OPINION OF ADVOCATE GENERAL

POIARES MADURO

delivered on 3 April 2008 (1)

Case C‑524/06

Heinz Huber

v

Bundesrepublik Deutschland

(Reference for a preliminary ruling from the Oberverwaltungsgericht für das Land Nordrhein-Westfalen (Germany))

1.        The present case concerns the processing of the personal data of foreign EU citizens who reside in Germany. The referring court asks whether the processing of data in a central register operated by the Bundesamt für Migration und Flüchtlinge (Federal Office of Migration and Refugees), to which other public authorities also have access, is compatible with the prohibition of discrimination on the basis of nationality, the right of establishment and Directive 95/46, (2) given that no such register exists for German citizens.

I –  Factual background

2.        The claimant in the main proceedings, Mr Heinz Hubert, is an Austrian citizen. Since 1996, he has been living and working in Germany. The personal data of foreign citizens living in Germany, including those of citizens of other Member States, are stored in a central register operated by the Federal Office for Migration and Refugees. Information on Mr Huber stored in the register includes his personal details and marital status, passport details, the date of his first entry into Germany, his residence status, his various changes of domicile within the country as well as the details of the registration authorities and the names of the administrative offices that have communicated his data. Personal data of German citizens are stored only in local, municipal registers, as no central register at the federal level exists for them.

3.        In 2002 Mr Huber, relying on Articles 12 and 49 EC and on Directive 95/46, requested the deletion from the central register of any data relating to him. His request was rejected by the Bundesverwaltungsamt (Federal Administrative Office), which was responsible at the time, while an administrative appeal within the same Office was also rejected. Then, Mr Huber brought an action before the Verwaltungsgericht (Administrative Court) with the same request. It upheld the action, finding that the storage of the claimant’s data was incompatible with Community law. The Federal Office for Migration and Refugees appealed against the judgment of the Administrative Court, so the Oberverwaltungsgericht für das Land Nordrhein-Westfalen (Higher Administrative Court of North-Rhine Westphalia) stayed the proceedings and referred three questions to the Court of Justice:

‘Is the general processing of personal data of foreign citizens of the Union in a central register of foreign nationals compatible with:

(a)      the prohibition of discrimination on grounds of nationality against citizens of the Union who exercise their right to move and reside freely within the territory of the Member States (first paragraph of Article 12 EC in conjunction with Articles 17 EC and 18(1) EC),

(b)       the prohibition of restrictions on the freedom of establishment of nationals of a Member State in the territory of another Member State (first paragraph of Article 43 EC),

(c)       the requirement of necessity under Article 7(e) of [Directive 95/46]?’

II –  Analysis

4.        The first two questions referred to the Court of Justice by the national court concern the compatibility of the German system of processing the data of foreign Union nationals with, first, the general principle of non-discrimination enshrined in Article 12 EC (read in conjunction with Articles 17 EC and 18(1) EC on Union citizenship and the right to move and reside freely within the European Union respectively) and, second, the right to establishment guaranteed by Article 43 EC. I share the Commission’s view that Article 12 EC is the most appropriate legal basis for analysing the issue, given that the claimant has clearly exercised his right under Community law, guaranteed by Article 18(1) EC, to move to another Member State. Indeed, I think that the question of discrimination is at the core of the present case. If the German system is considered to be incompatible with the prohibition laid down by Article 12 EC of discrimination on grounds of nationality in relation to the right to move and reside freely within a Member State, then it cannot be upheld regardless of whether it affects, or has the potential to affect, the claimant’s rights of establishment. Therefore, I will first discuss the question of discrimination and then turn to the requirement of necessity under Directive 95/46, which is the subject of the third question referred to the Court. (3)

A –    Does the German system discriminate against foreign EU nationals?

