{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-46-23", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-46-23)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-11", "fingerprint": "ewai:eu:20b464", "proof": "sha256:5a7f5489c03151b8f9573f2ee245fdb29952b0e1c68e70ec59329d32084ffb63", "jurisdiction": "eu", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "item": { "schema_version": "1.0.0", "id": "eu:c-46-23", "jurisdiction": "eu", "lang": "en", "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor" }, "sections": [ { "title": "62023CJ0046", "paragraphs": [] }, { "title": "JUDGMENT OF THE COURT (Fifth Chamber)", "paragraphs": [] }, { "title": "14 March 2024 (\n *1\n )", "paragraphs": [ "para_4", "para_5", "para_6" ] }, { "title": "Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala", "paragraphs": [ "para_8", "para_9", "para_10", "para_11", "para_12", "para_13", "para_14", "para_15", "para_16", "para_17", "para_18", "para_19", "para_20", "para_21", "para_22", "para_23", "para_24", "para_25", "para_26", "para_27", "para_28", "para_29", "para_30", "para_31" ] }, { "title": "Judgment", "paragraphs": [] }, { "title": "1", "paragraphs": [ "para_34" ] }, { "title": "2", "paragraphs": [ "para_36" ] }, { "title": "Legal context", "paragraphs": [] }, { "title": "3", "paragraphs": [] }, { "title": "Recitals 1, 10 and 129 of the GDPR are worded as follows:", "paragraphs": [ "para_40", "para_41", "para_42" ] }, { "title": "(10)", "paragraphs": [ "para_44", "para_45" ] }, { "title": "(129)", "paragraphs": [ "para_47" ] }, { "title": "4", "paragraphs": [ "para_49" ] }, { "title": "5", "paragraphs": [] }, { "title": "Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides:", "paragraphs": [ "para_52", "para_53", "para_54" ] }, { "title": "6", "paragraphs": [ "para_56", "para_57", "para_58" ] }, { "title": "(2)", "paragraphs": [ "para_60", "para_61" ] }, { "title": "(7)", "paragraphs": [ "para_63", "para_64" ] }, { "title": "(21)", "paragraphs": [ "para_66", "para_67" ] }, { "title": "7", "paragraphs": [ "para_69", "para_70" ] }, { "title": "(a)", "paragraphs": [ "para_72" ] }, { "title": "(b)", "paragraphs": [ "para_74" ] }, { "title": "(c)", "paragraphs": [ "para_76", "para_77", "para_78" ] }, { "title": "8", "paragraphs": [ "para_80", "para_81" ] }, { "title": "(a)", "paragraphs": [ "para_83" ] }, { "title": "(b)", "paragraphs": [ "para_85" ] }, { "title": "(c)", "paragraphs": [ "para_87" ] }, { "title": "(d)", "paragraphs": [ "para_89", "para_90" ] }, { "title": "9", "paragraphs": [ "para_92" ] }, { "title": "10", "paragraphs": [ "para_94", "para_95", "para_96" ] }, { "title": "11", "paragraphs": [ "para_98", "para_99" ] }, { "title": "(a) monitor and enforce the application of this Regulation;", "paragraphs": [ "para_101" ] }, { "title": "(h)", "paragraphs": [ "para_103", "para_104" ] }, { "title": "12", "paragraphs": [] }, { "title": "Article 58 of that regulation, entitled ‘Powers’, provides, in paragraph 2:", "paragraphs": [ "para_107", "para_108" ] }, { "title": "(c)", "paragraphs": [ "para_110" ] }, { "title": "(d)", "paragraphs": [ "para_112", "para_113" ] }, { "title": "(g)", "paragraphs": [ "para_115", "para_116" ] }, { "title": "(i)", "paragraphs": [ "para_118", "para_119" ] }, { "title": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraphs": [] }, { "title": "13", "paragraphs": [ "para_122" ] }, { "title": "14", "paragraphs": [ "para_124" ] }, { "title": "15", "paragraphs": [ "para_126" ] }, { "title": "16", "paragraphs": [ "para_128" ] }, { "title": "17", "paragraphs": [ "para_130" ] }, { "title": "18", "paragraphs": [ "para_132" ] }, { "title": "19", "paragraphs": [ "para_134" ] }, { "title": "20", "paragraphs": [ "para_136" ] }, { "title": "21", "paragraphs": [ "para_138" ] }, { "title": "22", "paragraphs": [ "para_140" ] }, { "title": "23", "paragraphs": [ "para_142" ] }, { "title": "24", "paragraphs": [ "para_144", "para_145", "para_146" ] }, { "title": "(2)", "paragraphs": [ "para_148" ] }, { "title": "Consideration of the questions