is no provision for such extension until the lifting of the deadlock for the election of or for the immediate renewal of those terms of office. In addition, the question of the legitimacy of the Inspectorate thus raised, to which the confidence of society in its activities and the acceptance of its decisions is linked, is of particular importance considering how cases are brought before it: the Inspectorate may act of its own motion, but also on the ‘initiative of citizens’ or public authorities, ‘including judges’. (22) In those circumstances, the de facto and sine die extension of the terms of office of the Inspectorate’s members could, in my opinion, give rise to legitimate concerns as regards the use of the powers and functions of that body as an instrument to exert pressure on, or political control over, judicial activity. (23)
40. It is ultimately for the referring court to rule on that matter having made the relevant findings in that regard. Indeed, it must be borne in mind that Article 267 TFEU does not empower the Court to apply rules of EU law to a particular case, but only to rule on the interpretation of the Treaties and of acts of EU institutions. According to settled case-law, the Court may, however, in the framework of the judicial cooperation provided for by Article 267 TFEU and on the basis of the material presented to it, provide the national court with an interpretation of EU law which may be useful to it in assessing the effects of one or other of its provisions. In that regard, the referring court will have to assess the risks related to an extension of the terms of office of the members of the Inspectorate in view of the requirement of independence of judges and public prosecutors, taking into account the legislation at issue in the main proceedings as such and in its national legal and factual context. (24)
41. As regards the legislation at issue in the main proceedings (25) and in so far as the referring court questions the Court on the implications of the Inspectorate’s activities continuing beyond the term of office of its members, having regard to the requirement of judicial independence, it is appropriate to ascertain whether the rules governing the organisation and operation of that body are designed in such a way that there can be no reasonable doubt, in the minds of individuals, that the powers and functions of that body will not be used as an instrument to exert pressure on, or political control over, judicial activity. Those rules may, generally speaking, affect that body’s practice directly and thus prevent or, on the contrary, encourage disciplinary action the object or effect of which is to exert pressure on those who have the task of adjudicating in a dispute or of ensuring political control over their activity. (26)
(b) The method of appointment and powers of the Inspectorate’s members
42. In the first place, it is common ground that the conditions for appointing the Inspectorate’s members are directly linked to the legislative authority, since those members are elected by a two-thirds majority of members of Parliament. That qualified majority requirement is aimed at mitigating the risk of politicising appointments and thus the Inspectorate itself, since in principle, such a majority transcends partisan interests and represents a consensus among persons who are recognised professionally. A more pragmatic approach leads to the conclusion that the effectiveness of that mechanism, designed to ensure the political neutrality of holders of public office, is relative, since it depends on the political context of each country.
43. In that regard, it is apparent from the information available to the Court that the process of appointing inspectors, in connection with their powers over the judiciary, is a source of concern for both the European Commission for Democracy through Law (‘the Venice Commission’) and for the Commission itself. (27) The Venice Commission states that the two-thirds majority, in the Bulgarian context, is often achieved through the distribution of ‘quotas’ in covert political negotiations, and that that means that, at the end of the day, each inspector is likely to have some political obligations vis-à-vis one or another party. (28) As for the Commission, it highlighted the difficulties surrounding the candidate selection procedure, pointing out, in its 2020 report on the rule of law in Bulgaria, that the Inspectorate itself made a motion for an amendment of the Law on the Judiciary that would require the Inspector General and the inspectors to be proposed by other bodies, such as the plenaries of the Varhoven kasatsionen sad (Supreme Court of Cassation, Bulgaria) and the Varhoven administrativen sad (Supreme Administrative Court, Bulgaria) or the general meetings of magistrates and professional organisations, rather than the members of Parliament. (29) In its 2023 report, the Commission observed that no progress had been made on advancing with the legislative amendments aiming at improving the functioning of the Inspectorate and avoiding the risk of political influence, in particular by involving judicial bodies in the selection of its members.
