Autoriteit Persoonsgegevens – CJEU Judgment (Netherlands, 2022)

In October 2018, the data subject, who was being represented by their attorney, were together approached by a journalist inside the courtroom. The journalist had certain documents from the case file which showed the data subject’s name, address and national identification number. Upon being asked by the data subject for the source of the documents, the journalist replied that they “were made available to him under the right of access to the case file” which the Administrative Jurisdiction Division of Council of State grants to journalists. Subsequently, the President of the Administrative Jurisdiction Division of Council of State confirmed to the data subject that certain documents were being given to journalists “to enable them to follow hearings, namely a copy of the notice of appeal, a copy of the response and, where appropriate, a copy of the contested judicial decision” and “those documents being destroyed at the end of the day.” The data subject and their attorney then approached the Dutch Data Protection Authority (DPA) and claimed that “allowing journalists to have access to personal data concerning them” amounted to a violation of GDPR. However, the DPA said that it was not competent to decide on the same due to Article 55(3) GDPR, which bars supervising authorities from supervising “processing operations of courts acting in their judicial capacity.” Thereafter, the DPA forwarded the request to the President of the Administrative Jurisdiction Division of Council of State. The President of the Administrative Jurisdiction Division of Council of State took note of the complaint and in consultation with the Data Protection Commission for Administrative Law Tribunals, Netherlands “formulated a new policy on access to documents from court files”. However, the DPA’s decision to not hear the matter, and to refer it to the President of the Administrative Jurisdiction Division of Council of State, was challenged by the data subject and his attorney before the District Court, Central Netherlands. The District Court, Central Netherlands stayed the proceedings and referred the following questions to the Court of Justice of the European Union (CJEU): 1. Is Article 55(3) of the General Data Protection Regulation (1) to be interpreted as meaning that ‘processing operations of courts acting in their judicial capacity’ can be understood to mean the provision by a judicial authority of access to procedural documents containing personal data, where such access is granted by making copies of those procedural documents available to a journalist, as described in the present order for reference? (a) In answering that question, is it relevant whether the national supervisory authority’s supervision of that form of data processing affects independent judicial decisions in specific cases? (b) In answering that question, is it relevant that, according to the judicial authority, the nature and purpose of the data processing is to inform a journalist in order to enable the journalist to better report on a public hearing in court proceedings, thereby serving the interests of openness and transparency in the administration of justice? (c) In answering that question, is it relevant whether there is any express legal basis for such data processing under national law? Before the Court of Justice, the data subject's attorney contended that the Council of State was not sharing the documents with journalists in its judicial capacity and in fact, the same was being done by its communication department. The CJEU considered the Advocate General’s opinion which stated that Recital 20 has the word “including”, and therefore the meaning of Article 55(3) GDPR cannot be “confined solely to guaranteeing the independence of the judges in the adoption of a given judicial decision.” It observed that supervision by DPA in such matters “would be liable to undermine, in general, the independence of the judiciary.” The CJEU held that the "processing of personal data carried out by courts in the context of their communication policy on cases before them falls outside the competence of the supervisory authority". Therefore, the court’s action of temporarily providing certain documents of cases to journalists, as described above, falls within the definition of ‘judicial capacity’, and the DPA will not have jurisdiction due to Article 55(3) GDPR.