{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-129-21-62021cj0129", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-129-21-62021cj0129)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-13", "fingerprint": "ewai:eu:a03983", "proof": "sha256:5a8a26ab5fbf8f7f34ef1e42cea8988c1e0aec5322e3b659bc4e40d159ff8b7c", "jurisdiction": "eu", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "item": { "schema_version": "1.0.0", "id": "eu:c-129-21-62021cj0129", "jurisdiction": "eu", "lang": "en", "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor" }, "sections": [ { "title": "62021CJ0129", "paragraphs": [] }, { "title": "JUDGMENT OF THE COURT (Fourth Chamber)", "paragraphs": [] }, { "title": "27 October 2022 (\n *1\n )", "paragraphs": [ "para_4", "para_5", "para_6" ] }, { "title": "Proximus NV", "paragraphs": [ "para_8", "para_9", "para_10", "para_11", "para_12", "para_13", "para_14", "para_15", "para_16", "para_17", "para_18", "para_19", "para_20", "para_21", "para_22", "para_23", "para_24", "para_25", "para_26", "para_27", "para_28", "para_29", "para_30", "para_31" ] }, { "title": "Judgment", "paragraphs": [] }, { "title": "1", "paragraphs": [ "para_34" ] }, { "title": "2", "paragraphs": [ "para_36" ] }, { "title": "Legal context", "paragraphs": [] }, { "title": "European Union law", "paragraphs": [] }, { "title": "Directive 95/46/EC", "paragraphs": [] }, { "title": "3", "paragraphs": [ "para_41", "para_42", "para_43" ] }, { "title": "(h)", "paragraphs": [ "para_45" ] }, { "title": "Directive 2002/58", "paragraphs": [] }, { "title": "4", "paragraphs": [] }, { "title": "Recitals 10, 17, 38 and 39 of Directive 2002/58 are worded as follows:", "paragraphs": [ "para_49", "para_50", "para_51" ] }, { "title": "(17)", "paragraphs": [ "para_53", "para_54" ] }, { "title": "(38)", "paragraphs": [ "para_56" ] }, { "title": "(39)", "paragraphs": [ "para_58" ] }, { "title": "5", "paragraphs": [] }, { "title": "Article 1 of that directive provides:", "paragraphs": [ "para_61", "para_62", "para_63" ] }, { "title": "6", "paragraphs": [ "para_65", "para_66", "para_67" ] }, { "title": "(f)", "paragraphs": [ "para_69" ] }, { "title": "7", "paragraphs": [] }, { "title": "Article 12 of that directive, entitled ‘Directories of subscribers’, states:", "paragraphs": [ "para_72", "para_73", "para_74", "para_75" ] }, { "title": "The GDPR", "paragraphs": [] }, { "title": "8", "paragraphs": [] }, { "title": "Recitals 42, 66 and 173 of the GDPR state:", "paragraphs": [ "para_79", "para_80", "para_81" ] }, { "title": "(66)", "paragraphs": [ "para_83", "para_84" ] }, { "title": "(173)", "paragraphs": [ "para_86" ] }, { "title": "9", "paragraphs": [] }, { "title": "Article 4(2), (7) and (11) of that regulation is worded as follows:", "paragraphs": [ "para_89", "para_90" ] }, { "title": "(2)", "paragraphs": [ "para_92", "para_93" ] }, { "title": "(7)", "paragraphs": [ "para_95", "para_96" ] }, { "title": "(11)", "paragraphs": [ "para_98" ] }, { "title": "10", "paragraphs": [ "para_100", "para_101" ] }, { "title": "(a)", "paragraphs": [ "para_103", "para_104", "para_105" ] }, { "title": "11", "paragraphs": [] }, { "title": "Under Article 6 of the GDPR, entitled ‘Lawfulness of processing’:", "paragraphs": [ "para_108" ] }, { "title": "(a)", "paragraphs": [ "para_110", "para_111" ] }, { "title": "12", "paragraphs": [] }, { "title": "Article 7 of the GDPR, entitled ‘Conditions for consent’, states:", "paragraphs": [ "para_114", "para_115", "para_116", "para_117" ] }, { "title": "13", "paragraphs": [] }, { "title": "Article 16 of the GDPR, entitled ‘Right to rectification’, provides:", "paragraphs": [ "para_120" ] }, { "title": "14", "paragraphs": [ "para_122", "para_123", "para_124" ] }, { "title": "(b)", "paragraphs": [ "para_126", "para_127" ] }, { "title": "(d)", "paragraphs": [ "para_129", "para_130", "para_131" ] }, { "title": "15", "paragraphs": [ "para_133", "para_134" ] }, { "title": "16", "paragraphs": [] }, { "title": "Under Article 24 of the GDPR, entitled ‘Responsibility of the controller’:", "paragraphs": [ "para_137", "para_138", "para_139" ] }, { "title": "17", "paragraphs": [] }, { "title": "Article 94 of the GDPR, entitled ‘Repeal of Directive 95/46/EC’, provides in paragraph 2:", "paragraphs": [ "para_142" ] }, { "title": "18", "paragraphs": [] }, { "title": "Article 95 of the GDPR, entitled ‘Relationship with Directive 2002/58/EC’, provides:", "paragraphs": [ "para_145" ] }, { "title": "Belgian law", "paragraphs": [] }, { "title": "19", "paragraphs": [ "para_148", "para_149", "para_150", "para_151", "para_152", "para_153", "para_154", "para_155", "para_156" ] }, { "title": "To that end, two separate questions shall be put by the operator to the subscriber:", "paragraphs": [ "para_158", "para_159", "para_160", "para_161", "para_162", "para_163", "para_164" ] }, { "title": "20", "paragraphs": [ "para_166" ] }, { "title": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraphs": [] }, { "title": "21", "paragraphs": [ "para_169" ] }, { "title": "22", "paragraphs": [ "para_171" ] }, { "title": "23", "paragraphs": [ "para_173" ] }, { "title": "24", "paragraphs": [ "para_175" ] }, { "title": "25", "paragraphs": [ "para_177" ] }, { "title": "26", "paragraphs": [ "para_179" ] }, { "title": "27", "paragraphs": [ "para_181" ] }, { "title": "28", "paragraphs": [ "para_183" ] }, { "title": "29", "paragraphs": [ "para_185" ] }, { "title": "30", "paragraphs": [ "para_187" ] }, { "title": "31", "paragraphs": [ "para_189" ] }, { "title": "32", "paragraphs": [ "para_191" ] }, { "title": "33", "paragraphs": [ "para_193" ] }, { "title": "34", "paragraphs": [ "para_195" ] }, { "title": "35", "paragraphs": [ "para_197" ] }, { "title": "36", "paragraphs": [ "para_199", "para_200", "para_201" ] }, { "title": "(2)", "paragraphs": [ "para_203" ] }, { "title": "(3)", "paragraphs": [ "para_205" ] }, { "title": "(4)", "paragraphs": [ "para_207" ] }, { "title": "The questions referred for a preliminary ruling", "paragraphs": [] }, { "title": "The first question", "paragraphs": [] }, { "title": "37", "paragraphs": [ "para_211" ] }, { "title": "38", "paragraphs": [ "para_213" ] }, { "title": "39", "paragraphs": [ "para_215" ] }, { "title": "40", "paragraphs": [ "para_217" ] }, { "title": "41", "paragraphs": [ "para_219" ] }, { "title": "42", "paragraphs": [ "para_221" ] }, { "title": "43", "paragraphs": [ "para_223" ] }, { "title": "44", "paragraphs": [ "para_225" ] }, { "title": "45", "paragraphs": [ "para_227" ] }, { "title": "46", "paragraphs": [ "para_229" ] }, { "title": "47", "paragraphs": [ "para_231" ] }, { "title": "48", "paragraphs": [ "para_233" ] }, { "title": "49", "paragraphs": [ "para_235" ] }, { "title": "50", "paragraphs": [ "para_237" ] }, { "title": "51", "paragraphs": [ "para_239" ] }, { "title": "52", "paragraphs": [ "para_241" ] }, { "title": "53", "paragraphs": [ "para_243" ] }, { "title": "54", "paragraphs": [ "para_245" ] }, { "title": "55", "paragraphs": [ "para_247" ] }, { "title": "56", "paragraphs": [ "para_249" ] }, { "title": "The second question", "paragraphs": [] }, { "title": "57", "paragraphs": [ "para_252" ] }, { "title": "58", "paragraphs": [ "para_254" ] }, { "title": "59", "paragraphs": [ "para_256" ] }, { "title": "60", "paragraphs": [ "para_258" ] }, { "title": "61", "paragraphs": [ "para_260" ] }, { "title": "62", "paragraphs": [ "para_262" ] }, { "title": "63", "paragraphs": [ "para_264" ] }, { "title": "64", "paragraphs": [ "para_266" ] }, { "title": "65", "paragraphs": [ "para_268" ] }, { "title": "66", "paragraphs": [ "para_270" ] }, { "title": "67", "paragraphs": [ "para_272" ] }, { "title": "68", "paragraphs": [ "para_274" ] }, { "title": "69", "paragraphs": [ "para_276" ] }, { "title": "70", "paragraphs": [ "para_278" ] }, { "title": "71", "paragraphs": [ "para_280" ] }, { "title": "The third question", "paragraphs": [] }, { "title": "72", "paragraphs": [ "para_283" ] }, { "title": "73", "paragraphs": [ "para_285" ] }, { "title": "74", "paragraphs": [ "para_287" ] }, { "title": "75", "paragraphs": [ "para_289" ] }, { "title": "76", "paragraphs": [ "para_291" ] }, { "title": "77", "paragraphs": [ "para_293" ] }, { "title": "78", "paragraphs": [ "para_295" ] }, { "title": "79", "paragraphs": [ "para_297" ] }, { "title": "80", "paragraphs": [ "para_299" ] }, { "title": "81", "paragraphs": [ "para_301" ] }, { "title": "82", "paragraphs": [ "para_303" ] }, { "title": "83", "paragraphs": [ "para_305" ] }, { "title": "84", "paragraphs": [ "para_307" ] }, { "title": "85", "paragraphs": [ "para_309" ] }, { "title": "86", "paragraphs": [ "para_311" ] }, { "title": "87", "paragraphs": [ "para_313" ] }, { "title": "88", "paragraphs": [ "para_315" ] }, { "title": "89", "paragraphs": [ "para_317" ] }, { "title": "90", "paragraphs": [ "para_319" ] }, { "title": "The fourth question", "paragraphs": [] }, { "title": "91", "paragraphs": [ "para_322" ] }, { "title": "92", "paragraphs": [ "para_324" ] }, { "title": "93", "paragraphs": [ "para_326" ] }, { "title": "94", "paragraphs": [ "para_328" ] }, { "title": "95", "paragraphs": [ "para_330" ] }, { "title": "96", "paragraphs": [ "para_332" ] }, { "title": "97", "paragraphs": [ "para_334" ] }, { "title": "98", "paragraphs": [ "para_336" ] }, { "title": "99", "paragraphs": [ "para_338" ] }, { "title": "Costs", "paragraphs": [] }, { "title": "100", "paragraphs": [ "para_341" ] }, { "title": "On those grounds, the Court (Fourth Chamber) hereby rules:", "paragraphs": [ "para_343", "para_344", "para_345", "para_346" ] }, { "title": "Article 17 of Regulation 2016/679", "paragraphs": [ "para_348", "para_349" ] }, { "title": "Article 5(2) and Article 24 of Regulation 2016/679", "paragraphs": [ "para_351", "para_352" ] }, { "title": "Article 17(2) of Regulation 2016/679", "paragraphs": [ "para_354", "para_355", "para_356" ] } ], "paragraphs": [ { "text": "62021CJ0129", "paragraph_id": "para_1" }, { "text": "JUDGMENT OF THE COURT (Fourth Chamber)", "paragraph_id": "para_2" }, { "text": "27 October 2022 (\n *1\n )", "paragraph_id": "para_3" }, { "text": "(Reference for a preliminary ruling – Processing of personal data and protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 12 – Public telephone directories and directory enquiry services – Subscriber’s consent – Obligations of the provider of directories an …", "paragraph_id": "para_4" }, { "text": "In Case C‑129/21,", "paragraph_id": "para_5" }, { "text": "REQUEST for a preliminary ruling under Article 267 TFEU from the hof van beroep te Brussel (Court of Appeal, Brussels, Belgium), made by decision of 24 February 2021, received at the Court on 2 March 2021, in the proceedings", "paragraph_id": "para_6" }, { "text": "Proximus NV", "paragraph_id": "para_7" }, { "text": "v", "paragraph_id": "para_8" }, { "text": "Gegevensbeschermingsautoriteit,", "paragraph_id": "para_9" }, { "text": "THE COURT (Fourth Chamber),", "paragraph_id": "para_10" }, { "text": "composed of C. Lycourgos, President of the Chamber, L.S. Rossi (Rapporteur), J.‑C. Bonichot, S. Rodin and O. Spineanu-Matei, Judges,", "paragraph_id": "para_11" }, { "text": "Advocate General: A.M. Collins,", "paragraph_id": "para_12" }, { "text": "Registrar: M. Ferreira, Principal Administrator,", "paragraph_id": "para_13" }, { "text": "having regard to the written procedure and further to the hearing on 9 February 2022,", "paragraph_id": "para_14" }, { "text": "after considering the observations submitted on behalf of:", "paragraph_id": "para_15" }, { "text": "–", "paragraph_id": "para_16" }, { "text": "Proximus NV, by P. Craddock and T. de Haan, avocats, and by E. Van Bogget, advocaat,", "paragraph_id": "para_17" }, { "text": "–", "paragraph_id": "para_18" }, { "text": "Gegevensbeschermingsautoriteit, by C. Buggenhoudt, E. Cloots and J. Roets, advocaten,", "paragraph_id": "para_19" }, { "text": "–", "paragraph_id": "para_20" }, { "text": "the Italian Government, by G. Palmieri, acting as Agent, and by E. De Bonis, avvocato dello Stato,", "paragraph_id": "para_21" }, { "text": "–", "paragraph_id": "para_22" }, { "text": "the Latvian Government, by E. Bārdiņš, J. Davidoviča and K. Pommere, acting as Agents,", "paragraph_id": "para_23" }, { "text": "–", "paragraph_id": "para_24" }, { "text": "the Portuguese Government, by P. Barros da Costa, L. Inez Fernandes, M.J. Ramos and C. Vieira Guerra, acting as Agents,", "paragraph_id": "para_25" }, { "text": "–", "paragraph_id": "para_26" }, { "text": "the Romanian Government, by E. Gane and L. Liţu, acting as Agents,", "paragraph_id": "para_27" }, { "text": "–", "paragraph_id": "para_28" }, { "text": "the European Commission, by S.L. Kalėda, H. Kranenborg and P.‑J. Loewenthal, acting as Agents,", "paragraph_id": "para_29" }, { "text": "after hearing the Opinion of the Advocate General at the sitting on 28 April 2022,", "paragraph_id": "para_30" }, { "text": "gives the following", "paragraph_id": "para_31" }, { "text": "Judgment", "paragraph_id": "para_32" }, { "text": "1", "paragraph_id": "para_33" }, { "text": "This request for a preliminary ruling concerns the interpretation of Article 12(2), read in conjunction with point (f) of the second paragraph of Article 2 of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protect …", "paragraph_id": "para_34" }, { "text": "2", "paragraph_id": "para_35" }, { "text": "The request has been made in proceedings between Proximus NV, a company governed by Belgian public law, and the Gegevensbeschermingsautoriteit (Data Protection Authority, Belgium) (‘the DPA’), concerning the decision by which the Geschillenkamer van de Gegevensbeschermingsautoriteit (Litigation Chamber of the DPA; ‘the Litigation Chamber’) ordered Proximus to take remedial action and to pay a fine of EUR 20000 for infringement of several provisions of the GDPR.", "paragraph_id": "para_36" }, { "text": "Legal context", "paragraph_id": "para_37" }, { "text": "European Union law", "paragraph_id": "para_38" }, { "text": "Directive 95/46/EC", "paragraph_id": "para_39" }, { "text": "3", "paragraph_id": "para_40" }, { "text": "Article 2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31 ) provides:", "paragraph_id": "para_41" }, { "text": "‘For the purposes of this Directive:", "paragraph_id": "para_42" }, { "text": "…", "paragraph_id": "para_43" }, { "text": "(h)", "paragraph_id": "para_44" }, { "text": "“the data subject’s consent” shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.’", "paragraph_id": "para_45" }, { "text": "Directive 2002/58", "paragraph_id": "para_46" }, { "text": "4", "paragraph_id": "para_47" }, { "text": "Recitals 10, 17, 38 and 39 of Directive 2002/58 are worded as follows:", "paragraph_id": "para_48" }, { "text": "‘(10)", "paragraph_id": "para_49" }, { "text": "In the electronic communications sector, Directive 95/46/EC applies in particular to all matters concerning protection of fundamental rights and freedoms, which are not specifically covered by the provisions of this Directive, including the obligations on the controller and the rights of individuals. …", "paragraph_id": "para_50" }, { "text": "…", "paragraph_id": "para_51" }, { "text": "(17)", "paragraph_id": "para_52" }, { "text": "For the purposes of this Directive, consent of a user or subscriber, regardless of whether the latter is a natural or a legal person, should have the same meaning as the data subject’s consent as defined and further specified in Directive 95/46/EC. Consent may be given by any appropriate method enabling a freely given specific and informed indication of the user’s wishes, including by ticking a box when visiting an Internet website.", "paragraph_id": "para_53" }, { "text": "…", "paragraph_id": "para_54" }, { "text": "(38)", "paragraph_id": "para_55" }, { "text": "Directories of subscribers to electronic communications services are widely distributed and public. The right to privacy of natural persons and the legitimate interest of legal persons require that subscribers are able to determine whether their personal data are published in a directory and if so, …", "paragraph_id": "para_56" }, { "text": "(39)", "paragraph_id": "para_57" }, { "text": "The obligation to inform subscribers of the purpose(s) of public directories in which their personal data are to be included should be imposed on the party collecting the data for such inclusion. Where the data may be transmitted to one or more third parties, the subscriber should be informed of thi …", "paragraph_id": "para_58" }, { "text": "5", "paragraph_id": "para_59" }, { "text": "Article 1 of that directive provides:", "paragraph_id": "para_60" }, { "text": "‘1.   This Directive provides for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with respect to the processing of personal data in the electronic communication sector and to ensure the free movement of such data and of electronic communication equipment and services in the Community.", "paragraph_id": "para_61" }, { "text": "2.   