44. In the second place, it follows from Article 132a(6) of the Bulgarian Constitution that the role of the Inspectorate, which acts on alerts but also of its own motion, is objectively very extensive. (30) In a context in which Bulgarian judges are subjected to numerous mechanisms of control, the Venice Commission states that the Inspectorate’s powers are defined in an all-encompassing manner and are not well demarcated and often overlap with those of the SJC, with the risk of encroachment and of shifting the real power from the SJC to the Inspectorate. It points out that, in addition to its investigative powers, the Inspectorate has the ability to filter disciplinary cases by finding that an ‘alert’ about the alleged misbehaviour of a magistrate is not worth attention. (31)
(c) The risk of external influence
45. The question arises of the possible guarantees provided by the legislation at issue in the main proceedings in order to ensure that the Inspectorate’s members are impervious to external elements, in particular the direct or indirect influence of the legislative and executive that might inform their decisions. As has been stated, in performing their functions, the Inspector General and the inspectors are ‘independent and subject only to the law’ under Article 132a of the Bulgarian Constitution. It may also be observed that the Inspectorate examines the part of the draft budget of the judiciary that concerns that inspectorate and submits it to the SJC. (32) The Bulgarian Government and the Inspectorate agree that there is no legal mechanism authorising any State power, and in particular the legislative authority responsible for the appointments, to influence the activities of the Inspectorate, particularly those involving scrutiny of the asset declarations of judges. In accordance with Article 57 of the Law on the Judiciary, the checks, envisaged as part of an annual programme, are carried out by teams selected by lot and, as regards those carried out following an alert, the inspector and the experts who assist that inspector are also chosen at random. Subject to verification by the referring court, it appears that the Inspectorate enjoys, within the Bulgarian constitutional organisation, a certain degree of organisational, operational and financial independence such as to prevent direct or indirect political influence over its members.
46. Nevertheless, it should be noted that, according to the orders for reference, the members of the Inspectorate may be dismissed. (33) In the opinion of the Venice Commission (CDL-AD(2017)018, paragraphs 58 to 60), reference is made to the fact that the national legislation provides that inspectors, like judges, may be removed from office before the end of their term for ‘a serious breach or systematic failure to discharge the official duties, as well as actions damaging the prestige of the judiciary’. The proposal to remove inspectors may be made by one fifth of the members of the Bulgarian National Assembly or by the Plenary of the SJC. Although that legislation may be understood as conferring the power to make the final decision on the Bulgarian National Assembly, the Venice Commission considers that such a decision should fall within the powers of that council. (34)
(d) The risk of misuse of powers
47. It is necessary to take into account any safeguards provided by the legislation at issue in the main proceedings, in order to prevent the occurrence or persistence of misuse of powers on the part of the Inspectorate’s members. (35) In that respect, the precondition of the Inspectorate having a certain institutional autonomy, however positive it may be in terms of protection from direct or indirect influences, makes it necessary to create a framework for the activities of that body, given the nature and scope of its tasks and its powers.
