CJEU - C-46/23 - Újpest Önkormányzat Polgármesteri Hivatala

CJEU - C-46/23 Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala v. Nemzeti Adatvédelmi és Információszabadság Hatóság
Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 17 GDPR Article 58(2)(d) GDPR Article 58(2)(g) GDPR
Decided:	14.03.2024
Parties:	Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala Nemzeti Adatvédelmi és Információszabadság Hatóság
Case Number/Name:	C-46/23 Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala v. Nemzeti Adatvédelmi és Információszabadság Hatóság
European Case Law Identifier:	ECLI:EU:C:2024:239
Reference from:	Alkotmánybíróság (Hungary Constitutional Court)
Language:	24 EU Languages
Original Source:	Judgement
Initial Contributor:	lm

The CJEU held that DPAs can exercise corrective powers under Article 58(2)(d) and (g) GDPR to order erasure of personal data by their own motion, regardless of where the data originated or whether the data subject requested its erasure.

English Summary

Facts

In February 2020, the Újpest administration (the controller) obtained personal data about Hungarian residents from the Hungarian Treasury and Budapest district office. The intent was to determine eligibility for a program seeking to provide financial supports to residents made vulnerable by the COVID-19 pandemic. The Hungarian DPA initiated an investigation after a report alerted it of the processing. The DPA determined that the controller failed to timely inform data subjects of the categories of personal data processed, the purposes of processing, or how they could exercise their rights in relation to the processing. On 22 April 2021, it found that the controller violated Articles 5, 14, and 12(1) GDPR. Pursuant to Article 58(2)(d), the DPA ordered the controller to erase the personal data of data subjects who were entitled to the right to erasure but had not requested it. The controller challenged the DPA’s order before the Fővárosi Törvényszék (Budapest High Court), arguing that Article 58(2)(d) GDPR does not empower the DPA to order the erasure of personal data in the absence of an Article 17 GDPR request from the data subject. On appeal, the Alkotmánybíróság (Hungarian Constitutional Court) held that the DPA is empowered to order erasure of unlawfully processed personal data of its own motion, regardless of whether a request has been made by the data subject. In doing so, it set aside a prior judgment by the Kúria (Hungary Supreme Court). Seeking clarification on the interpretation of Article 17 and 58(2) GDPR, the Constitutional Court referred two questions to the CJEU: 1. Can a DPA order a controller or processor to erase unlawfully processed personal data despite the absence of a request from the data subject? 2. If the DPA can exercise such corrective power, is that so whether or not the personal data were obtained from the data subject?

Holding

With regard to the first question, the Court held that some corrective powers under Article 58(2) GDPR, namely 58(2)(d) and (g) GDPR, may be exercised by the DPA of its own motion. Article 58(2)(c) GDPR, on the other hand, does require a prior data subject request. The Court noted that the plain language of Article 58(2)(d) and (g) does not require a data subject request to authorize the DPA’s corrective power. Article 58 GDPR uses different wording to distinguish between corrective measures that may only be adopted following a data subject request, such as Article 58(2)(c), and corrective measures that may be ordered by an authority of its own motion, such as Article 58(2)(d) and (g) GDPR. In addition, the Court found that Article 17(1) GDPR distinguishes between the right of the data subject to obtain erasure of their data and the obligation of the controller to erase such personal data without undue delay. The controller’s obligation thus attaches regardless of whether the data subject requests erasure. With regard to the second question, the Court concluded that the DPA’s power to order erasure of unlawfully processed data applies both to data collected from the data subject and to data originating from another source. It noted that the text of the provisions does not suggest that DPA corrective powers are contingent on the origin of the data.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!