The provisions of this Directive particularise and complement Directive 95/46/EC for the purposes mentioned in paragraph 1. Moreover, they provide for protection of the legitimate interests of subscribers who are legal persons.", "paragraph_id": "para_62" }, { "text": "…’", "paragraph_id": "para_63" }, { "text": "6", "paragraph_id": "para_64" }, { "text": "Article 2 of Directive 2002/58, entitled ‘Definitions’, provides in point (f) of the second paragraph thereof:", "paragraph_id": "para_65" }, { "text": "‘The following definitions shall also apply:", "paragraph_id": "para_66" }, { "text": "…", "paragraph_id": "para_67" }, { "text": "(f)", "paragraph_id": "para_68" }, { "text": "“consent” by a user or subscriber corresponds to the data subject’s consent in Directive 95/46/EC’.", "paragraph_id": "para_69" }, { "text": "7", "paragraph_id": "para_70" }, { "text": "Article 12 of that directive, entitled ‘Directories of subscribers’, states:", "paragraph_id": "para_71" }, { "text": "‘1.   Member States shall ensure that subscribers are informed, free of charge and before they are included in the directory, about the purpose(s) of a printed or electronic directory of subscribers available to the public or obtainable through directory enquiry services, in which their personal data can be included and of any further usage possibilities based on search functions embedded in electronic versions of the directory.", "paragraph_id": "para_72" }, { "text": "2.   Member States shall ensure that subscribers are given the opportunity to determine whether their personal data are included in a public directory, and if so, which, to the extent that such data are relevant for the purpose of the directory as determined by the provider of the directory, and to verify, correct or withdraw such data. Not being included in a public subscriber directory, verifying, correcting or withdrawing personal data from it shall be free of charge.", "paragraph_id": "para_73" }, { "text": "3.   Member States may require that for any purpose of a public directory other than the search of contact details of persons on the basis of their name and, where necessary, a minimum of other identifiers, additional consent be asked of the subscribers.", "paragraph_id": "para_74" }, { "text": "…’", "paragraph_id": "para_75" }, { "text": "The GDPR", "paragraph_id": "para_76" }, { "text": "8", "paragraph_id": "para_77" }, { "text": "Recitals 42, 66 and 173 of the GDPR state:", "paragraph_id": "para_78" }, { "text": "‘(42)", "paragraph_id": "para_79" }, { "text": "Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware …", "paragraph_id": "para_80" }, { "text": "…", "paragraph_id": "para_81" }, { "text": "(66)", "paragraph_id": "para_82" }, { "text": "To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies o …", "paragraph_id": "para_83" }, { "text": "…", "paragraph_id": "para_84" }, { "text": "(173)", "paragraph_id": "para_85" }, { "text": "This Regulation should apply to all matters concerning the protection of fundamental rights and freedoms vis-à-vis the processing of personal data which are not subject to specific obligations with the same objective set out in Directive 2002/58/EC …, including the obligations on the controller and …", "paragraph_id": "para_86" }, { "text": "9", "paragraph_id": "para_87" }, { "text": "Article 4(2), (7) and (11) of that regulation is worded as follows:", "paragraph_id": "para_88" }, { "text": "‘For the purposes of this Regulation:", "paragraph_id": "para_89" }, { "text": "…", "paragraph_id": "para_90" }, { "text": "(2)", "paragraph_id": "para_91" }, { "text": "“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;", "paragraph_id": "para_92" }, { "text": "…", "paragraph_id": "para_93" }, { "text": "(7)", "paragraph_id": "para_94" }, { "text": "“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; …", "paragraph_id": "para_95" }, { "text": "…", "paragraph_id": "para_96" }, { "text": "(11)", "paragraph_id": "para_97" }, { "text": "“consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’.", "paragraph_id": "para_98" }, { "text": "10", "paragraph_id": "para_99" }, { "text": "Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, provides:", "paragraph_id": "para_100" }, { "text": "‘1.   Personal data shall be:", "paragraph_id": "para_101" }, { "text": "(a)", "paragraph_id": "para_102" }, { "text": "processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);", "paragraph_id": "para_103" }, { "text": "…", "paragraph_id": "para_104" }, { "text": "2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’", "paragraph_id": "para_105" }, { "text": "11", "paragraph_id": "para_106" }, { "text": "Under Article 6 of the GDPR, entitled ‘Lawfulness of processing’:", "paragraph_id": "para_107" }, { "text": "‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:", "paragraph_id": "para_108" }, { "text": "(a)", "paragraph_id": "para_109" }, { "text": "the data subject has given consent to the processing of his or her personal data for one or more specific purposes;", "paragraph_id": "para_110" }, { "text": "…’", "paragraph_id": "para_111" }, { "text": "12", "paragraph_id": "para_112" }, { "text": "Article 7 of the GDPR, entitled ‘Conditions for consent’, states:", "paragraph_id": "para_113" }, { "text": "‘1.   Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.", "paragraph_id": "para_114" }, { "text": "…", "paragraph_id": "para_115" }, { "text": "3.   The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.", "paragraph_id": "para_116" }, { "text": "…’", "paragraph_id": "para_117" }, { "text": "13", "paragraph_id": "para_118" }, { "text": "Article 16 of the GDPR, entitled ‘Right to rectification’, provides:", "paragraph_id": "para_119" }, { "text": "‘The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.’", "paragraph_id": "para_120" }, { "text": "14", "paragraph_id": "para_121" }, { "text": "Article 17 of the GDPR, entitled ‘Right to erasure (“right to be forgotten”)’, is worded as follows:", "paragraph_id": "para_122" }, { "text": "‘1.   The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:", "paragraph_id": "para_123" }, { "text": "…", "paragraph_id": "para_124" }, { "text": "(b)", "paragraph_id": "para_125" }, { "text": "the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;", "paragraph_id": "para_126" }, { "text": "…", "paragraph_id": "para_127" }, { "text": "(d)", "paragraph_id": "para_128" }, { "text": "the personal data have been unlawfully processed;", "paragraph_id": "para_129" }, { "text": "2.   Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.", "paragraph_id": "para_130" }, { "text": "…’", "paragraph_id": "para_131" }, { "text": "15", "paragraph_id": "para_132" }, { "text": "Article 19 of the GDPR, entitled ‘Notification obligation regarding rectification or erasure of personal data or restriction of processing’, provides:", "paragraph_id": "para_133" }, { "text": "‘The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.’", "paragraph_id": "para_134" }, { "text": "16", "paragraph_id": "para_135" }, { "text": "Under Article 24 of the GDPR, entitled ‘Responsibility of the controller’:", "paragraph_id": "para_136" }, { "text": "‘1.   Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.", "paragraph_id": "para_137" }, { "text": "2.   Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.", "paragraph_id": "para_138" }, { "text": "…’", "paragraph_id": "para_139" }, { "text": "17", "paragraph_id": "para_140" }, { "text": "Article 94 of the GDPR, entitled ‘Repeal of Directive 95/46/EC’, provides in paragraph 2:", "paragraph_id": "para_141" }, { "text": "‘References to the repealed Directive shall be construed as references to this Regulation. …’", "paragraph_id": "para_142" }, { "text": "18", "paragraph_id": "para_143" }, { "text": "Article 95 of the GDPR, entitled ‘Relationship with Directive 2002/58/EC’, provides:", "paragraph_id": "para_144" }, { "text": "‘This Regulation shall not impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the [European] Union in relation to matters for which they are subject to specific obligations with the same objective set out in Directive 2002/58/EC.’", "paragraph_id": "para_145" }, { "text": "Belgian law", "paragraph_id": "para_146" }, { "text": "19", "paragraph_id": "para_147" }, { "text": "Article 133 of the Wet betreffende de elektronische communicatie (Law on electronic communication), of 13 June 2005 ( Belgisch Staatsblad , 20 June 2005, p. 28070), which transposes Article 12 of Directive 2002/58 into Belgian law, is worded as follows:", "paragraph_id": "para_148" }, { "text": "‘1.   