22 That court notes that the parties disagree as to how the concept of ‘controller’ in point 7 of Article 4 of the GDPR should be interpreted in the case in the main proceedings, since the personal data contained in the passage at issue in the main proceedings, the publication of which was not required by law, have been processed by several potential ‘successive’ controllers. Those are, first, the notary who drew up the extract containing the passage at issue in the main proceedings and inserted those data by mistake, second, the registry of the court at which that extract was subsequently lodged before being sent on to the Moniteur belge for publication and, third, the Moniteur belge, which, in accordance with the legal provisions governing its status and tasks, published that extract as it stood, that is to say, without any power to review or amend it, after receiving it from that court.
23 In that context, the referring court is uncertain whether the Moniteur belge can be classified as a ‘controller’ within the meaning of point 7 of Article 4 of the GDPR. If it can be so classified, and while noting that the parties to the main proceedings do not rely on the joint responsibility provided for in Article 26 of the GDPR, that court also seeks to ascertain whether the Moniteur belge must be regarded as solely responsible, under Article 5(2) of that regulation, for compliance with the principles laid down in Article 5(1) of that regulation, or whether that responsibility is also incumbent cumulatively on the public bodies that had previously processed the data contained in the passage at issue in the main proceedings, namely the notary who drew up the extract containing that passage and the Companies Court within the territorial jurisdiction of which the private limited liability company concerned has its seat.
24 In those circumstances, the cour d’appel de Bruxelles (Court of Appeal, Brussels) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Must [point 7 of] Article 4 … of the [GDPR] be interpreted as meaning that a Member State’s official [journal] - vested with a public task of publishing and archiving official documents, which, under the applicable national legislation, is responsible for publishing official documents whose publication is ordered by third-party public bodies, as they stand when received from those bodies after the latter have themselves processed the personal data contained in those documents, without the national legislature having granted the official [journal] any discretion over the content of the documents to be published or the [purposes] and means of publication - has the status of data controller?
(2) If the answer to Question 1 is in the affirmative, must Article 5(2) of the [GDPR] be interpreted as meaning that only the official [journal] in question need comply with the data controller’s responsibilities under that provision, to the exclusion of the third-party public bodies which have previously processed the data contained in the official documents whose publication they are requesting, or are those responsibilities incumbent cumulatively on each of the successive controllers?’
Consideration of the questions referred
The first question
25 By its first question, the referring court asks, in essence, whether point 7 of Article 4 of the GDPR must be interpreted as meaning that the agency or body responsible for the official journal of a Member State, which is inter alia required, under the law of that State, to publish as they stand official acts and documents that have been prepared by third parties under their own responsibility in compliance with the applicable rules, then lodged with a judicial authority that sends them to it for publication, may be classified as a ‘controller’ of the personal data contained in those acts and documents within the meaning of that provision.
26 As a preliminary point, it should be noted that the concept of ‘controller’, set out in point 7 of Article 4 of the GDPR, presupposes the existence of ‘processing’ of personal data, within the meaning of point 2 of Article 4 of that regulation. In the present case, it is apparent from the order for reference that the personal data contained in the passage at issue in the main proceedings were processed by the Moniteur belge. Even though the referring court does not set out the details of that processing, it is apparent from the concurring written observations of the DPA and the Belgian Government that those data were at the very least collected, recorded, stored, disclosed by transmission and disseminated by the Moniteur belge, such operations constituting ‘processing’ within the meaning of point 2 of Article 4 of that regulation.
27 With that preliminary point in mind, it must be recalled that, under point 7 of Article 4 of the GDPR, the concept of ‘controller’ covers natural or legal persons, public authorities, agencies or other bodies which, alone or jointly with others, determine the purposes and means of the processing of personal data. That provision also states that, where the purposes and means of such processing are determined, inter alia, by the law of a Member State, the controller may be nominated or the specific criteria for its nomination may be provided for by that law.
28 In that regard, it should be borne in mind that, according to the case-law of the Court, that provision is intended to ensure, through a broad definition of the concept of ‘controller’, effective and complete protection of data subjects (see, to that effect, judgments of 5 December 2023, Nacionalinis visuomenės sveikatos centras, C‑683/21, EU:C:2023:949, paragraph 29, and of 5 December 2023, Deutsche Wohnen, C‑807/21, EU:C:2023:950, paragraph 40 and the case-law cited).
29 Having regard to the wording of point 7 of Article 4 of the GDPR, read in the light of that objective, it appears that, in order to establish whether a person or entity is to be classified as a ‘controller’ within the meaning of that provision, it must be examined whether that person or entity determines, alone or jointly with others, the purposes and means of the processing or whether those purposes and means are determined by national law. Where such determination is made by national law, it must then be ascertained whether that law nominates the controller or provides for the specific criteria for its nomination.
