search

… The present case concerns the obligation of a controller, as defined in point 7 of Article 4 of (EU) / (‘the GDPR’), (2) to provide information to a data subject where personal data are collected by means of a body camera worn by ticket inspectors on public transport. …

… Provisional text OPINION OF ADVOCATE GENERAL MEDINA delivered on 1 August 2025 (1) Case C-422/24 Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik (Request for a preliminary ruling from the Högsta förvaltningsdomstolen (Supreme Administrative Court, Sweden)) (Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data and the free movement of such data - (EU) / - Personal data obtained by means of a body camera worn …

… Moreover, under Article 14(2)(f) of the GDPR, the data controller must inform the data subject from which source the personal data originate. 11 According to the Article 29 Working Party, Guidelines on transparency under /, 29 November 2017, WP260 rev. 01, paragraph 28, endorsed by the European Data Protection Board (EDPB) on 25 May 2018 (‘the WP 29 Guidelines on transparency’), the maximum time limit within which information under Article 14 must be provided is in any case one …

… That principle of accountability, which is also laid down in Article 5(2) of (EU) /, (49) must be interpreted in the light of Article 54 of that directive. It follows that the obligation to state reasons arises from the general scheme of the directive. 86. …

… /. …

… The competence of the EDPB under Article 65(1)(a) of / is limited to those matters alone. …

… There is nothing in / justifying putting the complainant in the same procedural situation as the party under investigation. Neither / nor the EDPB’s Rules of Procedure grant the complainant a right to access to the file. …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’). 7 See recital 3 of Directive 2015/849. 8 See Article 1 and recital 64 of Directive 2015/849. …

… According to the referring court, that is why two other natural persons, KL and TR, as persons to whom the breach is attributed, are also parties to the dispute in the main proceedings, since it is necessary, due to their rights as parties, that they are also addressees of the administrative penal order against the legal person and thus have a right to appeal, although the FMA has never sought to punish those natural persons. 5 Judgment of 5 December 2023 (C-807/21, ‘Deutsche Wohnen’, EU:C:2023:950). 6 …

… (EU) / 8 Recital 4 of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) states. ‘The processing of personal data should be designed to serve mankind. …

… Whenever the provisions of this Regulation follow the same principles as the provisions of [/], those two sets of provisions should, under the case-law of the Court of Justice of the European Union …, be interpreted homogeneously, in particular because the scheme of this Regulation should be understood as equivalent to the scheme of [/]. … (22) In order for processing to be lawful, personal data should be processed on the basis of the necessity for the performance …

… According to the General Court, the need to strike such a balance is emphasised by the EU legislature in recital 4 of /, of which 2018/1725 is the ‘equivalent’ as regards the protection of personal data by the Union institutions, bodies, offices and agencies, as stated in recital 5 of Regulation 2018/1725. 56 The General Court inferred from this, in paragraph 117 of the judgment under appeal, that it could not be accepted that the Parliament may invite TC to state his …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’). 9 Paragraph 1(2) of the Amending Law resulted in Paragraph6/A of the Child Protection Law, which now reads: ‘To ensure the fulfilment of the objectives set out in this Law and the implementation …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as well as Article 8(2) of the Charter; (2) Order Hungary to bear its own costs and to pay those incurred by the European Commission; (3) Order the Kingdom of Belgium, the Kingdom of Denmark, the Federal Republic of Germany, Ireland …

… sexual culture, sexual life, sexual orientation and sexual development, Hungary has infringed Articles 16 and 19 of Directive 2006/123, Article 56 TFEU, Articles 1, 7, 11 and 21 of the Charter and Article 2 TEU; - by imposing an obligation, by the Law on the criminal records system, on the body with direct access to the registered data to make available, to authorised persons, the registered data of persons who have committed sexual offences against children, Hungary has infringed Article 10 of …

… (EU) /) I. …

… Article 6 of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (‘the GDPR’), (8) entitled ‘Lawfulness of processing’, provides: ‘1. …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), if those which concern the submission of personal data of natural persons and their disclosure to third parties genuinely pursue interests worthy of protection, only concern data that is strictly necessary to that end and do not …

… Article 4(7) of / must be interpreted as meaning that a court having jurisdiction to authorise, at the request of another judicial body, disclosure by a bank to that body of data relating to the bank accounts of judges, public prosecutors and investigating magistrates as well as of their family members, cannot be classified as a controller within the meaning of that provision. 4. …

… Van Nuffel, acting as Agents, after hearing the Opinion of the Advocate General at the sitting on 4 October 2024, gives the following Judgment 1 These requests for a preliminary ruling concern the interpretation of the second subparagraph of Article 19(1) TEU and of Article 2(2)(a), Article 4(7), Article 32(1)(b), Article 33(3)(d), Article 51, Article 57(1)(b) and Article 79(1) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural …

… Article 2 of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that disclosure, to a judicial body, of personal data that are protected by banking secrecy and that concern judges, public prosecutors and investigating magistrates as well as …

… /. …

… / (see paragraph 3 of the contested opinion). 28 Contrary to the submissions of the EDPB, / does not contain any provision requiring supervisory authorities to ‘take utmost account’ of an opinion under Article 64(2) thereof. …

… No such rules are laid down in relation to opinions of the EDPB on general matters issued under Article 64(2) of /, such as the contested opinion. …

… Provisional text JUDGMENT OF THE COURT (First Chamber) 3 April 2025 (*) (Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - (EU) / - Article 4 - Definitions - Article 6 - Lawfulness of processing - Article 86 - Public access to official documents - Data concerning the representative of a legal person - Case-law of a national court imposing an obligation to inform and consult the data subject prior to disclosure of …

… Ondrůšek, acting as Agents, having decided, after hearing the Advocate General, to proceed to judgment without an Opinion, gives the following Judgment 1 This request for a preliminary ruling concerns the interpretation of point 1 of Article 2 and Article 6(1)(c) and (e) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive …

… Article 6(1)(c) and (e) of /, read in conjunction with Article 86 of that regulation, must be interpreted as not precluding national case-law which requires a controller, being a public authority responsible for reconciling public access to official documents with the right to the protection of personal data, to inform and consult the natural person concerned prior to the disclosure of official documents containing such data, provided that such an obligation is not impossible to …