CJEU - C‑272/19 - VQ v. Land Hessen
| CJEU - C‑272/19 VQ v. Land Hessen | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 4(7) GDPR Article 15 GDPR |
| Decided: | 09.07.2020 |
| Parties: | VQ Land Hessen |
| Case Number/Name: | C‑272/19 VQ v. Land Hessen |
| European Case Law Identifier: | |
| Reference from: | |
| Language: | 24 EU Languages |
| Original Source: | Judgement |
| Initial Contributor: | Bernardo Armentano |
The CJEU ruled that, when determining the purposes and means of the processing of personal data, the Petitions Committee of the parliament of a Member State is a ‘controller’ and must comply with Article 15 GDPR.
English Summary
Facts
VQ submitted a petition to the Petitions Committee of the Parliament of Land Hessen, in Germany. After that, he made an access request, pursuant to Article 15 GDPR. In particular, he asked to have access personal data concerning him, recorded by that Committee when dealing with his petition. However, the President of the Parliament of Land Hessen rejected the request, arguing that the GDPR was not applicable as the petition procedure constituted a function of the parliament, activity that would fall outside of its scope.
Dissatisfied, VQ brought an action before the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden, Germany) challenging this decision. While considering that German law did not grant the right to access in this context, the Court was uncertain whether: a) the Committee could be categorised as a ‘public authority’, within the meaning of Article 4(7) GDPR; and b) it could be considered as the ‘controller’ of VQ’s personal data.
Besides that, that Court was also uncertain whether it itself could be considered as a ‘court or tribunal’, within the meaning of Article 267 TFEU, read together with the second paragraph of Article 47 of the Charter.
In those circumstances, it decided to stay the proceedings and to refer the following questions to the CJEU for a preliminary ruling:
(1) Is Article 15 GDPR applicable to the committee of a parliament of a Federated State of a Member State that is responsible for dealing with the petitions of citizens and is that committee to be regarded as a public authority within the meaning of Article 4(7) GDPR?
(2) Is the referring court an independent and impartial court or tribunal within the meaning of Article 267 TFEU read in conjunction with the second paragraph of Article 47 of the Charter?
Holding
The CJEU considered that, by its second question, the Verwaltungsgericht Wiesbaden asked for a clarification on the admissibility of its request for a preliminary ruling, given that being a ‘court or tribunal’, within the meaning of Article 267, is a condition of that admissibility and, consequently, a prerequisite of the interpretation by the Court of the provision of EU law specified in the first question.
To answer to that question, the CJEU took account of a number of factors, such as whether the body is established by law, whether it is permanent, whether its jurisdiction is compulsory, whether its procedure is inter partes, whether it applies rules of law and whether it is independent.
It highlighted that the doubts expressed by the Verwaltungsgericht Wiesbaden concern its own independence from the legislature or from the executive, based on the following circumstances: (i) the judges are appointed and promoted by the Minister of Justice; (ii) the appraisal of judges is undertaken by the Ministry of Justice according to the same rules as are applicable to public officials; (iii) the personal data and professional contact details of the judges are managed by that ministry, which thus has access to that data; (iv) to cover temporary staff requirements, public officials can be appointed as temporary judges; and (v) the Minister of Justice prescribes the external and internal organisation of the courts or tribunals, determines the allocation of staff, means of communication and IT facilities of the courts or tribunals and also decides on the work-related travel abroad undertaken by the judges.
In that regard, the CJEU recalled that the independence of the judges of the Member States is of fundamental importance for the EU legal order in various respects. It is informed, first, by the principle of the rule of law, which, under Article 2 TEU, gives concrete expression to that value and entrusts shared responsibility for ensuring judicial review within the EU legal order to national courts or tribunals. Second, that independence is a necessary condition if individuals are to be guaranteed, within the scope of EU law, the fundamental right to an independent and impartial tribunal laid down in Article 47 of the Charter. Last, that independence is essential to the proper working of the judicial cooperation system embodied by the preliminary ruling mechanism under Article 267 TFEU, in that that mechanism may be activated only by a body responsible for applying EU law, which satisfies, inter alia, that criterion of independence.
Accordingly, the assessment of the independence must be done solely in light of Article 267 TFEU. In the present case, the CJEU considered that some factors raised by the Verwaltungsgericht Wiesbaden were not relevant. With regard to the procedure for the appointment of temporary judges, it acknowledged that such judges are not members of the formation of the court, which consists solely of the President of the Verwaltungsgericht Wiesbaden. As to the role of the Ministry of Justice of Land Hessen, it stated that the request for a preliminary ruling contains no information from which it can be ascertained to what extent this factor is liable to call into question, in the main proceedings, the independence of the Verwaltungsgericht Wiesbaden. Finally, it clarified that the mere fact that the legislative authorities play a part in the process for appointing a judge does not give rise to a relationship of subordination to those authorities or to doubts as to the judge’s impartiality, if, once appointed, he or she is not subject to any pressure and does not receive any instruction in performing the duties of his or her office. Given the guarantee of irremovability laid down in German Law, the CJEU held that the Verwaltungsgericht Wiesbaden should be considered as ‘court or tribunal’, within the meaning of Article 267 TFEU. Therefore, it admitted the request for a preliminary ruling.
To answer the first question, the CJEU noted that Article 4(7) GDPR defines the ‘controller’ as being the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Thus, the concept is not confined to public authorities, but is sufficiently wide to include any body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
The CJEU recalled that Article 2(2) GDPR constitutes an exception to the very wide scope of that regulation and, therefore, must be interpreted restrictively. The fact that an activity is characteristic of the State or of a public authority is not sufficient ground for the exception in Article 2(2)(b) GDPR to be automatically applicable. It is necessary that the activity is one of those explicitly mentioned by that provision or that it can be classified in their same category. In the present case, while the activities of the Petitions Committee of the Parliament are incontestably public, that committee contributing indirectly to the parliamentary activity, the CJEU held that not only are they political as much as administrative, but that it was also not clear from the case files that they correspond to those mentioned in Article 2(2)(b) and (d) GDPR or that they could be classified in their same category. Moreover, the CJEU highlighted that no exception is provided for in the GDPR with respect to parliamentary activities.
Consequently, in so far as the Petitions Committee determines, alone or with others, the purposes and means of the processing of personal data, it must be considered as a ‘controller’, within the meaning of Article 4(7) GDPR. Therefore, Article 15 GDPR is also applicable.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