30 In that regard, it must be stated that, having regard to the broad definition of the concept of ‘controller’ within the meaning of point 7 of Article 4 of the GDPR, the determination of the purposes and means of the processing and, where appropriate, the nomination of that controller by national law may not only be explicit but also implicit. In the latter case, that determination must nevertheless be derived with sufficient certainty from the role, task and powers conferred on the person or entity concerned. The protection of those persons would be undermined if point 7 of Article 4 of the GDPR were interpreted restrictively to cover only those cases in which the purposes and means of the data processing performed by a person, a public authority, an agency or a body are expressly determined by national law, even where those purposes and means are apparent, in essence, from the legal provisions governing the activity of the entity concerned.
31 In the present case, first, the referring court states that, in the case in the main proceedings, the Moniteur belge does not appear to be vested by national law with the power to determine the purposes and means of the data processing operations that it performs, and the first question was referred on the basis of that premiss. Moreover, it is apparent from the concurring explanations of the DPA and the Belgian Government at the hearing that the public authority managing the Moniteur belge, namely the FPS Justice, does not appear to be vested by national law with such a power either.
32 Second, it is apparent from the documents before the Court that the personal data contained in the acts and documents sent to the Moniteur belge for publication are essentially collected, recorded, stored and published as they stand with a view to informing the public officially of the existence of those acts and documents and making them enforceable against third parties.
33 Moreover, it is apparent from the explanations provided by the referring court that the processing is performed essentially by automated means: in particular, the data concerned are reproduced on printed paper copies, one of which is stored electronically, the paper copies are reproduced in electronic format for the website of the Moniteur belge and a copy may be obtained through a telephone helpline also responsible for providing citizens with a document search help service.
34 It thus follows from the documents before the Court that Belgian law has determined, at least implicitly, the purposes and means of the processing of personal data performed by the Moniteur belge.
35 In those circumstances, it should be noted that the Moniteur belge may be considered, as an agency or body responsible for processing the personal data contained in its publications in accordance with the purposes and means of processing prescribed by Belgian law, to be the ‘controller’ within the meaning of point 7 of Article 4 of the GDPR.
36 That conclusion is not called into question by the fact that the Moniteur belge, as a subdivision of the FPS Justice, does not have legal personality. It is apparent from the clear wording of that provision that a controller may be not only a natural or legal person, but also a public authority, an agency or a body, and such entities do not necessarily have legal personality under national law.
37 Similarly, the fact that, under national law, the Moniteur belge does not check, prior to their publication in that official journal, the personal data contained in the acts and documents received by that official journal cannot have any bearing on the question whether the Moniteur belge may be classified as a controller.
38 While it is true that the Moniteur belge must publish the document in question as it stands, it is the Moniteur belge alone that undertakes that task and then disseminates the act or document concerned. The publication of such acts and documents without any possibility of checking or amending their content is intrinsically linked to the purposes and means of processing determined by national law, in that the role of an official journal such as the Moniteur belge is confined to informing the public of the existence of those acts and documents, as they stand when sent to that official journal in the form of copies in accordance with the applicable national law, so as to make them enforceable against third parties. Moreover, it would be contrary to the objective of point 7 of Article 4 of the GDPR, referred to in paragraph 28 of the present judgment, to exclude the official journal of a Member State from the concept of ‘controller’ on the ground that it does not exercise control over the personal data contained in its publications (see, by analogy, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 34).
39 In the light of the foregoing, the answer to the first question is that point 7 of Article 4 of the GDPR must be interpreted as meaning that the agency or body responsible for the official journal of a Member State, which is inter alia required, under the law of that State, to publish as they stand official acts and documents that have been prepared by third parties under their own responsibility in compliance with the applicable rules, then lodged with a judicial authority that sends them to it for publication, may, notwithstanding its lack of legal personality, be classified as a ‘controller’ of the personal data contained in those acts and documents, where the national law concerned determines the purposes and means of the processing of personal data performed by that official journal.
The second question
40 By its second question, the referring court asks, in essence, whether Article 5(2) of the GDPR must be interpreted as meaning that the agency or body responsible for the official journal of a Member State, classified as a ‘controller’ within the meaning of point 7 of Article 4 of the GDPR, must be regarded as solely responsible for compliance with the principles set out in Article 5(1) of the GDPR or whether such compliance is incumbent cumulatively on that agency or body and on the third-party public entities that have previously processed the personal data contained in the acts and documents published by that official journal.
41 First of all, it should be recalled that, under Article 5(2) of the GDPR, the controller is to be responsible for compliance with the principles laid down in the form of obligations in paragraph 1 of that article and must be able to demonstrate compliance with those principles.
42 In the present case, it is apparent from the documents before the Court that the processing of the personal data at issue in the main proceedings that was entrusted to the Moniteur belge is both subsequent to the processing performed by the notary and by the registry of the court having jurisdiction and technically different from the processing performed by those two entities in that it is additional to it. The operations performed by the Moniteur belge are entrusted to it by national legislation and involve inter alia the digital transformation of the data contained in the acts or extracts of acts submitted to it and the publication, the making widely available to the public and the storage of those data.
