Adpublisher AG – Court Ruling (European Union, 2020)

By a letter of 18 December 2019, registered at the Court as Case E-11/19, the Board of Appeal for Administrative Matters (BoA) made a request (in the context of appeals against decisions of the DPA of the Principality of Liechtenstein). The BoA requested for an advisory opinion in a case pending before the DPA between Adpublisher AG (a public limited company of Liechtenstein) and "J" for alleged infringement of Articles 5, 6 and 15 GDPR. The DPA upheld J’s complaint concerning the infringement of Articles 5 and 6 GDPR. Further, on its own volition, the DPA determined that there had been an infringement of Articles 7, 15 and 32 GDPR. By a separate letter of 18 December 2019, registered at the Court as Case E-12/19, the BoA made a request for an advisory opinion in a case pending before it between Adpublisher AG and "K" (for alleged infringement of Article 15 GDPR). The DPA upheld K’s complaint in part and determined that there had been an infringement of Article 15 GDPR. Adpublisher challenged both decisions before the BoA and requested that both decisions be set aside. The Court decided, pursuant to Article 39 of the Rules of Procedure, to join the cases for the purpose of the procedure and the final judgment. The questions examined by the court are referring to the general procedure of hearing a complaint under the GDPR and further national appellate proceedings. The first question by the referring body, is whether the proceedings under article 77 and 78(1) GDPR may be carried out without disclosing the identity of a complainant, and whether any grounds must be provided for non disclosing the identity of the complainant. The second question set by the referring body, is whether the free of charge nature of the complaint procedure under article 77 GDPR extends to subsequent proceedings before appellate bodies, or has an impact on the liability of the data subject to be ordered to pay costs. As per the first question examined, the court the Court held that disclosing personal data of a complainant in a procedure initiated by the complainant themselves is necessary in instances where the following would otherwise be inhibited: 1. The ability to carry out obligations under the GDPR, 2. The exercise of the right to effective judicial remedy and due process. Further, the court held that the referring body essentially asks whether the free of charge nature of the complaint procedure under Article 77 GDPR extends to proceedings before appellate bodies or has an impact on the liability of the data subject to be ordered to pay costs. The court held that the data subject cannot be made responsible for costs incurred in relation to proceedings where: 1. They have been made party to these proceedings under Article 78(1) GDPR by virtue of a data controller appealing against a supervisory authority’s decision and, 2.  National law imposes this status on a data subject automatically. Consequently, where a data subject becomes a party to proceedings under Article 78(1) GDPR after a data controller appealing against a supervisory authority’s decision, and where national law imposes this status on a data subject automatically, the data subject may not be made responsible for any costs incurred in relation to those proceedings. ----