Opinion of Advocate General Bobek delivered on 3 September 2020.

• Jurisdiction: European Union
• Celex Number: 62019CC0620
• ECLI: ECLI:EU:C:2020:649
• Date: 03 September 2020
• Court: Court of Justice (European Union)

Provisional text

OPINION OF ADVOCATE GENERAL

BOBEK

delivered on 3 September 2020(1)

Case C‑620/19

Land Nordrhein-Westfalen

v

D.-H. T. acting as insolvency administrator in relation to the assets of J & S Service UG

(Request for a preliminary ruling from the Bundesverwaltungsgericht (Federal Administrative Court, Germany))

(Reference for a preliminary ruling — Jurisdiction of the Court — Reference in national legislation to provisions of EU law — Dzodzi case-law — Direct and unconditional renvoi — Interest in conceptual uniformity — Regulation (EU) 2016/679 — Data protection — Restrictions — Article 23(1), points (e) and (j) — Enforcement of civil law claims — Insolvency proceedings — Tax authorities)

I. Introduction

1. According to Article 267 TFEU, a request for a preliminary ruling must concern the interpretation of the Treaties or the validity and interpretation of acts of the institutions, bodies, offices or agencies of the Union. One of the conditions for the Court’s jurisdiction under that provision is that the EU act, the interpretation of which is sought, is applicable in the main proceedings, with that applicability normally set out in the relevant EU law act itself.

2. The Court has nonetheless stated, beginning with the judgment in Dzodzi, (2) that the Treaties do not exclude from the jurisdiction of the Court requests for a preliminary ruling on EU provisions which do not apply to the facts of the case directly (that is to say, by virtue of provisions contained in those EU law acts themselves), but where those provisions are made applicable indirectly (that is, through a renvoi (reference) made by national law, in effect extending the scope of EU law). The Court thus held that where, in regulating situations outside the scope of the EU measure concerned, national legislation adopts the same solutions as those adopted in that measure, it is clearly in the interest of the European Union that, in order to prevent future differences of interpretation, provisions taken from that measure should be interpreted uniformly.

3. Although that dictum was then confirmed and applied in a number of subsequent cases (‘the Dzodzi case-law’ (3)), the limits of the Court’s jurisdiction in those situations remain, to date, still quite unclear.

4. The present case brings that line of case-law to its outer limits. In its request for a preliminary ruling, the Bundesverwaltungsgericht (Federal Administrative Court, Germany) asks the Court to interpret Article 23(1), points (e) and (j), of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), (4) even though that provision is not directly applicable to the situation at issue in the main proceedings. Indeed, that situation falls, for a number of reasons, outside the scope of Regulation 2016/679. Article 23(1) thereof has been made applicable to the situation before the referring court solely by virtue of a renvoi contained in the applicable national legislation.

5. The present case thus invites the Court to clarify how far the logic of a national renvoi, started in Dzodzi, can reasonably be pushed in a scenario in which, following not one, but in fact several extensions of the scope of an EU rule on the part of the national legislature, the referring court is faced with having to interpret that rule which, in my view, has simply nothing useful to say on the actual question before that court.

II. Legal framework

A. EU law

6. Recitals 2, 4 and 73 of Regulation 2016/679 read:

‘(2) The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data. …

…

(4) The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter [of Fundamental Rights of the European Union; “the Charter”] as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.

…

(73) Restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, the right to object, decisions based on profiling, as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers may be imposed by Union or Member State law, as far as necessary and proportionate in a democratic society to safeguard public security, including the protection of human life especially in response to natural or manmade disasters, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, or of breaches of ethics for regulated professions, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest, further processing of archived personal data to provide specific information related to the political behaviour under former totalitarian state regimes or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes. Those restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.’

7. Article 1 (‘Subject-matter and objectives’) of Regulation 2016/679, provides:

‘1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.

2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.

…’

8.Article 23 of Regulation 2016/679 (‘Restrictions’) is the concluding provision of its Chapter III dealing with the rights of the data subject. It states:

‘1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

…

(e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security;

…

(j) the enforcement of civil law claims.’

B. National law

9. Paragraph 2a (‘Scope of the provisions relating to the processing of personal data’) of the Abgabenordnung (German Tax Code) (‘the AO’), as amended by the Law of 17 July 2017 (5) reads:

‘(3) The provisions of this Law and the tax laws relating to the processing of personal data do not apply where European Union law, in particular Regulation 2016/679 … applies directly in the version valid in each case or in accordance with subparagraph (5).

…

(5) Unless stated otherwise, the provisions of Regulation 2016/679, of this Law and of the tax laws relating to the processing of personal data of natural persons apply correspondingly to information relating to identified or identifiable

1. deceased natural persons or

2. corporations, associations of persons and corporate funds with or without legal personality.’

10. Paragraph 32b (‘Duty of the financial authority to provide information where personal data have not been obtained from the data subject’) of the AO states:

‘(1) The duty on the part of the financial authority to provide information relating to the data subject in accordance with Article 14(1), (2) and (4) of Regulation 2016/679, in addition to the exceptions laid down in Article 14(5) of Regulation 2016/679 and Paragraph 31c(2), does not exist

1. where the provision of the information

(a) would be prejudicial to the proper performance of the tasks within the competence of the financial authorities or other public bodies within the meaning of Article 23(1)(d) to (h) of Regulation 2016/679, or

(b) …

and therefore the interest of the data subject with respect to the provision of information has to be of secondary importance. Paragraph 32a(2) applies correspondingly.’

11. Paragraph 32c (‘Right of access by the data subject’) of the AO reads:

‘(1) The right of access by the data subject vis-à-vis a financial authority in accordance with Article 15 of Regulation 2016/679 does not exist where

1. the data subject does not have to be informed pursuant to Paragraph 32b(1) or (2),

2. the provision of information would adversely affect the legal entity of the financial authority in the establishment, exercise or...