VQ – CJEU Judgment (European Union, 2020)

VQ submitted a petition to the Petitions Committee of the Parliament of Land Hessen, in Germany. After that, he made an access request, pursuant to Article 15 GDPR. In particular, he asked to have access personal data concerning him, recorded by that Committee when dealing with his petition. However, the President of the Parliament of Land Hessen rejected the request, arguing that the GDPR was not applicable as the petition procedure constituted a function of the parliament, activity that would fall outside of its scope. Dissatisfied, VQ brought an action before the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden, Germany) challenging this decision. While considering that German law did not grant the right to access in this context, the Court was uncertain whether: a) the Committee could be categorised as a ‘public authority’, within the meaning of Article 4(7) GDPR; and b) it could be considered as the ‘controller’ of VQ’s personal data. Besides that, that Court was also uncertain whether it itself could be considered as a ‘court or tribunal’, within the meaning of Article 267 TFEU, read together with the second paragraph of Article 47 of the Charter. In those circumstances, it decided to stay the proceedings and to refer the following questions to the CJEU for a preliminary ruling: (1) Is Article 15 GDPR applicable to the committee of a parliament of a Federated State of a Member State that is responsible for dealing with the petitions of citizens and is that committee to be regarded as a public authority within the meaning of Article 4(7) GDPR? (2) Is the referring court an independent and impartial court or tribunal within the meaning of Article 267 TFEU read in conjunction with the second paragraph of Article 47 of the Charter? The CJEU considered that, by its second question, the Verwaltungsgericht Wiesbaden asked for a clarification on the admissibility of its request for a preliminary ruling, given that being a ‘court or tribunal