JS – Court Ruling (European Union, 2023)

From 1 November 2017 until 30 September 2019 the data subject was a temporary employee at the Single Resolution Board (SRB). On 29 September 2019, via email, the data subject requested from SRB a copy of all his personal data and all data referring to his person stored at SRB, based on the Regulation 2018/1725. This was because there had been two instances of access to his personal data stored in the European Commission’s personnel management IT system, on 12 June 2019. Thus, he wanted the EDPS to investigate whether those instances of access could have constituted a breach of his personal data. He also requested that measures be taken to prevent any unauthorised access, modification, processing or disclosure of his personal data stored at the SRB. On 17 February 2020, he reiterated his request to the SRB to confirm whether or not personal (in particular, HR-related) data concerning him was being processed, to provide a copy of his personal data and to restrict the processing of his personal data, while objecting to the processing of his personal data. On 28 February 2020, the DPO replied the data subject with certain data concerning him, stating that SRB applies by analogy the Common Commission-level retention list for European Commission files and in view of Articles 11, 26, 81 and 127 of the applicable [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A01962R0031-20140501 Staff Regulations of Officials of the European Union and Conditions of Employment of Other Servants of the European Union], the SRB had the legal obligation to store personal file in accordance with the retention list and that his personal file was now archived and would be stored up to 8 years after the extinction of all his rights, and for at least 120 years after his birth date. On 8 March 2020, the data subject requested the SRB to delete his personal data processed by the latter and reiterated his request for restriction of the processing of his personal data and for objection to the processing of such of his personal data which are not to be deleted. By emails of 20 March and 17 and 20 April 2020, the data subject reiterated his request for erasure, withdrawing his consent to the processing of those data by the SRB. On 30 April 2020, the DPO responded to emails rejecting a request for data erasure. The DPO stated that SRB had a legal obligation to retain the individual's personal file based on European Commission rules and Staff Regulations. The DPO also emphasized that the data could not be deleted and explained the lengthy retention period of 120 years after the individual's birth date. He also mentioned the requirement to keep data in a single personal file to any EU institution as a potential new employer, and some of the data in the personal file were also kept in the context of a further and/or future financial obligation for its staff or their family members. Additionally, the DPO cited legal obligations for data retention under Regulation 2018/1725, which prevented the right to object. Regarding a request for data processing restriction, the DPO asked the applicant to specify the data whose accuracy he disputed according to Regulation 2018/1725. On 20 March 2020, the data subject lodged a complaint with the EDPS against the SRB claiming that the processing and storage for 120 years violates his rights entitled by Regulation 2018/1725, in particular his right to erasure (“right to be forgotten”) of Article 19, right to restriction of processing of Article 20 and the right to object of Article 23. In the complaint, the data subject then asked the EDPS to instruct the SRB to comply with his requests in exercise of his rights, in particular the requested erasure of his personal data. On 18 January 2021, the EDPS rejected the complaint by the first contested decision concluding: * As for the right to erasure of Article 19 of Regulation 2018/1725, read in the light of Article 26 of the Staff Regulations, the SRB was under a legal obligation, within the meaning of Article 19(3)(b) of Regulation 2018/1725, to keep the content of the applicant’s personal file. * Regarding the right to object to the processing of personal data of Article 23(1) of Regulation 2018/1725, the EDPS recalled that, under Article 5(1)(b) of Regulation 2018/1725, processing of those data was lawful if it was necessary for compliance with a legal obligation to which the controller of the personal data was subject and this was indeed the case here. * Request for restriction of the processing of his personal data, based on Article 20(1) of Regulation 2018/1725, the EDPS also considered that it should be refused. First of all, the EDPS rejected the applicant’s argument based on the assumption that his personal data held by the SRB were incomplete or inaccurate. He then noted that the processing was lawful within the meaning of Article 5(1)(b) of Regulation 2018/1725, since it was necessary for compliance with a legal obligation to which the SRB was subject pursuant to Article 26 of the Staff Regulations. * Lastly, he recalled that the applicant had no right to object under Article 23 of Regulation 2018/1725, as previously established. The EDPS concluded therefrom that the applicant had no ground, in terms of Article 20(1) of that regulation, to obtain from the SRB a restriction of the processing of his personal data. After a reviewal request made by the data subject on 17 February 2021, on 9 March 2021, the EDPS refused the applicant’s request for review by the second contested decision. The data subject claimed for an annulment of the decision by European Data Protection Supervisor (EDPS) of 18 January 2021 rejecting his complaint (‘the first contested decision’), and of the decision from 9 March 2021 refusing his request for review of the first contested decision (‘the second contested decision’) (together, ‘the contested decisions’) and a compensation of €20,000 for the damage which he claims to have suffered as a result of the contested decisions. CJEU highlighted that the SRB was right to refuse the data subject’s request. Regarding the right to erasure, SRB have a legal obligation under Article 26 of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A01962R0031-20140501 Staff Regulations], which requires them to keep all documents concerning the administrative status of the official or servant concerned and all reports relating to his or her ability, efficiency and conduct. This retention was necessary for pension rights and other potential legal claims. The applicant did not develop any legal argument concerning the examination of the retention period for personal data in the light of the principle of proportionality and his complaint was limited to the request seeking erasure, the exercise of the right to object, and the exercise of the right to restrict the processing of the applicant’s personal data. Ultimately, the court understood that EDPS did not infringe the right to good administration and that they acted in accordance with the law, and if the applicant wished to challenge the proportionality of the retention period, he could file a new complaint for further examination. Regarding the second decision, the Court upheld the EDPS's decision to deny the review request, as the data subject did not provide new evidence or legal arguments justifying a review, and certain issues raised in the review request were outside the scope of the original complaint and decision. The Court rejected all the data subject claims for review of the two decisions issued by EDPS and dismissed the compensation request of €20,000 since no unlawfulness vitiating in both decisions has been established.