Nemzeti Adatvedelmi es Informacioszabadsag Hatosag (Protection of natural persons with regard to the processing of personal data - Complaint to a supervisory authority - Judicial remedies - Opinion) [2022] EUECJ C-132/21_O

1.

The present request for a preliminary ruling concerns the interpretation of Article 51(1), Article 52(1), Article 77(1) and Article 79(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). ( 2 )

2.

The request has been made in proceedings between BE and the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority responsible for data protection and the freedom of information, Hungary; ‘the supervisory authority’) concerning the refusal of BE’s request to be provided with extracts from the sound recording of a general meeting of shareholders in which he had participated.

3.

The GDPR is intended to ensure the effective application of the rules on the protection of personal data, by providing for a system of remedies that will allow a data subject to lodge a complaint with a supervisory authority, to seek a judicial remedy against the decision taken by that authority and a judicial remedy against a controller or his or her processor, if the data subject considers that the rights which that regulation confers on him or her have been infringed as a result of his or her personal data having been processed in breach of that regulation.

4.

The Fővárosi Törvényszék (Budapest High Court, Hungary) wishes to obtain guidance from the Court on the relationship between those two remedies and, more specifically, on how to prevent contradictory decisions concerning the existence of a breach of the rights protected by the GDPR being delivered within a Member State.

5.

That question is of great importance, in so far as the EU legislature’s intention to ensure effective judicial protection of the rights conferred by the GDPR and to guarantee a high-level and consistent protection of those rights does not appear to be compatible with the existence of contradictory decisions within a Member State, which gives rise to legal uncertainty.

6.

In this Opinion, I shall propose that the Court should rule that Article 78(1) of the GDPR, read with Article 47 of the Charter of Fundamental Rights of the European Union, ( 3 ) must be interpreted as meaning that, where a data subject exercises the remedies provided for in Article 77(1) and Article 79(1) of that regulation, the court required to hear and determine an action against the decision of a supervisory authority is not bound by the decision adopted by a court seised on the basis of the latter provision as to whether there has been an infringement of the rights which that data subject derives from that regulation.

7.

With that in mind, I shall set out the reasons why Article 77(1) and Article 79(1) of the GDPR must in my view be interpreted as meaning that the remedies which they provide for may be exercised in parallel, neither remedy having priority over the other under that regulation.

8.

I shall supplement that answer by explaining that, in the absence of EU rules applicable to the relationship between the remedies provided for in Articles 77 to 79 of the GDPR, it is for the Member States, in application of the principle of procedural autonomy and in the light of both the objective of guaranteeing a high and consistent level of protection of the rights conferred by that regulation and the right to an effective judicial remedy, enshrined in Article 47 of the Charter, to put in place at national level the mechanisms governing the relationship between those remedies that are necessary in order to ensure that contradictory decisions concerning the same processing of personal data cannot exist within the same Member State.

9.

Article 51(1) of the GDPR provides:

‘Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (“supervisory authority”).’

10.

In the words of Article 52(1) of the GDPR:

‘Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation.’

11.

Article 58(4) of the GDPR provides:

‘The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.’

12.

Article 77 of the GDPR, entitled ‘Right to lodge a complaint with a supervisory authority’, is worded as follows:

‘1.   Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

2.   The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.’

13.

Article 78 of the GDPR is entitled ‘Right to an effective judicial remedy against a supervisory authority’. Under paragraph 1 of that article:

‘Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.’

14.

Article 79 of the GDPR is entitled ‘Right to an effective judicial remedy against a controller or processor’. Paragraph 1 of that article is worded as follows:

‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.’

15.

Paragraph 22 of the információs önrendelkezési jogról és az információszabadságról szóló 2011. évi CXII. törvény (Law No CXII of 2011 on the right to self-determination as regards information and freedom of information; ‘the Law on information’), ( 4 ) of 26 July 2011, provides:

‘In the exercise of his or her rights, the data subject may in accordance with the provisions of Chapter VI:

16.

Paragraph 23 of the Law on information states:

‘(1)   The data subject may bring a legal action against the controller or the processor – in connection with processing operations falling within the latter’s sphere of activity – in the case where he or she considers that, in processing his or her personal data, the controller, or, where appropriate his or her agent or the processor acting under his or her orders, has infringed provisions on the processing of personal data which are laid down in legislation or in a binding legal act of the European Union. …

…

(4)   Court proceedings shall also be open to participation by persons who otherwise lack locus standi. The [supervisory authority] may intervene in those proceedings in support of the claims pursued by the data subject.

