X and Z v Autoriteit Persoonsgegevens.

• Jurisdiction: European Union
• ECLI: ECLI:EU:C:2022:216
• Docket Number: C-245/20
• Date: 24 March 2022
• Celex Number: 62020CJ0245
• Court: Court of Justice (European Union)

Provisional text

JUDGMENT OF THE COURT (First Chamber)

24 March 2022 (*)

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Competence of the supervisory authority – Article 55(3) – Processing operations of courts acting in their judicial capacity – Concept – Making available to a journalist of documents arising from court proceedings containing personal data)

In Case C‑245/20,

REQUEST for a preliminary ruling under Article 267 TFEU from the Rechtbank Midden-Nederland (District Court, Central Netherlands), made by decision of 29 May 2020, received at the Court on the same day, in the proceedings

X,

Z

v

Autoriteit Persoonsgegevens

THE COURT (First Chamber),

composed of K. Lenaerts, President of the Court, acting as President of the First Chamber, L. Bay Larsen, Vice-President of the Court, N. Jääskinen, J.-C. Bonichot (Rapporteur) and M. Safjan, Judges,

Advocate General: M. Bobek,

Registrar: L. Carrasco Marco, Administrator,

having regard to the written procedure and further to the hearing on 14 July 2021,

after considering the observations submitted on behalf of:

– X and Z, by S.A.J.T. Hoogendoorn, advocaat,

– the Autoriteit Persoonsgegevens, by G. Dictus and N.N. Bontje, advocaten,

– the Netherlands Government, by K. Bulterman and C.S. Schillemans, acting as Agents,

– the Spanish Government, by L. Aguilera Ruiz, acting as Agent,

– the Polish Government, by B. Majczyna, acting as Agent,

– the Portuguese Government, by L. Inez Fernandes and by P. Barros da Costa, L. Medeiros and I. Oliveira, acting as Agents,

– the Finnish Government, by H. Leppo, acting as Agent,

– the European Commission, by F. Erlbacher, H. Kranenborg and D. Nardi, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 6 October 2021,

gives the following

Judgment

1 This request for a preliminary ruling concerns the interpretation of Article 55(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).

2 The request has been made in proceedings between X and Z and the Autoriteit Persoonsgegevens (Data Protection Authority, Netherlands; ‘the AP’) concerning the access of journalists to personal data concerning them, included in a court file, at the hearing held before the Administrative Jurisdiction Division of the Raad van State (Council of State, Netherlands), in proceedings in which Z was a party and represented by X.

Legal context

European Union law

3 Recital 20 of Regulation 2016/679 states:

‘While this Regulation applies, inter alia, to the activities of courts and other judicial authorities, Union or Member State law could specify the processing operations and processing procedures in relation to the processing of personal data by courts and other judicial authorities. The competence of the supervisory authorities should not cover the processing of personal data when courts are acting in their judicial capacity, in order to safeguard the independence of the judiciary in the performance of its judicial tasks, including decision-making. It should be possible to entrust supervision of such data processing operations to specific bodies within the judicial system of the Member State, which should, in particular ensure compliance with the rules of this Regulation, enhance awareness among members of the judiciary of their obligations under this Regulation and handle complaints in relation to such data processing operations.’

4 Under Article 2 of that regulation:

‘1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

2. This Regulation does not apply to the processing of personal data:

(a) in the course of an activity which falls outside the scope of Union law;

(b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;

(c) by a natural person in the course of a purely personal or household activity;

(d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

3. For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 [of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1)] applies. Regulation [No 45/2001] and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98.

…’

5 Article 4(2) of the said regulation defines the concept of ‘processing’ as:

‘any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction’.

6 Pursuant to Article 51(1) of the same regulation:

‘Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (“supervisory authority”).’

7 Last, Article 55 of Regulation 2016/679 provides as follows:

‘1. Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.

2. Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply.

3. Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.’

Netherlands law

8 For the purposes of implementing Regulation 2016/679, the Kingdom of the Netherlands adopted the wet houdende regels ter uitvoering van Verordening (EU) 2016/679 van het Europees Parlement en de Raad van 27 april 2016 betreffende de bescherming van natuurlijke personen in verband met de verwerking van persoonsgegevens en betreffende het vrije verkeer van die gegevens en tot intrekking van Richtlijn 95/46/EG (algemene...