–

Land Nordrhein-Westfalen, by M. Kottmann and C. Mensching, Rechtsanwälte,

–

the German Government, by J. Möller and D. Klebs, acting as Agents,

–

the Czech Government, by M. Smolek, O. Serdula and J. Vláčil, acting as Agents,

–

the Polish Government, by B. Majczyna, acting as Agent,

–

the European Commission, initially by H. Kranenborg, D. Nardi and K. Kaiser and then by H. Kranenborg, D. Nardi and F. Erlbacher, acting as Agents,

1

This request for a preliminary ruling concerns the interpretation of Article 23(1)(e) and (j) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).

2

The request has been made in proceedings between Land Nordrhein-Westfalen and D.-H. T., acting as insolvency administrator of J & S Service UG, concerning a request for tax data about that company.

3

Recitals 2, 4, 14 and 73 of the GDPR state as follows:

…

…

…

4

Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides:

‘1.   This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.

2.   This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.

3.   The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.’

5

Article 4 of that regulation, entitled ‘Definitions’, provides in paragraph 1 that the concept of ‘personal data’ is to be understood as meaning ‘any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’.

6

According to paragraph 1 of Article 15 of that regulation, entitled ‘Right of access by the data subject’, a data subject is to have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to those personal data and certain information listed in that paragraph.

7

Article 23 of the GDPR, entitled ‘Restrictions’, provides as follows in paragraph 1:

‘Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

…

…

8

The Abgabenordnung (Tax Code) (BGBl. I 2002, p. 3866), in the version applicable to the dispute in the main proceedings (‘the Tax Code’) provides, in Paragraph 2a, entitled ‘Scope of the provisions relating to the processing of personal data’:

‘…

(3)   The provisions of this Law and the tax laws relating to the processing of personal data do not apply where European Union law, in particular [the GDPR] applies directly in the version valid in each case or in accordance with subparagraph (5).

…

(5)   Unless stated otherwise, the provisions of [the GDPR], of this Law and of the tax laws relating to the processing of personal data of natural persons apply correspondingly to information relating to identified or identifiable

9

Paragraph 32b of the Tax Code, entitled ‘Duty of the financial authority to provide information where personal data have not been obtained from the data subject’, states as follows:

‘(1)   The duty on the part of the financial authority to provide information relating to the data subject in accordance with Article 14(1), (2) and (4) of [the GDPR], in addition to the exceptions laid down in Article 14(5) of [the GDPR] and Paragraph 31c(2) [of this code], does not exist

and therefore the interest of the data subject with respect to the provision of information has to be of secondary importance. Paragraph 32a(2) [of this code] applies correspondingly.

…’

10

According to Paragraph 32c of that code, entitled ‘Right of access by the data subject’:

‘1.   The right of access by the data subject vis-à-vis a financial authority in accordance with Article 15 of [the GDPR] does not exist where

…’

11

Paragraph 32e of the code, entitled ‘Relationship to other rights to access and provision of information’, states as follows:

‘If the data subject or a third party has a right of access to information vis-à-vis the financial authority in accordance with the [Gesetz zur Regelung des Zugangs zu Informationen des Bundes (Law on access to federal state information)] of 5 September 2005 (BGBl. 2005 I, p. 2722), in the applicable version, or in accordance with corresponding legislation of the Länder, Articles 12 to 15 of [the GDPR] shall apply correspondingly in conjunction with Paragraphs 32a to 32d [of this code]. More extensive rights to information relating to tax data are excluded in that respect. Paragraph 30(4)(2) [of this code] shall not apply in that respect.’

12

Pursuant to Paragraph 129(1) of the Insolvenzordnung (Law on insolvency) of 5 October 1994 (BGBl. 1994 I, p. 2866), in the version applicable to the dispute in the main proceedings:

‘In accordance with Paragraphs 130 to 146, the liquidator (Insolvenzverwalter) may challenge legal acts that were performed prior to the commencement of insolvency proceedings and that are detrimental to creditors.’

13

Paragraph 2, entitled ‘Scope’, of the Gesetz über die Freiheit des Zugangs zu Informationen für das Land Nordrhein-Westfalen (Law on freedom of information of the Land of North Rhine-Westphalia) of 27 November 2001, in the version applicable to the dispute in the main proceedings, (‘the Law on freedom of information’) provides as follows:

‘(1)   This Law shall apply to the administrative activity of public authorities …. For the purposes of this Law, a public authority is any body which performs public administration tasks.