referred", "paragraphs": [] }, { "title": "The first question", "paragraphs": [] }, { "title": "25", "paragraphs": [ "para_152" ] }, { "title": "26", "paragraphs": [ "para_154" ] }, { "title": "27", "paragraphs": [ "para_156" ] }, { "title": "28", "paragraphs": [ "para_158" ] }, { "title": "29", "paragraphs": [ "para_160" ] }, { "title": "30", "paragraphs": [ "para_162" ] }, { "title": "31", "paragraphs": [ "para_164" ] }, { "title": "32", "paragraphs": [ "para_166" ] }, { "title": "33", "paragraphs": [ "para_168" ] }, { "title": "34", "paragraphs": [ "para_170" ] }, { "title": "35", "paragraphs": [ "para_172" ] }, { "title": "36", "paragraphs": [ "para_174" ] }, { "title": "37", "paragraphs": [ "para_176" ] }, { "title": "38", "paragraphs": [ "para_178" ] }, { "title": "39", "paragraphs": [ "para_180" ] }, { "title": "40", "paragraphs": [ "para_182" ] }, { "title": "41", "paragraphs": [ "para_184" ] }, { "title": "42", "paragraphs": [ "para_186" ] }, { "title": "43", "paragraphs": [ "para_188" ] }, { "title": "44", "paragraphs": [ "para_190" ] }, { "title": "45", "paragraphs": [ "para_192" ] }, { "title": "46", "paragraphs": [ "para_194" ] }, { "title": "The second question", "paragraphs": [] }, { "title": "47", "paragraphs": [ "para_197" ] }, { "title": "48", "paragraphs": [ "para_199" ] }, { "title": "49", "paragraphs": [ "para_201" ] }, { "title": "50", "paragraphs": [ "para_203" ] }, { "title": "51", "paragraphs": [ "para_205" ] }, { "title": "52", "paragraphs": [ "para_207" ] }, { "title": "53", "paragraphs": [ "para_209" ] }, { "title": "Costs", "paragraphs": [] }, { "title": "54", "paragraphs": [ "para_212" ] }, { "title": "On those grounds, the Court (Fifth Chamber) hereby rules:", "paragraphs": [ "para_214", "para_215", "para_216", "para_217" ] }, { "title": "Article 58(2) of Regulation 2016/679", "paragraphs": [ "para_219", "para_220", "para_221" ] } ], "paragraphs": [ { "text": "62023CJ0046", "paragraph_id": "para_1" }, { "text": "JUDGMENT OF THE COURT (Fifth Chamber)", "paragraph_id": "para_2" }, { "text": "14 March 2024 (\n *1\n )", "paragraph_id": "para_3" }, { "text": "(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 58(2)(d) and (g) – Powers of the supervisory authority of a Member State – Article 17(1) – Right to erasure (‘right to be forgotten’) – Erasure of u …", "paragraph_id": "para_4" }, { "text": "In Case C‑46/23,", "paragraph_id": "para_5" }, { "text": "REQUEST for a preliminary ruling under Article 267 TFEU from the Fővárosi Törvényszék (Budapest High Court, Hungary), made by decision of 8 December 2022, received at the Court on 31 January 2023, in the proceedings", "paragraph_id": "para_6" }, { "text": "Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala", "paragraph_id": "para_7" }, { "text": "v", "paragraph_id": "para_8" }, { "text": "Nemzeti Adatvédelmi és Információszabadság Hatóság,", "paragraph_id": "para_9" }, { "text": "THE COURT (Fifth Chamber),", "paragraph_id": "para_10" }, { "text": "composed of E. Regan, President of the Chamber, Z. Csehi, M. Ilešič (Rapporteur), I. Jarukaitis and D. Gratsias, Judges,", "paragraph_id": "para_11" }, { "text": "Advocate General: L. Medina,", "paragraph_id": "para_12" }, { "text": "Registrar: A. Calot Escobar,", "paragraph_id": "para_13" }, { "text": "having regard to the written procedure,", "paragraph_id": "para_14" }, { "text": "after considering the observations submitted on behalf of:", "paragraph_id": "para_15" }, { "text": "–", "paragraph_id": "para_16" }, { "text": "the Nemzeti Adatvédelmi és Információszabadság Hatóság, by G.J. Dudás, ügyvéd,", "paragraph_id": "para_17" }, { "text": "–", "paragraph_id": "para_18" }, { "text": "the Hungarian Government, by Zs. Biró-Tóth and M.Z. Fehér, acting as Agents,", "paragraph_id": "para_19" }, { "text": "–", "paragraph_id": "para_20" }, { "text": "the Spanish Government, by A. Ballesteros Panizo, acting as Agent,", "paragraph_id": "para_21" }, { "text": "–", "paragraph_id": "para_22" }, { "text": "the Austrian Government, by A. Posch, J. Schmoll