The judgment of the CJEU in Inspektor (Purposes of the processing of personal data – criminal investigations) of 8 December 2022 and the concept of further processing under the Law Enforcement Directive

Abstract

In the context of criminal law enforcement and cooperation, the fundamental right to the protection of personal data is not complemented by the General Data Protection Regulation (Regulation (EU) 2016/679 – ‘GDPR’), but by the national law implementing Directive (EU) 2016/680 (‘LED’) together with other pieces of EU legislation. The preliminary ruling of the Court of Justice of the European Union in Case C-180/21 Inspektor (Purposes of the Processing of Personal Data – Criminal Investigations) delivered by the Fifth Chamber on 8 December 2022 is the first judgment in which the Court considered the LED beyond its scope of application. It represents an important milestone for data protection law in the area of criminal law enforcement. This paper will provide an analysis of the main findings of the judgment, with particular focus on the concept of “further processing” and a first reflection on the consequences it may have on the work of competent authorities such as public prosecutors.