…’

14

Under Paragraph 4 of the Law on freedom of information, entitled ‘Right to information’,

‘(1)   Any natural person may claim, against the bodies referred to in Paragraph 2, in accordance with this Law, a right of access to official information held by the body.

(2)   Any special legal provisions concerning access to administrative information, the provision of information or the granting of access to the file shall take precedence over the provisions of this Law. The duty to act with discretion shall not apply in the context of this Law.’

15

D.-H. T., acting in the capacity of insolvency administrator of J & S Service, a German company, requested tax data about that company from the tax authorities, under Paragraph 4(1) of the Law on freedom of information, in order to examine the possibility of bringing insolvency avoidance claims in the context of the insolvency procedure.

16

Those data concerned the potential enforcement measures to which J & S Service was subject and those already taken, the payments received and the date on which the tax authorities became aware that the company was insolvent. D.-H.T. also requested statements in relation to all the taxes administered by the tax authorities for the period between March 2014 and June 2015.

17

As a result of the tax authorities rejecting that request, D.-H.T. brought proceedings before the appropriate Verwaltungsgericht (Administrative Court, Germany), which, in essence, upheld its action.

18

The appropriate Oberverwaltungsgericht (Higher Administrative Court, Germany) dismissed the appeal brought by Land Nordrhein-Westfalen against the first instance decision. That court found inter alia that the right of access to information exercised under the Law on freedom of information was not precluded by any specific tax rules and was not subject to any grounds of exclusion.

19

According to that court, entitlement to access to tax information had been transferred to the insolvency administrator in the context of the insolvency proceedings, and that transfer also included business secrets and tax information to the extent necessary for proper management of the assets of the insolvent debtor. Accordingly, even if the information requested was covered by tax secrecy, D.-H.T. was entitled, as the insolvency administrator, to request all information connected with the insolvency procedure from J & S Service. The insolvent debtor’s duty to participate also encompassed an obligation to release the tax authorities from tax secrecy.

20

Land Nordrhein-Westfalen brought an appeal on a point of law before the Bundesverwaltungsgericht (Federal Administrative Court, Germany) against the decision of the relevant Oberverwaltungsgericht (Higher Administrative Court).

21

That court notes at the outset that the GDPR does not apply directly in the present case because the case in the main proceedings does not concern personal data relating to a natural person within the meaning of Article 1(1) and Article 4(1) thereof, or the data subject’s right of access within the meaning of Article 15 of that regulation. According to the referring court, the right of access under Article 15 of that regulation is a right attaching to the data subject to whom the processing of personal data relates that does not form part of the assets of the insolvency and therefore is not covered by the transfer of powers of management and disposal to the insolvency administrator.

22

That court nevertheless recalls that, in order to ensure the uniform interpretation of EU law, the Court has already declared that it has jurisdiction to make preliminary rulings relating to provisions of EU law in purely internal situations, where those provisions had been rendered directly and unconditionally applicable by national law.

23

It considers that requirement to be satisfied in the present case, because Paragraph 2a(5) of the Tax Code makes reference, in so far as concerns the processing of the personal data of legal persons, to the provisions of the GDPR.

24

In that connection, the referring court asks essentially, by its first question, whether the tax authorities may restrict access to the tax data of a tax debtor under Article 23(1)(j) of the GDPR, to which Paragraph 32c(1)(2) of the Tax Code makes express reference.

25

Should it be found that the tax authorities may rely on Article 23(1)(j) of the GDPR, the referring court is uncertain whether the concept of ‘enforcement of civil law claims’, which appears in that article, also encompasses the defence against civil law claims.

26

The referring court states that, in national law, Paragraph 32c(1)(2) of the Tax Code expressly includes the defence of civil law claims as a ground on which a data subject’s right of access can be restricted. That provision is intended to ensure that the tax authorities are not treated differently from other creditors or debtors. The obligations of those authorities to provide information should therefore be governed only by civil law and be subject only to the condition that an insolvency avoidance claim is established on its merits and that only the nature and extent of the claim remain to be determined.

27

Lastly, the referring court wonders whether a national provision that introduces a restriction on the right of access conferred by Article 15 of the GDPR in the interests of defending insolvency avoidance claims against the tax authorities can have its basis in Article 23(1)(e) thereof.