(5)   If the court upholds the action, it shall find that an infringement has been committed and order the controller, or, where appropriate the processor, to:

and at the same time give judgment on any claims for damages for material and non-material harm.’

17.

After having attended the general meeting of 26 April 2019 of the limited company of which he is a shareholder, BE requested that company to communicate to him the sound recording made during the meeting.

18.

The company, as controller of the processing of those data, provided BE only with the extracts from the recording reproducing his contributions, and not those of the other participants.

19.

BE wished to have the extracts reproducing the participants’ replies to the questions which he had asked during the general meeting held on 26 April 2019 and asked the supervisory authority to declare that the company’s conduct was unlawful and to order it to communicate those extracts. The supervisory authority refused that request by decision of 29 November 2019.

20.

Following the refusal of his request, BE brought an action against the supervisory authority’s decision before the referring court, on the basis of Article 78(1) of the GDPR, seeking, principally, the variation or, in the alternative, the annulment of that decision.

21.

In parallel to the action before the supervisory authority, BE brought an action before a civil court against the controller, on the basis of Article 79(1) of the GDPR.

22.

When the action was still pending before the referring court, the Fövárosi Ítélötábla (Budapest Regional Court of Appeal, Hungary) upheld the action brought by BE on the basis of that provision, finding that the controller had infringed BE’s right of access to his personal data by not making available to him, in spite of his request, the parts of the sound recording containing the answers to his questions. ( 5 ) That judgment, delivered by a civil court of second instance, has become final.

23.

In his action before the referring court, BE asks that the finding of that civil court be taken into account in its decision.

24.

The referring court seeks to ascertain whether lessons may be learned from EU law as regards the relationship between the respective competences of, on the one hand, the supervisory authority dealing with a complaint, on the basis of Article 77(1) of the GDPR, and the administrative court with jurisdiction, under Article 78(1) of that regulation, to review the lawfulness of decisions taken by that authority and, on the other, the civil court which, under Article 79(1) of that regulation, is competent to adjudicate on an action brought by a person who considers that there has been a breach of the rights which he or she derives from that regulation.

25.

The referring court observes that the exercise in parallel of the remedies provided for in those provisions is liable to lead to the adoption of contrary decisions in respect of the same facts.

26.

According to the referring court, such a situation is liable to entail a risk of legal insecurity. It observes in that regard that, according to the national procedural rules, the decision of the supervisory authority is not binding on the civil court. Therefore, it cannot be precluded that the civil court may, on the basis of the same facts, deliver a decision contrary to that adopted by the supervisory authority.

27.

The referring court states that, in the present case, in accordance with the national procedural rules, the conditions on which the supervisory authority may intervene before the civil court were not satisfied. Furthermore, according to those rules, the decision of a civil court is not binding on an administrative court in the context of the review of the lawfulness of the decision of the supervisory authority which it must carry out, in accordance with Article 78(1) of the GDPR.

28.

In so far as the supervisory authority and the civil court which adjudicated at last instance adopted contrary decisions on the existence of a breach of the rules on personal data protection, the referring court seeks to ascertain whether any aspects of EU law make it possible to determine the relationship between remedies which are exercised in parallel. It mentions, by way of comparison, the rules which exist in the field of competition law. ( 6 )

29.

The referring court also observes that, unlike the circumstances that gave rise to the judgment of 27 September 2017, Puškár, ( 7 ) under the Hungarian legislation legal action is not conditional on the prior exhaustion of the available administrative remedies.

30.

However, the right to an effective remedy and the objective of guaranteeing a high level of protection of the rights conferred by the GDPR mean that consistency must be ensured in the application of that regulation. In order to achieve that result, it is necessary to determine which of the remedies that may be exercised in parallel must take priority.

31.

In that regard, the referring court states that it agrees with the supervisory authority’s opinion that the power provided for in Article 51(1) of the GDPR and the tasks and powers provided for in Article 57(1)(a) to (f) and Article 58(2)(b) and (c), respectively, of that regulation confer on the supervisory authority priority competence for the purposes of investigating and overseeing compliance with the obligations laid down in that regulation. It therefore proposes that the Court give an interpretation to the effect that, where proceedings are pending or have been concluded before the supervisory authority in respect of the same infringement, the decision of that authority – in the same way as the decision of the administrative court which has reviewed the lawfulness of that decision – should take priority for the purpose of resolving the question of the existence of a breach of the rules laid down in the GDPR. Consequently, in the referring court’s view, the findings of the civil courts, acting on the basis of Article 79 of the GDPR, are not binding in proceedings brought under Articles 77 and 78 of that regulation.

32.

