The Court clarified the interpretation of Article 19(1) TEU and several provisions of the GDPR (Regulation 2016/679) in the decision Inspektorat kam Visshia sadeben savet (C-313/23, C-316/23 and C-332/23). 

The Case concerned an order for the disclosure of data relating to the bank accounts of several judges and public prosecutors by the Inspectorate at the Supreme Judicial Council, Bulgaria. The referring court referred six questions to the Court of Justice concerning the interpretation of Article 19(1) TEU and of Articles 2(2)(a), 4(7), 32(1)(b), 33(3)(d), 51, 57(1)(a) and 79(1), read in conjunction with Article 47 of the Charter of Fundamental Rights. 

In its judgment, the Court of Justice held the following:

First, that Article 19(1)(2) TEU, read in conjunction with Article 47 of the Charter, precludes a situation in which the members of a Member State’s judicial body continue to perform their functions beyond the legal duration of their term of office until parliament elects new members. 

Turning to the GDPR, the Court finds that the disclosure of the personal data at hand constitutes processing of personal data and therefore comes within the GDPR’s material scope. Nevertheless, the Court rejected the interpretation according to which a court having jurisdiction to authorise disclosure of bank data relating to judges, public prosecutors, investigating magistrates and their family members cannot be classified as a controller within the meaning of Article 4(7) GDPR nor as a supervisory authority within the meaning of Article 51 GDPR. 

Finally, the Court of Justice holds that Article 79(1) GDPR, read in conjunction with Article 47 CFR, requires that a court having jurisdiction to authorise disclosure of personal data to another judicial body is not required, to ensure of its own motion the protection of the persons whose data are concerned.