CJEU Case C-492/23
-
CJEU Case C-492/23
Key facts of the case:
Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – Principle of accountability – Article 26 – Joint control with user advertisers – Article 9(1) and (2)(a) – Advertisements containing sensitive data – Lawfulness of processing – Consent – Articles 24, 25 and 32 – Obligations of the controller – Prior identification of the advertisements containing such data – Prior identification of the identity of the user advertiser – Refusal of publication of unlawful advertisements – Security measures such as to prevent the copying of advertisements and their publication on other websites – Electronic commerce – Directive 2000/31/EC – Articles 12 to 15 – Possibility for such an operator, with regard to an infringement of those obligations, to rely on the exemption from liability of an intermediary information society service provider
Outcome of the case:
On those grounds, the Court (Grand Chamber) hereby rules:
-
Article 5(2) and Articles 24 to 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required, before the publication of the advertisements and by means of appropriate technical and organisational measures,
- to identify the advertisements that contain sensitive data in terms of Article 9(1) of that regulation,
- to verify whether the user advertiser preparing to place such an advertisement is the person whose sensitive data appear in that advertisement and, if this is not the case,
- to refuse publication of that advertisement, unless that user advertiser can demonstrate that the data subject has given his or her explicit consent to the data in question being published on that online marketplace, within the meaning of Article 9(2)(a), or that one of the other exceptions provided for in Article 9(2)(b) to (j) is satisfied.
-
Article 32 of Regulation 2016/679
must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required to implement appropriate technical and organisational security measures in order to prevent advertisements published there and containing sensitive data, in terms of Article 9(1) of that regulation, from being copied and unlawfully published on other websites.
-
Article 1(5)(b) of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), and Article 2(4) of Regulation 2016/679,
must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of Regulation 2016/679, of the personal data contained in advertisements published on its online marketplace, cannot rely, in respect of an infringement of the obligations arising from Article 5(2) and Articles 24 to 26 and 32 of that regulation, on Articles 12 to 15 of that directive, relating to the liability of intermediary providers.
-
-
Paragraphs referring to EU Charter
77. By its second and third questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 5(2) and Articles 24 to 26 of the GDPR must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of the GDPR, of the personal data contained in advertisements published on its online marketplace, is required, before the publication of the advertisements, to identify those which contain sensitive data, in terms of Article 9(1) of the GDPR, to ascertain whether the user advertiser preparing to place such an advertisement is the person whose sensitive data are included in that advertisement and, if that is not the case, to refuse publication of the advertisement in the absence of explicit consent from the data subject, inasmuch as such publication would be liable to result in a serious infringement of that subject’s rights to respect for private life and to the protection of his or her personal data, guaranteed in Articles 7 and 8 of the Charter.
78. Under Article 1(2) of the GDPR, read in the light of recitals 4 and 10 thereof, that regulation has the objective in particular of ensuring a high level of protection of the fundamental rights and freedoms of natural persons with respect to the processing of personal data; that right to such protection is also recognised in Article 8 of the Charter and is closely connected to the right to respect for private life, enshrined in Article 7 of the Charter (see, to that effect, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20, EU:C:2022:601, paragraph 61 and the case-law cited).
...
90. Where the personal data that are processed are sensitive data, in terms of Article 9(1) of the GDPR, the controller must, inter alia, in order to determine what measures are appropriate within the meaning of Articles 24 and 25 of that regulation, take account of the fact that an infringement of the principles set out in Chapter II of that regulation with regard to the processing of such data may constitute a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter.
...
96. The risks associated with such publication are all the more serious in the case of sensitive data in terms of Article 9(1) of the GDPR. As expressly stated in recital 51 of the GDPR, personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to those fundamental rights and freedoms (see, to that effect, judgment of 4 October 2024, Lindenapotheke, C‑21/23, EU:C:2024:846, paragraph 75). The processing of such data may, as noted in paragraph 90 above, constitute a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter. In addition, the likelihood of an infringement of those rights by the publication of an advertisement containing sensitive data is very high where the user advertiser is not himself or herself the data subject and where the online marketplace allows such advertisements to be placed anonymously.
...
119. In that regard, in order to determine the specific risk represented by the processing concerned, account must be taken of the possible sensitivity of the personal data processed. As recalled in paragraphs 51 and 90 above, the enhanced protection, provided for in Article 9(1) of the GDPR for certain categories of data, because of their particular sensitivity, is based on the fact that the processing of such data is liable to constitute a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter (see, to that effect, judgment of 21 December 2023, Krankenversicherung Nordrhein, C‑667/21, EU:C:2023:1022, paragraph 41 and the case-law cited).
-
Paragraphs referring to EU Charter (original language)