View source for CJEU - C-231/22 - État belge (Data processed by an official journal)

{{CJEUdecisionBOX

|Case_Number_Name=C-231/22 Belgian State (Données traitées par un journal officiel)
|ECLI=ECLI:EU:C:2024:7

|Opinion_Link=
|Judgement_Link=https://curia.europa.eu/juris/document/document.jsf?text=&docid=281142&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1955925

|Date_Decided=11.01.2024
|Year=2024

|GDPR_Article_1=Article 4(7) GDPR
|GDPR_Article_Link_1=Article 5 GDPR#2
|GDPR_Article_2=Article 5(2) GDPR
|GDPR_Article_Link_2=Article 4 GDPR#7
|GDPR_Article_3=Article 17(1) GDPR
|GDPR_Article_Link_3=Article 17 GDPR#1
|GDPR_Article_4=Article 26(1) GDPR
|GDPR_Article_Link_4=Article 26 GDPR#1
|GDPR_Article_5=
|GDPR_Article_Link_5=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=LM
|Party_Link_1=
|Party_Name_2= Belgian State (Données traitées par un journal officiel) 
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=

|Reference_Body=
|Reference_Case_Number_Name=

|Initial_Contributor=sh
|
}}

The CJEU clarified that a controller, as defined by [[Article 4 GDPR|Article 4(7) GDPR,]] can be implicitly determined from national law.

==English Summary==

=== Facts ===
The statute of a company was changed by a natural person who was the majority shareholder. As a consequence of the changes, some personal data of him and the other company's partners were wrongly included. Among such data, there were names, monetary amounts and bank account details. As per national law, the new articles were prepared by the notary of the majority shareholder, and sent to the the registry of the court (Companies Court) and then forwarded by the court to the Office of the Moniteur belge for publication. 

After the publication, the notary, having realised the mistake, was authorised to request the deletion of the above sensitive data on behalf of the data subject (the majority shareholder) under [[Article 17 GDPR]]. The Moniteur Belge refused and the data subject filed a complaint with the Belgian DPA. The Belgian DPA reprimanded the Moniteur Belge and ordered them to comply with the erasure request within 30 days. 

The Belgian State appealed this decision to the Brussels Court of Appeal seeking an annulment of the DPA's decision. Specifically, they argued that it was uncertain whether the Moniteur Belge was a controller as per [[Article 4 GDPR|Article 4(7) GDPR.]] The passage had been processed by several 'successive controllers' (the notary who drew up the extract, the registry of the Court and the Moniteur Belge, who published the extract as it stood due to national law requirements). Moreover, since the parties did not claim joint controllership, it was also uncertain whether the Moniteur Belge was solely responsible for compliance with the GDPR. 

With this in mind, the court referred two questions to the CJEU:

1) Does [[Article 4 GDPR|Article 4(7) GDPR]] mean that a Member State's official journal, responsible for publishing official documents under national law (such as the one in the case), has the status of a data controller?

2) If so, does [[Article 5 GDPR#2|Article 5(2) GDPR]] mean that only that journal in question need to comply with the data controller's responsibilities? Or are the responsibilities incumbent cumulatively on each successive controller?

=== Holding ===
First, the CJEU held that the journal (the Moniteur belge) was a data controller as defined by [[Article 7 GDPR#4|Article]] [[Article 4 GDPR|4(7) GDPR]]. Second, unless joint responsibilities arise, they are solely responsible for compliance under the principle of accountability arising out of [[Article 5 GDPR|Article 5(2) GDPR.]] 

'''On the first question:''' 

Article 4(7) GDPR defines a controller as the: natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; <u>where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.</u> (Underline emphasis added).

As this case involved national law, the Court used the second part of Article 4(7) (underlined) to determine whether the Moniteur belge was a controller. In doing so, it looked at whether Belgian national law nominated a controller. Moniteur belge is not ''explicitly'' vested by national law with the power to determine the purposes and means of data processing operations. However, the Court determined that national law ''implicitly'' did so and that this was sufficient to make the Moniteur belge a controller under [[Article 4 GDPR|Article 4(7) GDPR.]] The Court justified this broadened scope by stating that definition of controller must be read broadly to determine effective and complete protection of data subjects (see [[CJEU - C‑131/12 - Google Spain|C‑131/12 Google Spain]]). 