48. It is apparent from the file submitted to the Court that, under the legislation at issue in the main proceedings, the Inspectorate is subject to an obligation of transparency (36) and that, particularly as regards the review of judges’ assets, it appears, subject to verification by the referring court, that several provisions govern its exercise. The national legislation requires the Inspectorate to publish, on its website, the declarations of all judges and public prosecutors, in addition to a list of the individuals who have failed to submit their declaration on time; the list must be taken down from the website at the end of the relevant calendar year. (37) With regard to checks relating to integrity and the possible existence of conflicts of interest, the procedure for verifying the asset declarations of judges is to be completed within six months. Although the Inspectorate does have the power to request the competent court to lift banking secrecy so that it may obtain information on the assets and bank account transactions of judges and public prosecutors, it is only in cases where they have refused access to their data. The law expressly provides that the verification must be carried out by comparing the facts declared against the information obtained. (38)
49. The fact remains that the Venice Commission, first, deplored that the legislation does not contain more detail on how the Inspectorate conducts its checks and on its powers, which results, as it had noted, in an overlap with the SJC. Second, the Venice Commission recommended that the investigative powers of the inspectors should not be unlimited but subject to supervision by an independent authority, for example the SJC. (39) It highlighted the importance of the role played by the Inspector General, who issues an order establishing the procedure for carrying out inspections and provides overall organisational and methodological guidance on how the Inspectorate operates. However, the Venice Commission recommends that that power to adopt general rules should be given to another body. It pointed out that the Inspector General has the power to order extraordinary inspections, prompted by complaints lodged against judges by individuals, in addition to those provided by the annual plan, and to define their object and time limits. Furthermore, the Inspector General may ‘exercise control over the activity of the inspectors’ in specific cases and it appears – this being a matter which it is for the referring court to ascertain – that that represents an appellate instance vis-à-vis the inspectors with the power to quash or amend ‘inspection reports’ following objections submitted to it by the judge concerned. (40)
50. I recall, in that respect, that the concentration of substantial powers in the hands of the person in charge of a body competent to conduct investigations and be involved in disciplinary proceedings, in so far as it gives him or her, in practice, a broad discretion in whether or not, by the decision to take no further action, to bring disciplinary proceedings against judges, is liable to facilitate the use by that person in charge of the disciplinary regime for judges to influence their activity. Therefore, legislation granting the person in charge of such a body powers such as those conferred on the Inspector General by the legislation at issue in the main proceedings could give rise to reasonable doubt, in the minds of individuals, as to the use of the powers and functions of that body as an instrument to exert pressure on, or political control over, judicial activity. (41)
51. The question of the creation of a framework for the activities of the Inspectorate involves verifying whether there are any guarantees of effective judicial protection for the judges and public prosecutors concerned. It must be noted, in the present case, that the procedure for lifting banking secrecy at issue in the main proceedings is not adversarial, that the review carried out by the court having jurisdiction is limited to say the least, and that its decision is not open to challenge. (42) Still, it may be observed that the orders for reference refer to Article 175h of the Law on the Judiciary, which allows the individuals concerned to submit written explanations and evidence during the examination by the Inspectorate of the facts declared, after details have been provided of their account balances and transactions. The Venice Commission notes that the results of an inspection are formulated in writing and submitted to the judge concerned. The judge may submit objections to the Inspector General, who must give a reasoned answer. (43)
(e) The practice of inspection
52. The referring court is also justified in taking into account the way in which that body exercises its constitutional responsibilities and its various powers, in particular if it does so, following the expiry of its members’ terms of office, in a way which could call into question its independence in relation to the legislature and the executive. (44)
53. It follows from the requests for a preliminary ruling that the only incident that the referring court mentions in connection with the Inspectorate’s activities concerns the unlawful publication, in 2019, on the Inspectorate’s website, of the personal data of several judges and public prosecutors, which resulted in a fine being imposed on the Inspectorate. Apart from the fact that that pre-dates the extension of the terms of office at issue, it cannot be regarded as an illustration of a direct or indirect external influence, of the executive or the legislature or as the occurrence or persistence of misuse of powers on the part of the Inspectorate’s members, the object or effect of which is to exert pressure on those who have the task of adjudicating in a dispute or of ensuring political control over their activity. According to the information provided by the referring court, the wrongful publication resulted from the individual failure of an Inspectorate official, who was neither the Inspector General nor an inspector, and who had failed to anonymise the data prior to publication and was later dismissed.
(f) The period of extension of the terms of office
54. The relevant factors of the national legal and factual context which the referring court must take into account include the period of extension of the terms of office, which in the present case was more than three years at the time the case was brought before the referring court. In that regard, in response to the referring court’s assertion that the Inspectorate continues to perform its functions ‘without a clearly defined end date’, the Bulgarian Government and the Inspectorate have submitted that the Konstitutsionen sad (Constitutional Court), in its 2022 judgment, clearly stated that the duration of the exercise of its functions depends on the occurrence of a certain future event, namely ‘until the election by the National Assembly of the Inspector General or inspectors’.
