CJEU - C-231/22 - Belgian State (Données traitées par un journal officiel): Difference between revisions
No edit summary |
No edit summary |
||
Line 71: | Line 71: | ||
Article 4(7) GDPR defines a controller as the: natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; <u>where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.</u> (Underline emphasis added). | Article 4(7) GDPR defines a controller as the: natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; <u>where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.</u> (Underline emphasis added). | ||
As this case involved national law, the Court used the second part of Article 4(7) (underlined) to determine whether the Moniteur belge was a controller. In doing so, it looked at whether | As this case involved national law, the Court used the second part of Article 4(7) (underlined) to determine whether the Moniteur belge was a controller. In doing so, it looked at whether Belgian national law nominated a controller. Moniteur belge is not ''explicitly'' vested by national law with the power to determine the purposes and means of data processing operations. However, the Court determined that national law ''implicitly'' did so and that this was sufficient to make the Moniteur belge a controller under [[Article 4 GDPR|Article 4(7) GDPR.]] The Court justified this broadened scope by stating that definition of controller must be read broadly to determine effective and complete protection of data subjects (see [[CJEU - C‑131/12 - Google Spain|C‑131/12 Google Spain]]). | ||
To be ''implicitly'' a controller under national law, three positive criteria must be fulfilled: | To be ''implicitly'' a controller under national law, three positive criteria must be fulfilled: | ||
Line 85: | Line 85: | ||
1) The entity in question does not need to have legal personality. This is because the wording of [[Article 4 GDPR|Article 4(7) GDPR]] makes it clear that a controller can be a natural person as well as a public authority. These do not have legal personalities, meaning that this is not a limiting factor when determining implied controllership. | 1) The entity in question does not need to have legal personality. This is because the wording of [[Article 4 GDPR|Article 4(7) GDPR]] makes it clear that a controller can be a natural person as well as a public authority. These do not have legal personalities, meaning that this is not a limiting factor when determining implied controllership. | ||
2) The entity in question does not need to check the data before publishing it. This is because the Moniteur Belge | 2) The entity in question does not need to check the data before publishing it. This is because the Moniteur Belge, under national law, is confined to the role of publishing the data as it stands.<ref>This is the case in many civil law countries where laws, company constitutions etc. are often published automatically. </ref> If [[Article 4 GDPR|Article 4(7)]] was applied literally, it would contradict its objective and exclude Moniteur Belge as a controller simply because it cannot exercise control over the personal data contained in its publications. Ex-post control and discretion over the conent is the data is, therefore, not essential for implied controllership. | ||
'''On the second question:''' | '''On the second question:''' | ||
On the second question the Court determined that [[Article 5 GDPR|Article 5(2) GDPR]] when read in conjunction with [[Article 4 GDPR|Article (4)7]] is limited to only apply to the entity classified as the 'controller'. However, should the referring court or national law determine that there is joint responsibility for processing, then [[Article 5 GDPR|Article 5(2)]] will apply to all the controllers responsible. First, the Court viewed the processing activities of the Moniteur belge to be different from those of the notary and court. The operations performed by the Moniteur belge are entrusted to it by national legislation, involve ''inter alia'' the digital transformation of the data contained in the acts submitted to it and their publication. The Moniteur belge is solely responsible for compliance because this is what Belgian national law has outlined. As the court noted, Article (4)7 also permits national law to itself determine those purposes and means and nominate the controller or provide for the specific criteria for its nomination. Second, the concept of joint controllership is extremely broad. [[Article 26 GDPR|Article 26(1) GDPR]] provides for joint responsibility where two or more controllers jointly determine the purposes and means of the processing and the respective responsibilities, regardless of a formal arrangements between the parties ([[CJEU - C-683/21 - Nacionalinis visuomenės sveikatos centras|C‑683/21 Nacionalinis visuomenės sveikatos centras]]). A person can have joint responsibility/joint controllership simply by exerting influence over the processing of personal data, for his, her or its own purposes. Moreover, joint responsibility of several actors for the same processing does not require