To be ''implicitly'' a controller under national law, three positive criteria must be fulfilled:

1) There must be no apparent designation of powers under national law. In this case, not only was the Moniteur belge under national legislation not vested with explicit powers to determine the purpose and means of processing, but neither was the public entity in charge of it (FPS Justice). 

2) The law must implicitly determine the purpose of the controller's processing. In this case, Moniteur belge's role under national law is to publish the documents as received from the companies court. This publication serves the purpose of informing the public of the existence of those acts as to make them enforceable against third parties. 

3) The law must implicitly determine the means of the controller's processing. In this case, Moniteur belge's processing is performed by automated means. A paper and electronic copy is produced for citizens to access. 

The Moniteur belge, therefore, fulfilled the criteria needed to be an implicit controller under Belgian national law. Nonetheless, the court went further to identify two factors that do not exclude an entity from being an implicit controller under national law.

1) The entity in question does not need to have legal personality. This is because the wording of [[Article 4 GDPR|Article 4(7) GDPR]] makes it clear that a controller can be a natural person as well as a public authority. These do not have legal personalities, meaning that this is not a limiting factor when determining implied controllership.

2) The entity in question does not need to check the data before publishing it. This is because the Moniteur Belge, under national law, is confined to the role of publishing the data as it stands.<ref>This is the case in many civil law countries where laws, company constitutions etc. are often published automatically. </ref> If [[Article 4 GDPR|Article 4(7)]] was applied literally, it would contradict its objective and exclude Moniteur Belge as a controller simply because it cannot exercise control over the personal data contained in its publications. Ex-post control and discretion over the conent is the data is, therefore, not essential for implied controllership.

'''On the second question:''' 





On the second question the Court determined that [[Article 5 GDPR|Article 5(2) GDPR]] when read in conjunction with [[Article 4 GDPR|Article (4)7]] is limited to only apply to the entity classified as the 'controller'. However, should the referring court or national law determine that there is joint responsibility for processing, then [[Article 5 GDPR|Article 5(2)]] will apply to all the controllers responsible. First, the Court viewed the processing activities of the Moniteur belge to be different from those of the notary and court.  The operations performed by the Moniteur belge are entrusted to it by national legislation, involve ''inter alia'' the digital transformation of the data contained in the acts submitted to it and their publication. The Moniteur belge is solely responsible for compliance because this is what Belgian national law has outlined. As the court noted, Article (4)7 also permits national law to itself determine those purposes and means and nominate the controller or provide for the specific criteria for its nomination.  Second, the concept of joint controllership is extremely broad. [[Article 26 GDPR|Article 26(1) GDPR]] provides for joint responsibility where two or more controllers jointly determine the purposes and means of the processing and the respective responsibilities, regardless of a formal arrangements between the parties ([[CJEU - C-683/21 - Nacionalinis visuomenės sveikatos centras|C‑683/21 Nacionalinis visuomenės sveikatos centras]]). A person can have joint responsibility/joint controllership simply by exerting influence over the processing of personal data, for his, her or its own purposes. Moreover, joint responsibility of several actors for the same processing does not require each of them to have access to the personal data concerned. Should national law imply or state joint responsibility, then [[Article 5 GDPR|Article 5(2)]] will extend to all those jointly responsible controllers, who will all be responsible for compliance with the GDPR.  

== Comment ==
This is a very practical judgement and extends the concept of controllership as need be within the limits of legal certainity to ensure a high level protection of fundamental rights. 

There has been some debate (see Peter Craddock) over whether legal bases (Article 6) can therefore, also be implied according to national law. However, there is little indication that this would be the case. The the aim of closing gaps in accountability does not de facto lead to broadening legal grounds for processing activities. 

== Further Resources ==
''Share blogs or news articles here!''