Provisional text
OPINION OF ADVOCATE GENERAL
SPIELMANN
delivered on 5 March 2026 (1)
Case C‑5/25 [Pilev] (i)
Criminal proceedings
against
WE
other party:
Sofiyska gradska prokuratura
(Request for a preliminary ruling from the Sofiyski gradski sad (Sofia City Court, Bulgaria))
( Reference for a preliminary ruling – Judicial cooperation in criminal matters – Protection of natural persons in relation to the processing of personal data in criminal matters – Processing operations of courts when acting in their judicial capacity – Applicability of Directive (EU) 2016/680 – Verification of the defendant’s identity in open court – Information relating to place of birth, nationality, place of residence, educational attainment level, marital status, criminal record and ethnicity )
Introduction
1. This case concerns the scope of the collection of the personal data of a defendant by a national criminal court for the sole purpose of verifying that that person is indeed the individual named in the indictment. It does not, however, concern the question of the court’s independence when acting in its capacity as the court ruling on the substance of a case or the court’s discretion to question the defendant in this regard.
2. This case therefore affords the Court an opportunity to clarify the scope of Directive (EU) 2016/680 (2) in relation to Regulation (EU) 2016/679 (3) and to consolidate its case-law on the proportionality of the processing (collection) of personal data by a criminal court to the objective pursued.
Legal framework
Directive 2016/680
3. Article 1 of that directive, entitled ‘Subject matter and objectives’, provides, in paragraph 1 thereof:
‘This directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’
4. Article 2 of that directive, entitled ‘Scope’, provides, in paragraph 1 thereof:
‘This directive applies to the processing of personal data by competent authorities for the purposes set out in Article 1(1).’
5. Article 3 of Directive 2016/680, entitled ‘Definitions’, is worded as follows:
‘For the purposes of this directive:
…
(7) “competent authority” means:
(a) any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; or
(b) any other body or entity entrusted by Member State law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
…’
6. In accordance with Article 4 of that directive, entitled ‘Principles relating to processing of personal data’:
‘1. Member States shall provide for personal data to be:
…
(c) adequate, relevant and not excessive in relation to the purposes for which they are processed;
…’
7. Article 8 of that directive, entitled ‘Lawfulness of processing’, provides, in paragraph 1 thereof, as follows:
‘Member States shall provide for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent authority for the purposes set out in Article 1(1) and that it is based on Union or Member State law.’
8. Article 10 of Directive 2016/680, entitled ‘Processing of special categories of personal data’, is worded as follows:
‘Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be allowed only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:
(a) where authorised by Union or Member State law;
(b) to protect the vital interests of the data subject or of another natural person; or
(c) where such processing relates to data which are manifestly made public by the data subject.’
Bulgarian law
The Code of Criminal Procedure (NPK)
9. Article 138(2) and (3) of the nakazatelno-protsesualen kodeks (Code of Criminal Procedure) (4) of 29 April 2006 (‘the NPK’) is worded as follows:
‘…
2. Before the examination, the competent body shall verify the identity of the defendant.
3. The examination of the defendant shall begin with the question of whether he or she understands the charges, after which the defendant shall be invited, if he or she so wishes, to state in free narrative form everything that he or she knows about the case.’
10. Article 272(1) of the NPK provides:
‘The presiding judge shall verify the defendant’s identity by asking the defendant his or her full name, date and place of birth, ethnicity, nationality, place of residence, educational attainment level, marital status and personal identification number and whether he or she has any previous convictions.’
11. Article 311(1)(2) of the NPK provides:
‘… the record of the court hearing shall include … the information relating to the identity of the defendant.’
The Law on civil registration (ZGR)
12. The zakon za grazhdanskata registratsia (Law on civil registration) (5) of 27 July 1999 (‘the ZGR’) provides, in Article 8(1) thereof, that the principal items of information relating to the civil status of natural persons are their name, date (day, month and year) and place of birth, sex, nationality and personal identification number.
The Law on Bulgarian identity documents (ZBLD)
13. The zakon za balgarskite lichni dokumenti (Law on Bulgarian identity documents) (6) of 1 April 1999 (‘the ZBLD’) provides, in Article 3(1) thereof, as follows:
‘Identity documents shall certify the holder’s identity and, where necessary, his or her nationality by means of the data contained therein.’
