Case C‑333/22

Ligue des droits humains ASBL
and
BA

v

Organe de contrôle de l’information policière

(Request for a preliminary ruling from the cour d’appel de Bruxelles)

Judgment of the Court (Fifth Chamber) of 16 November 2023

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Directive (EU) 2016/680 – Article 17 – Exercise of the rights of the data subject through the supervisory authority – Verification of the lawfulness of the data processing – Article 17(3) – Obligation to provide the data subject with a minimum of information – Scope – Validity – Article 53 – Right to seek an effective judicial remedy against the supervisory authority – Concept of a ‘legally binding decision’ – Charter of Fundamental Rights of the European Union – Article 8(3) – Control by an independent authority – Article 47 – Right to effective judicial protection)

1. Approximation of laws – Protection of natural persons with regard to the processing of personal data in criminal matters – Directive 2016/680 – Exercise of the rights of the data subject through the supervisory authority – Existence of the right to an effective judicial remedy against the decision of that authority – Concept of a ‘legally binding decision’ – Supervisory authority’s decision to close the process for verification of the lawfulness of the data processing – Included

   (Charter of Fundamental Rights of the European Union, Arts 8 and 47; European Parliament and Council Directive 2016/680, recitals 48, 75 and 86 and Arts 17, 46(1)(g), 47(1) and (2) and 53(1))

   (see paragraphs 38-52, 54, 55, operative part 1)

2. Approximation of laws – Protection of natural persons with regard to the processing of personal data in criminal matters – Directive 2016/680 – Article 17(3) – Assessment of that provision’s validity in the light of Article 8(3) and Article 47 of the Charter of Fundamental Rights – Provision setting out an obligation for the supervisory authority to inform the data subject, first, that the necessary verifications or a review have taken place and, secondly, of his or her right to seek a judicial remedy – Validity

   (Charter of Fundamental Rights of the European Union, Arts 8(3), 47 and 52(1); European Parliament and Council Directive 2016/680, recital 86 and Arts 17(3) and 53(1))

   (see paragraphs 60-72, operative part 2)

Résumé

In 2016, BA sought security clearance from the Autorité nationale de sécurité (National Security Authority, Belgium). He was refused that clearance, inter alia for reasons of State security and preservation of the constitutional democratic order, on account of his participation in demonstrations over the last decade. Specifically, that refusal was based on his personal data, processed by the Belgian police service.

Subsequently, BA requested the Organe de contrôle de l’information policière (OCIP) (Supervisory Body for Police Information (OCIP), Belgium), in its capacity as the supervisory authority, to identify the controllers responsible for processing his personal data and to order them to grant him access to all the information concerning him, in order to enable him to exercise his rights. The OCIP carried out a verification of the lawfulness of the processing of BA’s personal data in the police data banks in accordance with Belgian law. ( 1 ) Relying on that law, which does not allow the data subject direct access to his or her data, the OCIP merely informed BA that it had carried out the necessary verifications.

In that context, the cour d’appel de Bruxelles (Court of Appeal, Brussels, Belgium) was seised by the Ligue des droits humains ASBL and BA following an order from the tribunal de première instance francophone de Bruxelles (Brussels Court of First Instance (French-speaking), Belgium) declaring itself to have ‘no jurisdiction’ to hear and determine the application for interim measures lodged by those parties. The cour d’appel de Bruxelles (Court of Appeal, Brussels) referred a question to the Court of Justice on the interpretation and validity of Article 17 of Directive 2016/680 ( 2 ) in the light of the provisions of the Charter of Fundamental Rights of the European Union (‘the Charter’).

In its judgment, the Court rules, first, on the right of the data subject to seek an effective judicial remedy against the supervisory authority’s decision where that data subject’s rights have been exercised through that authority. Secondly, it holds Article 17 of Directive 2016/680 to be valid inasmuch as that provision lays down only a minimum obligation on the supervisory authority to inform the data subject that all necessary verifications or a review by the supervisory authority have taken place and of that data subject’s right to seek a judicial remedy.

Findings of the Court

The Court begins by recalling that Directive 2016/680 requires Member States to provide for the right of a natural or legal person to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. ( 3 ) It is thus necessary to determine whether that authority adopts such a decision where the data subject’s rights are exercised through that authority.