55. It is common ground that the Inspectorate’s members continue to exercise their functions despite their terms of office having expired, owing to the inability of the National Assembly to elect their successors in 2020. The file submitted to the Court contains no evidence to suggest that the situation will be remedied in the near future. Apart from the absence of any legal anti-deadlock mechanism, consisting in the lowering of the qualified majority required or transferring the power of appointment to a neutral entity, it is telling that there are no fewer than five other independent supervisory authorities which also operate on the basis of an expired term of office. (45) It thus appears, subject to verification by the referring court, that the period for which the inspectors continue to exercise their functions, after the expiry of their term of office, depends on the occurrence of a future event without a certain date, which means that the period of extension of those terms of office can therefore be regarded as indefinite. The suspension of the Inspectorate’s activities for an undefined period following the deadlock of the appointment process is undeniably worrying, but an indefinite extension of the terms of office of its members is even more concerning.
56. It seems to me that the legitimate concerns described above with regard to the selection of candidates for the posts of inspectors, the method of appointing the persons concerned, their possible dismissal by one fifth of the members of Parliament, the overlapping of the competences of the Inspectorate and the SJC due to a lack of detail in the applicable legislation and the extent of the Inspector General’s powers are aggravated by the fact that the Inspectorate’s members remain in post even though their terms of office expired in January or February 2020. (46) Despite the absence, in the file submitted to the Court, of a concrete example of an inspection or a proposal for disciplinary proceedings indicative of external influence or misuse of power by the Inspectorate, the continued operation of such a body, without a precise and definite time limit, only increases the risk of such an event occurring. (47)
57. Apart from the uncertainties surrounding changes in the individual circumstances of the Inspectorate’s members, the a priori indefinite extension of the terms of office of the persons concerned, without efforts being made in the short term to break the deadlock in electing new members of that body, deprives the relevant constitutional mechanism of all meaning. Moreover, taking into account the composition and functioning of the Inspectorate, it gives rise to legitimate doubts, in the minds of subjects of the law, as regards the imperviousness of the Inspectorate to external factors, and in particular, to the direct or indirect influence of the legislature, and as regards its neutrality with respect to the interests before it, but also as to whether they may lead to that body not being seen to be independent or impartial with the consequence of prejudicing the trust which justice in a democratic society must inspire in subjects of the law. (48) In such a situation, the Inspectorate cannot be regarded as being able to operate above all suspicion of partiality in all circumstances. (49)
58. The extension of the terms of office of members of a body such as the Inspectorate should, in my opinion, be permitted only in exceptional cases and on a temporary basis. This implies a return to normal as soon as possible, which is difficult to reconcile with the strict application of the principle of continuity, which must not lead, so as not to lead to a breach of the principle of proportionality, to the possibility of an indefinite extension of a term of office which has expired and which, as in the present case, may not be renewed immediately. The established extension of the terms of office of the Inspectorate’s members for more than three years, with no reasonable prospect of an end to the deadlock in the near future, is neither exceptional nor temporary in nature. Lastly, I would add that the functional status quo is incapable of holding to account a delinquent political authority seeking, where necessary, to maintain in office individuals with similar political affinities and to avoid electing new members of the Inspectorate on the basis of a more open method of candidate selection.