If, on the contrary, the primacy of the competence of the supervisory authority to find a breach of the rights conferred by the GDPR were not recognised, the referring court is of the view that, in the light of the principle of legal certainty, it would have to consider itself bound by the findings made in the final decision of the civil court, without assessing for itself the lawfulness of the findings made by the supervisory authority in its decision as to the existence of such a breach. The referring court considers that that would amount to depriving the competence provided for in Article 78 of that regulation of all substance.

33.

In the light of those factors, the Fővárosi Törvényszék (Budapest High Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

34.

Written observations have been lodged by BE, the supervisory authority, the Hungarian, Czech, Italian and Polish Governments and also by the European Commission. A hearing was held on 11 May 2022, in which the supervisory authority, the Hungarian and Polish Governments and the Commission took part.

35.

As a preliminary point, it should be borne in mind that, according to settled case-law, it is for the Court, in the procedure laid down by Article 267 TFEU providing for cooperation with national courts, to provide the national court with an answer which will be of use to it and enable it to decide the case before it and, to that end, the Court should, where necessary, reformulate the questions referred to it. ( 8 )

36.

In addition, it should be borne in mind that the Court has consistently held that the fact that a question submitted by the referring court refers only to certain provisions of EU law does not mean that the Court may not provide the national court with all the guidance on points of interpretation that may be of assistance in adjudicating on the case pending before it, whether or not that court has referred to those points in its questions. It is, in that regard, for the Court to extract from all the information provided by the referring court, in particular from the grounds of the decision to make the reference, the points of EU law which require interpretation in view of the subject matter of the dispute. ( 9 )

37.

I note that the referring court is currently hearing an action against a decision of the supervisory authority rejecting BE’s complaint, which corresponds to the remedy referred to in Article 78(1) of the GDPR.

38.

In order to be able to determine that action, the referring court wishes to obtain guidance from the Court on the relationship between, on the one hand, the complaint lodged with a supervisory authority under Article 77(1) of that regulation and, on the other, the remedies provided for in Article 78(1) and Article 79(1) of that regulation.

39.

In concrete terms, at this stage of the national proceedings, the referring court wishes to ascertain the discretion which it has in the context of the review of the lawfulness of the supervisory authority’s decision which it must carry out, in application of Article 78(1) of the GDPR, in the light of the fact that a civil court, hearing an action brought under Article 79(1) of that regulation, has reached a decision contrary to that adopted by the supervisory authority on a complaint based on Article 77(1) of that regulation.

40.

In those circumstances, it must in my view be considered that, by its questions, the referring court is asking the Court, in essence, to rule on whether Article 78(1) of the GDPR must be interpreted as meaning that, where a data subject exercises the remedies provided for in Article 77(1) and Article 79(1) of that regulation, the court dealing with an action against the decision of a supervisory authority is bound by the position adopted by a court seised on the basis of the latter provision as to the existence of an infringement of the rights which the data subject derives from that regulation.

41.

It is apparent from the order for reference that, from the referring court’s viewpoint, in order to answer that question it is necessary to determine whether, in the context of the review of the lawfulness of the decision of the supervisory authority which it must carry out, that court must take account, where the remedies provided for in Article 77(1) and Article 79(1) of the GDPR are exercised in parallel, of any priority which the former remedy may have over the latter remedy as regards the finding of an infringement of the rights protected by that regulation.

42.

With a view to answering the referring court’s questions, it should be borne in mind that it is settled case-law that, in order to interpret a provision of EU law, it is appropriate to take into account its wording and the objectives of the regulations of which it forms part. ( 10 )

43.

As regards the wording of Articles 77 to 79 of the GDPR, I observe that it follows from paragraph 1 of those articles, first, that the right to lodge a complaint is ‘without prejudice to any other administrative or judicial remedy’ and, second, that the right to bring an action against the decision of a supervisory authority is ‘without prejudice to any other administrative or non-judicial remedy’.

44.

It is therefore clear from the wording of those provisions that the remedies for which they make provision may be exercised in parallel. Furthermore, no rule governing the relationship between those remedies was laid down by the EU legislature in those provisions. To my mind, therefore, it cannot be inferred from the GDPR that any one remedy takes priority over the others for the purpose of establishing an infringement of the rights protected by that regulation.

45.

In particular, while it is true that, as follows more specifically from Article 51(1) of the GDPR, the supervisory authorities are to be responsible for overseeing the application of that regulation, in particular in order to protect the fundamental rights of natural persons as regards the processing of their personal data, in no provision of that regulation is it stated that those authorities are to have priority competence by comparison with the courts to find that there has been an infringement of those rights.

46.