28

The referring court states that Paragraph 32c(1)(2) of the Tax Code is geared towards treating the tax authorities in the same way as other creditors and debtors in relation to civil law claims and ensuring that taxation is due and lawful and therefore safeguarding tax revenue. Those objectives can amount to important objectives of general public interest in budgetary and taxation matters within the meaning of Article 23(1)(e) of the GDPR.

29

Nevertheless, according to the referring court, by means of Paragraph 32c(1)(2) of the Tax Code, the national legislature availed itself instead of the restriction under Article 23(1)(j) of the GDPR. The tax data requested are in fact of interest not for the purpose of the tax claims themselves, but for the payment operations which are a matter of insolvency law, as acts which can, where applicable, be avoided under the Law on insolvency of 5 October 1994, in the version applicable to the dispute in the main proceedings.

30

In those circumstances the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

31

In accordance with settled case-law, in the context of the cooperation between the Court and the national courts provided for in Article 267 TFEU, it is solely for the national court before which a dispute has been brought, and which must assume responsibility for the subsequent judicial decision, to determine in the light of the particular circumstances of the case both the need for a preliminary ruling in order to enable it to deliver judgment and the relevance of the questions which it submits to the Court. Consequently, where the questions submitted by the national court concern the interpretation of EU law, the Court is, in principle, bound to give a ruling (judgments of 18 October 1990, Dzodzi, C‑297/88 and C‑197/89, EU:C:1990:360, paragraphs 34 and 35, and of 14 February 2019, Milivojević, C‑630/17, EU:C:2019:123, paragraph 47 and the case-law cited).

32

However, it is also settled case-law that it is for the Court to examine the conditions in which a case has been referred to it by the national court, in order to assess whether it has jurisdiction (judgment of 16 June 2016, Rodríguez Sánchez, C‑351/14, EU:C:2016:447, paragraph 55 and the case-law cited).

33

The Court has repeatedly considered itself to have jurisdiction to give preliminary rulings on questions concerning provisions of European Union law in situations where the facts at issue in the main proceedings were outside the scope of European Union law and therefore fell within the competence of the Member States alone, but where those provisions of European Union law had been rendered applicable by domestic law due to a reference made by that law to the content of those provisions (judgment of 12 July 2012, SC Volksbank România, C‑602/10, EU:C:2012:443, paragraph 86 and the case-law cited).

34

That jurisdiction is justified by the fact that it is manifestly in the interest of the EU legal order that, in order to forestall future differences of interpretation, the provisions taken from EU law should be interpreted uniformly (see to that effect, judgments of 18 October 1990, Dzodzi, C‑297/88 and C‑197/89, EU:C:1990:360, paragraph 37, and of 12 December 2019, G. S. and V. G. (Threat to public policy), C‑381/18 and C‑382/18, EU:C:2019:1072, paragraph 42 and the case-law cited).

35

Nevertheless, the jurisdiction of the Court is confined to considering provisions of EU law only. In its reply to the national court, it cannot take account of the general scheme of the provisions of domestic law which, while referring to EU law, define the extent of that reference. Consideration of the limits which the national legislature may have placed on the application of EU law to purely internal situations, to which it is applicable only through the operation of the national legislation, is a matter for domestic law and hence falls within the exclusive jurisdiction of the courts of the Member State (see to that effect, judgment of 18 October 1990, Dzodzi, C‑297/88 and C‑197/89, EU:C:1990:360, paragraph 42).

36

In the present case, it emerges from the information provided by the referring court that, as a result of the reference made by Paragraph 2a(5)(2) of the Tax Code, the provisions of the GDPR on the processing of the personal data of natural persons apply mutatis mutandis to legal persons.

37

Specifically, Paragraph 32b of that code provides that the tax authorities do not have a duty to provide information where the personal data have not been obtained from the data subject, if that information could be prejudicial to the proper performance of the tasks within the competence of the financial authorities or other public bodies within the meaning of Article 23(1)(d) to (h) of the GDPR.

38

According to Paragraph 32c(1)(2) of that code, data subjects cannot rely on their right of access vis-à-vis the tax authorities under Article 15 of the GDPR if provision of the information requested could adversely affect those authorities in the establishment, exercise or defence of civil law claims or in the defence by those authorities of civil law claims established against them, within the meaning of Article 23(1)(j) thereof.

