Official Journal of the European Union

Series C

C/2024/917

29.1.2024

(Joined Cases C-26/22 and C-64/22, (1) SCHUFA Holding (Discharge from remaining debts))

(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Article 5(1)(a) - Principle of ‘lawfulness’ - Point (f) of the first subparagraph of Article 6(1) - Necessity of processing for the purposes of the legitimate interests pursued by the controller or by a third party - Article 17(1)(d) - Right to erasure where personal data have been unlawfully processed - Article 40 - Codes of conduct - Article 78(1) - Right to an effective judicial remedy against a supervisory authority - Decision taken by the supervisory authority on a complaint - Scope of judicial review of that decision - Credit information agencies - Storage of data from a public register relating to the discharge of remaining debts in favour of a person - Storage period)

(C/2024/917)

Language of the case: German

Referring court

Parties to the main proceedings

Applicants: UF (C-26/22), AB (C-64/22)

Defendant: Land Hessen

Intervener: SCHUFA Holding AG

Operative part of the judgment

1.Article 78(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that a decision on a complaint adopted by a supervisory authority is subject to full judicial review.

2.Article 5(1)(a) of Regulation 2016/679, read in conjunction with point (f) of the first subparagraph of Article 6(1) of that regulation, must be interpreted as precluding a practice of private credit information agencies consisting in retaining, in their own databases, information from a public register relating to the grant of a discharge from remaining debts in favour of natural persons in order to be able to provide information on the solvency of those persons, for a period extending beyond that during which the data are kept in the public register.

3.Article 17(1)(c) of Regulation 2016/679 must be interpreted as meaning that the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where he or she objects to the processing pursuant to Article 21(1) of that regulation and there are no overriding legitimate grounds capable of justifying, exceptionally, the processing in question.

4.Article 17(1)(d) of Regulation 2016/679 must be interpreted as meaning that the controller is required to erase unlawfully processed personal data as soon as possible.

(1) OJ C 148, 4.4.2022.

ELI: http://data.europa.eu/eli/C/2024/917/oj

ISSN 1977-091X (electronic edition)