 Comparable situations

5.        It is common ground among all the parties that there are significant differences between the processing of the personal data of German citizens and the data of nationals of other EU Member States. Germany does not have a centralised system for recording, storing and processing the personal data of its nationals. There are, however, around 7 700 municipal population registers, which record the basic personal details of citizens but which are not linked to each other and cannot be searched centrally and simultaneously. By contrast, the personal data of foreign nationals, including those of nationals of EU Member States, are stored not only in the municipal registers but also in a central register of foreign nationals operated by the Federal Office for Migration and Refugees. Moreover, the central register is considerably more extensive in scope and contains additional information which is not recorded in the municipal registers such as passport details, dates of entry to and exit from the country, residence status, details of any application for refugee status and its outcome, particulars of deportation orders and measures to execute them, information about suspected criminal activities of the data subject and information on criminal convictions. Thus, there is a difference in treatment between German nationals and foreign Union nationals in three respects: first, the personal data of foreign nationals are recorded not only in the municipal registers, where the data of German nationals are recorded as well, but also in the central register of foreign nationals; second, the central register contains more information on data subjects than the local registers do; and third, the data of foreign nationals are readily available to various governmental authorities through the central register while no such possibility exists in relation to German nationals. The question is whether such a difference in treatment constitutes prohibited discrimination

6.        The German Government reminds us that a finding of discrimination requires that there be two comparable situations which are treated differently. So, the obligation of Member States not to discriminate on the basis of national origin means that only similar cases should be treated alike. Since the residence status of German nationals is different from that of foreign nationals, these two categories of people are not in a similar position and, accordingly, no issue of discrimination arises. The same view is taken by the Danish Government, which notes that nationals of a particular State always have the right to enter and reside in their country, which, according to Article 3 of the Fourth Additional Protocol to the European Convention on Human Rights, can never deport them or refuse them entry, while foreign Union nationals are granted entry and residence rights only by virtue of Community law. According to the Dutch Government, the most pertinent criterion for deciding whether the two situations are comparable is the processing of data in relation to the right of residence. Since a German national living in Germany and a citizen of another Member State living in Germany have different residence rights – the former has an unlimited right based on his nationality, the latter a limited one granted by Community law – it is possible to treat their personal data differently without infringing the foreign citizens’ right to be free from discrimination on grounds of nationality. Essentially, what is being argued is that although there are two different systems of data processing in Germany, which apply according to the nationality of the data subject, no issue of discrimination on the basis of nationality can arise because German citizens are not comparable to EU citizens. The former have an unlimited right to reside in the country while the latter have no such right.

7.        I am not convinced by this line of reasoning. The starting point of our inquiry should be that there are two systems of data processing, one for Germans and another one for Union nationals. It is, of course, descriptively accurate to state that the residence rights of German citizens and foreign nationals are not the same. But this is no more than stating the obvious; it says nothing about how this difference in residence status should relate to the collection and processing of the personal data of German citizens and citizens of other Member States. Put differently, the Governments of Germany, Denmark and the Netherlands would have us believe that the fact that foreign EU citizens have limited residence rights compared to indigenous citizens is the last word of the story, while the opposite is true: it is only the beginning. For a finding of non-discrimination, it is not sufficient to point out that German citizens and foreign nationals are not in the same situation. It is also necessary to demonstrate that the difference in their respective situations is capable of justifying the difference in treatment. In other words, the difference in treatment must relate and be proportionate to the difference in their respective situations. Therefore, I agree with the Commission that, in order to decide whether a German national is in a comparable situation to an EU national in relation to the collection and processing of personal data by the German authorities, we need to examine the purposes for which this collection and processing takes place. The German Government submits that a systematic processing of personal data in a central register is necessary for immigration law and residence status purposes, for effective general law enforcement and for the collection of statistical data. I will discuss each of them in turn.

 Residence status and immigration rules

8.        The primary argument of the German Government is that Community law allows Member States to impose limitations on the entry and residence, within their territory, of citizens of other Member States, who may even be deported. In order to be able to exercise this power, the German authorities need an effective mechanism for collecting the personal data and monitoring the movements of foreigners who take up residence in the country; such a mechanism is not necessary for Germans as they have an unlimited right to reside in the country and can never be deported. The German Government makes two points in support of this position. First, it argues that Directive 2004/38/EC, by giving the Member States the power to require resident foreign EU citizens to register with the relevant authorities, has implicitly authorised the collection and processing of their data. (4) Second, the German Government relies heavily on the Court’s judgment in Watson and Belmann. (5) That case concerned an Italian law requiring all foreigners, including Community nationals, to register with the local police within three days of their entry to Italy, and provided for a fine or imprisonment and possible deportation in cases where an individual failed to comply. The Court held that deportation was ‘certainly incompatible’ (6) with the provisions of the Treaty, while any other penalty had to be proportionate to the gravity of the offence and not function as an obstacle to freedom of movement for persons. However, the Court explained: ‘by creating the principle of freedom of movement for persons and by conferring on any person falling within its ambit the right of access to the territory of the Member States, for the purposes intended by the Treaty, Community law has not excluded the power of Member States to adopt measures enabling the national authorities to have an exact knowledge of population movements affecting their territory’. (7) The German Government argues that, since Member States have the power to adopt measures in order to have exact knowledge of population movements, it is clear that they have the power to establish a register containing information about who enters or leaves the country even when they do so only in relation to EU citizens.