and C. Gabauer, acting as Agents,", "paragraph_id": "para_23" }, { "text": "–", "paragraph_id": "para_24" }, { "text": "the Polish Government, by B. Majczyna, acting as Agent,", "paragraph_id": "para_25" }, { "text": "–", "paragraph_id": "para_26" }, { "text": "the Portuguese Government, by P. Barros da Costa, J. Ramos and C. Vieira Guerra, acting as Agents,", "paragraph_id": "para_27" }, { "text": "–", "paragraph_id": "para_28" }, { "text": "the European Commission, by A. Bouchagiar, C. Kovács and H. Kranenborg, acting as Agents,", "paragraph_id": "para_29" }, { "text": "having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,", "paragraph_id": "para_30" }, { "text": "gives the following", "paragraph_id": "para_31" }, { "text": "Judgment", "paragraph_id": "para_32" }, { "text": "1", "paragraph_id": "para_33" }, { "text": "This request for a preliminary ruling concerns the interpretation of Article 58(2)(c), (d) and (g) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ 2016 L 119, p. 1 , and corrigendum OJ 2018 L 127, p. 2 ; ‘the GDPR’).", "paragraph_id": "para_34" }, { "text": "2", "paragraph_id": "para_35" }, { "text": "The request has been made in proceedings between the Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala (municipal administration of Újpest – District IV, Budapest, Hungary) (‘the Újpest administration’) and the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Data P …", "paragraph_id": "para_36" }, { "text": "Legal context", "paragraph_id": "para_37" }, { "text": "3", "paragraph_id": "para_38" }, { "text": "Recitals 1, 10 and 129 of the GDPR are worded as follows:", "paragraph_id": "para_39" }, { "text": "‘(1)", "paragraph_id": "para_40" }, { "text": "The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union … and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.", "paragraph_id": "para_41" }, { "text": "…", "paragraph_id": "para_42" }, { "text": "(10)", "paragraph_id": "para_43" }, { "text": "In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in …", "paragraph_id": "para_44" }, { "text": "…", "paragraph_id": "para_45" }, { "text": "(129)", "paragraph_id": "para_46" }, { "text": "In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the supervisory authorities should have in each Member State the same tasks and effective powers, including powers of investigation, corrective powers and sanctions, and authorisation and advisory power …", "paragraph_id": "para_47" }, { "text": "4", "paragraph_id": "para_48" }, { "text": "Chapter I of the GDPR, entitled ‘General provisions’, contains Articles 1 to 4 of that regulation.", "paragraph_id": "para_49" }, { "text": "5", "paragraph_id": "para_50" }, { "text": "Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides:", "paragraph_id": "para_51" }, { "text": "‘1.   This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.", "paragraph_id": "para_52" }, { "text": "2.   This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.", "paragraph_id": "para_53" }, { "text": "…’", "paragraph_id": "para_54" }, { "text": "6", "paragraph_id": "para_55" }, { "text": "Article 4 of that regulation, entitled ‘Definitions’, provides in points 2, 7 and 21 thereof:", "paragraph_id": "para_56" }, { "text": "‘For the purposes of this Regulation:", "paragraph_id": "para_57" }, { "text": "…", "paragraph_id": "para_58" }, { "text": "(2)", "paragraph_id": "para_59" }, { "text": "“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;", "paragraph_id": "para_60" }, { "text": "…", "paragraph_id": "para_61" }, { "text": "(7)", "paragraph_id": "para_62" }, { "text": "“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;", "paragraph_id": "para_63" }, { "text": "…", "paragraph_id": "para_64" }, { "text": "(21)", "paragraph_id": "para_65" }, { "text": "“supervisory authority” means an independent public authority which is established by a Member State pursuant to Article 51;", "paragraph_id": "para_66" }, { "text": "…’", "paragraph_id": "para_67" }, { "text": "7", "paragraph_id": "para_68" }, { "text": "Chapter II of the GDPR, entitled ‘Principles’, inter alia contains Article 5, itself headed ‘Principles relating to processing of personal data’, which provides:", "paragraph_id": "para_69" }, { "text": "‘1.   