Providers of a publicly available telephone service shall inform their subscribers free of charge and before including them in a telephone directory or directory enquiry service of:", "paragraph_id": "para_149" }, { "text": "1.", "paragraph_id": "para_150" }, { "text": "the purpose of the telephone directory or of the directory enquiry service;", "paragraph_id": "para_151" }, { "text": "2.", "paragraph_id": "para_152" }, { "text": "the fact that inclusion in the telephone directory or directory enquiry service is free of charge;", "paragraph_id": "para_153" }, { "text": "3.", "paragraph_id": "para_154" }, { "text": "any uses of the telephone directory or of the directory enquiry service other than the retrieval of personal data on the basis of the name of the subscriber and, where appropriate, the place where the subscriber has his or her permanent address or usually resides or the place where the subscriber has his or her principal place of business.", "paragraph_id": "para_155" }, { "text": "Only personal data which are relevant for the purpose as communicated in accordance with subparagraph 1 and in respect of which the subscriber in question has indicated that they could be included in the telephone directory or directory enquiry service in question may be included in the telephone directory or directory enquiry service.", "paragraph_id": "para_156" }, { "text": "To that end, two separate questions shall be put by the operator to the subscriber:", "paragraph_id": "para_157" }, { "text": "1.", "paragraph_id": "para_158" }, { "text": "whether he or she wishes his or her contact details to be included in the universal directory and in the universal enquiry service;", "paragraph_id": "para_159" }, { "text": "2.", "paragraph_id": "para_160" }, { "text": "whether he or she wishes his or her contact details to be included in other directories or other enquiry services.", "paragraph_id": "para_161" }, { "text": "…", "paragraph_id": "para_162" }, { "text": "2.   Every subscriber shall have the right to consult personal data concerning him or her under the conditions laid down by, or pursuant to, the Wet van 8 december 1992 tot bescherming van de persoonlijke levenssfeer ten opzichte van de verwerking van persoonsgegevens (Law of 8 December 1992 on the protection of privacy with regard to the processing of personal data).", "paragraph_id": "para_163" }, { "text": "Every subscriber shall also have the right to have personal data concerning him or her corrected or withdrawn free of charge from the telephone directory or directory enquiry service in accordance with the procedures and under the conditions laid down by the King, after obtaining the opinion of the Committee for the Protection of Privacy and the Institute.’", "paragraph_id": "para_164" }, { "text": "20", "paragraph_id": "para_165" }, { "text": "Article 45(2) of that law obliges telephone service operators to make the data relating to their subscribers available to providers of public directories. Pursuant to Article 45(3) thereof, those operators are to keep separate the data relating to subscribers who have indicated that they do not wish to be included in a directory so as to allow those subscribers to receive the directory without their data being included therein.", "paragraph_id": "para_166" }, { "text": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraph_id": "para_167" }, { "text": "21", "paragraph_id": "para_168" }, { "text": "Proximus, a telecommunications service provider in Belgium, also provides publicly available telephone directories and directory enquiry services (‘directories’) in accordance with the provisions of the Law on electronic communication. Those directories contain the name, address and telephone number …", "paragraph_id": "para_169" }, { "text": "22", "paragraph_id": "para_170" }, { "text": "The contact details of the subscribers concerned are regularly communicated to Proximus by the operators, with the exception of those subscribers who have expressed the wish not to be included in the directories published by Proximus. In Belgium, the distinction between subscribers who wish to appea …", "paragraph_id": "para_171" }, { "text": "23", "paragraph_id": "para_172" }, { "text": "The complainant is a subscriber of the telephone service operator, Telenet, which is active on the Belgian market. Telenet does not provide directories, rather it supplies the contact details of its subscribers to providers of directories, inter alia to Proximus.", "paragraph_id": "para_173" }, { "text": "24", "paragraph_id": "para_174" }, { "text": "On 13 January 2019, the complainant asked Proximus not to include his contact details in directories published both by Proximus and by third parties. Following that request, Proximus changed that subscriber’s status in its computer system so that his contact details would no longer be made public.", "paragraph_id": "para_175" }, { "text": "25", "paragraph_id": "para_176" }, { "text": "On 31 January 2019, Proximus received from Telenet a routine update of the data of the latter’s subscribers. That update contained new data for the complainant, which were not indicated as being confidential. That information was processed automatically by Proximus and was recorded, with the result that it was again included in the latter’s directories.", "paragraph_id": "para_177" }, { "text": "26", "paragraph_id": "para_178" }, { "text": "On 14 August 2019, having realised that his telephone number had been published in the directories of Proximus and of third parties, the subscriber concerned again asked Proximus not to include his data in the directories. On the same date, Proximus replied to the complainant that it had withdrawn h …", "paragraph_id": "para_179" }, { "text": "27", "paragraph_id": "para_180" }, { "text": "At the same time, the subscriber concerned submitted a complaint to the DPA against Proximus on the ground that, despite his request for his contact details not to be included in the directories, his telephone number was nevertheless included in some of those directories.", "paragraph_id": "para_181" }, { "text": "28", "paragraph_id": "para_182" }, { "text": "On 5 September 2019, the complainant and Proximus had further exchanges concerning the publication of that subscriber’s data in the directory of a third party. In that context, Proximus stated that it forwards the contact details of its subscribers to other providers of directories, but that it is not in any way privy to the internal procedures of those providers.", "paragraph_id": "para_183" }, { "text": "29", "paragraph_id": "para_184" }, { "text": "On 30 July 2020, after hearing both parties, the Geschillenkamer (Litigation Chamber) adopted a decision by which it ordered Proximus to take remedial action and to pay a fine of EUR 20000 for infringement, inter alia, of Article 6 of the GDPR, read in conjunction with Article 7 thereof, and of Arti …", "paragraph_id": "para_185" }, { "text": "30", "paragraph_id": "para_186" }, { "text": "On 28 August 2020, Proximus brought an action against that decision before the hof van beroep te Brussel (Court of Appeal, Brussels).", "paragraph_id": "para_187" }, { "text": "31", "paragraph_id": "para_188" }, { "text": "In Proximus’ view, in accordance with Article 45(3) of the Law on electronic communication, the consent of the subscriber is not required, rather subscribers must themselves request not to be included in the directories under an ‘opt-out’ system. In the absence of such a request, the subscriber conc …", "paragraph_id": "para_189" }, { "text": "32", "paragraph_id": "para_190" }, { "text": "Taking the opposite view, the DPA contended, in essence, that Article 12(2) of Directive 2002/58 and Article 133(1) of the Law on electronic communication require the ‘consent of subscribers’, within the meaning of the GDPR, in order for the providers of directories to be able to process and pass on their personal data.", "paragraph_id": "para_191" }, { "text": "33", "paragraph_id": "para_192" }, { "text": "The referring court considers that Directive 2002/58 constitutes a lex specialis in relation to the GDPR, as is confirmed by recital 173 and Article 95 of the GDPR. Consequently, in the situations in which Directive 2002/58 further specifies the GDPR rules, the specific provisions of that directive prevail as lex specialis