¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
(2) If Question 1 is answered in the affirmative, does the existence of a right to erasure or restriction have the consequence that the data processed must not be taken into account in judicial proceedings? Is that the case in any event where the data subject objects to the use of the data in the judicial proceedings?
(3) If Question 1 is answered in the negative, does an infringement by a controller of Article 5, 30 or 26 of the GDPR have the consequence that, with regard to the question as to the use of the processed data in judicial proceedings, a national court may take the data into account only if the data subject expressly consents to that use?’
Consideration of the questions referred
Admissibility
39 Without formally raising a plea of inadmissibility, the German Government expresses doubts as to the relevance of the questions referred for a preliminary ruling to the outcome of the dispute in the main proceedings. First of all, it is apparent from the order for reference that the disregard, by the Federal Office, of Article 5(2) of the GDPR has not been definitively established, the referring court merely presuming this to be the case. Next, that court did not state that the files of the Federal Office, on the assumption that it is not authorised to use them, are alone decisive for the solution of this dispute It also has other sources of information, which, in accordance with the principle of ex officio investigation, should be fully exploited where an authority does not submit files or where those files are incomplete. Lastly, the third question is manifestly hypothetical, since it is not apparent from the order for reference that the applicant in the main proceedings consented to or consents to the use of the processing of his personal data by the referring court.
40 It should be recalled that, according to settled case-law, questions relating to EU law enjoy a presumption of relevance. The Court may refuse to rule on a question referred by a national court for a preliminary ruling only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the Court does not have before it the legal or factual material necessary to give a useful answer to the questions submitted to it or where the problem is hypothetical. What is more, in proceedings under Article 267 TFEU, which are based on a clear separation of functions between the national courts and the Court, the national court alone has jurisdiction to find and assess the facts in the case before it (see, inter alia, judgment of 24 March 2022, Autoriteit Persoonsgegevens, C‑245/20, EU:C:2022:216, paragraphs 20 and 21 and the case-law cited).
41 As is clear from the second paragraph of Article 267 TFEU, in the framework of the close cooperation between the national courts or tribunals and the Court of Justice based on the assignment to each of different functions, it is for the referring court to decide at what stage in the proceedings it is appropriate for that court to refer a question to the Court of Justice for a preliminary ruling (judgment of 17 July 2008, Coleman, C‑303/06, EU:C:2008:415, paragraph 29 and the case-law cited).
42 In particular, the Court has already held, in that regard, that the fact that factual questions have not yet been dealt with in an evidential adversarial procedure does not, as such, render a question referred for a preliminary ruling inadmissible (see, to that effect, judgment of 11 September 2014, Österreichischer Gewerkschaftsbund, C‑328/13, EU:C:2014:2197, paragraph 19 and the case-law cited).
43 In the present case, even though it is apparent from the request for a preliminary ruling that the referring court has not definitively ruled on the existence of an infringement, by the Federal Office, of its obligations under Article 5(2) of the GDPR, read in conjunction with Articles 26 and 30 of that regulation, since that aspect of the dispute in the main proceedings must still, according to the information provided in that request, be the subject of an exchange of arguments, the fact remains that that court found that neither the arrangement on the joint processing of the data nor the records of processing activities, which are referred to in the latter two provisions, have been produced by the Federal Office as controller, despite the request that the referring court has made to it for this purpose.
44 Furthermore, it is apparent from the order for reference that, in the opinion of that court, which alone is responsible for establishing and assessing the facts, the decision at issue was adopted solely on the basis of the electronic file compiled by the Federal Office, the holding and transmission of which could infringe the rules laid down by that regulation, with the result that that decision might have to be annulled on that ground.
45 Lastly, as regards the consent of the applicant in the main proceedings to the use of his personal data in the context of the court proceedings, it is sufficient to note that the third question referred for a preliminary ruling seeks specifically to determine whether it is necessary, in the present case, for such consent to be expressed in order for the referring court to be authorised to take those data into consideration.
46 In those circumstances, where the Court receives a request for interpretation of EU law which is manifestly not unrelated to the reality or the subject matter of the main proceedings and it has the necessary information in order to give appropriate answers to the questions put to it in relation to the effect of the GDPR on the main proceedings, it must reply to that request and is not required to consider the facts as presumed by the referring court or tribunal, a presumption which it is for the referring court or tribunal to verify subsequently if that should prove to be necessary (see, by analogy, judgment of 17 July 2008, Coleman, C‑303/06, EU:C:2008:415, paragraph 31 and the case-law cited).