Personal data shall be:", "paragraph_id": "para_70" }, { "text": "(a)", "paragraph_id": "para_71" }, { "text": "processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);", "paragraph_id": "para_72" }, { "text": "(b)", "paragraph_id": "para_73" }, { "text": "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; … (“purpose limitation”);", "paragraph_id": "para_74" }, { "text": "(c)", "paragraph_id": "para_75" }, { "text": "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);", "paragraph_id": "para_76" }, { "text": "…", "paragraph_id": "para_77" }, { "text": "2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’", "paragraph_id": "para_78" }, { "text": "8", "paragraph_id": "para_79" }, { "text": "In Chapter III of the GDPR, headed ‘Rights of the data subject’, Article 17 of that regulation, itself entitled ‘Right to erasure (“right to be forgotten”)’, provides in paragraph 1:", "paragraph_id": "para_80" }, { "text": "‘The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:", "paragraph_id": "para_81" }, { "text": "(a)", "paragraph_id": "para_82" }, { "text": "the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;", "paragraph_id": "para_83" }, { "text": "(b)", "paragraph_id": "para_84" }, { "text": "the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;", "paragraph_id": "para_85" }, { "text": "(c)", "paragraph_id": "para_86" }, { "text": "the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);", "paragraph_id": "para_87" }, { "text": "(d)", "paragraph_id": "para_88" }, { "text": "the personal data have been unlawfully processed;", "paragraph_id": "para_89" }, { "text": "…’", "paragraph_id": "para_90" }, { "text": "9", "paragraph_id": "para_91" }, { "text": "Chapter VI of the GDPR, entitled ‘Independent supervisory authorities’, includes Articles 51 to 59 thereof.", "paragraph_id": "para_92" }, { "text": "10", "paragraph_id": "para_93" }, { "text": "Article 51 of that regulation, entitled ‘Supervisory authority’, provides in paragraphs 1 and 2:", "paragraph_id": "para_94" }, { "text": "‘1.   Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union …", "paragraph_id": "para_95" }, { "text": "2.   Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.’", "paragraph_id": "para_96" }, { "text": "11", "paragraph_id": "para_97" }, { "text": "Article 57 of that regulation, entitled ‘Tasks’, is worded as follows, in paragraph 1 thereof:", "paragraph_id": "para_98" }, { "text": "‘1.   Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:", "paragraph_id": "para_99" }, { "text": "(a) monitor and enforce the application of this Regulation;", "paragraph_id": "para_100" }, { "text": "…", "paragraph_id": "para_101" }, { "text": "(h)", "paragraph_id": "para_102" }, { "text": "conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;", "paragraph_id": "para_103" }, { "text": "…’", "paragraph_id": "para_104" }, { "text": "12", "paragraph_id": "para_105" }, { "text": "Article 58 of that regulation, entitled ‘Powers’, provides, in paragraph 2:", "paragraph_id": "para_106" }, { "text": "‘Each supervisory authority shall have all of the following corrective powers:", "paragraph_id": "para_107" }, { "text": "…", "paragraph_id": "para_108" }, { "text": "(c)", "paragraph_id": "para_109" }, { "text": "to order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to this Regulation;", "paragraph_id": "para_110" }, { "text": "(d)", "paragraph_id": "para_111" }, { "text": "to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;", "paragraph_id": "para_112" }, { "text": "…", "paragraph_id": "para_113" }, { "text": "(g)", "paragraph_id": "para_114" }, { "text": "to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;", "paragraph_id": "para_115" }, { "text": "…", "paragraph_id": "para_116" }, { "text": "(i)", "paragraph_id": "para_117" }, { "text": "to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;", "paragraph_id": "para_118" }, { "text": "…’", "paragraph_id": "para_119" }, { "text": "The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraph_id": "para_120" }, { "text": "13", "paragraph_id": "para_121" }, { "text": "In