UF v Land Hessen.

• Jurisdiction: European Union
• Date: 07 December 2023
• Court: Court of Justice (European Union)

Provisional text

JUDGMENT OF THE COURT (First Chamber)

7 December 2023 (*)

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(a) – Principle of ‘lawfulness’ – Point (f) of the first subparagraph of Article 6(1) – Necessity of processing for the purposes of the legitimate interests pursued by the controller or by a third party – Article 17(1)(d) – Right to erasure where personal data have been unlawfully processed – Article 40 – Codes of conduct – Article 78(1) – Right to an effective judicial remedy against a supervisory authority – Decision taken by the supervisory authority on a complaint – Scope of judicial review of that decision – Credit information agencies – Storage of data from a public register relating to the discharge of remaining debts in favour of a person – Storage period)

In Joined Cases C‑26/22 and C‑64/22,

REQUESTS for a preliminary ruling under Article 267 TFEU from the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany), made by decisions of 23 December 2021 and 31 January 2022, received at the Court on 11 January 2022 and 2 February 2022, in the proceedings

UF (C‑26/22),

AB (C‑64/22)

v

Land Hessen,

intervener:

SCHUFA Holding AG,

THE COURT (First Chamber),

composed of A. Arabadjiev, President of the Chamber, T. von Danwitz, P.G. Xuereb, A. Kumin (Rapporteur) and I. Ziemele, Judges,

Advocate General: P. Pikamäe,

Registrar: K. Hötzel, Administrator,

having regard to the written procedure and further to the hearing on 26 January 2023,

after considering the observations submitted on behalf of:

– UF and AB, by R. Rohrmoser and S. Tintemann, Rechtsanwälte,

– the Land Hessen, by M. Kottmann and G. Ziegenhorn, Rechtsanwälte,

– SCHUFA Holding AG, by G. Thüsing and U. Wuermeling, Rechtsanwalt,

– the German Government, by J. Möller and P.‑L. Krüger, acting as Agents,

– the Portuguese Government, by P. Barros da Costa, J. Ramos and C. Vieira Guerra, acting as Agents,

– the European Commission, by A. Bouchagiar, F. Erlbacher, H. Kranenborg and W. Wils, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 16 March 2023,

gives the following

Judgment

1 These requests for a preliminary ruling concern the interpretation of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’) and of point (f) of the first subparagraph of Article 6(1), Article 17(1)(d), Article 40, Article 77(1) and Article 78(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2; ‘the GDPR’).

2 The requests have been made in two sets of proceedings between UF (Case C‑26/22) and AB (Case C‑64/22), on the one hand, and the Land Hessen (Federal State of Hesse, Germany), on the other hand, concerning the refusal of the Hessischer Beauftragter für Datenschutz und Informationsfreiheit (Data Protection and Freedom of Information Commissioner for the Federal State of Hesse, Germany; ‘the HBDI’) to order SCHUFA Holding AG (‘SCHUFA’) to delete data held by it relating to the discharge from remaining debts in favour of UF and of AB.

Legal context

European Union law

Directive 2008/48/EC

3 According to recitals 26 and 28 of Directive 2008/48/EC of the European Parliament and of the Council of 23 April 2008 on credit agreements for consumers and repealing Council Directive 87/102/EEC (OJ 2008 L 133, p. 66):

‘(26) … In the expanding credit market, in particular, it is important that creditors should not engage in irresponsible lending or give out credit without prior assessment of creditworthiness, and the Member States should carry out the necessary supervision to avoid such behaviour and should determine the necessary means to sanction creditors in the event of their doing so. … [C]reditors should bear the responsibility of checking individually the creditworthiness of the consumer. …

…

(28) To assess the credit status of a consumer, the creditor should also consult relevant databases; the legal and actual circumstances may require that such consultations vary in scope. To prevent any distortion of competition among creditors, it should be ensured that creditors have access to private or public databases concerning consumers in a Member State where they are not established under non-discriminatory conditions compared with creditors in that Member State.’

4 Article 8(1) of that directive, that article being headed ‘Obligation to assess the creditworthiness of the consumer’, provides:

‘Member States shall ensure that, before the conclusion of the credit agreement, the creditor assesses the consumer’s creditworthiness on the basis of sufficient information, where appropriate obtained from the consumer and, where necessary, on the basis of a consultation of the relevant database. Member States whose legislation requires creditors to assess the creditworthiness of consumers on the basis of a consultation of the relevant database may retain this requirement.’

Directive 2014/17/EU

5 According to recitals 55 and 59 of Directive 2014/17/EU of the European Parliament and of the Council of 4 February 2014 on credit agreements for consumers relating to residential immovable property and amending Directives 2008/48/EC and 2013/36/EU and Regulation (EU) No 1093/2010 (OJ 2014 L 60, p. 34):

‘(55) It is essential that the consumer’s ability and propensity to repay the credit is assessed and verified before a credit agreement is concluded. That assessment of creditworthiness should take into consideration all necessary and relevant factors that could influence a consumer’s ability to repay the credit over its lifetime. …

…

(59) Consultation of a credit database is a useful element in the assessment of creditworthiness. …’

6 Entitled ‘Obligation to assess the creditworthiness of the consumer’, Article 18 of that directive provides, in paragraph 1 thereof:

‘Member States shall ensure that, before concluding a credit agreement, the creditor makes a thorough assessment of the consumer’s creditworthiness. That assessment shall take appropriate account of factors relevant to verifying the prospect of the consumer to meet his obligations under the credit agreement.’

7 Entitled ‘Database access’, Article 21 of that directive states, in paragraphs 1 and 2:

‘1. Each Member State shall ensure access for all creditors from all Member States to databases used in that Member State for assessing the creditworthiness of consumers and for the sole purpose of monitoring consumers’ compliance with the credit obligations over the life of the credit agreement. The conditions for such access shall be non-discriminatory.

2. Paragraph 1 shall apply both to databases which are operated by private credit bureaux or credit reference agencies and to public registers.’

Regulation (EU) 2015/848

8 Under recital 76 of Regulation (EU) 2015/848 of the European Parliament and of the Council of 20 May 2015 on insolvency proceedings (OJ 2015 L 141, p. 19):

‘In order to improve the provision of information to relevant creditors and courts and to prevent the opening of parallel insolvency proceedings, Member States should be required to publish relevant information in cross-border insolvency cases in a publicly accessible electronic register. In order to facilitate access to that information for creditors and courts domiciled or located in other Member States, this Regulation should provide for the interconnection of such insolvency registers via the European e-Justice Portal. …’

9 Entitled ‘Responsibilities of Member States regarding the processing of personal data in national insolvency registers’, Article 79 of that regulation provides, in paragraphs 4 and 5 thereof:

‘4. Member States shall be responsible, in accordance with Directive 95/46/EC [of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31)], for the collection and storage of data in national databases and for decisions taken to make such data available in the interconnected register that can be consulted via the European e-Justice Portal.

5. As part of the information that should be provided to data subjects to enable them to exercise their rights, and in particular the right to the erasure of data, Member States shall inform data subjects of the accessibility period set for personal data stored in insolvency registers.’

The GDPR

10 Under recitals 10, 11, 47, 50, 98, 141 and 143 of the GDPR:

‘(10) In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union. …

(11) Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.

…

(47) The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may...