search

… (EU) / - Conditions for lawful processing of personal data - Article 6(1)(c)) 1. …

… ; - the manner and format in which manufacturers must provide that information; - the obligation to supply independent operators with vehicle identification numbers (‘VINs’), (5) in conjunction with Article 6(1)(c) of (EU) /. (6) 5. As directed by the Court, I shall confine my Opinion to the third question. I. Legislative framework A. Regulation 2018/858 6. …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), which justifies the disclosure of vehicle identification numbers (VINs) to independent operators. 1 Original language: Spanish. 2 Regulation of the European Parliament and of the Council of 30 May 2018 on the approval and market …

… EU law must be interpreted as meaning that, where the controller of personal data has failed to comply with its obligations under Articles 26 or 30 of /, the lawfulness of the taking into account of such data by a national court is not subject to the data subject’s consent. [Signatures] * Language of the case: German. …

… JUDGMENT OF THE COURT (Fifth Chamber) 4 May 2023 (*) (Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - (EU) / - Article 5 - Principles relating to processing - Controllership - Article 6 - Lawfulness of processing - Electronic file compiled by an administrative authority relating to an asylum application - Transmission to the competent national court via an electronic mailbox - Infringement of Articles 26 and 30 …

… Kranenborg, acting as Agents, having decided, after hearing the Advocate General, to proceed to judgment without an Opinion, gives the following Judgment 1 This request for a preliminary ruling concerns the interpretation of Article 5, Article 17(1)(d), Article 18(1)(b) and Articles 26 and 30 of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such …

… Article 82(1) of / must be interpreted as precluding a national rule or practice which makes compensation for non-material damage, within the meaning of that provision, subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness. 3. …

… Article 82 of / must be interpreted as meaning that for the purposes of determining the amount of damages payable under the right to compensation enshrined in that article, national courts must apply the domestic rules of each Member State relating to the extent of financial compensation, provided that the principles of equivalence and effectiveness of EU law are complied with. …

… JUDGMENT OF THE COURT (Third Chamber) 4 May 2023 (*)(i) (Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - (EU) / - Article 82(1) - Right to compensation for damage caused by data processing that infringes that regulation - Conditions governing the right to compensation - Mere infringement of that regulation not sufficient - Need for damage caused by that infringement - Compensation for non-material damage resulting …

… In a world where personal data have become a bargaining chip and constitute a newly found goldmine for businesses, under what conditions can administrative fines be imposed to controllers or processors for breach of the data protection rules set out in (EU) /? (2) More specifically, is a ‘fault’ element required to be fulfilled before they can be subject to such fines? …

… Whether personal data are collected with a view to testing the IT systems embedded in a mobile application or for another purpose has, for its part, no bearing on the question of whether the operation in question qualifies as ‘processing’. (4) Article 83 of / must be interpreted as meaning that a fine can only be imposed in order to sanction a breach of the rules of that regulation which has been committed ‘intentionally or negligently’. …

… However, if the processor processes personal data outside of, or contrary to, the lawful instructions of the controller and uses the personal data received for its own purposes, and it is clear that the parties are not ‘joint controllers’, within the meaning of Article 4(7) and Article 21(6) of /, then the controller cannot be fined, in application of Article 83 of that regulation, in relation to the unlawful processing that took place. 1 Original language: English. 2 Regulation …

… This reference for a preliminary ruling affords the Court of Justice an opportunity to rule on the conditions under which an administrative fine may be imposed on a legal person for infringement of (EU) /. (2) 2. …

… OPINION OF ADVOCATE GENERAL CAMPOS SÁNCHEZ-BORDONA delivered on 27 April 2023 (1) Case C-807/21 Deutsche Wohnen SE v Staatsanwaltschaft Berlin (Request for a preliminary ruling from the Kammergericht Berlin (Higher Regional Court, Berlin, Germany)) (Reference for a preliminary ruling - Protection of personal data - (EU) / - Infringements - Imputation to an undertaking of an infringement committed by its employees - Possible strict liability - Transposition of concepts developed …

… Administrative fines which may be imposed under / require the conduct constituting the penalised infringement to be intentional or negligent. 1 Original language: Spanish. 2 Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’). 3 Law …

… (3) If the first question is answered in the negative, is the principle of accountability under Article 5(2) and Article 24 of (EU) /, read in conjunction with recital 74 thereof, to be interpreted as meaning that, in legal proceedings under Article 82(1) of (EU) /, the controller bears the burden of proving that the technical and organisational measures implemented are appropriate pursuant to Article 32 of that regulation? …

… (4) Is Article 82(3) of (EU) / to be interpreted as meaning that unauthorised disclosure of, or access to, personal data within the meaning of point 12 of Article 4 of (EU) / by means of, as in the present case, a “hacking attack” by persons who are not employees of the controller’s administration and are not subject to its control constitutes an event for which the controller is not in any way responsible and which entitles it to exemption from liability? …

… (2) If the first question is answered in the negative, what should be the subject matter and scope of the judicial review of legality in the examination as to whether the technical and organisational measures implemented by the controller are appropriate pursuant to Article 32 of (EU) /? …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1). 3 On the same day, the Commission made an application for interim relief, namely for the Court to impose on the Republic of Poland, pending the judgment on the substance of the proceedings, a series of obligations …

… subparagraph of Article 19(1) TEU; - by adopting and maintaining in force Article 88a of the amended Law relating to the ordinary courts, Article 45(3) of the amended Law on the Supreme Court and Article 8(2) of the amended Law relating to the administrative courts, the Republic of Poland has infringed the right to respect for private life and the right to protection of personal data, guaranteed by Article 7 and Article 8(1) of the Charter and by Article 6(1)(c) and (e), Article 6(3) and Article 9(1) of …

… (EU) / (4) 3. Paragraph 2 of Article 2 (‘Material scope’) provides: ‘This Regulation does not apply to the processing of personal data: … (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’ 2. Directive 2016/680 4. …

… OPINION OF ADVOCATE GENERAL EMILIOU delivered on 20 April 2023(1) Case C-307/22 FT v DW (Request for a preliminary ruling from the Bundesgerichtshof (Federal Court of Justice, Germany)) (Reference for a preliminary ruling - Protection of personal data - (EU) / - Articles 12, 15 and 23 - Right of access by the data subject to personal data undergoing processing - Right to receive a copy of personal data free of charge - Reimbursement of expenses - Patient’s medical records - Doctor …

… Articles 12 and 15 of (EU) / on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (‘the GDPR’) (2) grant data subjects far-reaching rights of access in respect of personal data being processed. Inter alia, those provisions require controllers to provide data subjects, free of charge, with a copy of that data. 2. …

… In conclusion, I propose that the Court answer the questions referred for a preliminary ruling by the Bundesgerichtshof (Federal Court of Justice, Germany) as follows: Article 12(5) and Article 15(3) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted …

… The answer to that question affords the Court of Justice a further opportunity to rule on the scope of Directive 2002/58/EC, (2) on the one hand, and the scope of Directive (EU) 2016/680 (3) and (EU) /, (4) on the other. 3. As regards Directive 2002/58, the Court has delivered a consistent line of decisions concerning when and under what conditions Member States may restrict the scope of the rights and obligations established by that directive. (5) I. Legal context A. …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, must be interpreted as not precluding the use, in administrative proceedings of a disciplinary nature, of personal data obtained lawfully and directly by public authorities …

… alternative: Article 9(1) of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, read in conjunction with Articles 6 and 10 of …