Opinion of Advocate General Medina delivered on 8 June 2023.

• Jurisdiction: European Union
• Celex Number: 62022CC0231
• ECLI: ECLI:EU:C:2023:468
• Date: 08 June 2023
• Court: Court of Justice (European Union)

Provisional text

OPINION OF ADVOCATE GENERAL

MEDINA

delivered on 8 June 2023(1)

Case C‑231/22

État belge

v

Autorité de protection des données,

joined party:

LM

(Request for a preliminary ruling from the cour d’appel de Bruxelles (Court of Appeal, Brussels, Belgium))

(Reference for a preliminary ruling – Regulation (EU) 2016/679 – Article 4(7) and (8) – Processing of personal data – Concepts of ‘controller’ and ‘processor’ – Determining the purpose and the means of the data processing – Obligation of designation by national law – Official journal – Publication of a company law act prepared by a notary – Request for withdrawal – Margin of discretion – Immutability – Article 5(2) – Successive controllers – Separate obligations of separate entities)

1. Acta Diurna were daily Roman official notices carved in stone or metal and displayed in public places such as the Forum of Rome. In the digital era, the issue that national authorities may be confronted with is whether the data published by the official journal of a given country are also carved in stone, metaphorically speaking, or whether they can be erased or modified.

2. The origin of the main proceedings lies in the publication of data by the Belgian official journal, the Moniteur belge, which publishes official documents in paper format and electronically.

3. The main proceedings are between the État belge (Belgian State) and the Autorité de protection des données (Data Protection Authority, Belgium; ‘the DPA’). Having noted that a passage from a company’s decision that was authenticated by a notary and which contained, in addition to the data required by Belgian law, personal data of a natural person was published by mistake, the Data Protection Officer (‘DPO’) of the notary requested the Moniteur belge to delete those data. However, the Service Public Fédéral Justice (Federal Public Service Justice; ‘the FPS Justice’), which is the managing authority of the Moniteur belge, refused that request.

4. Against that background, the questions submitted by the cour d’appel de Bruxelles (Court of Appeal, Brussels, Belgium) in its request for a preliminary ruling have a rather narrow scope. The referring court inquires, in essence, whether the Moniteur belge or the FPS Justice must be considered to be a ‘controller’ within the meaning of Article 4(7) of the Regulation (EU) 2016/679 (‘the GDPR’). (2) If the answer to that question is in the affirmative, the referring court also queries the limits of the obligations of a controller when the processing is carried out by consecutive entities.

I. Legislative framework

A. European Union law

5. In Chapter I of the GDPR, entitled ‘General provisions’, Article 4 thereof defines, in particular, the following terms: ‘personal data’, ‘processing’, ‘controller’ and ‘processor’.

6. Articles 5, 6, 17 and 26 of the GDPR are also relevant to this case.

B. National law

1. The Companies Code

7. Article 67(1) and (2) of the Loi du 7 mai 1999 contenant le Code des sociétés (3) (Law of 7 May 1999 on the Companies Code; ‘the Companies Code’) provided:

‘(1) The certified copies of authentic instruments, the duplicates or originals of documents under private signature and extracts, whether or not in electronic form, the lodging or publication of which are required by the following articles shall be lodged at the registry of the court of the undertaking in whose jurisdiction the company has its registered office.

…

(2) The documents lodged shall be kept in the file kept at that registry for each company and the companies in question shall be entered in the register of legal persons, the register of the Banque-Carrefour des Entreprises [central business registration body].’

8. Article 71 of the code stated:

‘The extract from company documents shall be signed for authentic instruments, by notaries, and for documents under private signature, by all partners jointly and severally or by one of them, entrusted for that purpose by the others with a special mandate.’

9. Article 73 of that code provided:

‘Publication shall take place in the annexes to the Moniteur belge within 15 days of the deposit, failing which the officials to whom the omission or delay may be attributed shall be liable for damages.

