Article 8 - Protection of personal data
Article 47 - Right to an effective remedy and to a fair trial
Article 52 - Scope and interpretation
Key facts of the case:
Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 17 – Exercise of the rights of the data subject through the supervisory authority – Verification of the lawfulness of the data processing – Article 17(3) – Obligation to provide the data subject with a minimum of information – Scope – Validity – Article 53 – Right to seek an effective judicial remedy against the supervisory authority – Concept of a ‘legally binding decision’ – Charter of Fundamental Rights of the European Union – Article 8(3) – Control by an independent authority – Article 47 – Right to effective judicial protection.
Outcome of the case:
On those grounds, the Court (Fifth Chamber) hereby rules:
1. Article 17 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Article 46(1)(g), Article 47(1) and (2) and Article 53(1) of that directive and with Article 8(3) and Article 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that where the rights of a data subject have been exercised, pursuant to Article 17 of that directive, through the competent supervisory authority and that authority informs that data subject of the result of the verifications carried out, that data subject must have an effective judicial remedy against the decision of that authority to close the verification process.
2. The examination of the second question has revealed nothing capable of affecting the validity of Article 17(3) of Directive 2016/680.
(85) Every data subject should have the right to lodge a complaint with a single supervisory authority and to an effective judicial remedy in accordance with Article 47 of the Charter where the data subject considers that his or her rights under provisions adopted pursuant to this Directive are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. …
...
30 In the event that the court seised were to hold that Article 42(2) of the LPD allowed access to the personal data processed by the police services to be systematically restricted, they requested, in the alternative, that a question be referred to the Court of Justice concerning, in essence, whether Articles 14, 15 and 17 of Directive 2016/680, read in conjunction with Articles 8 and 47 and Article 52(1) of the Charter, were to be interpreted as precluding national legislation allowing a general and systematic derogation from the right of access to personal data where, first, that right was exercised through the supervisory authority and, secondly, that authority could merely state to the data subject that it had carried out all the necessary verifications without informing him or her of the personal data being processed and of the recipients, irrespective of the intended purpose.
35 As a preliminary point, it is apparent from the request for a preliminary ruling that the questions of the referring court concern the existence, on the basis of Article 53(1) of Directive 2016/680, read in the light of Article 47 of the Charter, of an obligation for the Member States to provide for a right to an effective judicial remedy against the competent national supervisory authority, when a provision of national law is implemented which transposes Article 17 of that directive, according to which, in the cases covered by Article 13(3), Article 15(3) and Article 16(4) of that directive, the rights of the data subject may be exercised through such a supervisory authority.
36 In addition, it must be observed that the answer to that question is dependent on the nature and scope of the task and powers of the supervisory authority in connection with the exercise of the data subject’s rights, provided for in Article 17 of Directive 2016/680. That task and those powers are set out in Article 46(1)(g) and Article 47(1) and (2) of that directive and must be analysed in the light of Article 8(3) of the Charter, which requires that compliance with the rules on the protection of personal data, set out in paragraphs 1 and 2 of Article 8 thereof, is to be subject to control by an independent authority.
37 Therefore, the referring court must be understood as asking, in essence, by its first question, whether Article 17 of Directive 2016/680, read in conjunction with Article 46(1)(g), Article 47(1) and (2) and Article 53(1) of that directive, and with Article 8(3) and Article 47 of the Charter, must be interpreted as meaning that, where the rights of a data subject have been exercised, pursuant to Article 17 of that directive, through the competent supervisory authority, that data subject must have available to him or her an effective judicial remedy against that authority.
56 By its second question, the referring court asks, in essence, whether Article 17(3) of Directive 2016/680 is valid having regard to Article 8(3) and Article 47 of the Charter in so far as it obliges the supervisory authority only to inform the data subject (i) that all necessary verifications or a review by the supervisory authority have taken place and (ii) that that person has a right to seek a judicial remedy, since such information does not allow any judicial review of the action taken and the assessment made by the supervisory authority, in the light of the data processed and of the obligations of the controller.
57 First, it should be noted in this respect that, in accordance with a general principle of interpretation, an EU act must be interpreted, as far as possible, in such a way as not to affect its validity and in conformity with primary law as a whole and, in particular, with the provisions of the Charter. Thus, if the wording of secondary EU legislation is open to more than one interpretation, preference should be given to the interpretation which renders the provision consistent with primary law rather than to the interpretation which leads to its being incompatible with primary law (judgment of 21 June 2022, Ligue des droits humains, C‑817/19, EU:C:2022:491, paragraph 86 and the case-law cited).
58 Secondly, the right to an effective judicial remedy, guaranteed in Article 47 of the Charter, requires, in principle, that the person concerned must be able to ascertain the reasons on which the decision taken in relation to him or her is based, so as to make it possible for him or her to defend his or her rights in the best possible conditions and to decide, with full knowledge of the relevant facts, whether there is any point in his or her applying to the court with jurisdiction, and in order to put the latter fully in a position in which it may carry out the review of the lawfulness of that decision (see, to that effect, judgment of 4 June 2013, ZZ, C‑300/11, EU:C:2013:363, paragraph 53 and the case-law cited).
59 Although that right is not an absolute right and, in accordance with Article 52(1) of the Charter, limitations may be placed upon it, that is on condition that those limitations are provided for by law, they respect the essence of the rights and freedoms at issue and, in compliance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others (judgment of 26 January 2023, Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police), C‑205/21, EU:C:2023:49, paragraph 89 and the case-law cited).
70 In that regard, as the European Parliament noted in its observations, Article 15(4) of Directive 2016/680 provides that the controller must document the factual or legal reasons on which it has based the decision by which it limited, wholly or partly, the rights of access of the data subject and that that information must be made available to the supervisory authorities. As that institution suggested, that provision, read in conjunction with Articles 17 and 53 of that directive and in the light of Article 47 of the Charter, as interpreted by the case-law recalled in paragraphs 68 and 69 above, implies that that information must also be made available to the court before which an action against the supervisory authority has been brought, seeking review of the correct application of Article 17 of that directive.
71 Thus, it is apparent from paragraphs 63 to 70 above that the limitation provided for in Article 17 of Directive 2016/680 respects the essence of the data subject’s right to an effective judicial remedy against the supervisory authority’s decision to close the procedure provided for in that provision and the principles of necessity and proportionality, in accordance with Article 52(1) of the Charter.