14. Article 6 of the ZBLD provides:
‘Citizens shall be required to confirm their identity at the request of competent officials designated by law.’
15. Article 16(1) of the ZBLD is worded as follows:
‘Bulgarian identity documents shall contain the following mandatory personal data:
1. name;
2. date of birth;
3. personal identification number (identification number or foreign-national identification number);
4. sex;
5. nationality.’
The Law on the judiciary (ZSV)
16. The zakon za sadebnata vlast (Law on the judiciary) (7) (‘the ZSV’) provides, in Article 8(2) thereof, as follows:
‘In the performance of judicial duties, … no rights may be limited or advantages granted on grounds of … ethnicity …’
The dispute in the main proceedings, the question referred for a preliminary ruling and the proceedings before the Court
17. An indictment was submitted by the Sofiyska gradska prokuratura (Public Prosecutor’s Office of the City of Sofia, Bulgaria) to the Sofiyski gradski sad (Sofia City Court, Bulgaria), which is the referring court, alleging that, on 6 September 2023, in Sofia, a natural person, first, had bribed police officers so that they would not issue an infringement notice against him for driving a car without a driving licence and, secondly, at the same time and at the same place, had been working as a taxi driver without being in possession of the necessary licence. It is alleged that those acts amount to criminal offences.
18. A representative of the Public Prosecutor’s Office of the City of Sofia, the defendant and his legal representative attended the first hearing, which was held on 5 July 2024. The referring court continued the proceedings and, in accordance with Article 272(1) of the NPK, the presiding judge of the chamber was required to verify the identity of the defendant by asking him for the personal particulars referred to in that provision.
19. The presiding judge of the chamber satisfied himself that the person appearing before him was the individual named in the indictment on the basis of the identity document which the defendant presented. However, he refrained from asking the defendant the questions relating to his identity for which Article 272(1) of the NPK provides, and the proceedings were stayed.
20. The referring court requested the Konstitutsionen sad (Constitutional Court, Bulgaria) to rule Article 272(1) of the NPK incompatible with certain provisions of the Konstitutsia na Republika Bulgaria (Constitution of the Republic of Bulgaria). (8) The Konstitutsionen sad (Constitutional Court) declined to give a substantive ruling and so the referring court decided to refer the matter to the Court of Justice for a preliminary ruling.
21. The referring court points out that, while it can, as it did at the first hearing, identify a defendant with sufficient certainty by consulting his or her identity card, which contains all the necessary identification information, it is also useful to ask for the identification information provided for by Article 272(1) of the NPK, so that the person appearing before the court can, by means of the answers given, establish with greater certainty that he or she is the defendant, which is to say that the identity document used does not belong to another person and has not been forged. However, it states that it is sufficient to ask the individual appearing in court for his or her full name, date of birth and personal identification number.
22. Thus, the referring court wonders whether, by asking the person appearing before it in open court for the other particulars referred to in Article 272(1) of the NPK – specifically, his or her place of birth, ethnicity, nationality, place of residence, educational attainment level, marital status and previous convictions – and by recording the oral answers in the record of the hearing, it would be infringing the requirement of necessity governing the processing of personal data provided for by Directive 2016/680. Since those other particulars are not necessary for the reliable and complete identification of the defendant, asking for them goes beyond what is needed in order to achieve the objective pursued by Article 272(1) of the NPK, namely the identification of the defendant.
23. The referring court notes that some of the personal data referred to in Article 272(1) of the NPK could serve other purposes. The place of residence could serve to determine the address where any summons is to be served and previous convictions could also be relevant for sentencing purposes.
24. The referring court nevertheless points out, in essence, that those items of information, gathered before the judicial investigation commences, do not serve to identify the defendant. In fact, questioning the defendant and recording his or her answers does not suffice to verify those particulars reliably. Lastly, under national law, the information obtained in the course of identifying the person appearing in court cannot be used for the purposes of the decision on the substance of the case. The court first establishes the identity of the person appearing in court and only then informs that person of his or her rights. Consequently, those items of information (ethnicity, previous convictions, marital status, educational attainment level) are of no probative value.