each of them to have access to the personal data concerned. Should national law imply or state joint responsibility, then [[Article 5 GDPR|Article 5(2)]] will extend to all those jointly responsible controllers, who will all be responsible for compliance with the GDPR. | On the second question the Court determined that [[Article 5 GDPR|Article 5(2) GDPR]] when read in conjunction with [[Article 4 GDPR|Article (4)7]] is limited to only apply to the entity classified as the 'controller'. However, should the referring court or national law determine that there is joint responsibility for processing, then [[Article 5 GDPR|Article 5(2)]] will apply to all the controllers responsible. First, the Court viewed the processing activities of the Moniteur belge to be different from those of the notary and court. The operations performed by the Moniteur belge are entrusted to it by national legislation, involve ''inter alia'' the digital transformation of the data contained in the acts submitted to it and their publication. The Moniteur belge is solely responsible for compliance because this is what Belgian national law has outlined. As the court noted, Article (4)7 also permits national law to itself determine those purposes and means and nominate the controller or provide for the specific criteria for its nomination. Second, the concept of joint controllership is extremely broad. [[Article 26 GDPR|Article 26(1) GDPR]] provides for joint responsibility where two or more controllers jointly determine the purposes and means of the processing and the respective responsibilities, regardless of a formal arrangements between the parties ([[CJEU - C-683/21 - Nacionalinis visuomenės sveikatos centras|C‑683/21 Nacionalinis visuomenės sveikatos centras]]). A person can have joint responsibility/joint controllership simply by exerting influence over the processing of personal data, for his, her or its own purposes. Moreover, joint responsibility of several actors for the same processing does not require each of them to have access to the personal data concerned. Should national law imply or state joint responsibility, then [[Article 5 GDPR|Article 5(2)]] will extend to all those jointly responsible controllers, who will all be responsible for compliance with the GDPR. |
Revision as of 17:57, 16 January 2024
CJEU - C-231/22 Belgian State (Données traitées par un journal officiel) | |
---|---|
Court: | CJEU |
Jurisdiction: | European Union |
Relevant Law: | Article 4(7) GDPR Article 5(2) GDPR Article 17(1) GDPR Article 26(1) GDPR |
Decided: | 11.01.2024 |
Parties: | LM Belgian State (Données traitées par un journal officiel) |
Case Number/Name: | C-231/22 Belgian State (Données traitées par un journal officiel) |
European Case Law Identifier: | ECLI:EU:C:2024:7 |
Reference from: | |
Language: | 24 EU Languages |
Original Source: | Judgement |
Initial Contributor: | sh |
The CJEU clarified that a controller, as defined by Article 4(7) GDPR, can be implicitly determined from national law.
English Summary
Facts
The statute of a company was changed by a natural person who was the majority shareholder. As a consequence of the changes, some personal data of him and the other company's partners were wrongly included. Among such data, there were names, monetary amounts and bank account details. As per national law, the new articles were prepared by the notary of the majority shareholder, and sent to the the registry of the court (Companies Court) and then forwarded by the court to the Office of the Moniteur belge for publication.
After the publication, the notary, having realised the mistake, was authorised to request the deletion of the above sensitive data on behalf of the data subject (the majority shareholder) under Article 17 GDPR. The Moniteur Belge refused and the data subject filed a complaint with the Belgian DPA. The Belgian DPA reprimanded the Moniteur Belge and ordered them to comply with the erasure request within 30 days.
The Belgian State appealed this decision to the Brussels Court of Appeal seeking an annulment of the DPA's decision. Specifically, they argued that it was uncertain whether the Moniteur Belge was a controller as per Article 4(7) GDPR. The passage had been processed by several 'successive controllers' (the notary who drew up the extract, the registry of the Court and the Moniteur Belge, who published the extract as it stood due to national law requirements). Moreover, since the parties did not claim joint controllership, it was also uncertain whether the Moniteur Belge was solely responsible for compliance with the GDPR.
With this in mind, the court referred two questions to the CJEU:
1) Does Article 4(7) GDPR mean that a Member State's official journal, responsible for publishing official documents under national law (such as the one in the case), has the status of a data controller?
2) If so, does Article 5(2) GDPR mean that only that journal in question need to comply with the data controller's responsibilities? Or are the responsibilities incumbent cumulatively on each successive controller?
Holding
First, the CJEU held that the journal (the Moniteur belge) was a data controller as defined by Article 4(7) GDPR. Second, unless joint responsibilities arise, they are solely responsible for compliance under the principle of accountability arising out of Article 5(2) GDPR.
On the first question:
Article 4(7) GDPR defines a controller as the: natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. (Underline emphasis added).
As this case involved national law, the Court used the second part of Article 4(7) (underlined) to determine whether the Moniteur belge was a controller. In doing so, it looked at whether Belgian national law nominated a controller. Moniteur belge is not explicitly vested by national law with the power to determine the purposes and means of data processing operations. However, the Court determined that national law implicitly did so and that this was sufficient to make the Moniteur belge a controller under Article 4(7) GDPR. The Court justified this broadened scope by stating that definition of controller must be read broadly to determine effective and complete protection of data subjects (see C‑131/12 Google Spain).
To be implicitly a controller under national law, three positive criteria must be fulfilled:
1) There must be no apparent designation of powers under national law. In this case, not only was the Moniteur belge under national legislation not vested with explicit powers to determine the purpose and means of processing, but neither was the public entity in charge of it (FPS Justice).
2) The law must implicitly determine the purpose of the controller's processing. In this case, Moniteur belge's role under national law is to publish the documents as received from the companies court. This publication serves the purpose of informing the public of the existence of those acts as to make them enforceable against third parties.
3) The law must implicitly determine the means of the controller's processing. In this case, Moniteur belge's processing is performed by automated means. A paper and electronic copy is produced for citizens to access.
The Moniteur belge, therefore, fulfilled the criteria needed to be an implicit controller under Belgian national law. Nonetheless, the court went further to identify two factors that do not exclude an entity from being an implicit controller under national law.
1) The entity in question does not need to have legal personality. This is because the wording of Article 4(7) GDPR makes it clear that a controller can be a natural person as well as a public authority. These do not have legal personalities, meaning that this is not a limiting factor when determining implied controllership.
2) The entity in question does not need to check the data before publishing it. This is because the Moniteur Belge, under national law, is confined to the role of publishing the data as it stands.[1] If Article 4(7) was applied literally, it would contradict its objective and exclude Moniteur Belge as a controller simply because it cannot exercise control over the personal data contained in its publications. Ex-post control and discretion over the conent is the data is, therefore, not essential for implied controllership.
On the second question:
On the second question the Court determined that Article 5(2) GDPR when read in conjunction with Article (4)7 is limited to only apply to the entity classified as the 'controller'. However, should the referring court or national law determine that there is joint responsibility for processing, then Article 5(2) will apply to all the controllers responsible. First, the Court viewed the processing activities of the Moniteur belge to be different from those of the notary and court. The operations performed by the Moniteur belge are entrusted to it by national legislation, involve inter alia the digital transformation of the data contained in the acts submitted to it and their publication. The Moniteur belge is solely responsible for compliance because this is what Belgian national law has outlined. As the court noted, Article (4)7 also permits national law to itself determine those purposes and means and nominate the controller or provide for the specific criteria for its nomination. Second, the concept of joint controllership is extremely broad. Article 26(1) GDPR provides for joint responsibility where two or more controllers jointly determine the purposes and means of the processing and the respective responsibilities, regardless of a formal arrangements between the parties (C‑683/21 Nacionalinis visuomenės sveikatos centras). A person can have joint responsibility/joint controllership simply by exerting influence over the processing of personal data, for his, her or its own purposes. Moreover, joint responsibility of several actors for the same processing does not require each of them to have access to the personal data concerned. Should national law imply or state joint responsibility, then Article 5(2) will extend to all those jointly responsible controllers, who will all be responsible for compliance with the GDPR.
Comment
This is a very practical judgement and extends the concept of controllership as need be within the limits of legal certainity to ensure a high level protection of fundamental rights.
There has been some debate (see Peter Craddock) over whether legal bases (Article 6) can therefore, also be implied according to national law. However, there is little indication that this would be the case. The the aim of closing gaps in accountability does not de facto lead to broadening legal grounds for processing activities.
Further Resources
Share blogs or news articles here!
- ↑ This is the case in many civil law countries where laws, company constitutions etc. are often published automatically.