The EU legislature thus wished to provide data subjects with a complete system of remedies, in which the right to a judicial remedy and the possibility of exercising an administrative or non-judicial remedy coexist independently, neither remedy being subsidiary to the other. Data subjects may thus seek legal protection by lodging, in particular, a complaint with a supervisory authority, then, where appropriate, by challenging the decision taken by that authority before a court, and/or directly exercising a judicial remedy against a controller or his or her processor. Although the supervisory authority and the court(s) seised may make different findings of law as to whether there has been an infringement of the rules laid down by the GDPR, it must be emphasised that the EU legislature has not put in place suitable mechanisms to counter that risk, since it has not defined the rules governing the relationship between the remedies provided for in Articles 77 to 79 of that regulation.

47.

In that regard, it follows from the wording of that regulation that, although the EU legislature wished to lay down rules relating to the relationship between, on the one hand, complaints lodged with supervisory authorities in different Member States and, on the other, actions brought before courts in different Member States, it did not wish to lay down such rules as regards the implementation of the remedies within one and the same Member State.

48.

I note, in that respect, that, in Chapter VII, entitled ‘Cooperation and consistency’, the GDPR sets out mechanisms for mutual assistance between the supervisory authorities of the different Member States, aimed at ensuring the consistency of the decisions taken by those authorities. Furthermore, Article 81 of that regulation, entitled ‘Suspension of proceedings’, provides, in paragraph 2, that, ‘where proceedings concerning the same subject matter as regards processing of the same controller or processor are pending in a court in another Member State, any competent court other than the court first seised may suspend its proceedings’. In addition, under Article 81(3) of that regulation, ‘where those proceedings are pending at first instance, any court other than the court first seised may also, on the application of one of the parties, decline jurisdiction if the court first seised has jurisdiction over the actions in question and its law permits the consolidation thereof’.

49.

I note that such a possibility of suspending the proceedings or declining jurisdiction is not provided for where a complaint to a supervisory authority and judicial remedies are brought within the same Member State in relation to the same processing of personal data.

50.

It follows from the above that, in the context of the review of lawfulness of the decision taken by a supervisory authority which it must carry out in application of Article 78(1) of the GDPR, a national court is not required, under that regulation, to recognise either a priority competence of that authority or of a court seised on the basis of Article 79(1) of that regulation, nor a primacy of the finding made by that authority or that court as to whether there has been an infringement of the rights conferred by that regulation.

51.

A solution to the contrary would in my view run counter to the right to an effective remedy which a person challenging the decision adopted by a supervisory authority must enjoy.

52.

It follows, in fact, from the wording of Article 78(1) of the GDPR that that provision confers on each natural or legal person ‘the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them’. That provision echoes Article 58(4) of that regulation, from which it follows that the exercise of the powers conferred on the supervisory authority is to be subject to safeguards such as the right to an effective judicial remedy. ( 11 ) As the Court has already held, Article 47 of the Charter finds expression, in the sphere of personal data protection, in the right, provided for in Article 78(1) of the GDPR, of each natural or legal person to an effective judicial remedy against a legally binding decision of a supervisory authority concerning that natural or legal person. ( 12 )

53.

That right to an effective judicial remedy means that the court seised of an action against the decision of a supervisory authority, on the basis of Article 78(1) of the GDPR, must, as stated in recital 143 of that regulation, ‘exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before [it]’. That to my mind has the consequence that the court must be free to assess the lawfulness of the decision which it is required to review and, in order to be able do so, it must not be bound by any finding previously made by a court seised on the basis of Article 79(1) of the GDPR as to whether there has been an infringement of the rules laid down in that regulation.

54.

Therefore, although the court seised on the basis of Article 78(1) of the GDPR to review the lawfulness of a decision adopted by a supervisory authority must have unlimited freedom of appraisal to establish whether there has been an infringement of the rules laid down in that regulation, that is not to my mind because of an alleged priority of the supervisory authority, then, where appropriate, of that court to make that finding, but rather because of the right to an effective remedy, enshrined in Article 47 of the Charter, which means that that court should be in a position to review freely and in complete independence the lawfulness of the decision taken by that authority.

55.

As regards the objectives pursued by the GDPR, I note that the EU legislature’s decision to leave to data subjects the option to exercise in parallel the remedies provided for in Articles 77 to 79 of that regulation is consistent with the objective of that regulation, which is to guarantee a high level of protection of the rights conferred by that regulation.

56.

In that regard, as is clear from Article 1(2) of the GDPR, read with recitals 10, 11 and 13 thereof, that regulation requires the European Union institutions, bodies, offices and agencies, and the competent authorities of the Member States, to ensure a high level of protection of the rights guaranteed in Article 16 TFEU and Article 8 of the Charter. ( 13 )

57.