In that regard, the Court observes first that, in the cases provided for by Directive 2016/680 which seek to protect public interest purposes, ( 4 ) the Member States must provide for the possibility for the data subject’s rights to be exercised indirectly through the supervisory authority. That possibility offers that data subject an additional guarantee as to the lawful processing of his or her data where national law restricts the direct exercise of his or her rights before the controller, ( 5 ) as allowed under Directive 2016/680. ( 6 )

Next, the Court states that, to that end, each supervisory authority must, under Article 17 of Directive 2016/680, be entrusted with the task of checking the lawfulness of processing and have not only effective investigative powers, but also corrective powers. ( 7 ) In that context, its task falls entirely within the definition of its role by the Charter. ( 8 ) Furthermore, under that provision also, the supervisory authority is obliged to inform the person concerned that all the necessary verifications have been carried out.

The Court infers from this that, where the supervisory authority provides that information, it brings to the data subject’s knowledge the decision adopted in his or her regard to close the verification process, which necessarily affects his or her legal position. That decision therefore constitutes a legally binding decision for that data subject, irrespective of whether and to what extent that authority has found the processing of his or her data to be lawful or adopted corrective measures.

Lastly, the Court concludes that the data subject must be able to obtain judicial review of the merits of such a decision and, in particular, of the manner in which the supervisory authority performed its obligation to carry out all necessary verifications and, as the case may be, exercised its corrective powers. That conclusion is also consistent with Article 47 of the Charter concerning the right to an effective judicial remedy which, under settled case-law, must be accorded to any person relying on rights or freedoms guaranteed by EU law against a decision adversely affecting him or her which is such as to undermine those rights or freedoms.

As regards the validity of Article 17(3) of Directive 2016/680, the Court observes that, inasmuch as that provision does not preclude, in certain situations, in accordance with the rules adopted by the national legislature to implement it, the supervisory authority from being able, or even obliged, to communicate to the data subject the minimum information provided for by that provision, in particular where those rules seek to avoid compromising the public interest purposes provided for by that directive, it is liable to give rise to a limitation on the right to an effective judicial remedy, guaranteed in Article 47 of the Charter.

However, that limitation is expressly provided for by law and is not absolute. In addition, so far as concerns the other criteria which are capable of justifying such a limitation, ( 9 ) the Court points out that it is for the Member States to ensure that the national provisions implementing Article 17(3) of that directive, first, respect the essence of the right to effective judicial protection and, secondly, are based on a weighing up of the public interest purposes warranting limitation of that information and of the fundamental rights and legitimate interests of the data subject, in accordance with the principles of necessity and proportionality. Thus, it is for those Member States to provide that, under certain conditions, the information disclosed to the data subject may go beyond the minimum information, that the competent authority has a degree of discretion to determine whether it may communicate to the data subject, at least in brief, the result of its verifications and that, if not, the court with jurisdiction, seised of an action against the supervisory authority, may, nevertheless, ensure sufficient compliance with the procedural rights of the person concerned, such as the right to be heard and the adversarial principle, and exercise its power of review effectively.

Having regard to all those considerations, the Court holds that there is nothing calling into question the validity of Article 17(3) of Directive 2016/680.

( 1 ) Article 42 of the loi relative à la protection des personnes physiques à l’égard des traitements de données à caractère personnel (Law on the protection of natural persons with regard to the processing of personal data) of 30 July 2018 (Moniteur belge of 5 September 2018, p. 68616).

( 2 ) Article 17 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89) provides: ‘1. In the cases referred to in Article 13(3), Article 15(3) and Article 16(4) Member States shall adopt measures providing that the rights of the data subject may also be exercised through the competent supervisory authority. … 3. Where the right referred to in paragraph 1 is exercised, the supervisory authority shall inform the data subject at least that all necessary verifications or a review by the supervisory authority have taken place. The supervisory authority shall also inform the data subject of his or her right to seek a judicial remedy.’

( 3 ) Article 53(1) of Directive 2016/680.

( 4 ) Those purposes, set out in Article 13(3), Article 15(1) and Article 16(4) of Directive 2016/680, seek to: ‘avoid obstructing official or legal inquiries, investigations or procedures’, ‘avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties’, ‘protect public security’, ‘protect national security’, or ‘protect the rights and freedoms of others’.

( 5 ) Specifically, these rights are: the right to receive further information, the right of access to his or her data or the right to obtain their rectification, erasure or a restriction of processing, set out in Article 13(2), Article 14 and Article 16(1) to (3) of Directive 2016/680 respectively.

( 6 ) Article 13(3), Article 15(1) and Article 16(4) of Directive 2016/680.

( 7 ) Article 46(1)(g) and Article 47(1) and (2) of Directive 2016/680.

( 8 ) Article 8 of the Charter.

( 9 ) Provided for by Article 52(1) of the Charter.