CJEU - Case C 312/24 - Darashev

Summary

The Court of Justice of the European Union (CJEU) Advocate General (AG) has opined that storing data related to a former criminal investigation in a police officer's personnel file is unlawful under Article 6(3) of the GDPR. The AG stated this data is unrelated to the officer's duties and thus violates privacy regulations. The case involves a Bulgarian police officer seeking compensation for non-material damages and erasure of his name from a suspect database.

Full text

Help CJEU - Case C 312/24 - Darashev: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 15:55, 10 September 2025 view sourceAp (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators754 editsmTag: Visual edit← Older edit Latest revision as of 12:07, 24 July 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators512 editsm Tag: Visual edit Line 25: Line 25: |GDPR_Article_Link_7=|GDPR_Article_Link_7= |EU_Law_Name_1=Article 1(1) Directive 2016/680|EU_Law_Name_1=Article 1(1) Law Enforcement Directive 2016/680 |EU_Law_Link_1=https://eur-lex.europa.eu/eli/dir/2016/680/oj/eng|EU_Law_Link_1=http://data.europa.eu/eli/dir/2016/680/oj |EU_Law_Name_2=Article 9(1) Directive 2016/680|EU_Law_Name_2=Article 9(1) Law Enforcement Directive 2016/680 |EU_Law_Link_2=https://eur-lex.europa.eu/eli/dir/2016/680/oj/eng|EU_Law_Link_2=http://data.europa.eu/eli/dir/2016/680/oj |EU_Law_Name_3=|EU_Law_Name_3= |EU_Law_Link_3=|EU_Law_Link_3= Latest revision as of 12:07, 24 July 2026 CJEU - Case C 312/24 Darashev Court: CJEU Jurisdiction: European Union Relevant Law: Article 2(1) GDPR Article 6(1)(c) GDPR Article 6(3) GDPR Article 17(1)(d) GDPR Article 17(3) GDPR Article 1(1) Law Enforcement Directive 2016/680Article 9(1) Law Enforcement Directive 2016/680Law for the Ministry of InteriorInstruction No 8121z-532 of 9 September 2014 Decided: 04.09.2025 Parties: Case Number/Name: Case C 312/24 Darashev European Case Law Identifier: Reference from: Sofiyski rayonen sad Language: 24 EU Languages Original Source: AG Opinion Initial Contributor: Le The AG opined that the storage of data relating to a former criminal investigation collected under the LED in a police officer's personnel file was unlawful under Article 6(3) GDPR because it is unrelated to the duties the officer was required to perform. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources English Summary Facts The data subject is a police officer, holding various positions at the Internal Security directorate-general of the Bulgarian Ministry of the Interior (controller). In March 2016, investigative proceedings were commenced concerning an unknown offender in connection with an offence of theft. A few days later, the data subject was arrested and after being detained in police custody for 24 hours, he was released. Subsequently, he was neither placed under formal investigation nor charged, but he was the subject of several investigative measures, which in the course of 2016, were suspended without the offender having been identified. The controller stored the data about the criminal investigation on his personnel file, as provided by the ministerial instruction relating to personnel files, issued as a regulatory act pursuant to the statutory authorisation provided for in the Law on the Ministry of the Interior (ZMVR). The data subject continued his duties as a police officer and took part in selection procedures for promotion to other posts within the Ministry but he was rejected. The data subject brought an action before the Sofia District Court (Sofiyski rayonen sad) seeking compensation for non-material damage for the fact that he has not been promoted or transferred to other duties on account of his having been a suspect in the investigation. In addition, he asked that his name be erased from the database kept by the controller, in which he is mentioned as a suspect. In this context the court decided to stay the proceedings and to refer some questions to the CJEU for a preliminary ruling, regarding the interplay of the GDPR with the Law Enforcement Directive (LED), and more specifically regarding the storage of data concerning the official in his personnel file. The questions were combined and reformulated by the AG as follows: whether Article 2(1) GDPR and Article 9(1) LED are to be interpreted as meaning that the GDPR applies to the storing, by a public authority in the personnel file of one of its officials, of data regarding that official’s status as a suspect in a criminal investigation, where the data have been collected by an organisational unit within that public authority in the performance of its duties as a competent authority within the meaning of LED. whether Article 17(3) GDPR, read in conjunction with Article 6(1)(c) and Article 6(3) thereof, is to be interpreted as meaning that the storage, in a police officer’s personnel file, of personal data relating to a criminal investigation in which that officer was the subject of investigative measures, as a suspect, and which was discontinued, may be considered lawful for the purposes of compliance with a legal obligation to which the public authority that is his employer is subject under national law, as controller, merely on account of the nature of the duties which that officer is required to perform. Holding Regarding the first question about the scope of the GDPR, the AG responded positively, that the GDPR does apply in this case, provided that the storage of that data pursues purposes other than those set out in Article 1(1) LED, purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regarding the second question, the AG responded negatively, that the storage of the data subject’s data in this case was not lawful. First, he clarified that within the meaning of Article 6(3) GDPR, the storage of personal data could be based on a legal obligation being defined in a national law other that a law stricto sensu, though in accordance with national constitutional law. Therefore, in this case, the ministerial instruction was considered an appropriate legal basis. Nevertheless, the AG expressed doubts as to the foreseeability of the purposes of the processing, which, in accordance with Article 6(3) GDPR must be determined by the legal basis of the processing. As laid down in the ministerial instruction, the purpose of the storage was for reasons of ‘change of duties’. The AG considered that this, did not appear to meet an objective of public interest, for the purposes of Article 6(3) GDPR. Furthermore, he failed to see how the nature of the duties of maintaining public order, which fall to the data subject, could justify the storage of the data at issue in his personnel file. In conclusion, the AG opined that the storage of the data at issue was not lawful and that the data subject had the right to have them erased, pursuant to Article 17(1)(d) GDPR. Comment Share your comments here! Further Resources Share blogs or news articles here! Retrieved from "https://gdprhub.eu/index.php?title=CJEU_-_Case_C_312/24_-_Darashev&oldid=52474" Categories: Opinions of the AG of the CJEUEuropean UnionArticle 2(1) GDPRArticle 6(1)(c) GDPRArticle 6(3) GDPRArticle 17(1)(d) GDPRArticle 17(3) GDPR2025 This page was last edited on 24 July 2026, at 12:07. Content is available under Creative Commons Attribution-NonCommercial-ShareAlike unless otherwise noted. Privacy policy About GDPRhub Disclaimers

Entities