Official Journal of the European Union

Series C

C/2024/1501

26.2.2024

(Case C-231/22, (1) État belge (Data processed by an official journal))

(Reference for a preliminary ruling - Approximation of laws - Protection of natural persons with regard to the processing of personal data and free movement of such data (General Data Protection Regulation) - Regulation (EU) 2016/679 - Point 7 of Article 4 - Concept of ‘controller’ - Official journal of a Member State - Obligation to publish as they stand company documents prepared by companies or their legal representatives - Article 5(2) - Successive processing of the personal data contained in such documents by several separate persons or entities - Determination of responsibilities)

(C/2024/1501)

Language of the case: French

Referring court

Parties to the main proceedings

Appellant: État belge

Respondent: Autorité de protection des données

other party: LM

Operative part of the judgment

1.Point 7 of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that the agency or body responsible for the official journal of a Member State, which is inter alia required, under the law of that State, to publish as they stand official acts and documents that have been prepared by third parties under their own responsibility in compliance with the applicable rules, then lodged with a judicial authority that sends them to it for publication, may, notwithstanding its lack of legal personality, be classified as a ‘controller’ of the personal data contained in those acts and documents, where the national law concerned determines the purposes and means of the processing of personal data performed by that official journal.

2.Article 5(2) of Regulation 2016/679, read in conjunction with point 7 of Article 4 and Article 26(1) thereof,

must be interpreted as meaning that the agency or body responsible for the official journal of a Member State, classified as a ‘controller’ within the meaning of point 7 of Article 4 of that regulation, is solely responsible for compliance with the principles set out in Article 5(1) thereof as regards the personal data processing operations that it is required to perform under national law, unless joint responsibility with other entities in respect of those operations arises under that law.

ELI: http://data.europa.eu/eli/C/2024/1501/oj

ISSN 1977-091X (electronic edition)

*

Language of the case: French.