47 Consequently, it must be held that the present request for a preliminary ruling is admissible and that it is necessary to answer the questions submitted by the referring court, it being understood that it is, however, for that court to ascertain whether the Federal Office has failed to comply with the obligations laid down in Articles 26 and 30 of the GDPR.
Substance
The first question
48 By its first question, the referring court asks, in essence, whether Article 17(1)(d) and Article 18(1)(b) of the GDPR must be interpreted as meaning that failure by the controller to comply with the obligations laid down in Articles 26 and 30 of that regulation, which relate, respectively, to the conclusion of an arrangement determining joint responsibility for processing and to the maintenance of a record of processing activities, constitutes unlawful processing conferring on the data subject a right to erasure or restriction of processing, where such a failure entails an infringement by the controller of the principle of ‘accountability’ as set out in Article 5(2) of that regulation.
49 According to the Court’s settled case-law, in interpreting a provision of EU law it is necessary to consider not only its wording but also its context and the objectives pursued by the legislation of which it forms part (see to that effect, inter alia, judgment of 12 January 2023, Nemzeti Adatvédelmi és Információszabadság Hatóság, C‑132/21, EU:C:2023:2, paragraph 32 and the case-law cited).
50 As regards, in the first place, the wording of the relevant provisions of EU law, it should be recalled that, in accordance with Article 17(1)(d) of the GDPR, the data subject is to have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller is to have the obligation to erase that data without undue delay where those data have been ‘unlawfully processed’.
51 Similarly, under Article 18(1)(b) of the GDPR, if the data subject opposes the erasure of such data and requests the restriction of their use instead, he or she is to have the right to obtain from the controller restriction of processing where the ‘processing is unlawful’.
52 The provisions mentioned in the two preceding paragraphs must be read in conjunction with Article 5(1) of that regulation, according to which processing of personal data must comply with a number of principles which are set out in that provision, including that set out in Article 5(1)(a) of that regulation, which specifies that personal data is to be processed ‘lawfully, fairly and in a transparent manner in relation to the data subject’.
53 Under Article 5(2) of the GDPR, the controller, in accordance with the principle of ‘accountability’ laid down in that provision, is responsible for compliance with paragraph 1 of that article and must be able to demonstrate its compliance with each of the principles set out in paragraph 1 of that article, the burden of such proof thus being placed on it (see, to that effect, judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes), C‑175/20, EU:C:2022:124, paragraphs 77, 78 and 81).
54 It follows that, pursuant to paragraph 2 of Article 5 of that regulation, read in conjunction with paragraph 1(a) of that article, the controller must ensure that the processing of the data which it carries out is ‘lawful’.
55 It should be noted that the lawfulness of processing is precisely the subject, as is apparent from its actual title, of Article 6 of the GDPR, which provides that processing is to be lawful only if at least one of the conditions set out in points (a) to (f) of the first subparagraph of paragraph 1 of that article is met, namely, as is also apparent from recital 40 of that regulation, either that the data subject has given consent to the processing of his or her personal data for one or more specific purposes, or that processing is necessary for one of the purposes referred to, which relate, respectively, to the performance of a contract to which the data subject is party or to the taking of steps at the request of the data subject prior to entering into a contract, compliance with a legal obligation to which the controller is subject, the protection of the vital interests of the data subject or of another natural person, the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller and the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
56 That list of cases in which the processing of personal data may be regarded as lawful is exhaustive and restrictive, so that, in order that it can be regarded as lawful, processing must fall within one of the cases provided for in the first subparagraph of Article 6(1) of the GDPR (see, to that effect, judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 99 and the case-law cited, and of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation), C‑180/21, EU:C:2022:967, paragraph 83).
57 Thus, according to the case-law of the Court, any processing of personal data must comply with the principles relating to the processing of data which are set out in Article 5(1) of that regulation and satisfy the conditions governing lawfulness of the processing which are listed in Article 6 of that regulation (see, inter alia, judgments of 6 October 2020, La Quadrature du Net and Others, C‑511/18, C‑512/18 and C‑520/18, EU:C:2020:791, paragraph 208; of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 96; and of 20 October 2022, Digi, C‑77/21, EU:C:2022:805, paragraphs 49 and 56).