25. Consequently, the referring court has doubts as to whether Article 272(1) of the NPK satisfies the requirements laid down in Article 4(1)(c) and Article 8(1) of Directive 2016/680. In its view, the collecting, entry in the court record and subsequent storage in the case file of personal data concerning place of birth, ethnicity, nationality, place of residence, educational attainment level, marital status and criminal record go beyond what is necessary for the purposes of the criminal proceedings. It also has doubts as to the consistency of Article 272(1) of the NPK with Article 10 of Directive 2016/680, in so far as concerns information relating to the defendant’s ethnicity, since that information reveals the defendant’s ethnic origin.
26. In those circumstances, the Sofiyski gradski sad (Sofia City Court) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:
‘Is a national provision, such as Article 272(1) of the NPK[, in accordance with] which, when verifying the identity of a defendant, his or her personal data relating to place of birth, ethnicity, nationality, place of residence, educational attainment level, marital status and criminal record are processed (collected, recorded and stored) compatible with Articles 4(1)[(c), Article 8(1) and Article 10](1) of Directive 2016/680 where the personal data thus collected are in no way necessary for the purposes of the criminal proceedings?’
27. Written observations were submitted by the European Commission, which also made oral submissions at the hearing in open court on 3 December 2025.
Analysis
28. While it is clear from the request for a preliminary ruling that the referring court takes it as given that the national legislation at issue falls within the scope of Directive 2016/680, it is necessary, before addressing the substance of the question referred by the national court, to address the matter of the applicability of Directive 2016/680, to which much of the hearing was in fact devoted.
The applicability of Directive 2016/680
29. First of all, the question of whether there is ‘processing of personal data’ does not arise in the case in the main proceedings. It is clear from the request for a preliminary ruling that the personal identification data at issue are collected, recorded in the court record and stored in the case file. Moreover, even if it were to be considered that the data had already been collected by the competent authority under national law, (9) the concept of ‘processing’ is a broad one and would include consultation and storage by the referring court. The condition relating to the presence of ‘processing of personal data’ is thus fulfilled.
30. Next, it is clear from the wording of Article 2(1) of Directive 2016/680, read in conjunction with Article 1(1) of that directive, that two conditions must be met in order for the processing of personal data to fall within the scope of that directive. First, the processing must be carried out by a competent authority within the meaning of Article 3(7) of that directive and, secondly, the processing must be carried out for one of the purposes listed in Article 1(1) of thereof, those being ‘the prevention, investigation, detection [and] prosecution of criminal offences [and] the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security’. Conversely, the GDPR, which is the lex generalis governing the processing of personal data, excludes from its scope any processing that is carried out by ‘competent authorities’ for such purposes, (10) Directive 2016/680 being the applicable lex specialis in that domain. (11)
31. As regards, first of all, the question of whether a court falls within the scope ratione personae of Directive 2016/680, the answer, in my view, is that it does. Indeed, Article 3(7)(a) of that directive can, by the words ‘public authority competent for …’ refer not only to police authorities, but also to national criminal courts. (12) That view, while it may not expressly follow from the definition of the concept of ‘competent public authority’, may be logically inferred from the context in which that provision appears and, in particular, from a number of provisions of Directive 2016/680.
32. Indeed, in accordance with Article 32(1) of that directive, Member States must provide for controllers to designate a data protection officer, but may exempt courts and other independent judicial authorities from that obligation ‘when acting in their judicial capacity’. Similarly, Article 45(2) of that directive, read in the light of recital 80 thereof, (13) is aimed expressly at national courts and excludes competence on the part of supervisory authorities with regard to processing operations carried out by ‘courts when acting in their judicial capacity’, (14) so as not to interfere with specific rules of criminal procedures or the independence of the judiciary.