It should be made clear, however, that, as illustrated by the present case, the possibility afforded by the GDPR to bring parallel actions in respect of the same processing of personal data may present a disadvantage, namely the legal uncertainty that arises when contradictory decisions are reached in the same Member State. As I have pointed out above, while the risk of contradictory decisions between the supervisory authorities or the courts of different Member States was addressed by the EU legislature in that regulation, the same does not apply where such decisions are adopted within one and the same Member State.

58.

In those circumstances, it is for each Member State to put in place the procedural tools that make it possible to ensure, as much as possible, that contradictory decisions are not adopted in relation to the same processing of personal data.

59.

I recall, in that regard, that, in the absence of EU rules on the matter, it is, in accordance with the principle of procedural autonomy, for the national legal order of each Member State to establish procedural rules for the remedies provided for in Articles 77 to 79 of the GDPR, on condition, however, that those rules are not – in situations governed by EU law – less favourable than in similar domestic situations (the principle of equivalence) and that they do not make it impossible in practice or excessively difficult to exercise the rights conferred by EU law (the principle of effectiveness). ( 14 )

60.

In that context, and according to settled case-law, it is for the courts of the Member States, in application of the principle of sincere cooperation set out in Article 4(3) TEU, to ensure judicial protection of a person’s rights under EU law, Article 19(1) TEU, requiring, moreover, Member States to provide remedies sufficient to ensure effective judicial protection in the fields covered by EU law. ( 15 )

61.

Consequently, when they set out detailed procedural rules for legal actions intended to ensure the protection of rights conferred by the GDPR, the Member States must ensure compliance with the right to an effective remedy and to a fair hearing, enshrined in Article 47 of the Charter, which constitutes a reaffirmation of the principle of effective judicial protection. ( 16 )

62.

The characteristics of the legal remedies provided for in that regulation must thus be determined in accordance with Article 47 of the Charter.

63.

To my mind, effective judicial protection does not consist solely in making available to data subjects the remedies necessary for the protection of the rights which they derive from the GDPR. Where a number of remedies which may be exercised in parallel exist side by side, it is also necessary to guarantee the legal certainty of the judicial protection obtained. In so far as contradictory decisions as to whether there has been an infringement of the rules laid down in that regulation would not be capable of ensuring the effective judicial protection of the data subjects, it is necessary for the Member State to put the necessary measures in place so that such contradictory measures may be avoided.

64.

If procedural mechanisms determining the relationship between the different remedies were not put in place by the Member States, the objectives pursued by the GDPR, which consist in ensuring the effective judicial protection of data subjects and a high and consistent level of protection of the rights conferred by that regulation, could not be fully achieved.

65.

In that regard, it follows from recital 10 of the GDPR that that regulation seeks, in particular, to ensure a consistent and homogeneous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data throughout the Union and to remove the obstacles to flows of personal data within the Union. ( 17 )

66.

That requirement of a consistent and homogeneous application of the rules laid down in the GDPR could be undermined if divergences in the levels of protection between Member States, which that regulation is meant to eliminate, were able to remain within one and the same Member State. That requirement must therefore be addressed not only at inter-State level, but also with respect to the decisions taken within each Member State.

67.

Each Member State must therefore ensure that the existence of remedies that may be exercised in parallel by data subjects does not call in question the effectiveness of the protection of the rights which the GDPR confers on them. It is for the Member States to choose which procedural remedies appear to them to be the most appropriate in order to determine the relationship between the remedies provided for in Articles 77 to 79 of that regulation.

68.

By way of illustration, the Member States might provide that data subjects were required to exhaust all administrative remedies before bringing judicial proceedings. ( 18 )

69.

The Member States might also provide that a court seised of an action under Article 79(1) of the GDPR, when a complaint procedure under Article 77(1) of that regulation or a legal action under Article 78(1) of that regulation is pending, may or must stay the proceedings pending before it and not give judgment until a decision has been taken in one or other of those procedures.

70.

I note that the Court has already held that the right of access to a court is not an absolute right and that it may thus entail proportionate restrictions which pursue a legitimate aim and do not undermine the very essence of that right. ( 19 ) A stay of proceedings may, in that respect, constitute a solution in order to avoid the adoption of contradictory decisions that may undermine legal certainty. ( 20 )

71.

In the light of all of the foregoing considerations, I propose that the Court should answer the questions for a preliminary ruling referred by the Fővárosi Törvényszék (Budapest High Court, Hungary) as follows: