Referral C-546/26 (Ministar na zdraveopazvaneto, 26 May 2026)

Must Article 9 of Regulation (EU) 2016/679 1 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC 2 (General Data Protection Regulation; ‘the GDPR’), read in conjunction with Articles 7 and 8 and Article 52(1) of the Charter of Fundamental Rights of the European Union, be interpreted as allowing national arrangements under which basic parameters of the centralised processing of personal data concerning health are determined not by a law but by a regulatory act adopted by a body of the executive branch on the basis of a general statutory delegation of powers?

Must Article 9(2)(c), (g), (h) and (i) of the GDPR and Articles 7 and 8 of the Charter be interpreted as allowing the creation and operation of a common national information system into which it is mandatory to enter data identifying the person (name, personal identification number, identity document, citizenship) and all of the person’s medical data, such as medical examinations carried out, medical referrals issued, results of medical diagnostic tests, hospital stays, vaccinations, prescriptions issued, prophylactic care, blood group, allergies, acute infectious diseases suffered, chronic conditions or disabilities diagnosed, pharmacological treatments carried out, medical devices used, etc., including data on cosmetic surgery carried out by medical centres, including any carried out on patients’ private parts?

Must Article 9(2)(c), (g), (h) and (i) of the GDPR and Articles 7 and 8 of the Charter be interpreted as allowing full access to an information system with the characteristics of the system described in the previous question, without the patient’s consent, in ‘emergencies’ in which it is not possible to obtain the patient’s consent in good time?

Must Article 9(2)(c), (g), (h) and (i) of the GDPR and Articles 7 and 8 of the Charter be interpreted as allowing full access to an information system with the characteristics of the system described in the second question, with the patient’s consent, where consent cannot be given in part (for only part of the information in the electronic file, limited to the information necessary for the examination, treatment or other medical intervention in question, or for only a specific period of time), and in respect of which provision is made for the following:

unrestricted access to all health records in patients’ electronic health files granted to medical professionals in primary healthcare facilities ‘during and for the purposes of the performance of their duties’, but without the system using a ‘filter’, which is to say that assessing what part of the data the medical professional needs to consult is entirely at his or her discretion, in accordance with Article 27(2) of Naredba No N-6/21.12.2022 g. za funktsioniraneto na Natsionalnata zdravnoinformatsionna sistema (Regulation No N-6 of 21 December 2022 on the operation of the national health information system), read in conjunction with Article 27(8) thereof;

unrestricted access to all health records in patients’ electronic health files granted to medical professionals in outpatient healthcare facilities ‘during and for the purposes of the performance of their duties’ for a period of no more than 30 calendar days from the initial examination carried out by them, but without the system using a ‘filter’, which is to say that assessing what data the medical professional consults and how often he or she accesses the file within the 30-day period is entirely at his or her discretion, in accordance with Article 27(3) of Regulation No N-6, read in conjunction with Article 27(8) thereof;

unrestricted access to all health records in patients’ electronic health files granted to medical professionals in inpatient healthcare facilities ‘during and for the purposes of the performance of their duties’ in connection with the hospital stay for a period of no more than 30 calendar days from the patient’s discharge, but without the system using a ‘filter’; that is to say, assessing what part of the data the medical professional consults and how often he or she accesses the file within the 30-day period is entirely at his or her discretion;

unrestricted access to all health records in patients’ electronic health files granted to medical professionals in healthcare facilities in relation to the exercise of their particular function in respect of the patient, but without any time limit and without the system using a ‘filter’, which is to say that assessing what part of the data the medical professionals consult and how often they access the file within the 30-day period is entirely at their discretion, in accordance with Article 27(5) of Regulation No N-6, read in conjunction with Article 27(8) thereof;

unrestricted access to all health records in patients’ electronic health files granted to insurance companies in relation to ‘the relevant health records of the patient, during and for the purposes of the performance of their duties in connection with a specific insurance claim’ in the context of voluntary health insurance based on a health insurance contract, but without the system using a ‘filter’, which is to say that assessing what data the insurance company consults is entirely at its discretion, in accordance with Article 27(6) of Regulation No N-6, read in conjunction with Article 27(8) thereof.

Must Article 9(2)(c), (g), (h) and (i) of the GDPR and Articles 7 and 8 of the Charter be interpreted as allowing the authorities responsible for the pre-trial stage of the proceedings to have full access, without the patient’s consent, to an information system with the characteristics of the system described in the second question in connection with pending pre-trial or trial stages of proceedings, on the basis of a decision adopted by the public prosecutor in charge of the investigation, but without the system using a ‘filter’, which is to say that assessing which data the public prosecutor in charge of the investigation consults is entirely at his or her discretion, in accordance with Article 27(9) of Regulation No N-6?

Must Article 9(2)(c), (g), (h) and (i) of the GDPR and Articles 7 and 8 of the Charter be interpreted as allowing patients not to be informed every time their data have been accessed in an information system like that at issue in the main proceedings but only to be informed ‘where necessary’, pursuant to the third sentence of Article 27(11) of Regulation No N-6, whereas the situations constituting ‘necessity’ are not set out in the law or in Regulation No N-6?

____________

1 OJ 2016 L 119, p. 1.
1 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).