59. In the light of the foregoing considerations, the answer to the first question referred for a preliminary ruling should be that the second subparagraph of Article 19(1) TEU, read in conjunction with Article 47 of the Charter, must be interpreted as precluding legislation, as interpreted by national case-law, which authorises members of a body who are elected by Parliament for terms of office of a predetermined duration, which may not be renewed consecutively, and who are empowered to scrutinise the activities and integrity of judges and public prosecutors and to propose the initiation of disciplinary proceedings against them, de facto to continue to exercise their functions indefinitely after their term of office has expired, without efforts being made in the short term to break the deadlock in electing new members of that body, where that legislation has not been designed in such a way that there can be no reasonable doubt, in the minds of individuals, as regards the use of the powers and functions of that body as an instrument to exert pressure on, or political control over, the activity of those judges and public prosecutors.
B. The third question referred for a preliminary ruling
60. The third question referred for a preliminary ruling asks the Court of Justice to determine whether a court which authorises a State authority to access personal data concerning the account balances of judges and public prosecutors as well as their families determines the purposes or means of processing and may therefore be classified as a ‘controller’ within the meaning of Article 4(7) of the GDPR.
61. To answer that question, a clearer picture is needed of the scope and place of the ‘processing’ of personal data at issue in the main proceedings. (50)
62. In that regard, it must be pointed out that the concept of ‘processing’ includes any operation which is performed on personal data or on sets of personal data, whether or not by automated means, such as, inter alia, ‘collection’, ‘consultation’, ‘use’, ‘disclosure by transmission, dissemination or otherwise making available’. Furthermore, it is apparent from that definition that the processing of personal data may consist in one or a number of operations, each of which relates to one of the different stages that the processing of personal data may involve. (51)
63. It is apparent from the requests for a preliminary ruling that the judicial authority authorises a bank to disclose to the Inspectorate information relating to the accounts and deposits of judges and public prosecutors and their family members. The Inspectorate then collects, consults and uses that information, which was held by the bank, to identify potential conflicts of interest. It follows that the disclosure of the information covered by banking secrecy authorised by the judicial authority is regarded as a processing operation, which is part of a process consisting of several steps involving the bank, the judicial authority and the Inspectorate in turn.
64. That being the case, it must be determined whether the court authorising that disclosure can be classified as a ‘controller’ within the meaning of Article 4(7) of the GDPR.
65. On that point, it should be borne in mind that the objective pursued by the GDPR, as is set out in Article 1 thereof and in recitals 1 and 10 thereof, consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their rights to privacy with respect to the processing of personal data, as enshrined in Article 8(1) of the Charter and Article 16(1) TFEU. To that end, the EU legislature has adopted a broad definition (52) of the concept of ‘controller’, the objective of which is to ensure effective and complete protection of data subjects. (53)
66. The concept of ‘controller’ is inextricably linked to the control that a person or entity exercises over the processing of personal data. (54) More specifically, Article 4(7) of the GDPR defines the concept of ‘controller’ as the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing. (55) That article also states that, where the purposes and means of such processing are determined, inter alia, by the law of a Member State, the controller or the specific criteria for its nomination may be provided for by that law.
67. It therefore follows from the wording of that article that the controller is identified according to two methods. It must be examined whether a legal person or entity determines, alone or jointly with others, the purposes and means of the processing at issue or whether those purposes and means are determined by national law.
68. Where the purposes and means of the processing are determined by national law, it must, according to the most recent case-law, be ascertained whether that law nominates the controller or provides for the specific criteria for its nomination. The nomination of the controller by national law may not only be explicit but also implicit. In the latter case, that determination must nevertheless be derived with sufficient certainty from the role, task and powers conferred on the person or entity concerned. (56)
69. In the present case, it is apparent from the requests for a preliminary ruling that, under Article 132a(6) of the Bulgarian Constitution, the Inspectorate is responsible, inter alia, for carrying out checks in respect of the integrity and conflicts of interest of judges and public prosecutors. As such, it is to verify, in accordance with the Law on the Judiciary, (57) the declarations of assets and interests that judges and public prosecutors must send to it. The Inspectorate is to publish those declarations on its website and keep them in an electronic public register. (58) Furthermore, it is clear from Article 20 of the Law on the protection of personal data that the Inspectorate’s members may not disclose information consisting of a secret protected by law, of which they have acquired knowledge in the performance of their activities.