58 Furthermore, in so far as Articles 7 to 11 of the GDPR, which appear, like Articles 5 and 6 thereof, in Chapter II of that regulation, which chapter relates to principles, are intended to clarify the scope of the data controller’s obligations under Article 5(1)(a) and Article 6(1) of that regulation, the processing of personal data, in order to be lawful, must also comply, as is apparent from the Court’s case-law, with those other provisions of that chapter which concern, in essence, consent, processing of special categories of sensitive personal data and processing of personal data relating to criminal convictions and offences (see, to that effect, judgments of 24 September 2019, GC and Others (De-referencing of sensitive data), C‑136/17, EU:C:2019:773, paragraphs 72 to 75, and of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraphs 100, 102 and 106).
59 It should be noted, as all the governments that have lodged written observations and the European Commission have done, that compliance by the controller with the obligation laid down in Article 26 of the GDPR to conclude an arrangement determining joint responsibility for processing and the obligation to maintain a record of processing activities laid down in Article 30 of that regulation is not among the grounds for lawfulness of processing which are set out in the first subparagraph of Article 6(1) of that regulation.
60 In addition, unlike Articles 7 to 11 of the GDPR, Articles 26 and 30 of that regulation are not intended to clarify the scope of the requirements set out in Article 5(1)(a) and Article 6(1) of that regulation.
61 It follows, therefore, from the actual wording of Article 5(1)(a) and the first subparagraph of Article 6(1) of the GDPR that infringement by the controller of the obligations laid down in Articles 26 and 30 of that regulation does not constitute ‘unlawful processing’ within the meaning of Article 17(1)(d) and Article 18(1)(b) of that regulation, which would stem from the controller’s infringement of the principle of ‘accountability’ as set out in Article 5(2) of that regulation.
62 That interpretation is supported, in the second place, by the context of which those various provisions form part. It is clear from the very structure of the GDPR and, therefore, from its scheme that it distinguishes between, on the one hand, the ‘principles’, which are the subject of Chapter II thereof, which contains, inter alia, Articles 5 and 6 of that regulation, and, on the other hand, the ‘general obligations’, which form part of Section 1 of Chapter IV of that regulation relating to controllers, which include the obligations referred to in Articles 26 and 30 of that regulation.
63 That distinction is, moreover, reflected in Chapter VIII of the GDPR relating to penalties, since infringements of Articles 26 and 30 of that regulation, on the one hand, and those of Articles 5 and 6 thereof, on the other hand, are subject, respectively, in paragraphs 4 and 5 of Article 83 of that regulation, to administrative fines up to a certain amount, which differs according to the paragraph concerned on account of the degree of gravity of those respective infringements which is recognised by the EU legislature.
64 In the third and last place, the literal interpretation of the GDPR set out in paragraph 61 of the present judgment is supported by the objective pursued by that regulation, as set out in Article 1 thereof and recitals 1 and 10 thereof, which consists, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data, as enshrined in Article 8(1) of the Charter of Fundamental Rights of the European Union and Article 16(1) TFEU. (see, to that effect, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20, EU:C:2022:601, paragraph 125 and the case-law cited).
65 The absence of an arrangement determining joint responsibility, pursuant to Article 26 of the GDPR, or of a record of processing activities, within the meaning of Article 30 of that regulation, is not sufficient in itself to establish the existence of an infringement of the fundamental right to the protection of personal data. In particular, while it is true that, as is apparent from recitals 79 and 82 of that regulation, the clear allocation of the responsibilities between joint controllers and the record of processing activities are means of ensuring that those controllers comply with the guarantees laid down by that regulation for the protection of the rights and freedoms of data subjects, the fact remains that the absence of such a record or of such an arrangement does not demonstrate, in itself, that those rights and freedoms have been infringed.
66 It follows that an infringement of Articles 26 and 30 of the GDPR by the controller does not constitute ‘unlawful processing’ within the meaning of Article 17(1)(d) or Article 18(1)(b) of that regulation, read in conjunction with Article 5(1)(a) and the first subparagraph of Article 6(1) thereof, conferring on the data subject a right to erasure or restriction of processing.