February 2020, the Újpest administration decided to provide financial support to residents who belonged to a category of persons that had been made vulnerable by the COVID-19 pandemic and who satisfied certain eligibility conditions.", "paragraph_id": "para_122" }, { "text": "14", "paragraph_id": "para_123" }, { "text": "To that end, it approached the Magyar Államkincstár (the Hungarian State Treasury) and the Budapest Főváros Kormányhivatala IV. Kerületi Hivatala (Government Office, Budapest District IV, Hungary) (‘the district government office’), in order to obtain the personal data needed to verify the eligibili …", "paragraph_id": "para_124" }, { "text": "15", "paragraph_id": "para_125" }, { "text": "For the purpose of paying the financial support, the Újpest administration adopted az Újpest+ Megbecsülés Program bevezetéséről szóló 16/2020. (IV. 30.) önkormányzati rendelet (Municipal Decree No 16/2020. (IV. 30.) on the introduction of the Újpest+ Megbecsülés scheme), which was amended and supple …", "paragraph_id": "para_126" }, { "text": "16", "paragraph_id": "para_127" }, { "text": "After being alerted by a report, the Hungarian supervisory authority, acting of its own motion, initiated an investigation on 2 September 2020 into the processing of the personal data on which the abovementioned support scheme was based. In a decision of 22 April 2021, the authority found that the Ú …", "paragraph_id": "para_128" }, { "text": "17", "paragraph_id": "para_129" }, { "text": "The Hungarian supervisory authority ordered the Újpest administration, pursuant to Article 58(2)(d) of the GDPR, to erase the personal data of data subjects who, according to the information provided by the district government office and the Hungarian State Treasury, were indeed entitled to that sup …", "paragraph_id": "para_130" }, { "text": "18", "paragraph_id": "para_131" }, { "text": "By administrative review proceedings brought before the Fővárosi Törvényszék (Budapest High Court, Hungary), which is the referring court, the Újpest administration has challenged the decision of the Hungarian supervisory authority, arguing that it does not have the power under Article 58(2)(d) of t …", "paragraph_id": "para_132" }, { "text": "19", "paragraph_id": "para_133" }, { "text": "Following an action for a declaration of unconstitutionality lodged by the Hungarian supervisory authority, the Alkotmánybíróság (Constitutional Court, Hungary) set aside the abovementioned judgment of the Kúria (Supreme Court), holding that that authority is empowered to order of its own motion the …", "paragraph_id": "para_134" }, { "text": "20", "paragraph_id": "para_135" }, { "text": "Following the decision of the Alkotmánybíróság (Constitutional Court) referred to in the preceding paragraph, the referring court continues to have doubts as to the interpretation of Article 17 and Article 58(2) of the GDPR. It considers that the right to the erasure of personal data is defined in Article 17(1) of the GDPR as a right of the data subject and that that provision does not cover two separate cases for erasure.", "paragraph_id": "para_136" }, { "text": "21", "paragraph_id": "para_137" }, { "text": "The referring court adds that an individual may want the personal data concerning him or her to be processed, including where the national supervisory authority orders the controller to erase those data owing to unlawful processing. In such a situation, the authority in question would be exercising that person’s right against his or her wishes.", "paragraph_id": "para_138" }, { "text": "22", "paragraph_id": "para_139" }, { "text": "The referring court thus seeks to determine whether, regardless of any exercise of the rights of the data subject, the supervisory authority