Case C‑73/16

Peter Puškár

v

Finančné riaditeľstvo Slovenskej republiky
and
Kriminálny úrad finančnej správy

(Request for a preliminary ruling
from the Najvyšší súd Slovenskej republiky)

(Reference for a preliminary ruling — Charter of Fundamental Rights of the European Union — Articles 7, 8 and 47 — Directive 95/46/EC — Articles 1, 7 and 13 — Processing of personal data — Article 4(3) TEU — Drawing up of a list of personal data — Subject matter — Tax collection — Fight against tax fraud — Judicial review — Protection of fundamental rights and freedoms — Legal action dependent on a requirement of a prior administrative complaint — Whether that list is permissible as evidence — Rules on the lawfulness of the processing of personal data — Performance of a task carried out in the public interest by the controller)

Summary — Judgment of the Court (Second Chamber), 27 September 2017

1. Approximation of laws—Protection of individuals with regard to the processing of personal data—Directive 95/46—Scope—Exceptions—Processing operations concerning public security, defence, State security and the activities of the State in areas of criminal law—Restrictive interpretation

   (European Parliament and Council Directive 95/46, Art. 3(2))

2. Approximation of laws—Protection of individuals with regard to the processing of personal data—Directive 95/46—Scope—Concept of the processing of personal data—Processing of data for tax purposes—Included

   (European Parliament and Council Directive 95/46, Arts 2(a) and (b) and 13(1))

3. Fundamental rights—Right to effective judicial protection—Right to an effective remedy—National legislation making the exercise of a judicial remedy by a person stating that his right to protection of personal data has been infringed subject to the prior exhaustion of the available administrative remedies—Lawfulness—Conditions—Procedures for exercising those remedies not affecting disproportionally the right to an effective remedy

   (Charter of Fundamental Rights of the European Union, Art. 47; European Parliament and Council Directive 95/46)

4. Fundamental rights—Right to effective judicial protection—Right to an effective remedy—List containing personnel data and presented as evidence of an infringement of the protection of personal data—Rejection of that list as evidence of such an infringement because it had been obtained without the consent, legally required, of the person responsible for processing that data—Not permissible—Exceptions—Rejection laid down by national legislation and respecting both the essence of the right to an effective remedy and the principle of proportionality

   (Charter of Fundamental Rights of the European Union, Art. 47; European Parliament and Council Directive 95/46, Arts 10 to 12)

5. Approximation of laws—Protection of individuals with regard to the processing of personal data—Directive 95/46—Rules on the lawfulness of the processing of personal data—Criteria for making data processing legitimate—Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority—Creation, for the purposes of tax administration and combating tax fraud, of a list of persons without the consent of the persons concerned—Lawfulness—Conditions—Authorities creating the list having been invested by the national legislation with tasks carried out in the public interest—Observance of the principle of proportionality—Existence of sufficient indications to assume the validity of the inclusion of the data subjects on the list—Compliance with all of the rules on the lawfulness of the processing of personal data imposed by the directive

   (European Parliament and Council Directive 95/46, Art. 7(e))

1.  In so far as it renders inapplicable the system of protection of personal data provided for in Directive 95/46 and thus deviates from the objective underlying it, namely to ensure the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data, the exception provided for in the first indent of Article 3(2) of that directive must be interpreted strictly.

   In that regard, it should be borne in mind that the activities which are mentioned by way of example in that article are, in any event, activities of the State or of State authorities unrelated to the fields of activity of individuals (see judgments of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraph 43, and of 16 December 2008, Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 41).

   The Court has also considered that the activities mentioned by way of example in the first indent of Article 3(2) of Directive 95/46 are intended to define the scope of the exception which is provided for there, with the result that that exception applies only to the activities which are expressly listed there or which can be classified in the same category (see judgment of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraph 44).

   (see paras 36-38)

2.  See the text of the decision.

   (see paras 34, 41-44)

3.  Article 47 of the Charter of Fundamental Rights of the European Union must be interpreted as meaning that it does not preclude national legislation, which makes the exercise of a judicial remedy by a person stating that his right to protection of personal data guaranteed by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, has been infringed, subject to the prior exhaustion of the remedies available to him before the national administrative authorities, provided that the practical arrangements for the exercise of such remedies do not disproportionately affect the right to an effective remedy before a court referred to in that article. It is important, in particular, that the prior exhaustion of the available remedies before the national administrative authorities does not lead to a substantial delay in bringing a legal action, that it involves the suspension of the limitation period of the rights concerned and that it does not involve excessive costs.

   (see para. 76, operative part 1)

4.  Article 47 of the Charter of Fundamental Rights of the European Union must be interpreted as precluding that a national court rejects, as evidence of an infringement of the protection of personal data conferred by Directive 95/46, a list, such as the contested list, submitted by the data subject and containing personal data relating to him, if that person had obtained that list without the consent, legally required, of the person responsible for processing that data, unless such rejection is laid down by national legislation and respects both the essential content of the right to an effective remedy and the principle of proportionality.

   Thus, in order to assess the proportionality of a rejection of the disputed list as evidence, the referring court must examine whether its national legislation limits, in relation to the data included in the list, information and access rights laid down in Articles 10 to 12 of Directive 95/46 and if such a limitation is, where appropriate, justified. Moreover, even where that is the case and there is evidence to support a legitimate interest in the possible confidentiality of the contested list, the national courts must determine on a case-by-case basis whether this takes precedence over interest in the protection of the rights of the individual and whether, in the proceedings before that court, other means exist to ensure that confidentiality, in particular as regards the personal data of other natural persons included on that list.

   (see paras 97, 98, operative part 2)

5.  Article 7(e) Directive 95/46 must be interpreted as not precluding the processing of personal data by the authorities of a Member State for the purpose of collecting tax and combating tax fraud such as that effected by drawing up of a list of persons such as that at issue in the main proceedings, without the consent of the data subjects, provided that, first, those authorities were invested by the national legislation with tasks carried out in the public interest within the meaning of that article, that the drawing-up of that list and the inclusion on it of the names of the data subjects in fact be adequate and necessary for the attainment of the objectives pursued and that there be sufficient indications to assume that the data subjects are rightly included in that list and, second, that all of the conditions for the lawfulness of that processing of personal data imposed by Directive 95/46 be satisfied.

   (see para. 117, operative part 3)