…’

10. Under Article 74(1) of that code:

‘The following shall be deposited and published in accordance with the preceding articles:

(1) acts amending the provisions, which this Code requires to be published;’

2. The Royal Decree of 30 January 2001

11. Article 1 of the Arrêté royal du 30 janvier 2001 portant exécution du code des sociétés (Royal Decree of 30 January 2001 implementing the Companies Code) (4) provided:

‘… the court clerks of the [company] courts shall receive the deposit of all documents, extracts from documents, minutes and documents whose disclosure is ordered by the Companies Code …’

12. Article 11 of that royal decree provided:

‘(1) Documents, extracts from documents and documents whose publication is required in the annexes to the Moniteur belge shall be lodged at the Registry together with a copy. …

(2) All paper documents submitted must meet the following conditions:

…

6° be signed, as appropriate, by the notary acting or by persons authorised to represent the legal person in relation to third parties, stating the names and capacity of the signatories;

…

(3) The copies of the documents, extracts from documents and documents referred to in Articles 67, 68, 74 … of the Companies Code … intended for the Moniteur belge shall be submitted without correction or redaction. …

…’

13. Article 14 of the royal decree reads as follows:

‘The Registrar shall send to the management of the Moniteur belge, no later than the second working day following that on which it was lodged, copies of the documents, extracts from documents and documents … which he has received and which must be published in the annexes to the Moniteur belge.

…’

14. Article 16 of that royal decree stated:

‘Where publication is necessary, it shall be made by means of the annexes to the Moniteur belge within the time limits laid down by law.’

3. The Programme Law I of 24 December 2002

15. Article 472 of the Loi-programme du 24 décembre 2002 (Programme Law of 24 December 2002) (5) provides:

‘The Moniteur belge is an official publication published by the management of the Moniteur belge, which brings together all the texts so that publication in the Moniteur belge is ordered.’

16. Article 474 of that programme law states:

‘Three paper copies shall be published in the Moniteur belge by the management of the Moniteur belge.

…

One copy is stored electronically. The King shall determine the arrangements for electronic storage …’

17. Article 475 of the same programme law is worded as follows:

‘Any other making available to the public shall be made via the website of the management of the Moniteur belge.

The publications made available on that website shall be the exact reproductions in electronic format of the paper copies provided for in Article 474.’

18. Under Article 475a of the Programme Law of 24 December 2002:

‘Any citizen may obtain a copy of the documents and documents published in the Moniteur belge by means of a free telephone helpline at cost price from the Moniteur belge. This service is also responsible for providing citizens with a document search help service.’

19. Article 475b of that programme law:

‘Other accompanying measures shall be taken by Royal Decree deliberated in the Council of Ministers in order to ensure the widest possible dissemination of and access to the information contained in the Moniteur belge.’

II. Facts, proceedings and the questions referred for a preliminary ruling

20. LM is a majority shareholder of Bureau LM, a Belgian private limited liability company.

21. On 23 January 2019, that company held a general meeting during which it decided to reduce its capital, amending its articles of association to that effect.

22. In accordance with the legal rules governing disclosure, a notary prepared a partial text. On 12 February 2019, the notary lodged it at the Registry of the tribunal de l’entreprise néerlandophone de Bruxelles (Brussels Companies Court (Dutch-speaking), Belgium) for the purposes of its official publication in the Moniteur belge.

23. On 22 February 2019, that partial text was published in the annexes to the Moniteur belge. In particular, it contained the decision to reduce the company’s capital, the initial amount of capital, the amount of the reduction, the new amount of share capital and the new text of the articles of association. In addition to the information published pursuant to a legal requirement, the partial text at issue contained the names of the two partners of the company at issue, the amounts that had been repaid to them and their bank account numbers (‘the passage at issue’), the publication of which was not required by law.

24. Having found that the notary had erred in including the passage at issue in the partial text published, the DPO of the notary, referring to Article 17 of the GDPR, requested the FPS Justice to delete the passage at issue and to publish the partial text once again, this time without that passage.

25. On 10 April 2019, the FPS Justice refused to grant that request (6) and offered to publish a new partial text, redacted from the passage at issue, while leaving the original publication of 22 February 2019 intact.

26. On 21 January 2020, LM, one of the two partners of the company concerned, filed a complaint with the DPA against the Moniteur belge (the FPS Justice) alleging infringement of Article 5 (in particular the data minimisation principle), Article 6 (processing of personal data) and Article 17 (right to erasure) of the GDPR.

27. By decision of 23 March 2021, the DPA upheld the complaint and, in essence, ordered the deletion of the passage at issue.

28. On 22 April 2021, the Belgian State brought an appeal against that decision...