DATA PROTECTION
European Court of Justice: the administrative and civil remedies provided for by the GDPR may be exercised concurrently with and independently of each other.
In April 2019, BE attended the general meeting of a public limited company of which he is a shareholder and, at that time, put questions to the members of the board of directors and to other participants. Subsequently, he asked the company to send him the sound recording made at the general meeting. However, that company made available to him only the excerpts from that recording which reproduced his own contributions, excluding those of the other participants, even though their contributions constituted answers to questions put by him.
BE then asked the Hungarian supervisory authority responsible under the General Data Protection Regulation (GDPR) to order the company concerned to send him the recording in question. That authority having refused his request, BE brought an administrative appeal against the decision refusing that request before the Budapest High Court. At the same time, he also brought proceedings before the Hungarian civil courts against the decision of the company in question to refuse him access. Those proceedings were based on a provision of the GDPR conferring on each data subject the right to an effective judicial remedy where he or she considers that his or her rights under that regulation have been infringed. The administrative appeal proceedings are still ongoing, but the Hungarian civil courts seised in respect of the other set of proceedings have, by a judgment which has become final, already found that the company referred to above had infringed BE’s right of access to his personal data.
The Budapest High Court asks the Court of Justice whether, in the context of reviewing the lawfulness of the decision of the national supervisory authority, it is bound by the final judgment of the civil courts concerning the same facts and the same alleged infringement, by the company concerned, of the GDPR. In addition, given that the parallel exercise of administrative and civil remedies could give rise to contradictory decisions, the Hungarian court seeks to ascertain whether one of those remedies might take priority over the other.
The Court of Justice recalls that the GDPR offers different remedies to persons claiming that its provisions have been infringed, it being understood that each of those remedies must be capable of being exercised ‘without prejudice’ to the others. Thus, it does not provide for any priority or exclusive competence or jurisdiction or for any rule of precedence in respect of the assessment carried out by the supervisory authority or by a court as to whether there is an infringement of the rights concerned. Consequently, the Court notes that the administrative and civil remedies provided for by the GDPR may be exercised concurrently with and independently of each other.
As regards the risk of contradictory decisions by the national administrative and judicial authorities concerned, the Court emphasises that it is for each Member State to ensure, through adopting the procedural rules necessary for that purpose and in exercising its procedural autonomy, that the concurrent and independent remedies provided for by the GDPR do not call into question the effectiveness and effective protection of the rights guaranteed by that regulation, the consistent and homogeneous application of its provisions, or, lastly, the right to an effective remedy before a court or tribunal.
(Source: Press Release 3/2023 of the EUCJ - Ownership of the contents; EUCJ)
BE then asked the Hungarian supervisory authority responsible under the General Data Protection Regulation (GDPR) to order the company concerned to send him the recording in question. That authority having refused his request, BE brought an administrative appeal against the decision refusing that request before the Budapest High Court. At the same time, he also brought proceedings before the Hungarian civil courts against the decision of the company in question to refuse him access. Those proceedings were based on a provision of the GDPR conferring on each data subject the right to an effective judicial remedy where he or she considers that his or her rights under that regulation have been infringed. The administrative appeal proceedings are still ongoing, but the Hungarian civil courts seised in respect of the other set of proceedings have, by a judgment which has become final, already found that the company referred to above had infringed BE’s right of access to his personal data.
The Budapest High Court asks the Court of Justice whether, in the context of reviewing the lawfulness of the decision of the national supervisory authority, it is bound by the final judgment of the civil courts concerning the same facts and the same alleged infringement, by the company concerned, of the GDPR. In addition, given that the parallel exercise of administrative and civil remedies could give rise to contradictory decisions, the Hungarian court seeks to ascertain whether one of those remedies might take priority over the other.
The Court of Justice recalls that the GDPR offers different remedies to persons claiming that its provisions have been infringed, it being understood that each of those remedies must be capable of being exercised ‘without prejudice’ to the others. Thus, it does not provide for any priority or exclusive competence or jurisdiction or for any rule of precedence in respect of the assessment carried out by the supervisory authority or by a court as to whether there is an infringement of the rights concerned. Consequently, the Court notes that the administrative and civil remedies provided for by the GDPR may be exercised concurrently with and independently of each other.
As regards the risk of contradictory decisions by the national administrative and judicial authorities concerned, the Court emphasises that it is for each Member State to ensure, through adopting the procedural rules necessary for that purpose and in exercising its procedural autonomy, that the concurrent and independent remedies provided for by the GDPR do not call into question the effectiveness and effective protection of the rights guaranteed by that regulation, the consistent and homogeneous application of its provisions, or, lastly, the right to an effective remedy before a court or tribunal.
(Source: Press Release 3/2023 of the EUCJ - Ownership of the contents; EUCJ)