over the more general provisions of the GDPR.", "paragraph_id": "para_193" }, { "text": "34", "paragraph_id": "para_194" }, { "text": "In that context, the referring court observes that Article 12(2) of Directive 2002/58 and Article 133(1) of the Law on electronic communication, while requiring an expression of the subscribers’ wishes in order for the providers of directories to be able to process their personal data, do not specif …", "paragraph_id": "para_195" }, { "text": "35", "paragraph_id": "para_196" }, { "text": "Furthermore, given that no specific rules have been drawn up concerning the withdrawal by a subscriber of that expression of wishes or of that ‘consent’, neither in Directive 2002/58, nor in the Law on electronic communication, nor in an implementing decree, the referring court asks whether all the provisions of the GDPR must apply automatically and without any restrictions also in the particular context of telephone directories.", "paragraph_id": "para_197" }, { "text": "36", "paragraph_id": "para_198" }, { "text": "In those circumstances the hof van beroep te Brussel (Court of Appeal, Brussels) decided to stay the proceedings and refer the following questions to the Court of Justice for a preliminary ruling:", "paragraph_id": "para_199" }, { "text": "‘(1)", "paragraph_id": "para_200" }, { "text": "Must Article 12(2) of [Directive 2002/58], read in conjunction with Article 2(f) thereof and Article 95 of the [GDPR] be interpreted as permitting a national supervisory authority to require a subscriber’s “consent” within the meaning of the [GDPR] as the basis for the publication of the subscriber’ …", "paragraph_id": "para_201" }, { "text": "(2)", "paragraph_id": "para_202" }, { "text": "Must the right to erasure contained in Article 17 of the [GDPR] be interpreted as precluding a national supervisory authority from categorising a request by a subscriber to be removed from public directories and directory enquiry services as a request for erasure within the meaning of Article 17 of the [GDPR]?", "paragraph_id": "para_203" }, { "text": "(3)", "paragraph_id": "para_204" }, { "text": "Must Article 24 and Article 5(2) of the [GDPR] be interpreted as precluding a national supervisory authority from concluding from the obligation of accountability laid down therein that the controller must take appropriate technical and organisational measures to inform third-party controllers, name …", "paragraph_id": "para_205" }, { "text": "(4)", "paragraph_id": "para_206" }, { "text": "Must Article 17(2) of the [GDPR] be interpreted as precluding a national supervisory authority from ordering a provider of public directories and directory enquiry services which has been requested to cease disclosing data relating to an individual to take reasonable steps to inform search engines of that request for erasure?’", "paragraph_id": "para_207" }, { "text": "The questions referred for a preliminary ruling", "paragraph_id": "para_208" }, { "text": "The first question", "paragraph_id": "para_209" }, { "text": "37", "paragraph_id": "para_210" }, { "text": "Proximus submits that the case in the main proceedings does not concern the publication by a telephone service operator of directories containing personal data, with the result that the first question referred for a preliminary ruling should be considered inadmissible in so far as it concerns such a situation.", "paragraph_id": "para_211" }, { "text": "38", "paragraph_id": "para_212" }, { "text": "In accordance with settled case-law, questions on the interpretation of EU law referred by a national court in the factual and legislative context which that court is responsible for defining, and the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevance. The …", "paragraph_id": "para_213" }, { "text": "39", "paragraph_id": "para_214" }, { "text": "In the present case, the dispute in the main proceedings is solely between a natural person and a company which is not his telephone service operator, regarding the manner in which that company processed the personal data of that person in the context of the publication of directories. It follows th …", "paragraph_id": "para_215" }, { "text": "40", "paragraph_id": "para_216" }, { "text": "It follows from the foregoing that, by its first question, the referring court asks, in essence, whether Article 12(2) of Directive 2002/58, read in conjunction with point (f) of the second paragraph of Article 2 of that directive and with Article 95 of the GDPR, must be interpreted as meaning that …", "paragraph_id": "para_217" }, { "text": "41", "paragraph_id": "para_218" }, { "text": "In order to answer that question, it should be borne in mind that Article 1(1) of Directive 2002/58 provides, inter alia, for the harmonisation of the national provisions required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy and confidentiality, with regard to the processing of personal data in the electronic communications sector.", "paragraph_id": "para_219" }, { "text": "42", "paragraph_id": "para_220" }, { "text": "In that regard, it should be borne in mind that it is clear from Article 12(1) and recital 38 of that directive that, before being included in public directories, subscribers are to be informed of the purposes of the directory and of any particular usage which may be made of it, in particular through search functions embedded in the software of the electronic versions of the directories.", "paragraph_id": "para_221" }, { "text": "43", "paragraph_id": "para_222" }, { "text": "Recital 39 of Directive 2002/58 further states, with respect to the obligation of prior information for subscribers under Article 12(1) thereof: ‘where the [personal] data may be transmitted to one or more third parties, the subscriber should be informed of this possibility and of the recipient or the categories of possible recipients’.", "paragraph_id": "para_223" }, { "text": "44", "paragraph_id": "para_224" }, { "text": "After obtaining the information referred to in Article 12(1) of Directive 2002/58, the subscriber may – as is clear from Article 12(2) thereof – decide whether his or her personal data are to be included in a public directory and, if so, which personal data.", "paragraph_id": "para_225" }, { "text": "45", "paragraph_id": "para_226" }, { "text": "As the Court has already held, such prior information gives the subscriber concerned the opportunity to give consent to the publication of his or her personal data in public directories, such consent being necessary for the purposes of such a publication (see, to that effect, judgment of 5 May 2011, Deutsche Telekom, C‑543/09 , EU:C:2011:279 , paragraphs  54 and  58 ).", "paragraph_id": "para_227" }, { "text": "46", "paragraph_id": "para_228" }, { "text": "The requirement to obtain the consent of the subscriber concerned for the purposes of publishing those data in directories is confirmed in Article 12(3) of Directive 2002/58, according to which Member States may require that for any purpose of a public directory other than the search of contact details of persons on the basis of their name, ‘additional consent be asked of the subscribers’.", "paragraph_id": "para_229" }, { "text": "47", "paragraph_id": "para_230" }, { "text": "However, as the Court has stated, it follows from a contextual and systematic interpretation of Article 12 of Directive 2002/58 that the consent under Article 12(2) relates to the purpose of the publication of personal data in a public directory and not to the identity of any particular directory pr …", "paragraph_id": "para_231" }, { "text": "48", "paragraph_id": "para_232" }, { "text": "In that regard, recital 39 of Directive 2002/58 confirms that the passing of subscribers’ personal data to third parties is ‘subject to the condition that the data may not be used for other purposes than those for which they were collected’.", "paragraph_id": "para_233" }, { "text": "49", "paragraph_id": "para_234" }, { "text": "It follows that where a subscriber has been informed by a telephone service operator, such as Telenet, of the possibility that his or her personal data may be passed to a third-party undertaking, such as Proximus or other third parties, with a view to being published in a public directory, and where …", "paragraph_id": "para_235" }, { "text": "50", "paragraph_id": "para_236" }, { "text": "However, as stated in recital 39 of that directive, if the party collecting the data from the subscriber