Judgment of the Court of Justice Fifth Chamber of 16 November 2021, Ligue des droits humains Verification by the supervisory authority of data processing, C-333/22

• Date: 16 November 2021
• Year: 2021

2

I. PROTECTION OF PERSONAL DATA

Judgment of the Court of Justice (Fifth Chamber) of 16 November 2021, Ligue des droits

humains (Verification by the supervisory authority of data processing), C-333/22

Link to the full text of the judgment

Reference for a preliminary ruling – Protection of natural persons with regard to the processing of

personal data – Directive (EU) 2016/680 – Article 17 – Exercise of the rights of the data subject through

the supervisory authority – Verification of the lawfulness of the data processing – Article 17(3) – Obligation

to provide the data subject with a minimum of information – Scope – Validity – Article 53 – Right to seek

an effective judicial remedy against the su pervisory authority – Concept of a ‘legally binding decision’ –

Charter of Fundamental Rights of the European Union – Article 8(3) – Control by an independent

authority – Article 47 – Right to effective judicial protection

In 2016, BA sought security clearance from the Autorité nationale de sécurité (National Security

Authority, Belgium). He was refused that clearance, inter alia for reasons of State security and

preservation of the constitutional democratic order, on account of his participation in demonstrations

over the last decade. Specifically, that refusal was based on his personal data, processed by the

Belgian police service.

Subsequently, BA requested the Organe de contrôle de l’information policière (OCIP) (Supervisory

Body for Police Information (OCIP), Belgium), in its capacity as the supervisory authority, to identify

the controllers responsible for processing his personal data and to order them to grant him access to

all the information concerning him, in order to enable him to exercise his rights. The OCIP carried out

a verification of the lawfulness of the processing of BA’s personal data in the police data banks in

accordance with Belgian law.

1

Relying on that law, which does not allow the data subject direct access

to his or her data, the OCIP merely informed BA that it had carried out the necessary verifications.

In that context, the cour d’appel de Bruxelles (Court of Appeal, Brussels, Belgium) was seised by the

Ligue des droits humains ASBL and BA following an order from the tribunal de première instance

francophone de Bruxelles (Brussels Court of First Instance (French-speaking), Belgium) declaring itself

to have ‘no jurisdiction’ to hear and determine the application for interim measures lodged by those

parties. The cour d’appel de Bruxelles (Court of Appeal, Brussels) referred a question to the Court of

Justice on the interpretation and validity of Article 17 of Directive 2016/680

2

in the light of the

provisions of the Charter of Fundamental Rights of the European Union (‘the Charter’).

In its judgment, the Court rules, first, on the right of the data subject to seek an effective judicial

remedy against the supervisory authority’s decision where that data subject’s rights have been

exercised through that authority. Secondly, it holds Article 17 of Directive 2016/680 to be valid

inasmuch as that provision lays down only a minimum obligation on the supervisory authority to

1

Article 42 of the loi relative à la protection des personnes physiques à l’égard des traitements de données à caractère personnel (Law on the

protection of natural persons with regard to the processing of personal data) of 30 July 2018 (Moniteur belge of 5 September 2018, p. 68616).

2

Article 17 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons

with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or

prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council

Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89) provides: ‘1. In the cases re ferred to in Article 13(3), Article 15(3) and Article 16(4)

Member States shall adopt measures providing that the rights of the data subject may also be exercised through the competent supervisory

authority. … 3. Where the right referred to in paragraph 1 is exercised, the supervisory authority shall inform the data subject at least that all

necessary verifications or a review by the supervisory authority have taken place. The supervisory authority shall also inform the data

subject of his or her right to seek a judicial remedy.’