9.        Yet, neither Directive 2004/38 nor Watson and Belmann confer on Member States an unlimited power to adopt registration and monitoring systems for citizens of other Member States. Obviously, a registration requirement necessarily means that some personal data of EU citizens will be collected, stored and processed. Directive 2004/38, though, does not include any provisions about how this is to be done. That is a matter for each Member State, which, however, must exercise that power in a way which is compatible with its Community law obligations, including the obligation not to discriminate on the basis of national origin. Therefore, the fact that the Community legislature has implicitly accepted the possibility of some data collection taking place does not mean that it has authorised Member States to establish any system of data collection and processing they think appropriate.

10.      Similarly, I think that the German Government reads too much into the excerpt from Watson and Belmann cited above. This case is authority only for the proposition that Member States may monitor population movements. It does not establish a general right for national authorities to carry out this monitoring in any way they think appropriate or convenient, and it certainly does not excuse Member States from complying with their obligations under Community law, and, in particular, the prohibition of discrimination on the basis of nationality. The German authorities may adopt measures to monitor population movements, but such measures must be compatible with the Treaty and any other relevant provisions of Community law.

11.      Therefore, we need to examine those three features of the German system which lead to differential treatment between nationals and Union citizens and to assess whether they are justified as a means of enforcing residence and immigration rules.

12.      Clearly, making the data of Union citizens available not only to immigration authorities but to the administration in general is not justified by any need to enforce residence rules. Even if the system under consideration is necessary so that the immigration authorities can perform their functions, it does not follow that the data stored therein should be made available to other administrative and criminal authorities and agencies. It is stated in the order for reference that the information stored in the register of foreign nationals can be used not only by the Federal Office for Migration and Refugees but by many other public authorities and agencies such as the police, the security services, the public prosecutor’s office and the courts. Certain of these authorities may retrieve data by means of an automated procedure. Access to this information can also be given to non-public, charitable organisations, public authorities from other States and international organisations. It is obvious that the scope of the data collection and processing through the central register for foreigners is very extensive and goes beyond immigration purposes to encompass all kinds of relationships between an individual and the State. Through the central register, the various authorities in Germany are in a position to retrieve data about the personal status of EU nationals living in the country, to monitor systematically and without difficulty their whereabouts and to share among themselves all the information they need for such monitoring. The register of the Federal Office for Migration and Refugees is, thus, much more than an immigration register; it is a comprehensive database through which State authorities have the personal data of EU citizens at their fingertips. The treatment of German citizens is completely different, as no similar data collection mechanism exists for them. An administrative agency which needs information on a German national would have to carry out a much more cumbersome and complicated search based on the municipal registers which are not centrally managed, cannot be searched simultaneously and contain less information than the register for foreign citizens.

13.      For the same reason, I do not consider that the amount of data stored in the central register for foreigners can be justified. Registration of Union citizens is authorised by Directive 2004/38 exclusively for the purposes of ascertaining one’s residence status and rights. It follows that the only pieces of data that Member States can legitimately collect and process are those that relate to residence rights of Union citizens. Article 8 of Directive 2004/38, paragraph 1 of which provides for the possibility of a registration requirement, states, in paragraph 3, which information and documentation national authorities may require in order to issue a registration certificate. Union citizens may be asked to prove their identity by showing their passport or identity card and provide documentation concerning employment or study in the host country (if they are coming as students or workers) or evidence of their financial resources; this list is restrictive and not indicative. By enacting Article 8(3), the European Parliament and the Council have made an assessment that the information referred to therein is enough to enable Member States to exercise their right to monitor who enters the country and takes up residence there. Accordingly, collecting, storing and processing more data than Article 8(3) of Directive 2004/38 allows, as Germany currently does, cannot be justified by the need to enforce residence and immigration rules.