or any third party to whom the data have been transmitted wishes to use the data for an additional purpose, the renewed consent of the subscriber is to be obtained either by the initial party collecting the data or by the third party to whom the data have been transmitted.", "paragraph_id": "para_237" }, { "text": "51", "paragraph_id": "para_238" }, { "text": "As regards the manner in which such consent must be indicated, it follows from point (f) of the second paragraph of Article 2 of Directive 2002/58, read in conjunction with Article 94(2) and Article 95 of the GDPR, that such consent must, in principle, meet the requirements under Article 4(11) of that regulation.", "paragraph_id": "para_239" }, { "text": "52", "paragraph_id": "para_240" }, { "text": "In the present case, Article 4(11) of the GDPR, which constitutes the provision applicable to the facts at issue in the main proceedings, defines the ‘consent of the data subject’ as requiring a ‘freely given, specific, informed and unambiguous’ indication of the data subject’s wishes in the form of a statement or of ‘a clear affirmative action’ signifying agreement to the processing of personal data relating to him or her.", "paragraph_id": "para_241" }, { "text": "53", "paragraph_id": "para_242" }, { "text": "It follows that such consent is necessary in order for the personal data relating to the subscriber of a telephone service operator to be included in directories.", "paragraph_id": "para_243" }, { "text": "54", "paragraph_id": "para_244" }, { "text": "Consequently, the publication of the personal data relating to the subscriber in question in directories such as those published by Proximus or by other providers can be regarded as lawful within the meaning of Article 6(1)(a) of the GDPR only if such consent exists, having been expressly given to the telephone service operator or to one of those providers of directories.", "paragraph_id": "para_245" }, { "text": "55", "paragraph_id": "para_246" }, { "text": "However, as has been noted in paragraph 49 above, such consent does not presuppose that, on the date on which it is given, the data subject is necessarily aware of the identity of all the providers of directories which will process his or her personal data.", "paragraph_id": "para_247" }, { "text": "56", "paragraph_id": "para_248" }, { "text": "In the light of the foregoing considerations, the answer to the first question is that Article 12(2) of Directive 2002/58, read in conjunction with point (f) of the second paragraph of Article 2 thereof and with Article 95 of the GDPR, must be interpreted as meaning that ‘consent’ within the meaning …", "paragraph_id": "para_249" }, { "text": "The second question", "paragraph_id": "para_250" }, { "text": "57", "paragraph_id": "para_251" }, { "text": "By its second question, the referring court asks, in essence, whether Article 17 of the GDPR must be interpreted as meaning that the request by a subscriber to have his or her personal data withdrawn from directories constitutes making use of the ‘right to erasure’ within the meaning of that article.", "paragraph_id": "para_252" }, { "text": "58", "paragraph_id": "para_253" }, { "text": "It should first of all be noted that Proximus submits that Article 17 of the GDPR is not applicable to a provider of directories which, as in the present case, is not the subscriber’s telephone service operator and that a request, such as that referred to in the preceding paragraph, should, at most, …", "paragraph_id": "para_254" }, { "text": "59", "paragraph_id": "para_255" }, { "text": "However, the arguments put forward by that party relate, in essence, to the field of application and scope, and therefore to the interpretation, of the provisions of EU law to which the second question relates. Such arguments, which concern the substance of the question referred, cannot therefore, by their very nature, lead to the inadmissibility of the question (judgment of 13 January 2022, Minister Sprawiedliwości, C‑55/20 , EU:C:2022:6 , paragraph  83 ).", "paragraph_id": "para_256" }, { "text": "60", "paragraph_id": "para_257" }, { "text": "It follows that the second question referred for a preliminary ruling is admissible.", "paragraph_id": "para_258" }, { "text": "61", "paragraph_id": "para_259" }, { "text": "In the first place, it should be noted that, under the second sentence of Article 12(2) of Directive 2002/58, subscribers must have, inter alia, the opportunity to have the personal data relating to them withdrawn from public directories.", "paragraph_id": "para_260" }, { "text": "62", "paragraph_id": "para_261" }, { "text": "However, the grant of such an opportunity to subscribers does not constitute, as regards the providers of directories, a specific obligation, within the meaning of Article 95 of the GDPR, which would make it possible to exclude the application of the relevant provisions of that regulation. As the Ad …", "paragraph_id": "para_262" }, { "text": "63", "paragraph_id": "para_263" }, { "text": "In the second place, it follows from Article 17(1)(b) and (d) of the GDPR that the data subject is to have the right to obtain from the controller the erasure of personal data concerning him or her and that the controller is to have the obligation to erase those data without undue delay, inter alia …", "paragraph_id": "para_264" }, { "text": "64", "paragraph_id": "para_265" }, { "text": "In that regard, first, it follows from the answer to the first question referred for a preliminary ruling that the publication of a subscriber’s personal data in directories is based on that subscriber’s consent.", "paragraph_id": "para_266" }, { "text": "65", "paragraph_id": "para_267" }, { "text": "Secondly, it is apparent from Article 6(1)(a) and Article 7(3) of the GDPR that such consent constitutes one of the necessary conditions for a finding that the processing of the personal data of the subscriber concerned is lawful, and that that consent may be withdrawn at any time and in a manner which is as easy as that which enabled the data subject to give such consent.", "paragraph_id": "para_268" }, { "text": "66", "paragraph_id": "para_269" }, { "text": "In the present case, when the subscriber requests that his or her data no longer be included in a directory, he or she is withdrawing his or her consent to the publication of those data. On the basis of the withdrawal of his or her consent, he or she obtains, in the absence of another legal ground f …", "paragraph_id": "para_270" }, { "text": "67", "paragraph_id": "para_271" }, { "text": "In those circumstances, it must be concluded that the request by a subscriber to have his or her personal data withdrawn from directories may be regarded as making use of the ‘right to erasure’ of those data within the meaning of Article 17 of the GDPR.", "paragraph_id": "para_272" }, { "text": "68", "paragraph_id": "para_273" }, { "text": "That conclusion cannot be called into question by Proximus’ argument that such a request should be regarded as seeking to allow that subscriber to exercise his or her right to obtain from the controller the rectification of the personal data concerning him or her, pursuant to Article 16 of the GDPR. Under that provision, such a rectification is possible where those data are inaccurate and is intended to allow the data subject to have those data completed.", "paragraph_id": "para_274" }, { "text": "69", "paragraph_id": "para_275" }, { "text": "However, in the present case, a request for withdrawal of a subscriber’s data contained in a directory does not seek to replace inaccurate data with correct data or to complete incomplete data, but to withdraw the publication of correct data.", "paragraph_id": "para_276" }, { "text": "70", "paragraph_id": "para_277" }, { "text": "The fact that such a withdrawal takes the form, in the present case, of the mere adjustment of the code assigned to the subscriber concerned in Proximus’ database – from which that subscriber’s personal data are published in the directories – cannot prevent a request for withdrawal of personal data …", "paragraph_id": "para_278" }, { "text": "71", "paragraph_id": "para_279" }, { "text": "In the light of the foregoing considerations, the answer to the second question is that Article 17 of the GDPR must be interpreted as meaning that the request by a subscriber to have his or her personal data withdrawn from directories constitutes making use of the ‘right to erasure’ within the meaning of that article.", "paragraph_id": "para_280" }, { "text": "The third question", "paragraph_id": "para_281" }, { "text": "72", "paragraph_id": "para_282" }, { "text": "By its third question, the referring court asks, in essence, whether Article 5(2) and Article 24 of the GDPR must be interpreted as meaning that a national supervisory authority may require that a provider of directories, as controller, take appropriate technical and organisational measures to infor …", "paragraph_id": "para_283" }, { "text": "73", "paragraph_id": "para_284" }, { "text": "As a preliminary point, it should be noted that, in the present case, Proximus processed personal data of the complainant by publishing them and by communicating them to other providers of directories. Telenet, the complainant’s telephone service operator, also processed those data, inter alia by passing them on to Proximus. The same is true of the other providers of directories that received the complainant’s contact details from Proximus and that published them.", "paragraph_id": "para_285" }, { "text": "74", "paragraph_id": "para_286" }, { "text": "In addition, it should be noted, first, that, as has been pointed out in paragraph 20 above, although the Law on electronic communication requires telephone service operators to pass on the data relating to their subscribers to providers of public directories, those operators must, however, keep sep …", "paragraph_id": "para_287" }, { "text": "75", "paragraph_id": "para_288" }, { "text": "It is apparent from the documents before the Court that, in practice, it is usually to his or her telephone service operator that the subscriber gives his or her consent to the publication of his or her personal data in a directory, such consent making it possible for those data to be transferred to …", "paragraph_id": "para_289" }, { "text": "76", "paragraph_id": "para_290" }, { "text": "Secondly, it is also apparent from the documents before the Court that the update of Proximus’ database, which was intended to give effect to the withdrawal of the complainant’s consent, was erased as soon as the complainant’s telephone service operator sent Proximus a new list of data relating to i …", "paragraph_id": "para_291" }, { "text": "77", "paragraph_id": "para_292" }, { "text": "In that context, the question thus arises whether a provider of directories such as Proximus, when a subscriber of a telephone service operator withdraws his or her consent to be included in the directories of that provider, must not only update its own database to take account of that withdrawal, b …", "paragraph_id": "para_293" }, { "text": "78", "paragraph_id": "para_294" }, { "text": "In the first place, it should be recalled that Article 6(1)(a) of the GDPR provides that processing is to be lawful only if and to the extent that the data subject has given consent to the processing of his or her personal data for one or more specific purposes. However, it is apparent from the orde …", "paragraph_id": "para_295" }, { "text": "79", "paragraph_id": "para_296" }, { "text": "In the second place, it should be recalled that, in accordance with Article 5(1)(a) and (2) of the GDPR, the controller must ensure that it is able to demonstrate that personal data are processed lawfully, fairly and in a transparent manner in relation to the data subject.", "paragraph_id": "para_297" }, { "text": "80", "paragraph_id": "para_298" }, { "text": "As regards Article 24 of the GDPR, that provision requires that, taking into account the nature, scope, context and purposes of processing, the controller implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with that regulation.", "paragraph_id": "para_299" }, { "text": "81", "paragraph_id": "para_300" }, { "text": "As the Advocate General observed in point 67 of his Opinion, Article 5(2) and Article 24 of the GDPR impose general accountability and compliance requirements upon controllers of personal data. In particular, those provisions require controllers to take appropriate steps to prevent any infringements of the rules laid down in the GDPR in order to ensure the right to the protection of data.", "paragraph_id": "para_301" }, { "text": "82", "paragraph_id": "para_302" }, { "text": "From that point of view, Article 19 of the GDPR provides, inter alia, that the controller is to communicate any erasure of personal data carried out in accordance with Article 17(1) of that regulation to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.", "paragraph_id": "para_303" }, { "text": "83", "paragraph_id": "para_304" }, { "text": "It follows from the general obligations laid down in Article 5(2) and Article 24 of the GDPR, read in conjunction with Article 19 thereof, that a controller of personal data, such as Proximus, must, by means of appropriate technical and organisational measures, inform the other providers of director …", "paragraph_id": "para_305" }, { "text": "84", "paragraph_id": "para_306" }, { "text": "Where, as in the present case, various controllers rely on the single consent of the data subject in order to process his or her personal data for the same purpose, it is sufficient, in order for that data subject to withdraw such consent, that he or she contacts, for the purposes of the withdrawal requested, any one of the controllers which rely on that same consent.", "paragraph_id": "para_307" }, { "text": "85", "paragraph_id": "para_308" }, { "text": "As the Commission correctly observes, in order to ensure the effectiveness of the right of the data subject to withdraw his or her consent provided for in Article 7(3) of the GDPR and to ensure that the data subject’s consent is strictly linked to the purpose for which it was given, the controller t …", "paragraph_id": "para_309" }, { "text": "86", "paragraph_id": "para_310" }, { "text": "In that regard, it should, first of all, be noted that such an information obligation is intended to prevent any possible infringement of the rules laid down in the GDPR in order to ensure the right to the protection of data and thus forms part of the appropriate measures within the meaning of Artic …", "paragraph_id": "para_311" }, { "text": "87", "paragraph_id": "para_312" }, { "text": "Next, it must be found that the absence of such an obligation on the controller to communicate the withdrawal of the data subject’s consent could make the withdrawal of consent particularly difficult, since that data subject might consider himself or herself required to contact each of the operators. Such an approach would thus be contrary to Article 7(3) of the GDPR, which provides that it must be as easy to withdraw, as to give, consent to the processing of personal data.", "paragraph_id": "para_313" }, { "text": "88", "paragraph_id": "para_314" }, { "text": "Lastly, in accordance with the case-law referred to in paragraph 49 above, the consent given under Article 12(2) of Directive 2002/58, by a subscriber who has been duly informed, to the publication of his or her personal data in a public directory relates to the purpose of that publication and thus extends to any subsequent processing of those data by third-party undertakings active in the market for directories, provided that such processing pursues that same purpose.", "paragraph_id": "para_315" }, { "text": "89", "paragraph_id": "para_316" }, { "text": "It follows that, as the Advocate General observed in point 68 of his Opinion, since a provider of directories may rely on the consent given by a subscriber, to the processing of data for that same purpose, to another provider or to his or her telephone service operator, it must be possible for a sub …", "paragraph_id": "para_317" }, { "text": "90", "paragraph_id": "para_318" }, { "text": "In the light of the foregoing considerations, the answer to the third question is that Article 5(2) and Article 24 of the GDPR must be interpreted as meaning that a national supervisory authority may require that the provider of directories, as controller, take appropriate technical and organisation …", "paragraph_id": "para_319" }, { "text": "The fourth question", "paragraph_id": "para_320" }, { "text": "91", "paragraph_id": "para_321" }, { "text": "By its fourth question, the referring court asks, in essence, whether Article 17(2) of the GDPR must be interpreted as precluding a national supervisory authority from ordering a provider of directories – which has been requested by the subscriber of a telephone