33. Those provisions confirm that courts are subject, when acting in their judicial capacity, to the obligations imposed by Directive 2016/680, albeit their independence and impartiality are preserved in that context. (15)
34. In addition, judicial authorities are expressly mentioned in recital 11 of Directive 2016/680, which states that ‘such competent authorities may include … public authorities such as the judicial authorities’. Recitals 20, 49 and 107 and Article 18 of that directive (16) also refer to the processing of personal data by ‘courts and other judicial authorities, in particular as regards personal data contained in a judicial decision or in records in relation to criminal proceedings’. (17)
35. Therefore, national courts must be regarded as ‘competent public authorities’ for the purposes of that directive and as being subject to the provisions thereof when they process personal data in judicial decisions or documents relating to criminal proceedings. (18)
36. Secondly, the more delicate question arises of whether processing carried out by a court in the context of criminal court proceedings may be considered to fall within the scope ratione materiae of Directive 2016/680. That question, which has not, to my knowledge, yet been addressed, (19) amounts to asking whether or not such processing serves one of the purposes listed in Article 1(1) and Article 3(7)(a) of that directive and, in particular, that of the ‘prosecution’ of criminal offences.
37. I would observe that the Court has already held, in the judgment in Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation), (20) that the purposes referred to in Article 1 of Directive 2016/680 are separate purposes, namely those of the ‘prevention’, ‘investigation’, ‘detection’ and ‘prosecution’ of criminal offences and the ‘execution of criminal penalties’. That judgment thus clarified that the EU legislature had sought to adopt rules corresponding to the specific features which characterise the activities carried out by the competent authorities in the field governed by that directive, while taking account of the fact that they constitute distinct activities serving purposes specific to them. (21)
38. Admittedly, as Advocate General Campos Sánchez-Bordona indicated in his Opinion, the concept of ‘prosecution’ may refer to an activity which (although not in the Spanish-language version of the directive) precedes the judicial proceedings. (22) Moreover, leaving aside the differences between the legal systems of the Member States, this term generally refers to all the acts and procedures initiated by the public prosecutor’s office against persons suspected of having committed an offence, with a view to having them tried to establish their guilt or innocence. (23)
39. Nevertheless, in order to establish the scope ratione materiae of Directive 2016/680, it seems to me that, rather than attempting to distinguish between the role of the ‘prosecuting authority’ and that of the court in the context of criminal court proceedings, it would be more appropriate to interpret the concept of ‘prosecution’ from the perspective of the purpose of the prosecution of criminal offences. Indeed, the rules in that directive apply to the activity of the processing of personal data ‘for the purposes of’ criminal prosecutions.
40. Such a teleological approach would, to my mind, imply a broad interpretation of the concept of ‘prosecution activities’, one that can encompass some of the acts carried out by a criminal court in the context of court proceedings. The processing of personal data carried out by a court in the context of criminal court proceedings can, in fact, under certain circumstances, depending on the national procedural system, (24) be considered as helping to establish that the acts ascribed to the defendant have sufficient probative value and that the classification of those acts under criminal law is accurate, so as to lead, ultimately, to a judgment. (25) In that sense, such data processing by the court responsible for the processing may be regarded as being carried out ‘for the purposes of … prosecution’, within the meaning of the relevant provisions of Directive 2016/680.
41. In that context, the activities of ‘prosecution’ could include not only the investigation conducted by the police and the decision as to whether or not to prosecute taken by the public prosecutor, but also the preparation of the case, the referral to a court and, where appropriate, criminal court proceedings such as those at issue in the dispute in the main proceedings.
42. I would also point out that, as is apparent from the request for a preliminary ruling, after the police investigation, the referring court, to which the indictment issued by the public prosecutor’s office is submitted, continues the proceedings and itself conducts a judicial inquiry, (26) which commences with the verification of the defendant’s identity in accordance with Article 272 of the NPK and continues to the substantive judgment delivered by that same court. That court’s task is thus to ‘conduct the judicial proceedings in the context of criminal prosecutions following the indictment submitted by the public prosecutor’. According to the referring court, this is the judicial phase of the criminal proceedings instituted for the purposes of criminal prosecution. In that context, the concept of ‘prosecution activities’ carried out in the context of criminal court proceedings takes on its full meaning.
43. I would add that that broad approach to the concept of ‘prosecution activities’, in addition to having the advantage of not pre-judging the various national criminal justice systems, is not contrary to the principle that exceptions to the application of the GDPR, the lex generalis, must be interpreted strictly. (27) Such an approach does not mean that criminal court proceedings are exempt from personal data protection regulations, but rather that they are subject to the lex specialis in the field, specifically provided for in Article 2(2)(d) of the GDPR.
44. Finally, a teleological approach to ‘prosecution activities’ seems to me to flow from the legislative history of Directive 2016/680 and to be suited to the directive’s objectives.
45. First of all, as regards the legislative history of Directive 2016/680, I would observe that, with the entry into force of the Lisbon Treaty, Article 16 TFEU became the proper legal basis for the revision of Framework Decision 2008/977/JHA. (28) As mentioned in recital 10 of Directive 2016/680, in Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, (29) the conference acknowledged that specific rules on the protection of personal data and the free movement of personal data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU could prove necessary because of the specific nature of those fields. The Commission therefore proposed two texts, one general, in the form of a regulation that would become the GDPR, and the other specific to the protection of personal data in the field of criminal justice, (30) which was regarded as more sensitive and therefore to be the subject of a directive requiring transposition by the Member States – one that would become Directive 2016/680 – applying to all acts that may be taken by criminal justice actors, whether or not they have a cross-border dimension. (31)
46. The approach taken by the European Union was thus to distinguish between data processing in the police and criminal justice context and other processing of personal data, so as to take account of the specific nature of the protection of personal data in the field covered by Directive 2016/680, namely the protection of personal data in the field of judicial cooperation in criminal matters and police cooperation, as is apparent from recitals 10 and 11 of that directive.
47. Secondly, as regards the aims of Directive 2016/680, that directive seeks, in particular, as is apparent from recitals 4, 7 and 15 thereof, to ensure a consistent and high level of protection of the personal data of natural persons and to facilitate the exchange of personal data between competent authorities of Members States, in order to ensure effective judicial cooperation in criminal matters and police cooperation.
48. I would note that, as has been pointed out by legal theoreticians, the dual regime for the protection of personal data may give rise to significant difficulty in determining which instrument is relevant, the GDPR or Directive 2016/680. (32)
49. It is therefore all the more important that, in the same criminal procedure, the processing of personal data should not be governed by two different instruments, solely because the processing has been carried out by different law-enforcement authorities at different stages of the procedure. If a criminal court giving judgment in criminal proceedings were excluded from the scope of Directive 2016/680, this would, as the Commission emphasised at the hearing, lead to a fragmented regime under which the same criminal procedure would be subject to one or other of two instruments, depending on the stage of the procedure in question.
50. That approach would, in my view, run counter not only to the principle of legal certainty, (33) but also to the consistent and coherent protection of personal data.
51. In addition, in some cases, law-enforcement authorities will have greater flexibility in the exercise of their duties in the context of Directive 2016/680 than they would have in the context of the GDPR. (34) In particular, the processing of ‘special categories of personal data’, which include so-called ‘sensitive’ data, is allowed – although only where strictly necessary – under Article 10 of that directive, whereas it is prohibited under Article 9(1) of the GDPR, subject to the exceptions laid down in Article 9(2) thereof. Similarly, Article 4(1)(c) of Directive 2016/680, which concerns the principle of data minimisation, provides that personal data must be adequate, relevant and not excessive, whereas Article 5(1)(c) of the GDPR provides that they must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
52. The application of Directive 2016/680 throughout the duration of the criminal procedure is therefore all the more justified, since the rules governing the protection of personal data may differ, in certain respects, from those of the GDPR.
53. Lastly, a fragmented approach to criminal procedures would be hard to reconcile with the objective, mentioned in recital 7 of Directive 2016/680, of facilitating the exchange of personal data between competent authorities of Members States in order to ensure effective judicial cooperation in criminal matters and police cooperation.
54. It follows from all of the foregoing that the processing of personal data carried out by a national court in the context of the examination of a criminal case falls within the scope of Directive 2016/680 as processing carried out by a competent authority for the purposes of the prosecution of criminal offences.