14.      The third element of the German system which leads to differential treatment between Germans and Union nationals, namely the existence of a central register for the latter as opposed to local ones for the former, gives rise to a more difficult question: is the systematic and centralised processing of the personal data of Union citizens necessary for the enforcement of Community law provisions on entry and residence?

15.      I have to say from the outset that the existence of two separate data processing systems casts an unpleasant shadow over Union citizens, whom the German Government monitors much more strictly and systematically than German citizens. While the idea underlying the EU law provisions on citizenship and the right of entry and residence is that individuals should be able to integrate into the society of the host Member State and enjoy the same treatment as nationals, the system in question perpetuates the distinction between ‘us’ – the natives – and ‘them’ – the foreigners. Such a system can reinforce the prejudice of individuals or certain segments of society against foreigners and is likely to stigmatise Union citizens merely on account of their national origin. It must be also noted that the systematic monitoring of individuals is, in some European States, associated, for historical reasons, with undemocratic and totalitarian regimes, which explains, in part, why so many people in Europe find those systems particularly objectionable. On the other hand, there are European States where centralised systems of data processing do exist without raising any particular social controversy. In the present case, the sensitivity of the issue is enhanced by the fact that only the data of citizens of other Member States are subject to such a centralised processing. At the same time, this could be seen as a consequence of the different residential status of nationals of other Member States in Germany.

16.      I think that the proper test here is one of effectiveness, and it is for the national court to apply it. The question it must ask is whether there are other ways of data processing by which the immigration authorities could enforce the rules on residence status. If it answers that question in the affirmative, the centralised data storage and processing for Union citizens should be declared unlawful. It is not necessary for the alternative system to be the most effective or appropriate; it is enough for it to be able to perform adequately. Put differently, even if the central register is more effective or convenient or user-friendly than its alternatives (such as the decentralised, local registers), the latter are clearly to be preferred if they can be used to indicate the residence status of Union citizens.

17.      In assessing the effectiveness of the various registration systems, the national court should take into account the case-law of the Court of Justice on the right of entry to and residence in a Member State, as it is in those judgments that the powers of the national authorities in this field and their limits are defined. For example, it has been clear for many years now that a Member State can neither prevent a citizen of another Member State from entering its territory nor deport him at will; only an individual’s personal conduct which poses a real and serious threat to society may justify a prohibition of entry or a deportation order. (8) Moreover, this power must be narrowly construed, as it constitutes a derogation from the fundamental principle of freedom of movement within the Union. (9) These principles have been affirmed recently by the Court in Commission v Spain (10) and Commission v Germany (11) and given legislative recognition by the Community legislature in Directive 2004/38. (12)

18.      Of course, any discussion of the right to reside in a Member State and its limits should take place against the concept of Union citizenship. Following the Treaty on European Union it is no longer possible to think about the status of EU nationals and the rights they have to enter a Member State and reside there in the same way as we did before it. The Court explained the rule in Baumbast as follows: ‘… Union citizenship has been introduced into the EC Treaty and Article 18(1) EC has conferred a right, for every citizen, to move and reside freely within the territory of the member States. Under Article 17(1) EC, every person holding the nationality of a Member State is to be a citizen of the Union. Union citizenship is destined to be the fundamental status of nationals of the Member States’ (my emphasis). (13) As the Court held in Grzelczyk, the starting point in discrimination cases should be that Union citizens are entitled to the same treatment as nationals subject to express exceptions. (14) The prohibition of discrimination on the basis of nationality is no longer merely an instrument at the service of freedom of movement; it is at the heart of the concept of European citizenship and of the extent to which the latter imposes on Member States the obligation to treat Union citizens as national citizens. Though the Union does not aim to substitute a ‘European people’ for the national peoples, it does require its Member States no longer to think and act only in terms of the best interests of their nationals but also, in so far as possible, in terms of the interests of all EU citizens.

