Official Journal of the European Union

Series C

C/2024/1653

(Case C-33/22, (<span class="oj-super oj-note-tag">1</span>) Österreichische Datenschutzbehörde)

(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Article 16 TFEU - Regulation (EU) 2016/679 - Article 2(2)(a) - Scope - Exclusions - Activities which fall outside the scope of Union law - Article 4(2) TEU - Activities concerning national security - Committee of inquiry set up by the parliament of a Member State - Article 23(1)(a) and (h), Articles 51 and 55 of Regulation (EU) 2016/679 - Competence of the supervisory authority responsible for data protection - Article 77 - Right to lodge a complaint with a supervisory authority - Direct effect)

(C/2024/1653)

Language of the case: German

Referring court

Parties to the main proceedings

Appellant on a point of law: Österreichische Datenschutzbehörde

Respondent on a point of law: WK

Interested party: Präsident des Nationalrates

Operative part of the judgment

1.The first sentence of Article 16(2) TFEU and Article 2(2)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that an activity cannot be regarded as being outside the scope of Union law and therefore falling outside the scope of that regulation for the sole reason that it is carried out by a committee of inquiry set up by the parliament of a Member State in the exercise of its power of scrutiny over the executive.

2.Article 2(2)(a) of Regulation 2016/679, read in the light of recital 16 of that regulation,

must be interpreted as meaning that the activities of a committee of inquiry set up by the parliament of a Member State in the exercise of its power of scrutiny over the executive, the purpose of which is to investigate the activities of a police State-protection authority on account of a suspicion of political influence over that authority, cannot, as such, be regarded as activities concerning national security which fall outside the scope of Union law, within the meaning of that provision.

3.Article 77(1) and Article 55(1) of Regulation 2016/679

must be interpreted as meaning that, where a Member State has chosen, in accordance with Article 51(1) of that regulation, to establish a single supervisory authority, without, however, conferring on it the competence to monitor the application of that regulation by a committee of inquiry set up by that Member State’s parliament in the exercise of its power of scrutiny over the executive, those provisions directly confer on that authority the competence to hear complaints relating to the processing of personal data by that committee of inquiry.

ELI: http://data.europa.eu/eli/C/2024/1653/oj

ISSN 1977-091X (electronic edition)