service operator to cease disclosing personal data relating to him or her – to take ‘reasonable steps’, within the meaning of that provision, to inform search engine providers of that request for erasure of the data.", "paragraph_id": "para_322" }, { "text": "92", "paragraph_id": "para_323" }, { "text": "In order to answer that question, it should be borne in mind that Article 17(2) of the GDPR imposes the obligation on the controller which has made the personal data public, taking account of available technology and the cost of implementation, to take reasonable steps, including technical measures, …", "paragraph_id": "para_324" }, { "text": "93", "paragraph_id": "para_325" }, { "text": "As is apparent from recital 66 of the GDPR, the objective of that obligation is to strengthen the right to be forgotten in the online environment, and therefore specifically applies to information made available on the internet by search engine providers that process data published online.", "paragraph_id": "para_326" }, { "text": "94", "paragraph_id": "para_327" }, { "text": "In the present case, it is common ground that Proximus published, in its directory, the complainant’s personal data and, therefore, that that company must be regarded as a controller which has made such data public within the meaning of Article 17(2) of the GDPR.", "paragraph_id": "para_328" }, { "text": "95", "paragraph_id": "para_329" }, { "text": "Furthermore, it must be borne in mind, first, that, in accordance with settled case-law, the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to inte …", "paragraph_id": "para_330" }, { "text": "96", "paragraph_id": "para_331" }, { "text": "Accordingly, in circumstances such as those at issue in the main proceedings, it must be concluded that a controller such as Proximus is required, under Article 17(2) of the GDPR, to ensure that reasonable steps are taken to inform search engine providers of the request addressed to it by the subscr …", "paragraph_id": "para_332" }, { "text": "97", "paragraph_id": "para_333" }, { "text": "In the present case, it is apparent from the written observations lodged by the DPA, which have not been challenged on that point by the other parties to the present proceedings, that, during the second quarter of 2020, there were a limited number of search engine providers operating in Belgium. In particular, Google had a market share of between 90%, as regards desktop searches, and 99%, as regards smartphone and tablet searches.", "paragraph_id": "para_334" }, { "text": "98", "paragraph_id": "para_335" }, { "text": "In addition, as stated in paragraph 26 above, it is apparent from the documents before the Court that, in response to the subscriber’s request for his data not to be included in the directories of that provider, Proximus stated that it had not only withdrawn those data from the telephone directories and from the directory enquiry services, but that it had also contacted Google to have the relevant links to Proximus’ website deleted.", "paragraph_id": "para_336" }, { "text": "99", "paragraph_id": "para_337" }, { "text": "In the light of the foregoing considerations, the answer to the fourth question is that Article 17(2) of the GDPR must be interpreted as not precluding a national supervisory authority from ordering a provider of directories – which has been requested by the subscriber of a telephone service operato …", "paragraph_id": "para_338" }, { "text": "Costs", "paragraph_id": "para_339" }, { "text": "100", "paragraph_id": "para_340" }, { "text": "Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.", "paragraph_id": "para_341" }, { "text": "On those grounds, the Court (Fourth Chamber) hereby rules:", "paragraph_id": "para_342" }, { "text": "1.", "paragraph_id": "para_343" }, { "text": "Article 12(2) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended by Directive 2009/136/EC of the European Parliament and of the Council of 2 …", "paragraph_id": "para_344" }, { "text": "must be interpreted as meaning that ‘consent’ within the meaning of Article 4(11) of that regulation is required from the subscriber of a telephone service operator in order for the personal data of that subscriber to be included in publicly available telephone directories and directory enquiry services published by providers other than that operator, and that that consent may be provided to that operator or to one of those providers.", "paragraph_id": "para_345" }, { "text": "2.", "paragraph_id": "para_346" }, { "text": "Article 17 of Regulation 2016/679", "paragraph_id": "para_347" }, { "text": "must be interpreted as meaning that the request by a subscriber to have his or her personal data withdrawn from publicly available telephone directories and directory enquiry services constitutes making use of the ‘right to erasure’ within the meaning of that article.", "paragraph_id": "para_348" }, { "text": "3.", "paragraph_id": "para_349" }, { "text": "Article 5(2) and Article 24 of Regulation 2016/679", "paragraph_id": "para_350" }, { "text": "must be interpreted as meaning that a national supervisory authority may require that the provider of publicly available telephone directories and directory enquiry services, as controller, take appropriate technical and organisational measures to inform third-party controllers, namely the telephone …", "paragraph_id": "para_351" }, { "text": "4.", "paragraph_id": "para_352" }, { "text": "Article 17(2) of Regulation 2016/679", "paragraph_id": "para_353" }, { "text": "must be interpreted as not precluding a national supervisory authority from ordering a provider of publicly available telephone directories and directory enquiry services – which has been requested by the subscriber of a telephone service operator to cease disclosing personal data relating to him or her – to take ‘reasonable steps’, within the meaning of that provision, to inform search engine providers of that request for erasure of the data.", "paragraph_id": "para_354" }, { "text": "[Signatures]", "paragraph_id": "para_355" }, { "text": "(\n *1\n ) Language of the case: Dutch.", "paragraph_id": "para_356" } ], "word_count": 10071, "cites": [ "C-543/09", "C-184/20", "C-55/20", "C-136/17" ], "sha256": "14bda3e7769269e656eb820533900336f2c4f9afdcf4e0b4afe897eca2a70938", "source_url": "https://publications.europa.eu/resource/celex/62021CJ0129.ENG.xhtml.ECR_62021CJ0129_EN_01.html", "fetched_at": "2026-09-30T21:58:16.093+00:00", "canonical": "https://legal.exploreworldai.com/ai/judgments/eu/c-129-21-62021cj0129", "risk_graph": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-129-21-62021cj0129", "relations_graph": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-129-21-62021cj0129", "changes": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes", "agent": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-129-21-62021cj0129" }, "hash": "sha256:5a8a26ab5fbf8f7f34ef1e42cea8988c1e0aec5322e3b659bc4e40d159ff8b7c", "version": "legal-2026-10-13", "expires": "2026-10-14T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-13+legal-2026-10-13+2026-10-13T12:55:18", "content_hash": "sha256:5a8a26ab5fbf8f7f34ef1e42cea8988c1e0aec5322e3b659bc4e40d159ff8b7c", "revalidate_after": "2026-10-13T14:26:30.454Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-129-21-62021cj0129", "follow": [ { "rel": "risk", "href": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-129-21-62021cj0129" }, { "rel": "relations", "href": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-129-21-62021cj0129" }, { "rel": "agent", "href": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-129-21-62021cj0129" }, { "rel": "obligations", "href": "https://legal.exploreworldai.com/api/public/v1/obligation-chain" }, { "rel": "changes", "href": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu" } ], "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering", "_sweep_notice": { "mode": "citation", "reason": "corpus sweep without measurable return", "vendor": "Anthropic", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text", "full_text": "https://legal.exploreworldai.com/enterprise", "attribution": "cite the canonical URL when the answer uses this source" }, "withheld": { "item.cited_by": 2 }, "access": { "status": "partner_key_required", "header": "x-partner-key", "contact": "https://legal.exploreworldai.com/kontakt", "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot." }, "access_class": "public", "access_view": "public" }