70. In order to perform its tasks, the Inspectorate may obtain information from a banking institution relating to the accounts and deposits of judges and public prosecutors and their family members. The proceedings before the referring court fall within that framework. If the data subjects have not consented to that disclosure, the Inspectorate may, pursuant to Article 175e(6) of the Law on the Judiciary and Article 62(6) of the Law on Credit Institutions, apply to the rayonen sad (district court) to order the bank to disclose the data covered by banking secrecy.
71. According to Article 62(7) of the Law on the Judiciary, the referring court must adopt a decision at the latest within 24 hours of receiving that request, specifying the period to which the information sought covered by banking secrecy relates. It is clear from the information provided by the referring court (59) and from the observations submitted by the Bulgarian Government (60) that the rayonen sad (district court) merely ascertains, first, whether the request emanates from a public authority or public body, as provided for in Article 62(6) of the Law on Credit Institutions, and second, that the persons whose accounts are the subject of the request for the lifting of banking secrecy are required to make a declaration under the Law on the Judiciary.
72. It follows from that that, in the procedure established by Bulgarian law, the rayonen sad (district court) simply exercises, as the referring court points out, formal control over the Inspectorate’s requests for disclosure of information covered by banking secrecy.
73. In that regard, I note that that court must rule on the requests made before it by the Inspectorate within a particularly short period of time, without being able to assess either how that disclosure is relevant to the objective of identifying conflicts of interest or how the data are to be provided and subsequently used by the Inspectorate. Furthermore, the bank discloses that information directly to the Inspectorate, which must ensure its confidentiality. The Inspectorate examines the accounts of the judges and public prosecutors and their family members to determine the amount of their assets. In accordance with the task conferred on it by the Bulgarian Constitution, it also carries out checks in respect of the integrity of the judges and public prosecutors and investigates whether any conflicts of interest exist.
74. I infer from that that the court does not have the power to determine the purposes and means of the processing of personal data covered by banking secrecy.
75. By contrast, it is clear that Bulgarian law has determined, at least implicitly, the purposes and means of the processing of the data and has designated the Inspectorate as a controller within the meaning of Article 4(7) of the GDPR.
76. Similarly, it follows from that determination of the purposes and means of the processing that, given the role, task and powers conferred on it by national law, the court, which authorises the disclosure of that information to the Inspectorate, has not been designated by the Bulgarian legislature to have such responsibility. Moreover, it seems to me that the mere fact that the disclosure of that information is subject to authorisation granted by a court cannot be sufficient to characterise that court as the ‘controller’ in respect of those data. Indeed, it is inferred from the foregoing that that authorisation has no other purpose than to allow the Inspectorate to process the personal data disclosed to it by the bank, in accordance with the purposes and means determined by Bulgarian law.
77. In the light of all those factors, it appears to me that the court that grants a public authority access to the account balances of judges and public prosecutors and family members, subject only to verifying that the request has been made by such an authority and that it concerns persons required to declare their assets, cannot, in view of the role, tasks and powers conferred on it by national law, be classified as the controller in respect of such personal data within the meaning of Article 4(7) of the GDPR.
C. The sixth question referred for a preliminary ruling
78. The sixth question referred for a preliminary ruling is raised independently of the answer that the Court must give to the third and fourth questions. The referring court seeks, in essence, to ascertain whether Article 79(1) of the GDPR, read in conjunction with Article 47 of the Charter, requires the judicial authority which decides on the request for disclosure of personal data submitted by a State authority to grant of its own motion protection to the persons whose data are concerned, by requiring that authority to provide it with information on the security measures taken pursuant to Article 33(3)(d) of the GDPR and on their effective implementation, where it is known that that authority has committed a security breach in respect of personal data in the past.