67 As all the governments which have lodged written observations and the Commission have argued, such an infringement must therefore be remedied by recourse to other measures provided for by the GDPR, such as the adoption, by the supervisory authority, of ‘corrective powers’, within the meaning of Article 58(2) of that regulation, in particular, in accordance with point (d) of that provision, the bringing of processing operations into compliance, the lodging of a complaint with the supervisory authority, in accordance with Article 77(1) of that regulation, or compensation for any damage caused by the controller, pursuant to Article 82 thereof.
68 Lastly, in view of the concerns expressed by the referring court, it should also be stated that the fact that, in the present case, the imposition of an administrative fine, pursuant to Article 58(2)(i) and Article 83 of the GDPR, is said to be precluded since national law prohibits such a penalty against the Federal Office is not such as to prevent the effective enforcement of that regulation. It is sufficient to note, in that regard, that Article 83(7) of that regulation expressly confers on Member States the power to provide whether and to what extent such fines may be imposed on public authorities or bodies. Moreover, the various alternative measures provided for by the GDPR, recalled in the preceding paragraph, make it possible to ensure such effective enforcement.
69 Consequently, the answer to the first question is that Article 17(1)(d) and Article 18(1)(b) of the GDPR must be interpreted as meaning that failure by the controller to comply with the obligations laid down in Articles 26 and 30 of that regulation, which relate, respectively, to the conclusion of an arrangement determining joint responsibility for processing and to the maintenance of a record of processing activities, does not constitute unlawful processing conferring on the data subject a right to erasure or restriction of processing, where such a failure does not, as such, entail an infringement by the controller of the principle of ‘accountability’ as set out in Article 5(2) of that regulation, read in conjunction with Article 5(1)(a) and the first subparagraph of Article 6(1) thereof.
The second question
70 In the light of the answer given to the first question, there is no need to answer the second question.
The third question
71 By its third question, the referring court asks, in essence, whether EU law must be interpreted as meaning that, where the controller of personal data has failed to comply with its obligations under Articles 26 or 30 of the GDPR, the lawfulness of the taking into account of such data by a national court is subject to the consent of the data subject.
72 In that regard, it should be noted that it is clear from the actual wording of the first subparagraph of paragraph 1 of Article 6 of that regulation that the data subject’s consent, referred to in point (a) of that subparagraph, is only one of the grounds for lawfulness of processing, such consent not however being required by the other grounds for lawfulness set out in points (b) to (f) of that subparagraph, which grounds are based, in essence, on the need for processing for the attainment of specified purposes (see, by analogy, judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C‑708/18, EU:C:2019:1064, paragraph 41).
73 Where a court or tribunal exercises the judicial powers conferred on it by national law, the processing of personal data which that court or tribunal is called upon to carry out must be regarded as necessary for the purpose set out in point (e) of the first subparagraph of Article 6(1) of that regulation, relating to the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
74 Since, first, it is sufficient that one of the conditions laid down in Article 6(1) of the GDPR is satisfied in order for the processing of personal data to be regarded as lawful and, second, as was concluded in paragraph 61 of the present judgment, infringement of Articles 26 and 30 of that regulation does not constitute unlawful processing, the taking into account, by the referring court, of personal data which have been processed by the Federal Office in breach of the obligations laid down in those articles is not subject to the data subject’s consent.
75 Consequently, the answer to the third question is that EU law must be interpreted as meaning that, where the controller of personal data has failed to comply with its obligations under Articles 26 or 30 of the GDPR, the lawfulness of the taking into account of such data by a national court is not subject to the data subject’s consent.
Costs
76 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Fifth Chamber) hereby rules:
1. Article 17(1)(d) and Article 18(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
must be interpreted as meaning that failure by the controller to comply with the obligations laid down in Articles 26 and 30 of that regulation, which relate, respectively, to the conclusion of an arrangement determining joint responsibility for processing and to the maintenance of a record of processing activities, does not constitute unlawful processing conferring on the data subject a right to erasure or restriction of processing, where such a failure does not, as such, entail an infringement by the controller of the principle of ‘accountability’ as set out in Article 5(2) of that regulation, read in conjunction with Article 5(1)(a) and the first subparagraph of Article 6(1) thereof.
2. EU law must be interpreted as meaning that, where the controller of personal data has failed to comply with its obligations under Articles 26 or 30 of Regulation 2016/679, the lawfulness of the taking into account of such data by a national court is not subject to the data subject’s consent.
[Signatures]
* Language of the case: German.
© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.
BAILII: