{"id":86424,"date":"2026-06-18T10:44:56","date_gmt":"2026-06-18T08:44:56","guid":{"rendered":"https:\/\/www.lexxion.eu\/?post_type=dpi&p=86424"},"modified":"2026-06-18T10:46:14","modified_gmt":"2026-06-18T08:46:14","slug":"data-protection-insider-issue-155","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-155\/","title":{"rendered":"Data Protection Insider, Issue 155"},"content":{"rendered":"

Table of Contents:<\/strong><\/p>\n

    \n
  1. CJEU: Police HR to apply GDPR when processing personnel data related to investigations<\/a><\/li>\n
  2. AG Considers Access to Personal Data in EU Documents Related to COVID-19 Vaccines<\/a><\/li>\n
  3. EDPB Publishes New Materials<\/a><\/li>\n<\/ol>\n

     <\/p>\n

    In the present edition, we inform our readers of an important CJEU judgment, which helps practitioners delineate the scope of applicability of the GDPR and the LED, an AG Opinion dealing with the issue of access to EU documents relating to the COVID-19 pandemic, and new material published by the EDPB.<\/p>\n

    CJEU: Police HR to apply GDPR when processing personnel data related to investigations<\/h2>\n

    [1]<\/a> On 4th<\/sup> June, the CJEU ruled on the distinction between the scope of applicability of the GDPR and the LED in the framework of criminal investigations against police staff for HR purposes and on the right to erasure of HR data in Darashev<\/em>. As to the facts of the case, the applicant in the main proceedings is a police officer in Bulgaria and held various positions in different departments, all belonging to the Ministry of the Interior. The \u201cInternal Security\u201d department within the Ministry of the Interior, to which he did not belong, opened investigations against an unknown perpetrator suspected of robbery, and eventually arrested the applicant in the main proceedings. They held him in custody for 24 hours, during which time they collected data on him, including his fingerprints, and asked victims to identify him. As he was not identified by the victims and no traces of his fingerprints were found on the stolen objects, he was released. He was never investigated or accused of the crime in question. In the following years, he applied for promotion within his department several times, which was always turned down by the HR department on account of him having been previously arrested. In the course of the claim for damages which the applicant raised against the Public Prosecutor\u2019s Office, in essence two questions arose: (1) as to whether the GDPR or the LED is applicable to the processing of personnel data, where the processing takes places by one entity \u2013 the Ministry of the Interior \u2013 but by different units within it (one unit where the police officer works and of which they are an employee, and one unit which acts in its law enforcement capacity) and (2) how the right to erasure is to be interpreted and applied in relation to his personnel file. As to the first question, the CJEU established that: \u201cIn the present case, although the initial collection of personal data carried out by the \u2018Internal Security\u2019 directorate of the Ministry of the Interior for the purposes of the investigation concerning the applicant in the main proceedings falls within the scope of Directive 2016\/680, the processing at issue in the main proceedings, in so far as it is carried out for human resources management purposes, falls within the scope of the GDPR\u201d. As to the second question, the CJEU left it to the referring court to decide whether continuing to store the data of the applicant for HR purposes is lawful under the GDPR and provided the following guidance: \u201cArticle 17(3)(b) of the GDPR, read in conjunction with point (c) of the first subparagraph of Article 6(1) and Article 6(3) of that regulation and in the light of Article 52(1) of the Charter, must be interpreted as meaning that the storage, in the personnel file of a police officer, for the purposes of the management of his career and the monitoring of compliance\u2026of personal data relating to his or her status as a suspect in a suspended criminal investigation, where that officer has not been accused of or faced criminal charges for the offence concerned, may be regarded as justified for the purposes of compliance with a legal obligation to which the public authority, the employer of that officer, is subject on the basis of national law, provided that that legal basis is clear and precise, that its application is foreseeable for data subjects and that that obligation meets an objective of public interest and is proportionate to that objective\u201d.<\/p>\n

    AG Considers Access to Personal Data in EU Documents Related to COVID-19 Vaccines<\/h2>\n

    [2]<\/a> On 11th<\/sup> June, Advocate General Rantos delivered their Opinion in the joint cases of European Commission v Margrete Auken and Others and European Commission v Fabien Courtois and Others<\/em>. In essence, these cases concern appeals by the Commission, which seeks to have prior judgments made by the Court set aside. In these prior judgments, the General Court \u201cannulled in part, respectively, Decision C(2022) 1038 final of the\u2026Commission\u2026taken pursuant to Article 4 of Regulation (EC) No 1049\/2001\u2026granting Ms Auken and Others\u2026partial access to the advance purchase agreements and purchase agreements for COVID-19 pandemic vaccines concluded between the Commission and the pharmaceutical undertakings concerned\u2026and Decision C(2022) 1359 final of the\u2026Commission\u2026.adopted pursuant to Article 4 of Regulation (EC) No 1049\/2001, granting Mr Courtois and Others\u2026partial access to certain documents relating to the purchase of vaccines by that institution in the context of that pandemic\u201d. In relation to data protection \u2013 the case goes somewhat beyond data protection, the remainder of which will not be considered here \u2013 the case concerns \u201cthe extent of the Commission\u2019s power to refuse natural persons, by relying on the protection of personal data, access to documents of the EU institutions relating\u2026to the names of the members of the joint negotiation team, composed of Commission officials and a small number of experts from the Member States, for the purchase of vaccines from pharmaceutical undertakings\u201d. In this regard, the AG\u2019s Opinion considers, in particular, two issues. First: the proposition, put forward by the Commission \u201cthat the General Court wrongly classified as a \u2018specific purpose in the public interest\u2019, within the meaning of Article 9(1)(b) of Regulation 2018\/1725, the objective of ascertaining the impartiality of the members of the joint negotiation team\u201d. The AG concluded that this proposition \u201cshould be rejected as unfounded\u201d. In doing so, they considered, for example, the legitimacy of the proposition that individual requests for access to documents could be in the public interest, the legitimacy of the proposition that transparency of negotiations could be regarded as representing a specific public interest, and the fact that \u201cdisclosure of anonymised versions of\u2026declarations of absence of conflict of interests\u2026do not make it possible to carry out an external verification to check the accuracy and\/or completeness of the information contained therein\u201d. Second: the proposition, put forward by the Commission, that the Court had misinterpreted the \u201csecond condition laid down in Article 9(1)(b) of Regulation 2018\/1725\u201d \u2013 concerning the proportionality of transfers of personal data following a weighing of competing interests. In this regard, the Commission asserted that: i) \u201cinterference arising from the disclosure of the personal data in question would be particularly serious for the members of the joint negotiation team\u201d for example exposing \u201cthem to unsolicited external contacts which would not be limited to contact from the press, but could also include harm to their physical integrity and forms of harassment, in particular by supporters of \u2018conspiracy theories\u2019, whose numbers are not insignificant in the context of the COVID-19 pandemic\u201d; ii) that certain of the public servants in question had no decision-making power; and that iii) \u201cthe objective of ascertaining the impartiality of the members of the joint negotiation team has already been achieved by the disclosure of anonymised versions of the declarations of absence of conflict of interests\u201d. The AG rejected the Commission\u2019s positions. In doing so, the AG considered the first two of the Commission\u2019s arguments inadmissible \u2013 on the basis of lack of specification of the legal challenge to the Court\u2019s argumentation. The AG then highlighted, in relation to the Commission\u2019s third argument, the position already put forward in relation to the anonymous disclosure of declarations of absence of conflicts of interests made in relation to the first issue considered.<\/p>\n

    EDPB Publishes New Materials<\/h2>\n

    Over the past two weeks, the EDPB released the following significant materials:<\/p>\n