Substance
55. The referring court asks, in essence, whether Article 4(1)(c), Article 8(1) and Article 10 of Directive 2016/680 preclude national legislation which provides for the systematic verification by a criminal court of all of the information referred to in Article 272(1) of the NPK when it is for the sole purpose of identifying the defendant in criminal court proceedings. (35)
56. It should be borne in mind that the fundamental rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’) are not absolute rights. Limitations may therefore be imposed, so long as, in accordance with Article 52(1) of the Charter, they are provided for by law, respect the essence of the fundamental rights and observe the principle of proportionality. (36)
57. The principle of data minimisation, laid down in Article 4(1)(c) of Directive 2016/680, and the principle of lawfulness of processing, provided for in Article 8(1) of that directive, thus require the Member States to provide for the personal data in question to be adequate, relevant and not excessive in relation to the purposes for which they are processed and for processing to be necessary for the purposes pursued, in accordance with the principle of proportionality.
58. In addition, Article 10 of Directive 2016/680, which is a specific provision governing the processing of special categories of personal data, including data revealing racial or ethnic origin, aims to ensure enhanced protection of data subjects, in so far as, due to their particular sensitivity and the context in which they are processed, the data at issue are liable, as is apparent from recital 37 of that directive, to create significant risks for fundamental rights and freedoms, such as the right to respect for private life and the right to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter. (37)
59. In the present case, the referring court has the task of conducting the court proceedings in criminal prosecutions following on from an indictment issued by the public prosecutor’s office. In order to be able to perform that task, it must formally establish the identity of the person appearing before it and, in particular, verify that that person is indeed the individual named in the indictment. (38) For the purposes of verifying the identity of the defendant, Article 272(1) of the NPK requires the referring court systematically to ask the person appearing in each individual case for a number of items of personal data, these being his or her full name, date and place of birth, ethnicity, nationality, place of residence, educational attainment level, marital status and personal identification number and whether he or she has any previous convictions.
60. The objective of verifying the identity of the defendant is, as such, legitimate and likely to be an objective of general interest recognised by the European Union, within the meaning of Article 52(1) of the Charter, in particular that of ensuring that there is no mistake as to who is appearing in court.
61. It is therefore necessary for the referring court to determine whether the requirement to collect the data at issue is, first, appropriate for contributing to the attainment of the identity verification objective which it pursues, secondly, necessary, meaning that there are no alternative measures less restrictive of the right to the protection of personal data but equally effective for the attainment of the objective relied on (39) and, thirdly, proportionate to that objective, which implies a proper balance between the objective of general interest pursued and the rights of the person whose personal data are collected, (40) the Court of Justice having jurisdiction to provide the referring court with the necessary guidance on interpretation.
62. I would point out that the question referred does not concern the collection of certain civil status and identification data, namely the person’s full name, date of birth and personal identification number. Those data, moreover, are classic items of identification information, including under the Bulgarian legislation on civil status and identity documents. (41)
63. The referring court does, on the other hand, question the proportionality of the systematic collection of some items of information, namely (i) place of birth and nationality, (ii) place of residence, educational attainment level, marital status and criminal record; and (iii) ethnicity, which I shall discuss in turn.
64. First of all, some of those data items, including place of birth and nationality, are among the ‘principal items of information relating to … civil status’. (42) They therefore enable the identity of the individual named in the indictment to be verified and any confusion to be avoided. Furthermore, the interference with the right to privacy and the protection of personal data which the collection of such data entails is not such that, after the interests at stake are weighed, it appears disproportionate to the identity verification objective pursued.
65. Secondly, as regards the collection of the additional data relating to educational attainment level, marital status, place of residence and criminal record, this may, as the referring court and the Commission pointed out in their written submissions, be relevant for purposes other than identification. Educational attainment level and marital status may be important for individualising the sentence. The place of residence may be pertinent if the enforcement of a criminal penalty is transferred to another State. Similarly, a criminal record may make it possible to determine whether or not there has been recidivism. Nevertheless, as is apparent from the Bulgarian rules of procedure, those items of information, collected by the presiding judge of the chamber at the stage of verifying the identity of the person appearing in court, may not be used for the purposes of the decision on the substance of the case and are of no probative value. Moreover, and in any event, questioning the defendant and recording his or her answers is not sufficient to establish the reliability of those items of data. Official documents, such as a criminal record, civil status record or a degree certificate will need to be consulted or produced.
