European Commission v Kingdom of Spain.

• Jurisdiction: European Union
• ECLI: ECLI:EU:C:2021:138
• Date: 25 February 2021
• Docket Number: C-658/19
• Celex Number: 62019CJ0658
• Court: Court of Justice (European Union)

Provisional text

JUDGMENT OF THE COURT (Eighth Chamber)

25 February 2021 (*)

(Failure of a Member State to fulfil obligations – Article 258 TFEU – Directive (EU) 2016/680 – Processing of personal data – Prevention, investigation, detection or prosecution of criminal offences – Failure to transpose and notify the transposition measures – Article 260(3) TFEU – Application for the imposition of a lump sum and a penalty payment)

In Case C‑658/19,

ACTION for failure to fulfil obligations under Article 258 and Article 260(3) TFEU, brought on 4 September 2019,

European Commission, represented by D. Nardi, G. von Rintelen and S. Pardo Quintillán, acting as Agents,

applicant,

v

Kingdom of Spain, represented by L. Aguilera Ruiz, acting as Agent,

defendant,

supported by:

Republic of Poland, represented by B. Majczyna, acting as Agent,

intervener,

THE COURT (Eighth Chamber),

composed of N. Wahl, President of the Chamber, F. Biltgen (Rapporteur) and L.S. Rossi, Judges,

Advocate General: G. Pitruzzella,

Registrar: A. Calot Escobar,

having regard to the written procedure,

having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,

gives the following

Judgment

1 By its application, the European Commission claims that the Court should:

– declare that, by failing to adopt, by 6 May 2018 at the latest, the laws, regulations and administrative provisions necessary to comply with Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89), or, in any event, by failing to notify those measures to the Commission, the Kingdom of Spain has failed to fulfil its obligations under Article 63(1) of Directive 2016/680;

– impose a penalty payment on that Member State, pursuant to Article 260(3) TFEU, in the amount of EUR 89 548.20 for each day of delay, as from the date of the judgment of the Court, for failure to fulfil its obligation to notify the measures transposing that directive;

– impose the payment of a lump sum on that Member State pursuant to Article 260(3) TFEU, on the basis of a daily amount of EUR 21 321.00 multiplied by the number of days which have elapsed between the day following the expiry of the transposition deadline laid down in the directive and the date on which the infringement comes to an end, or, failing compliance, the date of delivery of this judgment, with a minimum lump sum of EUR 5 290 000; and

– order the Kingdom of Spain to pay the costs.

Legal context

2 Article 1 of Directive 2016/680 is worded as follows:

‘1. This Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

2. In accordance with this Directive, Member States shall:

(a) protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data; and

(b) ensure that the exchange of personal data by competent authorities within the Union, where such exchange is required by Union or Member State law, is neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.

3. This Directive shall not preclude Member States from providing higher safeguards than those established in this Directive for the protection of the rights and freedoms of the data subject with regard to the processing of personal data by competent authorities.’

3 Article 63(1) of Directive 2016/680 provides:

‘1. Member States shall adopt and publish, by 6 May 2018, the laws, regulations and administrative provisions necessary to comply with this Directive. They shall forthwith notify to the Commission the text of those provisions. They shall apply those provisions from 6 May 2018.

When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made.

2. By way of derogation from paragraph 1, a Member State may provide, exceptionally, where it involves disproportionate effort, for automated processing systems set up before 6 May 2016 to be brought into conformity with Article 25(1) by 6 May 2023.

3. By way of derogation from paragraphs 1 and 2 of this Article, a Member State may, in exceptional circumstances, bring an automated processing system as referred to in paragraph 2 of this Article into conformity with Article 25(1) within a specified period after the period referred to in paragraph 2 of this Article, if it would otherwise cause serious difficulties for the operation of that particular automated processing system. The Member State concerned shall notify the Commission of the grounds for those serious difficulties and the grounds for the specified period within which it shall bring that particular automated processing system into conformity with Article 25(1). The specified period shall in any event not be later than 6 May 2026.

4. Member States shall communicate to the Commission the text of the main provisions of national law which they adopt in the field covered by this Directive.’

Pre-litigation procedure and proceedings before the Court

4 Since the Commission had not received from the Kingdom of Spain any information concerning the adoption and publication of the laws, regulations and administrative provisions necessary to comply with Directive 2016/680 by the expiry of the transposition deadline laid down in Article 63 of that directive, namely 6 May 2018, the Commission sent a letter of formal notice to that Member State on 20 July 2018.

5 In the Kingdom of Spain’s reply, dated 26 September 2018, it became clear that, on that date, no transposition measure had yet been adopted. On 25 January 2019, the Commission therefore sent a reasoned opinion to that Member State, inviting it to adopt the measures necessary to comply with the requirements of Directive 2016/680 within two months of receipt of that opinion.

6 In its response to the reasoned opinion, dated 27 March 2019, the Kingdom of Spain stated that the administrative procedure for the adoption of the measures transposing Directive 2016/680 was ongoing and would be finalised at the end of July 2019. It specified that the parliamentary procedure should be completed by the end of March 2020. In addition, that Member State stated that the delay in transposition was essentially due to the particular political context and the need to transpose that directive by means of an organic law.

7 Considering that the Kingdom of Spain had not adopted the national measures transposing Directive 2016/680, nor notified those measures, the Commission brought the present action on 4 September 2019.

8 By decision of the President of the Court of 10 December 2019, the Republic of Poland was granted leave to intervene in support of the Kingdom of Spain.

The action

Failure to fulfil obligations under Article 258 TFEU

Arguments of the parties

9 According to the Commission, by failing to adopt, by 6 May 2018 at the latest, all the laws, regulations and administrative provisions necessary to comply with Directive 2016/680 or, in any event, by failing to notify those provisions to the Commission, the Kingdom of Spain has failed to fulfil its obligations under Article 63 of that directive.

10 The Commission also claims that that Member State has failed to fulfil its obligations by failing to adopt a specific transposition measure since, according to the Court’s case-law, where, as in Article 63 of Directive 2016/680, a directive expressly requires that the measures transposing it include a reference to the directive or that such reference is made when they are officially published, it is in any event necessary to adopt a specific transposition measure.

11 Moreover, in its judgment of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks) (C‑543/17, EU:C:2019:573), the Court held that the Member States must provide to the Commission clear and precise information and indicate unequivocally the laws, regulations and administrative provisions by means of which they consider that they have satisfied the various requirements imposed on them by a directive.

12 In the present case, the Commission considers that none of those obligations has been complied with by the Kingdom of Spain.

13 The Kingdom of Spain does not dispute that it has failed to fulfil its obligations to adopt and notify measures transposing Directive 2016/680.

14 However, that Member State explains that a series of very exceptional circumstances delayed the activities of the national government and parliament with regard to the adoption of the transposition measures required, which will be notified to the Commission in accordance with Article 63 of Directive 2016/680 as soon as they are adopted. While acknowledging that the institutional circumstances of the case do not, under the Court’s case-law, allow the alleged failure to be justified, the Kingdom of Spain maintains that those circumstances are particularly relevant to assess the proportionality of the sanctions proposed by the Commission.

Findings of the Court

15 According to the Court’s settled case-law, the question whether a Member State has failed to fulfil its obligations must be determined by reference to the situation prevailing in...