79. In that regard, the referring court notes that the procedure before it is not adversarial in so far as the persons concerned by the request for the disclosure of the account balances of the judges and public prosecutors and their family members are not parties to those proceedings. (61) It takes the view that, were it to confine itself, as required by Bulgarian law, to a purely formal examination of those requests, the data subjects would be deprived of the right to an effective judicial remedy guaranteed by the provisions of Article 79(1) of the GDPR, read in conjunction with Article 47 of the Charter.
80. It follows from that that, in order to answer the question referred, it is necessary to establish whether those provisions impose an obligation on the court adopting a decision in such proceedings to review of its own motion whether the measures aimed at preventing any further security breach in respect of the personal data whose disclosure is requested are sufficient.
81. In my opinion, it is apparent from the subject matter of the provisions of Article 79(1) of the GDPR that the answer to that question can only be in the negative.
82. In that regard, it seems to me that the issue regarding the security of the information covered by banking secrecy raised by the referring court must be assessed in the light of the controller’s obligations, as summarised below.
83. In the first place, the controller is required to prevent any security breach in respect of personal data. More specifically, under Article 5(2) of the GDPR, the controller is responsible for, and must be able to demonstrate compliance with, the principles relating to the processing of the data set out in paragraph 1 of that article. In particular, the controller must, in accordance with the principle of integrity and confidentiality of personal data laid down in Article 5(1)(f) of that regulation, make sure that such data are processed in a manner that ensures appropriate security of those data, using appropriate technical or organisational measures. According to Article 32(1) of the GDPR, those measures must ensure a level of security appropriate to the risk represented by the processing.
84. In the second place, the controller is required to react to any security breach in respect of personal data. In that respect, Article 33(1) of the GDPR requires the controller to notify the breach in question to the competent supervisory authority by describing, in accordance with paragraph 3(d) of that article, the measures proposed to be taken to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.
85. It is in the context of those provisions that the subject matter of the legal action provided for in Article 79(1) of the GDPR should be examined. On that point, it should be recalled that, in Chapter VIII of that regulation, entitled ‘Remedies, liability and penalties’, the EU legislature has established, for the benefit of the data subjects, different remedies before the administrative or judicial authorities, it being understood that each of those remedies must be capable of being exercised without prejudice to the others. (62)
86. First of all, Article 77(1) of the GDPR provides that every data subject is to have the right to lodge a complaint with a supervisory authority, if the data subject considers that the processing of personal data infringes that regulation. Next, according to Article 78(1) of that regulation, each natural or legal person is to have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.
87. Lastly, Article 79(1) of the GDPR, entitled ‘Right to an effective judicial remedy against a supervisory authority’ guarantees every data subject the right to bring an action where he or she considers that his or her rights under that regulation have been infringed as a result of the processing of his or her personal data in non-compliance with that regulation. According to the case-law of the Court, that article does not exempt the data subject from his or her obligation under Article 82(1) of that regulation to prove that he or she has actually suffered material or non-material damage. (63)
88. To my mind, it follows unambiguously from the wording of those last two articles that the action brought against a controller or a processor is intended to repair the damage caused by the previous infringement of the rights conferred by the GDPR. By contrast, it cannot be inferred from the wording of those articles that a court would be obliged to ascertain preventively that the controller in respect of the personal data has adopted measures capable of avoiding any subsequent infringement of those rights.
89. That being the case, it is necessary to examine how the provisions of Article 47 of the Charter affect the interpretation of Article 79(1) of the GDPR.
90. As is clear from recital 141 of that regulation, (64) the provisions of Article 79(1) are intended to implement the right to an effective remedy enshrined in Article 47 of the Charter. In other words, the EU legislature had already incorporated that right when drafting the provisions governing the action that the data subject may bring against the controller.
