CE - 489838

CE - 489838
Court:	CE (France)
Jurisdiction:	France
Relevant Law:	Article 55(3) GDPR Article 45 Loi n° 2024-449 du 21 mai 2024 visant à sécuriser et à réguler l'espace numérique
Decided:	24.07.2024
Published:
Parties:	M.A.B. Tribunal administratif de Cergy-Pontoise
National Case Number/Name:	489838
European Case Law Identifier:	ECLI:FR:CECHS:2024:489838.20240724
Appeal from:	CNIL (France) n/a
Appeal to:	Unknown
Original Language(s):	French
Original Source:	Conseil d'Etat (in French)
Initial Contributor:	n/a

The Supreme Administrative Court confirmed that, under national law, it is competent to supervise processing activities of courts acting in their judicial capacity.

English Summary

Facts

A data subject brought two cases before the Administrative Court of Cergy-Pontoise (Tribunal administratif de Cergy-Pontoise) – the controller. The data concerning these case were processed in an automated data processing system called “Sagace”.

After both cases had been decided, the data subject requested the access to their personal data connected to those cases. The data were processed in “Sagace”.

The controller rejected data subject’s request, which caused the data subject to lodge a complaint with the French DPA (CNIL).

The DPA stated the access request fell within the scope of the judicial capacity of courts and as such was excluded from jurisdiction of the DPA.

The data subject appealed against the CNIL's decision to the Supreme Administrative Court (Conseil d’Etat).

Holding

The court rejected the appeal.

The access request at hand touched upon the exercise of judicial capacity by courts. This was because the “Sagace” system, which processed the data subject’s data, was designed to allow parties of administrative court proceedings manage pending cases. Also, according to the body of evidence, the access requests were directly linked to the proceedings initiated by the data subject – they wanted to verify whether the court took into account two pleadings delivered within proceedings.

Hence, under Article 55(3) GDPR the DPA had no competence to decide cases referring to court’s exercise of judicial capacity.

Within French legal system, Article 45 of Law of 21 May 2024 on the security and regulation of the digital space (Loi n° 2024-449 du 21 mai 2024 visant à sécuriser et à réguler l'espace numérique conferred the court (Conseil d’Etat) with the authority to control data processing activities by administrative courts while exercise judicial capacity.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Full Text

FRENCH REPUBLIC
IN THE NAME OF THE FRENCH PEOPLE

Considering the following procedures:

By two requests and two reply briefs, registered on December 1, 2023 and April 2, 2024 at the litigation secretariat of the Council of State under numbers 489838 and 489839, Mr. A... B... requests the Council of State to cancel for abuse of power the decision of December 1, 2022, confirmed after free appeal on March 2, 2023, by which the National Commission for Informatics and Liberties (CNIL) declared itself incompetent to process its complaint directed against the refusal which would have was opposed by the registry of the administrative court of Cergy-Pontoise to his request for access to personal data concerning him contained in the “Sagace” application and linked to files nos. 1702662 and 1707748.

.................................................. ..................................

Considering the other documents in the files;

Seen :
- Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016;
- Law No. 78-17 of January 6, 1978;
- Law No. 2024-449 of May 21, 2024;
- the decree of April 11, 2005 relating to automated processing of personal information concerning the management of all contentious activities of the Council of State, administrative courts of appeal and administrative tribunals;
- the administrative justice code;

After hearing in public session:

- the report of Mrs Alexandra Poirson, auditor,

- the conclusions of Mr. Laurent Domingo, public rapporteur;

Considering the following:

1. Mr. B...'s requests are directed against the same decision of the CNIL. It is necessary to join them in order to rule on them with a single decision.

2. It appears from the documents in the file that Mr. B... submitted a complaint to the CNIL seeking to order the president of the administrative court of Cergy-Pontoise to give him access to the personal data concerning him, contained in the automated processing of information called “Sagace” and relating to two cases judged, at his request, by this court. By a decision of December 1, 2022, confirmed after a free appeal by Mr. B... on March 2, 2023, the CNIL declared itself incompetent to rule on this complaint, on the grounds that this treatment was relative to the exercise, by the court administrative, of its jurisdictional function.

3. On the one hand, under the terms of 1 of article 51 of the European regulation of April 27, 2016: "Each Member State provides that one or more independent public authorities are responsible for monitoring the application of this regulation, in order to protect the fundamental rights and freedoms of natural persons with regard to the processing and to facilitate the free flow of personal data within the Union (hereinafter referred to as "supervisory authority"). Under the terms of 3 of Article 55 of the regulation: “The supervisory authorities are not competent to control the processing operations carried out by the courts in the exercise of their jurisdictional function”.

4. On the other hand, by virtue of I of article 8 of the law relating to data processing, files and freedoms, the National Commission for Data Processing and Freedoms, an independent administrative authority, is the authority national control within the meaning and for the application of Regulation (EU) 2016/679 of April 27, 2016. However, having regard to the provisions of 3 of Article 55 mentioned in the previous point, this control does not extend to operations processing carried out by the courts in the exercise of their judicial function. Article 45 of the law of May 21, 2024 aimed at securing and regulating the digital space introduced into the administrative justice code a chapter V relating to the control of personal data processing operations carried out by administrative courts in the exercise of their jurisdictional function, comprising a single article L115-1, under which, according to the modalities it provides, the Council of State is responsible for controlling the processing operations of personal data carried out in the exercise of their jurisdictional function, in particular by ordinary administrative courts.

5. The automated processing of “Sagace” information, implemented by the Council of State, the administrative courts of appeal and the administrative tribunals, aims to allow the parties to a proceeding to consult the information contained remotely in their file and to follow the investigation of their case by taking note of the procedural documents of the different parties and the court. The operations carried out by this processing therefore relate to the exercise by these courts of their jurisdictional function. Thus, they do not fall, having regard to the provisions of 3 of article 55 of the regulation of April 27, 2016, within the competence of the CNIL, which is the national supervisory authority within the meaning and for the application of this regulation. . They now fall, under the law of May 21, 2024, under the control entrusted, in particular for operations carried out by administrative courts, to the Council of State.

6. It appears from the documents in the file that Mr. B...'s request related to possible connections to the Sagace treatment occurring on October 24 and 28, 2019, dates on which he had filed two briefs with the Cergy-Pontoise administrative court in the context of the investigation of his case, and aimed in particular to ensure that the public rapporteur had been informed of it before concluding at the hearing. Such a request therefore related to the exercise by the administrative court of its jurisdictional function. Consequently, the CNIL was right to declare itself incompetent, in application of the provisions of the regulation of April 27, 2016 cited in point 3 , to rule on the complaint of Mr. B.... Are in addition, and in any event, without impact in this regard, on the one hand, the judgment of October 5, 2022 by which the administrative court of appeal of Paris dismissed Mr. B...'s request that the CNIL be ordered to investigate his complaint and, on the other hand, the circumstance that the decree of April 11, 2005 governing the processing “Sagace” mentions article 39 of the law of January 6, 1978 then in force and relating to the right of access and rectification of persons concerned by automated processing of information. It follows from the above, and without there being any need to rule on the objection raised by the CNIL, that Mr. B...'s requests must be rejected.

DECIDED :
--------------

Article 1: The requests of Mr. B... are rejected.
Article 2: This decision will be notified to Mr. A... B... and to the National Commission for Information Technology and Liberties.
Deliberated at the end of the session of July 4, 2024 where sat: Mr. Bertrand Dacosta, president of the chamber, presiding; Mr. Olivier Yeznikian, State Councilor and Ms. Alexandra Poirson, auditor-rapporteur.

Returned on July 24, 2024.

President :
Signed: Mr. Bertrand Dacosta

The rapporteur:
Signed: Mrs Alexandra Poirson

The Secretary :
Signed: Ms. Valérie Vella

ECLI:FR:CECHS:2024:489838.20240724