search

… Provisional text OPINION OF ADVOCATE GENERAL KOKOTT delivered on 12 February 2026 (1) Case C-829/24 European Commission v Hungary (Failure of a Member State to fulfil obligations - Article 49 TFEU - Freedom of establishment - Article 56 TFEU - Freedom to provide services - Article 63 TFEU - Free movement of capital - Directive 2000/31/EC on electronic commerce - Article 3 - Directive 2006/123/EC on services in the internal market - Articles 14, 16 and 19 - (EU) / on general data …

… See also Regulation (EU) 2024/900 of the European Parliament and of the Council of 13 March 2024 on the transparency and targeting of political advertising (OJ L, 2024/900). 4 Paragraph 3(a)(ac) of the contested law. 5 (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); - Dismiss the action as to the remainder; - Order Hungary to bear the costs; - Order the European Parliament, the Kingdom of Belgium, the Czech Republic, the Kingdom of Denmark, the Federal Republic of Germany, the Republic of Estonia …

… JUDGMENT OF THE COURT (Grand Chamber) 10 February 2026 (*) (Appeal - Protection of natural persons with regard to the processing of personal data - (EU) / - Article 63 - Consistency mechanism - Article 65 - Dispute resolution by the European Data Protection Board - Binding decision - Action for annulment - First paragraph of Article 263 TFEU - Act open to challenge - Fourth paragraph of Article 263 TFEU - Condition that the measure against which the action has been brought must …

… Legal context 2 Recitals 10 and 143 of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2; ‘the GDPR’) state: ‘(10) In order to ensure a consistent and high level of protection of natural persons and to remove the …

… (EU) / 10 Article 58 of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), provides, in paragraph 2 thereof: ‘Each supervisory authority shall have all of the following corrective powers: … (i) to impose an administrative fine pursuant …

… In addition, while the proceedings concerned are complex and the underlying facts of those proceedings often opaque and therefore not known to the State, those proceedings are subject to a limitation period of five years from the date of the facts in question. 21 Lastly, that court states that the case-law resulting from the judgment of 5 December 2023, Deutsche Wohnen (C-807/21, EU:C:2023:950) - in which the Court held that Article 58(2) and Article 83(1) to (6) of / must be interpreted …

… / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC 37. …

… What is more, in the absence of any proceedings before them, the Italian courts have had no opportunity to examine – whether on the basis of the parties’ submissions or of their own motion – any issue relating to the application and interpretation of EU law provisions (in particular, the General Data Protection ( (EU) /)), seeking, where appropriate, a preliminary ruling from the CJEU (see, mutatis mutandis, Mansouri, cited above, § 115). …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, “the GDPR”) (OJ 2016 L 119/1) entered into force on 24 May 2016 and has applied since 25 May 2018. 38. …

… Provisional text JUDGMENT OF THE COURT (First Chamber) 18 December 2025 (*) (Reference for a preliminary ruling - Protection of personal data - (EU) / - Articles 13 and 14 - Scope - Personal data collected by means of body cameras worn by ticket inspectors on public transport - Legal basis for the obligation on the data controller to provide information to the data subject) In Case C-422/24, REQUEST for a preliminary ruling under Article 267 TFEU from the Högsta förvaltningsdomstolen …

… Kranenborg, acting as Agents, after hearing the Opinion of the Advocate General at the sitting on 1 August 2025, gives the following Judgment 1 This request for a preliminary ruling concerns the interpretation of Articles 13 and 14 of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection …

… In that regard, it states that the parties disagree as to the conclusion to be drawn from those differences. 17 Lastly, the referring court is uncertain as to the importance to be attached to the Guidelines on transparency under /, adopted on 29 November 2017, in their revised version of 11 April 2018, by the Working Party established by Article 29 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard …

… (EU) / - Article 5 - Principles relating to the processing of personal data - Article 6 - Lawfulness of processing - Principle of proportionality) I. …

… The Latvijas Republikas Satversmes tiesa (Constitutional Court) also seeks to ascertain whether Article 5(1) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (7) (‘the GDPR’) must be interpreted as authorising the making available to the public of such information without …

… A Member State is not obliged to disclose information relating to every shareholder in a public limited company and make it publicly available in the register in accordance with Article 16(3) of Directive 2017/1132. (2) (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), …

… . … (38) (EU) / [(4)] applies to the processing of personal data under this Directive. As a consequence, natural persons whose personal data are held in national registers as beneficial owners should be informed accordingly. …

… Furthermore, only personal data that is up to date and corresponds to the actual beneficial owners should be made available and the beneficiaries should be informed about their rights under the current Union legal data protection framework, as set out in [/] and Directive (EU) 2016/680 [(5)], and the procedures applicable for exercising those rights. …

… Article 13 of /, entitled ‘Information to be provided where personal data are collected from the data subject’, provides as follows in paragraph 1: ‘1. …

… The processing of personal data within the framework of this Directive shall be carried out in accordance with (EU) /.’ 5. Article 5 of Directive 2002/58/EC, (3) entitled ‘Confidentiality of the communications’, establishes as follows in paragraph 3: ‘3. …

… Article 5 of /, (4) entitled ‘Principles relating to processing of personal data’, states as follows in point (f) of paragraph 1: ‘1. Personal data shall be: … (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).’ 7. …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’), and that Article 15 of the GDPR is an equivalent provision to Article 17 of Regulation 2018/1725. 42 In that context, it must be noted that, as set out in Article 15(1) of the GDPR, the data subject …

… and limited logging capabilities of the data management systems in which [the applicant’s] data [had been] stored’. 41 In the present case, in response to the applicant’s argument that, contrary to the judgment of 22 June 2023, Pankki S (C-579/21, EU:C:2023:501), the log files provided by EPSO on 30 November 2023 did not indicate the recipients of the personal data concerning him or the purpose of each access, it must be observed, as a preliminary point, that that judgment concerns Article 15 of …

… Article 1(5)(b) of Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), and Article 2(4) of /, must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of /, of the personal data contained in advertisements published …

… JUDGMENT OF THE COURT (Grand Chamber) 2 December 2025 (*1) (Reference for a preliminary ruling - Protection of personal data - (EU) / - Article 4(7) - Concept of ‘controller’ - Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers - Article 5(2) - Principle of accountability - Article 26 - Joint control with user advertisers - Article 9(1) and (2)(a) - Advertisements …

… Article 32 of / must be interpreted as meaning that the operator of an online marketplace, as controller, within the meaning of Article 4(7) of that regulation, of the personal data contained in advertisements published on its online marketplace, is required to implement appropriate technical and organisational security measures in order to prevent advertisements published there and containing sensitive data, in terms of Article 9(1) of that regulation, from being copied and unlawfully …