Opinion of Advocate General Medina delivered on 15 June 2023.

• Jurisdiction: European Union
• ECLI: ECLI:EU:C:2023:488
• Date: 15 June 2023
• Celex Number: 62022CC0333
• Court: Court of Justice (European Union)

Provisional text

OPINION OF ADVOCATE GENERAL

MEDINA

delivered on 15 June 2023(1)

Case C‑333/22

Ligue des droits humains ASBL,

BA

v

Organe de contrôle de l’information policière

(Request for a preliminary ruling from the cour d’appel de Bruxelles (Court of Appeal, Brussels, Belgium))

(Reference for a preliminary ruling – Protection of individuals with regard to the processing of personal data in criminal matters – Exercising the rights of the data subject through the competent supervisory authority – Verification by that authority of the lawfulness of the processing of the data subject’s personal data – Right to an effective judicial remedy against the supervisory authority)

1. Directive (EU) 2016/680, (2) better known as ‘the Law Enforcement Directive’, lays down specific rules on the protection of personal data and the free movement of those data in the fields of judicial cooperation in criminal matters and police cooperation and in essence, reflects the ‘specific nature of those fields’. (3) Directive 2016/680 pursues two policy objectives. On the one hand, the directive is intended to contribute to the accomplishment of an area of freedom, security and justice (AFSJ), (4) allowing for the free flow of personal data between competent authorities for law enforcement purposes. (5) On the other hand, it is intended to ensure a high level of protection of such data. Its legal basis is Article 16(2) TFEU which entrusts the EU legislature to lay down rules relating to the protection of personal data.

2. ‘Reconciling’ those two policy objectives pursued by Directive 2016/680 remains, however, a difficult task. (6) The present case provides the Court with the opportunity to examine a concrete example of the balancing of law enforcement and data protection in the context of the exercise by data subjects of their rights. The directive strengthens the rights of data subjects compared to the previous regime under Council Framework Decision 2008/977/JHA. (7) This strengthening concerns, more particularly, the recognition of a direct right of access by the data subject, which is an essential component of the fundamental right to data protection. As observed in academic literature, the rights of data subjects in the field of law enforcement are ‘an essential tool against informational power asymmetries and unlawful processing operations’. (8) It is therefore essential to ensure that those rights can be exercised effectively.

I. Legal framework

European Union law

Directive 2016/680

3. Article 3 of Directive 2016/680 sets out the following definitions:

‘(8) “controller” means the competent authority which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

…

(15) “supervisory authority” means an independent public authority which is established by a Member State pursuant to Article 41’.

4. Chapter III of Directive 2016/680 is headed ‘Rights of the data subject’. Under that chapter, Article 13, headed ‘Information to be made available or given to the data subject’, provides in paragraphs 3 and 4:

‘3. Member States may adopt legislative measures delaying, restricting or omitting the provision of the information to the data subject pursuant to paragraph 2 to the extent that, and for as long as, such a measure constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned, in order to:

(a) avoid obstructing official or legal inquiries, investigations or procedures;

(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c) protect public security;

(d) protect national security;

(e) protect the rights and freedoms of others.

4. Member States may adopt legislative measures in order to determine categories of processing which may wholly or partly fall under any of the points listed in paragraph 3.’

5. Article 14 of Directive 2016/680, headed ‘Right of access by the data subject’, states:

‘Subject to Article 15, Member States shall provide for the right of the data subject to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

…’

6. Article 15 of Directive 2016/680, headed ‘Limitations to the right of access’, provides:

‘1. Member States may adopt legislative measures restricting, wholly or partly, the data subject’s right of access to the extent that, and for as long as such a partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned, in order to:

(a) avoid obstructing official or legal inquiries, investigations or procedures;

(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c) protect public security;

(d) protect national security;

(e) protect the rights and freedoms of others.

2. Member States may adopt legislative measures in order to determine categories of processing which may wholly or partly fall under points (a) to (e) of paragraph 1.

3. In the cases referred to in paragraphs 1 and 2, Member States shall provide for the controller to inform the data subject, without undue delay, in writing of any refusal or restriction of access and of the reasons for the refusal or the restriction. Such information may be omitted where the provision thereof would undermine a purpose under paragraph 1. Member States shall provide for the controller to inform the data subject of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy.

4. Member States shall provide for the controller to document the factual or legal reasons on which the decision is based. That information shall be made available to the supervisory authorities.’

7. Article 16 of Directive 2016/680, headed ‘Right to rectification or erasure of personal data and restriction of processing’, provides in paragraph 4:

‘Member States shall provide for the controller to inform the data subject in writing of any refusal of rectification or erasure of personal data or restriction of processing and of the reasons for the refusal. Member States may adopt legislative measures restricting, wholly or partly, the obligation to provide such information to the extent that such a restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned in order to:

(a) avoid obstructing official or legal inquiries, investigations or procedures;

(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c) protect public security;

(d) protect national security;

(e) protect the rights and freedoms of others.

Member States shall provide for the controller to inform the data subject of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy.’

8. Article 17 of Directive 2016/680, headed ‘Exercise of rights by the data subject and verification by the supervisory authority’, states:

‘1. In the cases referred to in Article 13(3), Article 15(3) and Article 16(4) Member States shall adopt measures providing that the rights of the data subject may also be exercised through the competent supervisory authority.

2. Member States shall provide for the controller to inform the data subject of the possibility of exercising his or her rights through the supervisory authority pursuant to paragraph 1.

3. Where the right referred to in paragraph 1 is exercised, the supervisory authority shall inform the data subject at least that all necessary verifications or a review by the supervisory authority have taken place. The supervisory authority shall also inform the data subject of his or her right to seek a judicial remedy.’

Belgian law

9. The loi relative à la protection des personnes physiques à l’égard des traitements de données à caractère personnel (Law on the protection of natural persons with regard to the processing of personal data) of 30 July 2018 (Moniteur belge, 5 September 2018, p. 68616) (‘the LPD’) transposes Directive 2016/680 into Belgian law. Title 2, Chapter III of the LPD lays down the rights of the data subject, which consist, in essence, of the right to information, the right of access to data and the right to rectification.

10. Article 42 of the LPD provides:

‘Any request to exercise the rights set out in this chapter with respect to the police services … or to the Inspection générale de la police fédérale et de la police locale [(General Inspectorate of the Federal and Local Police, Belgium)] shall be made to the supervisory authority referred to in Article 71.

In the cases referred to in Articles 37(2), 38(2), 39(4) and 62(1), the supervisory authority referred to in Article 71 shall inform the data subject only that the necessary verifications have been carried out.

Notwithstanding paragraph 2, the supervisory authority referred to in Article 71 may communicate certain contextual information to the person concerned.

The King shall determine, following opinion from the supervisory authority referred to in Article 71, the category of contextual information that may be communicated to the person concerned by this authority.’

11. The referring court states that the ‘contextual information’ that the Supervisory Body for Police Information can disclose to...