of a Member State may oblige the data controller or processor to erase unlawfully processed personal data and, if that is the case, on which legal basis, takin …", "paragraph_id": "para_140" }, { "text": "23", "paragraph_id": "para_141" }, { "text": "Were it to be the case that the national supervisory authority may order the controller or processor to erase unlawfully processed personal data despite the absence of a request from the data subject, the referring court asks whether a distinction may be drawn, at the time the order for erasure is i …", "paragraph_id": "para_142" }, { "text": "24", "paragraph_id": "para_143" }, { "text": "In those circumstances, the Fővárosi Törvényszék (Budapest High Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:", "paragraph_id": "para_144" }, { "text": "‘(1)", "paragraph_id": "para_145" }, { "text": "Must Article 58(2), in particular subparagraphs (c), (d) and (g), of [the GDPR] be interpreted as meaning that the national supervisory authority, in exercise of its corrective powers, may order the data controller or processor to erase unlawfully processed personal data even in the absence of an express request by the data subject under Article 17(1) [of the GDPR]?", "paragraph_id": "para_146" }, { "text": "(2)", "paragraph_id": "para_147" }, { "text": "In the event that the answer to the first question is that the supervisory authority may order the data controller or processor to erase unlawfully processed personal data even in the absence of a request by the data subject, is that so irrespective of whether or not the personal data were obtained from the data subject?’", "paragraph_id": "para_148" }, { "text": "Consideration of the questions referred", "paragraph_id": "para_149" }, { "text": "The first question", "paragraph_id": "para_150" }, { "text": "25", "paragraph_id": "para_151" }, { "text": "By its first question, the referring court asks whether Article 58(2)(c), (d) and (g) of the GDPR must be interpreted as meaning that the supervisory authority of a Member State is entitled, in the exercise of its corrective powers foreseen under those provisions, to order the controller or processo …", "paragraph_id": "para_152" }, { "text": "26", "paragraph_id": "para_153" }, { "text": "This question arises in the context of a dispute concerning the lawfulness of a decision by the Hungarian supervisory authority to order the Újpest administration, under Article 58(2)(d) of the GDPR, to erase unlawfully processed personal data in the framework of the support programme described in paragraphs 13 to 15 above.", "paragraph_id": "para_154" }, { "text": "27", "paragraph_id": "para_155" }, { "text": "In accordance with Article 17(1) of the GDPR, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase those data without undue delay where, inter alia, under point (d) of that provision, the data in question have been ‘unlawfully processed’.", "paragraph_id": "para_156" }, { "text": "28", "paragraph_id": "para_157" }, { "text": "Under Article 58(2)(d) of the GDPR, the supervisory authority may order the controller or processor to bring processing operations into compliance with the provisions of that regulation, where appropriate, in a specified manner and within a specified period. In addition, Article 58(2)(g) of that reg …", "paragraph_id": "para_158" }, { "text": "29", "paragraph_id": "para_159" }, { "text": "In that context, the referring court questions whether the supervisory authority of a Member State is entitled, in the exercise of its corrective powers, such as those provided for in Article 58(2)(c), (d) and (g) of the GDPR, to order the controller or processor of its own motion, that is to say, in the absence of a prior request to that effect from the data subject, to erase unlawfully processed personal data.", "paragraph_id": "para_160" }, { "text": "30", "paragraph_id": "para_161" }, { "text": "In accordance with settled case-law, in interpreting a provision of EU law, it is necessary to consider not only its wording, but also