19.      When the Court describes Union citizenship as the ‘fundamental status’ of nationals it is not making a political statement; it refers to Union citizenship as a legal concept which goes hand in hand with specific rights for Union citizens. Principal among them is the right to enter and live in another Member State. Directive 2004/38 reflects this new rule in recital 11, which states that ‘the fundamental and personal right of residence in another Member State is conferred directly on Union citizens by the Treaty and is not dependent upon their having fulfilled administrative procedures’.

20.      In the light of the foregoing analysis, I think that two of the elements of the data processing system under consideration, namely that it is accessible by authorities other than the Federal Office for Migration and Refugees and that it includes various pieces of personal information beyond those allowed by Article 8(3) of Directive 2004/38, cannot be justified by the need to enforce immigration law and residence status provisions. The centralised nature of the system can be justified only if the national court concludes, after considering the case-law of the Court of Justice on the right to enter and reside in a Member State, that a central register is the only effective way for enforcing immigration law and residence status provisions.

 General law enforcement and statistical data

21.      The German Government claims that in addition to issues relating to residence status and immigration rules, there are also general law-enforcement considerations, namely the combating of crime and threats to security, which justify the difference in treatment between Germans and citizens of other Member States. Indeed, law enforcement and the combating of crime could, in principle, be a legitimate public policy reason qualifying rights granted by Community law. What Member States cannot do, though, is to invoke it selectively, that is, against EU nationals living in their territory, but not against their own citizens. If a central register is so important for effective general policing, it should obviously include everyone living within a particular country regardless of his nationality. It is not open to national authorities to say that fighting crime requires the systematic processing of personal data of EU citizens but not of that relating to nationals. This would be tantamount to saying that EU nationals pose a greater security threat and are more likely to commit crimes than citizens, which, as the Commission points out, is completely unacceptable.

22.      There is, of course, the issue of convenience. Having a comprehensive database containing the personal data of every foreigner in the country makes it easy for the police and security services to monitor an individual’s movements and conduct. It is far more complicated and time-consuming to have to search thousands of local registers to get the information they may want, as they need to do with German citizens. However, first, administrative convenience can never be a reason justifying discriminatory treatment on the basis of nationality or any other restriction on the rights granted by Community law; (15) second, if the police need a convenient surveillance method, it is clear that they must need the same one for both Germans and foreigners.

23.      Finally, the German Government claims that the central register for EU nationals is necessary in order to collect statistical information on migration and population movement in Europe. It cites, to this effect, Regulation (EC) No 862/2007 of the European Parliament and of the Council of 11 July 2007 on Community statistics on migration and international protection. (16) Yet, the Regulation neither requires nor authorises the establishment of a database containing the personal data of EU nationals who have exercised their rights to freedom of movement. Statistics are, by definition, anonymous and impersonal. All that the German authorities have to do to comply with their obligations under the Regulation is to compile this anonymous information on migration.

24.      Therefore, I think that the Court should answer the question whether the German system constitutes discrimination on the basis of national origin as follows:

‘A system of data storage and processing such as the one at issue in the main proceedings is incompatible with the prohibition of discrimination on grounds of nationality in so far as it includes data beyond those specified in Article 8(3) of Directive 2004/38 and is accessible by public authorities other than the immigration authority. The centralised processing of personal data applicable only to citizens of other Member States will also be incompatible with the prohibition of discrimination on grounds of nationality if there are other effective ways for enforcing immigration and residence status rules, that being for the national court to assess.’

B –    The requirement of necessity under Directive 95/46

25.      For present purposes, the relevant provision is that of Article 7(e) of Directive 95/46, which states: ‘Member States shall provide that personal data may be processed only if … processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed’. Therefore, the question we have to ask is whether this particular form of centralised processing is necessary for the achievement of a legitimate public interest objective.

26.      In its written submissions to the Court, the German Government takes the view that the public interest at play here is the exercise by Member States of their power to enforce Community law in relation to the entry and residence of Union citizens in their territory. The data processing system currently in force, the German Government submits, is necessary for the performance of this task, as there are no other, less intrusive measures which could allow national authorities to enforce immigration law.

