Opinion of Advocate General Kokott delivered on 30 March 2017.

• Jurisdiction: European Union
• Celex Number: 62016CC0073
• ECLI: ECLI:EU:C:2017:253
• Date: 30 March 2017
• Court: Court of Justice (European Union)
• Procedure Type: Reference for a preliminary ruling
• Docket Number: C-73/16

OPINION OF ADVOCATE GENERAL

KOKOTT

delivered on 30 March 2017 ( 1 )

Case C‑73/16

Peter Puškár,

Parties to proceedings:

Finančné riaditeľstvo Slovenskej republiky,

Kriminálny úrad finančnej správy

(Request for a preliminary ruling

from the Najvyšší súd Slovenskej republiky (Supreme Court of the Slovak Republic)

(Reference for a preliminary ruling — Processing of personal data — Protection of fundamental rights — Need for prior proceedings — List of personal data created for the purpose of controlling tax fraud — Admissibility of the list as evidence — Principle of sincere cooperation — Relationship between the case‑law of the Court of Justice of the European Union and the case-law of the European Court of Human Rights)

I. Introduction

1. Not for the first time, disagreement between the Supreme Court of the Slovak Republic and the Constitutional Court of that Member State has given rise to a reference for a preliminary ruling. ( 2 ) In this case, the dispute centres on whether the tax authorities are permitted to keep a confidential list of natural persons who purport to act as company directors of specific legal persons. This dispute raises questions about effective judicial protection: first, whether the exhaustion of an obligatory administrative remedy may be made a precondition for the bringing of legal proceedings, and second, whether the list may be rejected as inadmissible evidence if it was circulated without the consent of the tax authorities. Finally, the Court of Justice is asked to advise the national court whether its case-law or the case-law of the European Court of Human Rights (ECtHR) should be followed, where those two courts are in conflict.

II. Legal Framework

A. EU law

2. The principle of data protection provided in Article 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’) is given specific form in the Data Protection Directive, ( 3 ) which will shortly be replaced by the General Data Protection Regulation. ( 4 )

3. Article 6(1) of the Data Protection Directive contains specific principles regarding the processing of personal data: ‘Member States shall provide for personal data to be: (a) processed fairly and lawfully; … (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purpose for which they were collected or for which they are further processed, are erased or rectified; …’

4. Article 7 of the Data Protection Directive governs the conditions under which the processing of personal data is permitted: ‘Member States shall provide that personal data may be processed only if: (a) the data subject has unambiguously given his consent; or … (c) processing is necessary for compliance with a legal obligation to which the controller is subject; or … (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; (f) processing is necessary for the purpose of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1(1).’

5. Article 10 of the Data Protection Directive requires that the data subject from whom personal data is collected must be given specific information. Article 11 contains corresponding provisions for cases in which the data is not obtained from the data subject. Article 12 contains the right of the data subject to information on the processing of his data and the right to rectification, erasure or blocking of data the processing of which does not comply with the provisions of the Directive.

6. Exceptions to specific provisions of the Data Protection Directive are contained in Article 13(1): ‘Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary measure to safeguard: … (d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions; (e) an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters; (f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e); …’

7. Article 14 of the Data Protection Directive contains the data subject’s right to object: ‘Member States shall grant the data subject the right: (a) at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data; …’

8. Article 22 of the Data Protection Directive contains a provision on remedies: ‘Without prejudice to any administrative remedy for which provision may be made, inter alia before the supervisory authority referred to in Article 28, prior to referral to the judicial authority, Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question.’

9. Article 28(4) of the Data Protection Directive provides for a right to lodge a claim with a supervisory authority: ‘Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim. Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.’

B. Slovak law

10. Paragraph 250v(1) and (3) of the Občiansky súdny poriadok (Code of civil procedure; ‘CCP’), as applicable to the main proceedings contains the following provisions on legal protection: ‘(1) Individuals or legal persons who claim that their rights or legally protected interests have been harmed by the unlawful action of a public authority, which does not constitute a decision, and that they were the direct addressee of that action or that its effects directly prejudiced them, may apply for protection against the action before a court, provided such action or its effects persist or may recur. … (3) Legal proceedings shall be inadmissible unless the claimant has exhausted the remedies available to him under specific legislation …’

11. The zákon č.9/2010 Z. z. o sťažnostiach (Law No 9/2010 on administrative complaints) provides for the possibility of a complaint against acts or omissions of the administration.

12. Paragraph 164 of the zákon č.563/2009 Z. z. o správe daní (daňový poriadok) (Law No 563/2009 on tax administration; ‘Tax Code’), as applicable to the case in the main proceedings relates to the processing of personal data: ‘For the purpose of tax collection, the tax authorities, the Finance Directorate (finančné riaditeľstvo) and the Ministry of Finance (ministerstvo) shall be authorised to process the personal data of taxpayers, the representatives of taxpayers and other persons in accordance with specific legislation (95); ( 5 ) personal data may be made accessible only to the authorities in their capacity as the tax authorities, the Financial Administration and the Ministry and, in connection with tax collection and the performance of their tasks under specific legislation, to any other person, court or prosecution authority that is acting within the framework of criminal proceedings. In the information systems (95), it is permissible to process the name and surname of a natural person, his or her permanent address and, if he or she was not allocated an tax identification number on registration, his or her national identity number.’

13. Paragraph 4(3)(d), (e) and (o) of zákon č.333/2011 Z. z. o orgánoch štátnej správy v oblasti daní, poplatkov a colníctva (Law No 333/2011 on state administrative bodies for taxes, duties and customs) governs the relevant tasks of the Finance Directorate for the present case: ‘The Finance Directorate shall perform the following tasks: (d) it shall create, develop and operate the Financial Administration information systems; … ; it shall notify the Ministry of its intention to carry out activities in relation to the creation and development of the Financial Administration information systems; (e) it shall create and keep a central list of economic operators and other persons engaged in activities governed by the customs legislation and ensure that it is aligned with the relevant lists of the European Commission; it shall create and keep a central list of taxpayers and maintain and update the database; it shall create...