19.6.2023

Official Journal of the European Union

C 216/18

(Case C-60/22, (<span class="oj-super oj-note-tag">1</span> Bundesrepublik Deutschland (Court electronic mailbox))

(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Article 5 - Principles relating to processing - Controllership - Article 6 - Lawfulness of processing - Electronic file compiled by an administrative authority relating to an asylum application - Transmission to the competent national court via an electronic mailbox - Infringement of Articles 26 and 30 - No arrangement determining joint responsibility for processing and maintaining the record of processing activities - Consequences - Article 17(1) - Right to erasure (‘right to be forgotten’) - Article 18(1) - Right to restriction of processing - Concept of ‘unlawful processing’ - Taking into account of the electronic file by a national court - Absence of consent of the data subject)

(2023/C 216/24)

Language of the case: German

Referring court

Parties to the main proceedings

Applicant: UZ

Defendant: Bundesrepublik Deutschland

Operative part of the judgment

1.Article 17(1)(d) and Article 18(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

1.must be interpreted as meaning that failure by the controller to comply with the obligations laid down in Articles 26 and 30 of that regulation, which relate, respectively, to the conclusion of an arrangement determining joint responsibility for processing and to the maintenance of a record of processing activities, does not constitute unlawful processing conferring on the data subject a right to erasure or restriction of processing, where such a failure does not, as such, entail an infringement by the controller of the principle of ‘accountability’ as set out in Article 5(2) of that regulation, read in conjunction with Article 5(1)(a) and the first subparagraph of Article 6(1) thereof.

2.EU law must be interpreted as meaning that, where the controller of personal data has failed to comply with its obligations under Articles 26 or 30 of Regulation 2016/679, the lawfulness of the taking into account of such data by a national court is not subject to the data subject’s consent.

Gratsias

Passer

Smulders

Delivered in open court in Luxembourg on 6 March 2025.

Registrar

President of the Chamber

ECLI:EU:C:2025:140

15