Opinion of Advocate General Bobek delivered on 6 October 2021.

• Jurisdiction: European Union
• ECLI: ECLI:EU:C:2021:822
• Date: 06 October 2021
• Celex Number: 62020CC0245
• Court: Court of Justice (European Union)

Provisional text

OPINION OF ADVOCATE GENERAL

BOBEK

delivered on 6 October 2021(1)

Case C‑245/20

X,

Z

v

Autoriteit Persoonsgegevens

(Request for a preliminary ruling from the Rechtbank Midden-Nederland (District Court, Central Netherlands, Netherlands))

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Competence of the supervisory authority – Processing operations carried out by courts in the exercise of their judicial capacity – Disclosure of procedural documents to a journalist)

I. Introduction

1. ‘Publicity is the very soul of justice. It is the keenest spur to exertion, and the surest of all guards against impropriety. … It is through publicity alone that justice becomes the mother of security. By publicity, the temple of justice is converted into a school of the first order, where the most important branches of morality are enforced …’ (2)

2. Although written at the dawn of the 19th century, (3) the words of Jeremy Bentham have lost none of their traction. Certainly, the context back then was very different. Open justice and its publicity needed to be vindicated not only with regard to certain enlightened monarchs (more often the case, to not very enlightened absolutist monarchs), but also, or rather in particular, vis-à-vis a number of peculiar, yet still lingering, medieval visions of the nature of the law and the judicial process. (4)

3. There is no explicit information on temples of justice being converted into schools in the main proceedings. It nonetheless still appears that, in the Netherlands, the principle of open justice has resulted in the ability of the press to access, at the date of a hearing, certain procedural documents in the cases scheduled before the court for that day. The purpose of that access is to assist journalists in better reporting on a case being heard. (5)

4. The applicants in the present case are natural persons that take issue with that policy. They maintain that they did not consent to the disclosure to a journalist of selected procedural documents relating to their case, heard before the Raad van State (Council of State, Netherlands). The applicants claimed that there had been a breach of various rights and obligations under Regulation (EU) 2016/679 (‘the GDPR’) (6) before the national supervision authority. Nevertheless, the defendant supervisory authority did not deem itself competent to assess that complaint. In its view, the processing at issue was carried out in the national courts’ ‘judicial capacity’, pursuant to Article 55(3) of the GDPR.

5. It is within this context that the Rechtbank Midden-Nederland (District Court, Central Netherlands, Netherlands) seeks guidance primarily on the issue of whether the disclosure to the press of certain procedural documents for the purposes of better media reporting on a case being heard in open court constitutes an activity of the ‘courts acting in their judicial capacity’, within the meaning of Article 55(3) of the GDPR.

II. Legal framework

A. EU law

6. Recital 20 of the GDPR states:

‘While this Regulation applies, inter alia, to the activities of courts and other judicial authorities, Union or Member State law could specify the processing operations and processing procedures in relation to the processing of personal data by courts and other judicial authorities. The competence of the supervisory authorities should not cover the processing of personal data when courts are acting in their judicial capacity, in order to safeguard the independence of the judiciary in the performance of its judicial tasks, including decision-making. It should be possible to entrust supervision of such data processing operations to specific bodies within the judicial system of the Member State, which should, in particular ensure compliance with the rules of this Regulation, enhance awareness among members of the judiciary of their obligations under this Regulation and handle complaints in relation to such data processing operations.’

7. Pursuant to Article 2(1) of the same regulation:

‘This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.’

8. The concept of ‘processing’ is defined in Article 4(2) of the GDPR as:

‘any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction’.

9. Article 6 of the same regulation, entitled ‘Lawfulness of processing’, reads, in relevant part, as follows:

‘1. Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

2. Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.

3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

(a) Union law; or

(b) Member State law to which the controller is subject.’

10. By virtue of Article 51(1) of the GDPR:

‘Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (“supervisory authority”).’

11. However, pursuant to Article 55(3) thereof, ‘supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity’.

B. National law

12. The Uitvoeringswet AVG of 16 May 2016 (‘the UAVG’) implements the GPDR into Netherlands law. Article 6 thereof entrusts the defendant with the obligation to monitor compliance with the GDPR in the Netherlands. The UAVG does not reproduce the exception provided for in Article 55(3) of the GDPR.

13. On 31 May 2018, the president of the Afdeling bestuursrechtspraak van de Raad van State (Administrative Jurisdiction Division of the Council of State, Netherlands), the judicial administrations of the Centrale Raad van Beroep (Higher Social Security and Civil Service Court, Netherlands), and the College van Beroep voor het bedrijfsleven (Administrative Court of Appeal for Trade and Industry, Netherlands) adopted a regulation on the processing of personal data in administrative courts. That regulation established the AVG-commissie bestuursrechtelijke colleges (the GDPR Commission for Administrative Law Tribunals) (‘the GDPR Commission’). That commission is responsible for advising the Raad van State (Council of State), the judicial administrations of the Centrale Raad van Beroep (Higher Social Security and Civil Service Court), and the College van Beroep voor het bedrijfsleven (Administrative Court of Appeal for Trade and Industry) on the handling of complaints relating to the respect of rights guaranteed by the GDPR.

III. Facts, national proceedings and the questions referred

14. On 30 October 2018, the Raad van State (Council of State) heard an administrative law dispute between Z (‘Citizen Z’) and the Mayor of Utrecht (Netherlands) (‘Mayor M’). For the purposes of that dispute, X (‘Lawyer X’) acted as Citizen Z’s representative (collectively, ‘the applicants’). (7)

15. After that hearing, and in the presence of Lawyer X, Citizen Z was approached by a person who introduced himself as a journalist (‘Journalist J’). That journalist had at his disposal several procedural documents from the case file. When asked about those documents, Journalist J stated that he had been given access to those documents by virtue of the right of access to the case file given to journalists by the Raad van State (Council of State).

16. On the same day, Lawyer X wrote to the President of the Afdeling bestuursrechtspraak van de Raad van State (Administrative Jurisdiction Division of the Council of State) (‘President P’) to confirm whether access had been given to the case file – if so, by whom – and whether copies had been made with the knowledge or approval of staff of the Raad van State (Council of State).

17. By letter of 21 November 2018, President P replied that, at times, the Raad van State (Council of State) provides journalists with information relating to hearings. It does so, inter alia, by making that information available for inspection to journalists who are in the building on that day to report on a particular hearing. That information includes a copy of the notice of appeal (or higher appeal), the response, and, in the case of a higher appeal, the decision of the rechtbank (District Court, Netherlands). Those copies are only available for inspection on the day of...