31.5.2021

EN

Official Journal of the European Union

C 206/13

(Case C-132/21)

(2021/C 206/17)

Language of the case: Hungarian

Referring court

Parties to the main proceedings

Applicant: BE

Defendant: Nemzeti Adatvédelmi és Információszabadság Hatóság

Intervener: Budapesti Elektromos Művek Zrt.

Questions referred

1.Must Articles 77(1) and 79(1) of [Regulation 2016/679] (1) be interpreted as meaning that the administrative appeal provided for in Article 77 constitutes an instrument for the exercise of public rights, whereas the legal action provided for in Article 79 constitutes an instrument for the exercise of private rights? If so, does this support the inference that the supervisory authority, which is responsible for hearing and determining administrative appeals, has priority competence to determine the existence of an infringement?

2.In the event that the data subject — in whose opinion the processing of personal data relating to him has infringed Regulation 2016/679 — simultaneously exercises his right to lodge a complaint under Article 77(1) of that regulation and his right to bring a legal action under Article 79(1) of the same regulation, may an interpretation in accordance with Article 47 of the Charter of Fundamental Rights be regarded as meaning:

(a)that the supervisory authority and the court have an obligation to examine the existence of an infringement independently and may therefore even arrive at different outcomes; or

(b)that the supervisory authority’s decision takes priority when it comes to the assessment as to whether an infringement has been committed, regard being had to the powers provided for in Article 51(1) of Regulation 2016/679 and those conferred by Article 58(2)(b) and (d) of that regulation?

3.Must the independence of the supervisory authority, ensured by Articles 51(1) and 52(1) of Regulation 2016/679, be interpreted as meaning that that authority, when conducting and adjudicating upon complaint proceedings under Article 77, is independent of whatever ruling may be given by final judgment by the court having jurisdiction under Article 79, with the result that it may even adopt a different decision in respect of the same alleged infringement?

(1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1)