27.      The concept of necessity has a long history in Community law and is well established as part of the proportionality test. It means that the authority adopting a measure which interferes with a right protected by Community law in order to achieve a legitimate aim must demonstrate that the measure is the least restrictive for the achievement of this aim. (17) Moreover, when the processing of personal data may be liable to infringe the fundamental right of privacy, Article 8 of the European Convention on Human Rights, which guarantees the right to private and family life, also becomes relevant. As the Court held in Österreichischer Rundfunk and Others, when a national measure is incompatible with Article 8 of the Convention, it also fails to pass the threshold of Article 7(e) of Directive 95/46. (18) The second paragraph of Article 8 stipulates that an interference with private life may be legitimate if it pursues one of the aims listed therein and is ‘necessary in a democratic society’. The European Court of Human Rights has held that the adjective ‘necessary’ implies that there exists ‘a pressing social need’ for the State to act in a particular way and that the measure taken is proportionate to the legitimate aim pursued. (19)

28.      All this means that, in view of the facts of this case, the answer to the third question turns out to depend on a substantially similar analysis to that employed to answer the question on discrimination on grounds of nationality. I have already explained that there are three objectionable elements in the data processing system at issue. For the first two of them, the reply to the question whether they are necessary under Directive 95/46 is the same as the conclusion in relation to the principle of non-discrimination on the basis of nationality: they are not necessary, at least for the purpose of enforcing the rules on the right of entry and residence of foreign EU citizens which is the public interest being claimed by the German Government, on the basis of Article 7(e) of Directive 95/46. For this task to be achieved, all that is required is that the relevant authority, namely the Federal Office for Migration and Refugees, processes the personal data of Union citizens. The transmission (20) of the data to other public authorities does not meet the requirement of necessity laid down under the Directive. The same is true of the amount of data collected in the central register. The only information that can be legitimately stored and processed is that which is essential for the enforcement of immigration and residence status provisions. For Union citizens, this information is exhaustively listed in Article 8(3) of Directive 2004/38; anything which goes beyond this cannot be deemed to be necessary for immigration law purposes. Therefore, the fact that the central register for foreigners includes additional data also fails to meet the requirement of necessity under Directive 95/46.

29.      This leaves us with the third element of the German system, its centralised nature. Is such a manner of data processing compatible with the requirement of necessity under Directive 95/46? Again, the answer will not depart from the answer provided to the first question. I think it is for the national court to make a decision on this point on the basis of the elements put forward above. (21) While the German Government enjoys some leeway to decide how to pursue its legitimate objectives, the requirement of necessity under Directive 95/46 means that it has to demonstrate that it is impossible to enforce Community law provisions on entry and residence in Germany of citizens of other Member States unless their data are centrally processed. An argument that centralised processing is more convenient, easier or quicker than alternative forms of processing should not be enough for the Government to pass the test of necessity.

30.      The question would be different and substantially more complex and potentially difficult to answer if the national court were asking the Court of Justice to give a ruling on the compatibility of a centralised system of data processing applicable to all individuals resident in Germany with the requirement laid down in Article 7(e) of Directive 95/46; the necessity for such a system would need to be argued on the basis of public interests other than immigration policy. That would require balancing the public interests to be pursued by such a centralised system with the individual rights protected by that Directive. While the Directive aims to remove the obstacles to flows of personal data which could affect cross-border economic activities, it also provides for the attainment of a high level of data protection throughout the Community. This concern with data protection and privacy is not subordinate to the aim of facilitating the free flow of data; it runs in parallel with it, and functions as the basis upon which any legitimate processing of data takes effect. Put differently, in the context of Directive 95/46, data protection is not merely incidental to the economic activity that may be facilitated by data processing; it is on a par with it. This is expressed in the title of the Directive (‘on the protection of individuals with regard to the processing of personal data and on the free movement of such data’), in recitals 2, 10, 11 and 12 and, of course, in its numerous provisions imposing specific obligations on data controllers. Furthermore, the right to privacy, which, in essence, is at stake in data protection cases, is protected in Article 7 of the Charter of Fundamental Rights of the European Union. In any event, it is neither necessary nor appropriate to address this hypothetical question in the context of the current case.

