CJEU Case C-768/21 / Opinion
-
CJEU Case C-768/21 / Opinion
Key facts of the case:
Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(a) and (f) – Tasks of the supervisory authority – Article 58(2) – Powers of the supervisory authority – Article 77(1) – Right to lodge a complaint – Personal data breach – Obligation of supervisory authority to adopt measures
Conclusion:
In the light of the above considerations, I propose that the Court of Justice answer the question referred for a preliminary ruling by the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany) as follows:The combined provisions of Article 57(1)(a) and (f), Article 58(2)(a) to (j) and Article 77(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that where the supervisory authority finds that data processing has infringed the data subject’s rights, the supervisory authority must take action under Article 58(2) of Regulation 2016/679 to the extent necessary to ensure full compliance with that regulation. In that respect, it is required to select, taking into account the specific circumstances of each individual case, the appropriate, necessary and proportionate action to remedy the infringement and ensure that the data subject’s rights are respected.
-
Paragraphs referring to EU Charter
35. As the Court of Justice held in the judgment in SCHUFA, in accordance with Article 8(3) of the Charter and Article 51(1) and Article 57(1)(a) of the GDPR, the national supervisory authorities are responsible for monitoring compliance with the EU rules concerning the protection of natural persons with regard to the processing of personal data.
...
41. Moreover, the supervisory authority’s investigative powers under Article 58(1) of the GDPR would be of little value if the supervisory authority were forced to confine itself to carrying out an investigation even where a personal data breach had been found. Enforcement of EU law on personal data protection is an essential component of the notion of ‘control’ included in Article 16(2) TFEU and Article 8(3) of the Charter. In that context, it should not be forgotten that the supervisory authority also acts in the interests of the person or entity whose rights have been infringed. In that regard, it should be noted that Article 57(1)(f) and Article 77(2) of the GDPR impose certain obligations with regard to the complainant, namely to ‘inform the complainant of the progress and the outcome of the investigation’.
...
62. Any other interpretation would, in my view, be incompatible with the obligation to ensure respect for the fundamental rights of the Charter, by which, pursuant to Article 51(1) of the Charter, the authorities of the Member States are bound when implementing EU law. That obligation is also incumbent on the supervisory authorities, as follows from Article 58(4) of the GDPR. ( 25 ) Seen in that light, it is reasonable to argue that EU law grants the data subject a subjective right to demand that the authority adopt the measure in question. However, I wish to emphasise that, in the present case, I see no indication that the conditions for such a limitation of the supervisory authority’s discretion are met.
...
74. I would also like to point out that, in the case of the cumulative imposition of financial penalties of a criminal nature, there is even a risk of infringing the principle of‘ne bis in idem’, as interpreted by the Court of Justice, which is referred to in recital 149 of the GDPR. That principle constitutes a fundamental right, protected by Article 50 of the Charter, and it may only be restricted under strict conditions, referred to in Article 52 of the Charter. In other words, there may also be legal barriers to the imposition of administrative fines.
-
Paragraphs referring to EU Charter (original language)