43 Therefore, the Moniteur belge must be considered to be responsible, under Article 5(2) of the GDPR, for compliance with the principles set out in paragraph 1 of that article, as regards the processing that it is required to perform under national law, and, accordingly, with all the obligations imposed on the controller by the GDPR.
44 Next, in view of the referring court’s doubts as to whether such an official journal is solely responsible for those processing operations, it should be recalled that, as is apparent from the wording of point 7 of Article 4 of the GDPR, that provision provides not only that the purposes and means of the processing of personal data may be determined jointly by several persons as controllers, but also that national law may itself determine those purposes and means and nominate the controller or provide for the specific criteria for its nomination.
45 Thus, in connection with a chain of processing operations that are performed by different persons or entities and relate to the same personal data, national law may determine the purposes and means of all the processing operations performed successively by those different persons or entities in such a way that they are regarded jointly as controllers.
46 Furthermore, it should be recalled that Article 26(1) of the GDPR provides for joint responsibility where two or more controllers jointly determine the purposes and means of the processing of personal data. That provision also states that joint controllers must, by means of an arrangement between them, determine in a transparent manner their respective responsibilities for compliance with the obligations under that regulation, unless and in so far as the respective responsibilities of the controllers are determined by EU or Member State law to which the controllers are subject.
47 It is thus apparent from that provision that the respective responsibilities of joint controllers of personal data do not necessarily depend on the existence of an arrangement between the various controllers (see, to that effect, judgment of 5 December 2023, Nacionalinis visuomenės sveikatos centras, C‑683/21, EU:C:2023:949, paragraphs 44 and 45), but may stem from national law.
48 In addition, the Court has held, first, that it is sufficient that a person exerts influence over the processing of personal data, for his, her or its own purposes, and participates, as a result, in the determination of the purposes and means of that processing in order for him, her or it to be regarded as a joint controller and, second, that the joint responsibility of several actors for the same processing does not require each of them to have access to the personal data concerned (see, to that effect, judgment of 5 December 2023, Nacionalinis visuomenės sveikatos centras, C‑683/21, EU:C:2023:949, paragraphs 40 to 43 and the case-law cited).
49 It follows from paragraphs 44 to 48 of the present judgment that, under the combined provisions of Article 26(1) and point 7 of Article 4 of the GDPR, the joint responsibility of several actors in a processing chain concerning the same personal data may be established by national law provided that the various processing operations are linked by purposes and means determined by national law and that national law determines the respective responsibilities of each of the joint controllers.
50 It should be made clear that such a determination of the purposes and means linking the various processing operations performed by several actors in a chain and of their respective responsibilities may be made not only directly but also indirectly by national law, provided that, in the latter case, it can be inferred in a sufficiently explicit manner from the legal provisions governing the persons or entities concerned and the processing of the personal data that they perform in connection with the processing chain imposed by that law.
51 Last, and so far as is relevant, it must be stated that, in the event that the referring court concludes that the agency or body responsible for the Moniteur belge is not solely responsible, but jointly with others, for compliance with the principles set out in Article 5(1) of the GDPR as regards the data contained in the passage at issue in the main proceedings, such a conclusion in no way prejudges the question whether, in the light of, inter alia, the exceptions set out in Article 17(3)(b) and (d) of the GDPR, the request for erasure submitted by the natural person referred to in paragraph 13 of the present judgment should be granted.
52 In the light of the foregoing considerations, the answer to the second question is that Article 5(2) of the GDPR, read in conjunction with point 7 of Article 4 and Article 26(1) thereof, must be interpreted as meaning that the agency or body responsible for the official journal of a Member State, classified as a ‘controller’ within the meaning of point 7 of Article 4 of that regulation, is solely responsible for compliance with the principles set out in Article 5(1) thereof as regards the personal data processing operations that it is required to perform under national law, unless joint responsibility with other entities in respect of those operations arises under that law.
Costs
53 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Third Chamber) hereby rules:
1. Point 7 of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
must be interpreted as meaning that the agency or body responsible for the official journal of a Member State, which is inter alia required, under the law of that State, to publish as they stand official acts and documents that have been prepared by third parties under their own responsibility in compliance with the applicable rules, then lodged with a judicial authority that sends them to it for publication, may, notwithstanding its lack of legal personality, be classified as a ‘controller’ of the personal data contained in those acts and documents, where the national law concerned determines the purposes and means of the processing of personal data performed by that official journal.
2. Article 5(2) of Regulation 2016/679, read in conjunction with point 7 of Article 4 and Article 26(1) thereof,
must be interpreted as meaning that the agency or body responsible for the official journal of a Member State, classified as a ‘controller’ within the meaning of point 7 of Article 4 of that regulation, is solely responsible for compliance with the principles set out in Article 5(1) thereof as regards the personal data processing operations that it is required to perform under national law, unless joint responsibility with other entities in respect of those operations arises under that law.
[Signatures]
* Language of the case: French.
© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.
BAILII: