CJEU - C-26/22 - SCHUFA Holding

CJEU - C-26/22 SCHUFA Holding
Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 6(1)(f) GDPR Article 40 GDPR Article 77(1) GDPR Article 78(1) GDPR
Decided:
Parties:	VG Wiesbaden SCHUFA Holding AG
Case Number/Name:	C-26/22 SCHUFA Holding
European Case Law Identifier:
Reference from:	VG Wiesbaden (Germany)
Language:	24 EU Languages
Original Source:	Judgement
Initial Contributor:	n/a

See Holding for questions referred.

English Summary

Facts

Facts pending decision.

Holding

1. Is Article 77(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (‘GDPR’), read in conjunction with Article 78(1) thereof, to be understood as meaning that the outcome that the supervisory authority reaches and notifies to the data subject

(a) has the character of a decision on a petition? This would mean that judicial review of a decision on a complaint taken by a supervisory authority in accordance with Article 78(1) GDPR is, in principle, limited to the question of whether the authority has handled the complaint, investigated the subject matter of the complaint to the extent appropriate and informed the complainant of the outcome of the investigation,

or

(b) is to be understood as a decision on the merits taken by a public authority? This would mean that judicial review of a decision on a complaint taken by a supervisory authority in accordance with Article 78(1) GDPR leads to the decision on the merits being subject to a full substantive review by the court, whereby, in individual cases – for example where discretion is reduced to zero – the supervisory authority may also be obliged by the court to take a specific measure within the meaning of Article 58 GDPR.

2. Is the storage of data at a private credit information agency, where personal data from a public register, such as the ‘national databases’ within the meaning of Article 79(4) and (5) of Regulation (EU) 2015/848 of the European Parliament and of the Council of 20 May 2015 on insolvency proceedings, are stored without a specific reason in order to be able to provide information in the event of a request, compatible with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union?

3. Are private databases (in particular databases of a credit information agency) which exist in parallel with, and are set up in addition to, the State databases and in which the data from the latter (in casu, insolvency announcements) are stored for longer than the period provided for within the narrow framework of Regulation (EU) 2015/848, read in conjunction with the national law, permissible in principle, or does it follow from the ‘right to be forgotten’ under Article 17(1)(d) GDPR that such data must be deleted where

(a) provision is made for a processing period which is identical to that of the public register,

or

(b) provision is made for a retention period which exceeds that provided for in respect of public registers?

4. In so far as Article 6(1)(f) GDPR enters into consideration as the sole legal basis for the storage of data at private credit information agencies with regard to data also stored in public registers, is a credit information agency already to be regarded as pursuing a legitimate interest in the case where it imports data from the public register without a specific reason so that those data are then available in the event of a request?

5. Is it permissible for codes of conduct which have been approved by the supervisory authorities in accordance with Article 40 GDPR, and which provide for time limits for review and erasure that exceed the retention periods for public registers, to suspend the balancing of interests prescribed under point Article 6(1)(f) GDPR?

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!