31.      Consequently, I think that the Court should answer the third question as follows:

A system of data storage and processing such as the one at issue in the main proceedings is incompatible with the requirement of necessity under Article 7(e) of Directive 95/46 in so far as it includes data beyond those specified in Article 8(3) of Directive 2004/38 and is accessible by public authorities other than the immigration authorities. The centralised processing of personal data applicable only to citizens of other Member States will also be incompatible with the requirement of necessity under Article 7(e) of Directive 95/46, unless it can be demonstrated that there is no other way of enforcing immigration and residence status rules, that being for the national court to assess.

III –  Conclusion

32.      For these reasons I propose that the Court give the following answers to the questions referred by the Oberverwaltungsgericht für das Land Nordrhein-Westfalen:

(1)      A system of data storage and processing such as the one at issue in the main proceedings is incompatible with the prohibition of discrimination on grounds of nationality in so far as it includes data beyond those specified in Article 8(3) of Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States and is accessible by public authorities other than the immigration authority. The centralised processing of personal data applicable only to citizens of other Member States will also be incompatible with the prohibition of discrimination on grounds of nationality if there are other effective ways for enforcing immigration and residence status rules, that being for the national court to assess.

(2)       A system of data storage and processing such as the one at issue in the main proceedings is incompatible with the requirement of necessity under Article 7(e) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data in so far as it includes data beyond those specified in Article 8(3) of Directive 2004/38 and is accessible by public authorities other than the immigration authorities. The centralised processing of personal data applicable only to citizens of other Member States will also be incompatible with the requirement of necessity under Article 7(e) of Directive 95/46, unless it can be demonstrated that there is no other way of enforcing immigration and residence status rules, that being for the national court to assess.

---

1 – Original language: English.

---

2 – Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) (‘the Directive’).

---

3 – A further reason to treat the first two questions together is that the order for reference does not provide sufficient information to enable the Court of Justice to examine whether this particular form of data processing has a negative impact on the claimant’s right of establishment under Article 43 EC. The Greek Government also takes the view that the case must be examined under Article 12 EC and not 43 EC, as it raises no questions relating to the right of establishment.

---

4 – Article 8 of Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States (OJ 2004 L 158, p. 77) and corrigendum OJ 2004 L 229, p. 35.

---

5 – Case 118/75 [1976] ECR 1185.

---

6 – Ibid., paragraph 20.

---

7 – Ibid., paragraph 17.

---

8 – Case 41/74 Van Duyn [1974] ECR 1337; Case 67/74 Bonsignore [1975] ECR 297; Case 30/77 Bouchereau [1977] ECR 1999.

---

9 – Case 36/75 Rutili [1975] ECR 1219; Bouchereau.

---

10 – Case C‑503/03 [2006] ECR I‑1097.

---

11 – Case C‑441/02 [2006] ECR I‑3449.

---

12 – Article 27(2) of Directive 2004/38 provides that restrictions on the right of entry and residence are to comply with the principle of proportionality and are to be based exclusively on the personal conduct of the individual which must represent a genuine, present and sufficiently serious threat affecting one of the fundamental interests of society. Under Article 31, an individual who is subject to such measures is to have access to judicial and administrative redress, including interim relief.

---

13 – C‑413/99 Baumbast [2002] ECR I‑7091, paragraphs 81and 82.

---

14 – Case C‑184/99 Grzelczyk [2001] ECR I‑6193, paragraph 31.

---

15 – See Case C‑18/95 Terhoeve [1999] ECR I‑345, paragraph 45 (‘Considerations of an administrative nature cannot justify derogation by a Member State from the rules of Community law. That principle applies with even greater force where the derogation in question amounts to preventing or restricting the exercise of one of the fundamental freedoms of Community law’).

---

16 – OJ 2007 L 199, p. 23

---

17 – See inter alia Joined Cases 133/85, 134/85, 135/85 and 136/85 Rau and Others [1987] ECR 2289.

---

18 – Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I‑4989, paragraph 91.

---

19 – See, inter alia, Gillow v United Kingdom (1989) 11 EHRR 335; Z v Finland (1998) 25 EHRR 371.

---

20 – Disclosure by transmission and dissemination of personal data constitute a form of processing: Article 2(b) of Directive 95/46.

---

21 – The same approach to the assessment of necessity was taken by the Court of Justice in Österreichischer Rundfunk and Others, paragraph 88.