DATA PROTECTION
CJEU considers supervisory authorities' power to supervise the courts particularly regarding disclosure of documents to journalists.
The Court of Justice of the European Union ('CJEU') issued, on 24 March 2022, its judgment in X, Z v. Autoriteit Persoonsgegevens (Case C-245/20) regarding the interpretation of the supervisory authorities' power to supervise the courts in Article 55(3) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), in particular in relation to the disclosure of documents to journalists.
Background
The CJEU outlined that Rechtbank Midden-Nederland referred the following matters to the CJEU for a preliminary ruling:
Findings
In its preliminary ruling, the CJEU stated that Article 55(3) of the GDPR must be interpreted as meaning that the fact that a court temporarily places documents, which arise from a court proceeding and contain personal data, at the disposal of journalists in order to better account for the progress of that procedure, falls within the scope of that court's 'judicial activities', within the meaning of that provision. Furthermore, the CJEU noted that the Court may refuse to rule on a question referred by a national court for a preliminary ruling only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the Court does not have before it the legal or factual material necessary to give a useful answer to the questions submitted to it, or where the problem is hypothetical.
Moreover, the CJEU stated that the purpose of Article 55 of the GDPR is to define the competence of the supervision of the processing of personal data and, in particular, to define the competence of the national supervisory authority. Therefore, the CJEU highlighted that Article 53(3) of the GDPR provides that the processing operations carried out by courts 'acting in their judicial capacity' fall outside the competence of that supervisory authority.
In addition, the CJEU stipulated, amongst other things, that it is apparent from recital 20 of the GDPR, in particular from the use of the expression 'including', that the scope of the objective pursued by Article 55(3) of the GDPR, consisting in safeguarding the independence of the judiciary in the performance of its judicial tasks, cannot be confined solely to guaranteeing the independence of judges in the adoption of a given judicial decision.
As such, the CJEU provided that the term 'in its judicial activities' in Article 55(3) of the GDPR, is not limited to the processing of personal data carried out by the courts in individual cases, but refers in a broader sense to any processing in the context of their judicial activities. Thus the CJEU emphasised that the supervisory authority is not competent where such supervision may directly or indirectly affect the independence of members, or have an impact on the decisions of the courts.
Outcomes
In the light of all the foregoing considerations, the CJEU stated that the answer to the question referred is that Article 55(3) of the GDPR must be interpreted as meaning that the fact that a court makes documents from court proceedings, containing personal data, temporarily available to journalists in order to enable them better to report on the course of those proceedings, falls within the exercise, by that court, of its 'judicial capacity', within the meaning of that provision.
Read the decision here.
Background
The CJEU outlined that Rechtbank Midden-Nederland referred the following matters to the CJEU for a preliminary ruling:
- whether Article 55(3) of the GDPR is to be interpreted as meaning that 'processing operations of courts acting in their judicial capacity' can be understood to mean the provision, by a judicial authority, of access to procedural documents containing personal data, where such access is granted by making copies of those procedural documents available to a journalist;
- whether it is relevant that the national supervisory authority's supervision of that form of data processing affects independent judicial decisions in specific cases;
- whether it is relevant that, according to the judicial authority, the nature and purpose of the data processing is to inform a journalist in order to enable the journalist to better report on a public hearing in court proceedings, thereby serving the interests of openness and transparency in the administration of justice; and
- whether it is relevant if there is any express legal basis for such data processing under national law.
Findings
In its preliminary ruling, the CJEU stated that Article 55(3) of the GDPR must be interpreted as meaning that the fact that a court temporarily places documents, which arise from a court proceeding and contain personal data, at the disposal of journalists in order to better account for the progress of that procedure, falls within the scope of that court's 'judicial activities', within the meaning of that provision. Furthermore, the CJEU noted that the Court may refuse to rule on a question referred by a national court for a preliminary ruling only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the Court does not have before it the legal or factual material necessary to give a useful answer to the questions submitted to it, or where the problem is hypothetical.
Moreover, the CJEU stated that the purpose of Article 55 of the GDPR is to define the competence of the supervision of the processing of personal data and, in particular, to define the competence of the national supervisory authority. Therefore, the CJEU highlighted that Article 53(3) of the GDPR provides that the processing operations carried out by courts 'acting in their judicial capacity' fall outside the competence of that supervisory authority.
In addition, the CJEU stipulated, amongst other things, that it is apparent from recital 20 of the GDPR, in particular from the use of the expression 'including', that the scope of the objective pursued by Article 55(3) of the GDPR, consisting in safeguarding the independence of the judiciary in the performance of its judicial tasks, cannot be confined solely to guaranteeing the independence of judges in the adoption of a given judicial decision.
As such, the CJEU provided that the term 'in its judicial activities' in Article 55(3) of the GDPR, is not limited to the processing of personal data carried out by the courts in individual cases, but refers in a broader sense to any processing in the context of their judicial activities. Thus the CJEU emphasised that the supervisory authority is not competent where such supervision may directly or indirectly affect the independence of members, or have an impact on the decisions of the courts.
Outcomes
In the light of all the foregoing considerations, the CJEU stated that the answer to the question referred is that Article 55(3) of the GDPR must be interpreted as meaning that the fact that a court makes documents from court proceedings, containing personal data, temporarily available to journalists in order to enable them better to report on the course of those proceedings, falls within the exercise, by that court, of its 'judicial capacity', within the meaning of that provision.
Read the decision here.