91. It follows that, according to the case-law of the Court, the characteristics of the remedies provided for in Article 77(1), Article 78(1) and Article 79(1) of the GDPR must be established in accordance with the right to effective judicial protection. From that point of view, it is for the Member States to ensure, within the scope of their procedural autonomy, that the arrangements for the exercise of those remedies effectively allow the data subjects to seek the protection of the rights conferred on them by that regulation. (65)
92. It is in the light of all those factors that the role conferred on the referring court by the Bulgarian legislature must be examined.
93. It is true that the Bulgarian legislature has decided that, in non-adversarial proceedings, the court conducts a purely formal review of the requests submitted to it by the Inspectorate for the disclosure of the account balances of judges and public prosecutors and their family members. That being the case, and despite its limited powers, it does not follow in any way from Article 79(1) of the GDPR that that court should, before deciding on those requests, have the power to review of its own motion whether the measures taken to prevent any subsequent security breach in respect of personal data are sufficient.
94. I consider that, for the reasons I have already set out, national law has designated the Inspectorate as the controller in respect of the processing of information covered by banking secrecy the disclosure of which is ordered by the judicial authority. It follows that, in that capacity, the Inspectorate is required to take all the measures provided for by the GDPR such as to ensure the security of the information it has collected.
95. From that perspective, it is sufficient, in order to comply with the system implemented by the GDPR, that, in accordance with Article 79(1) of that regulation, the persons concerned by that disclosure may, in the event of infringement of the rights conferred on them by that regulation, bring an action against the Inspectorate in accordance with the procedural rules guaranteeing observance of the right to effective judicial protection enshrined in Article 47 of the Charter. (66)
96. In the light of all those considerations, I suggest that the Court answer that, subject to the foregoing reservation, Article 79(1) of the GDPR, read in conjunction with Article 47 of the Charter, does not require the court which, in accordance with national law, is responsible, in non-adversarial proceedings, for ruling on a request for the disclosure of the account balances of judges and public prosecutors and their family members, to ascertain of its own motion that the controller has adopted measures such as to prevent any subsequent security breach in respect of data protection.
VI. Conclusion
97. In the light of the foregoing considerations, I propose that the Court answer the first, third and sixth questions referred by the Sofiyski rayonen sad (Sofia District Court, Bulgaria) as follows:
(1) The second subparagraph of Article 19(1) TEU, read in conjunction with Article 47 of the Charter of Fundamental Rights of the European Union,
must be interpreted as precluding legislation, as interpreted by national case-law, which authorises members of a body who are elected by Parliament for terms of office of a predetermined duration, which may not be renewed consecutively, and who are empowered to scrutinise the activities and integrity of judges and public prosecutors and to propose the initiation of disciplinary proceedings against them, de facto to continue to exercise their functions indefinitely after their term of office has expired, without efforts being made in the short term to break the deadlock in electing new members of that body, where that legislation has not been designed in such a way that there can be no reasonable doubt, in the minds of individuals, as to the use of the powers and functions of that body as an instrument to exert pressure on, or political control over, the activity of those judges and public prosecutors.
(2) Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
must be interpreted as meaning that the court which grants a public authority access to the account balances of judges and public prosecutors and their family members, subject only to verifying that the request has been made by such an authority and that it concerns persons required to declare their assets, cannot, in view of the role, tasks and powers conferred on it by national law, be classified as the controller in respect of such personal data.
(3) Article 79(1) of Regulation 2016/679, read in conjunction with Article 47 of the Charter of Fundamental Rights,
must be interpreted as meaning that the court which, in accordance with national law, is responsible, in non-adversarial proceedings, for ruling on a request for the disclosure of the account balances of judges and public prosecutors and their family members, is not required to ascertain of its own motion that the controller has adopted measures such as to prevent any subsequent security breach in respect of personal data. Nevertheless, national law must provide that the procedural rules for the legal action that the persons concerned by such disclosure may bring against the controller, pursuant to Article 79(1), safeguard the right to effective judicial protection enshrined in Article 47 of the Charter of Fundamental Rights.