39

It is clear from the request for a preliminary ruling that the provisions of the Tax Code at issue in the main proceedings make a reference to Article 23 of the GDPR in order to regulate the tax authorities’ obligation to provide information and the data subject’s right of access vis-à-vis those authorities, with the aim of remedying the disadvantage at which those authorities would find themselves compared with private law creditors in insolvency procedures, thereby contributing to the safeguarding of tax revenue.

40

In the dispute in the main proceedings, the data subject in respect of the information requested is a legal person, specifically an insolvent company.

41

As can be seen from Article 1(1) of the GDPR, that regulation lays down rules relating to the protection of the data of natural persons and does not extend to data relating to legal persons.

42

Article 23 of that regulation, of which the referring court seeks an interpretation, governs situations where EU law or the law of the Member State to which the data controller or processor is subject may restrict the scope of the rights conferred on data subjects, defined as identified or identifiable natural persons, and the corresponding obligations on data controllers.

43

The questions referred concern specifically the interpretation of Article 23(1) of the GDPR in a situation in which that article has been rendered applicable to legal persons in order to regulate the obligations on public authorities to provide information under the Law on freedom of information.

44

However, the provisions of the Tax Code at issue in the main proceedings do not merely render the provisions of the GDPR applicable outside the scope of that regulation; they also modify their subject matter and scope.

45

Although the provisions of the Tax Code at issue in the main proceedings are derived from an almost literal reproduction of certain provisions of the GDPR, the purpose of that regulation and the context in which it was adopted are substantially different from the purpose and context of the domestic legislation at issue in the main proceedings, because the GDPR seeks among other matters to ensure respect for the fundamental rights of natural persons and, at the same time, to strike a balance between those rights and the need to safeguard other legitimate interests in a democratic society.

46

It must be observed, first, that the concept of information concerning legal persons is radically different from the concept of the personal data of natural persons as defined in EU law. The right of any natural person to the protection of personal data concerning him or her is a fundamental right enshrined in Article 8(1) of the Charter of Fundamental Rights of the European Union. Any restrictions on that right must therefore, as Article 23(1) of the GDPR states, be provided for by law, respect the essence of the fundamental rights and freedoms and be a necessary and proportionate measure in a democratic society to safeguard certain public and private interests. Information concerning legal persons, in contrast, has no comparable protection in EU law.

47

Therefore, in this case, the German law concerns, in reality, not the protection of the personal data of natural persons, governed by the GDPR in EU law, but rather the purely national law concept of the protection of the personal data of legal persons. That being so, the questions referred do not in fact concern the interpretation of a provision of EU law rendered applicable, beyond its scope of application, by a provision of national law, but instead to a national law concept that has no equivalent in EU law.

48

Secondly, as the Advocate General has indicated, in essence, in points 86 and 88 of his Opinion, Article 23(1) of the GDPR seeks to strike a fair balance between respect for the fundamental rights of natural persons that are affected by data processing and the need to safeguard other legitimate interests in a democratic society. In order to interpret the restrictions for which it provides it is therefore necessary to weigh the fundamental rights conferred on natural persons against the interests that those restrictions are intended to preserve.

49

Article 23 of the GDPR cannot therefore be construed without having regard to the fact that it specifically seeks to guarantee the fundamental rights of natural persons.

50

This means that the provisions of that regulation cannot be interpreted in the same way in relation to natural persons and in relation to legal persons, whose right to the protection of data is not defined by the GDPR. Accordingly, in contrast to the position taken by the referring court, it cannot be held that there is a manifest interest in the present case in the Court interpreting those provisions with a view to ensuring that they are interpreted uniformly.

51

Accordingly, the provisions of EU law which the Court is asked to interpret cannot be regarded as having been rendered applicable as such by the national law in cases out with the scope of that regulation (see, by analogy, judgment of 28 March 1995, Kleinwort Benson, C‑346/93, EU:C:1995:85, paragraph 19).

52

In the light of the foregoing, it must be held that the Court does not have jurisdiction to answer the questions referred by the Bundesverwaltungsgericht (Federal Administrative Court).

53

Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (First Chamber) hereby rules:

The Court does not have jurisdiction to answer the questions referred by the Bundesverwaltungsgericht (Federal Administrative Court, Germany) by decision of 4 July 2019.