66. That being so, I take the view that legislation which, in an indiscriminate and generalised manner, renders it necessary systematically to question any defendant regarding those additional items of information, and then to record the answers in the court record, is liable to go beyond what is necessary for the simple purpose of identifying the defendant. The requirement of identification does not, in my view, render it necessary systematically to process all of the categories of data listed, only those which, in light of the specific circumstances, are necessary in order to dispel any reasonable doubt as to the identity of the person appearing in court, which is a matter for the national court to assess.
67. Furthermore, even assuming that certain information relating to educational attainment level, marital status, place of residence and criminal record might, in some cases, be needed in order to identify the defendant, the principle of proportionality also requires that all the relevant factors be weighed and that the importance of the objective of general interest pursued be balanced against the seriousness of the interference with the fundamental rights and personal data protection of the data subject. (43) However, the fact that those data are systematically requested, combined with the fact that they are collected in open court, recorded in the court record and then stored in the case file, which is accessible to the parties, is liable to constitute an interference that goes beyond what is necessary for identification purposes at this preliminary stage of criminal proceedings.
68. Thirdly, as regards data relating to ‘ethnicity’, it must be borne in mind that Article 10 of Directive 2016/680 provides that the processing of sensitive data is to be allowed ‘only where strictly necessary’, which constitutes a strengthened condition for the lawful processing of such data and entails, inter alia, a particularly strict review of compliance with the principle of ‘data minimisation’, as derived from Article 4(1)(c) of that directive; that requirement constitutes a specific application of that principle to those sensitive data. (44) The use of the adverb ‘only’ before the words ‘where strictly necessary’ underlines that the processing of those particular categories of data can be regarded as permissible only in a limited number of cases, while the absolute nature of that necessity means that it is to be assessed with particular rigour. (45)
69. A question that is systematically asked in open court of any defendant regarding his or her ‘ethnicity’, and thus concerning the ethnic origin of the defendant, in no way meets the requirements laid down in Article 10 of Directive 2016/680. (46) The identification of the defendant can, as a general rule, be ensured by the civil status data and the identification information that are already available, in particular from identity documents, without it being necessary to have recourse to a marker of the defendant’s ethnic origin. Furthermore, the requirement of strict necessity implies that it must be shown, on the basis of specific factors, that, in the absence of that particular item of data, the objective pursued cannot be attained in an equivalent manner. A general and indiscriminate obligation to collect such personal data at this stage of the proceedings for the identification of the defendant, one which does not depend on any particular difficulty relating to that identification, seems to me to be contrary, as a matter of principle, to the requirement of strict necessity laid down in Article 10 of that directive. (47)
70. It follows from all of the foregoing that, in my view, the answer to the referring court’s question should be that Article 4(1)(c), Article 8(1) and Article 10 of Directive 2016/680 are to be interpreted as precluding a provision of national legislation, such as Article 272(1) of the NPK, in that it requires that the personal data of the defendant relating to his or her place of residence, educational attainment level, marital status, criminal record and ethnicity are systematically processed (collected, recorded and stored) when the defendant’s identity is verified in the context of criminal proceedings, where those items of personal data are not necessary for that purpose, which is a matter for the referring court to ascertain.
Conclusion
71. Having regard to all of the foregoing considerations, I propose that the Court of Justice answer the question referred for a preliminary ruling by the Sofiyski gradski sad (Sofia City Court, Bulgaria) as follows:
Article 4(1)(c), Article 8(1) and Article 10 of Directive 2016/680 (EU) of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA,
must be interepreted as precluding a provision of national legislation, such as Article 272(1) of the nakazatelno-protsesualen kodeks (Bulgarian Code of Criminal Procedure), in that it requires that the personal data of the defendant relating to his or her place or residence, educational attainment level, marital status, criminal record and ethnicity are systematically processed (collected, recorded and stored) when the defendant’s identity is verified in the context of criminal proceedings, where those items of personal data are not necessary for that purpose, which is a matter for the referring court to ascertain.