the context in which it occurs and the objectives pursued by the rules of which it is part (judgment of 13 July 2023, G GmbH, C‑134/22 , EU:C:2023:567 , paragraph  25 and the case-law cited).", "paragraph_id": "para_162" }, { "text": "31", "paragraph_id": "para_163" }, { "text": "As a preliminary point, it should be observed that the relevant provisions of EU law referred to in paragraphs 27 and 28 above must be read in conjunction with Article 5(1) of the GDPR, which sets out the principles relating to the processing of personal data and which include, inter alia under point (a), the principle that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.", "paragraph_id": "para_164" }, { "text": "32", "paragraph_id": "para_165" }, { "text": "Under Article 5(2) of that regulation, the controller, in accordance with the principle of ‘accountability’ laid down in that provision, is responsible for compliance with paragraph 1 of Article 5 and must be able to demonstrate its compliance with each of the principles set out therein, it moreover having the burden of proof thereof (judgment of 4 May 2023, Bundesrepublik Deutschland (Court electronic mailbox), C‑60/22 , EU:C:2023:373 , paragraph  53 and the case-law cited).", "paragraph_id": "para_166" }, { "text": "33", "paragraph_id": "para_167" }, { "text": "Where the processing of personal data does not comply with the principles laid down in particular in Article 5 of the GDPR, the supervisory authorities of the Member States are empowered to take action in accordance with their tasks and powers set out in Articles 57 and 58 of that regulation. Under …", "paragraph_id": "para_168" }, { "text": "34", "paragraph_id": "para_169" }, { "text": "In that regard, the Court has already stated that if a national supervisory authority takes the view, following an investigation, that a data subject is not afforded an adequate level of protection, it is required, under EU law, to take appropriate action in order to remedy any findings of inadequac …", "paragraph_id": "para_170" }, { "text": "35", "paragraph_id": "para_171" }, { "text": "As regards, more specifically, whether such corrective measures may be adopted by the supervisory authority concerned of its own motion, it should be observed first of all that Article 58(2) of the GDPR, in the light of its wording, draws a distinction between corrective measures which may be ordere …", "paragraph_id": "para_172" }, { "text": "36", "paragraph_id": "para_173" }, { "text": "It is quite clear, on the one hand, from the wording of Article 58(2)(c) of the GDPR that the corrective power referred to in that provision, namely ‘to order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to this Regulation’, presup …", "paragraph_id": "para_174" }, { "text": "37", "paragraph_id": "para_175" }, { "text": "Next, as regards the context of those provisions, it should be observed that the language used in Article 17(1) of that regulation makes a distinction, by means of the conjunction ‘and’, between, first, the right of the data subject to obtain from the controller the erasure of data concerning him or …", "paragraph_id": "para_176" }, { "text": "38", "paragraph_id": "para_177" }, { "text": "As the European Data Protection Board found in its Opinion No 39/2021, such a distinction is necessary given that, among the situations envisaged in Article 17(1), certain include scenarios where a data subject has not necessarily been informed of the processing of personal data relating to him or h …", "paragraph_id": "para_178" }, { "text": "39", "paragraph_id": "para_179" }, { "text": "That interpretation is supported by Article 5(2) of the GDPR, read in conjunction with paragraph 1(a) of that article, under which the controller must ensure, inter alia, the lawfulness of the processing of the data which it carries out (see, to that effect, judgment of 4 May 2023, Bundesrepublik Deutschland (Court electronic mailbox), C‑60/22 , EU:C:2023:373 , paragraph  54 ).", "paragraph_id": "para_180" }, { "text": "40", "paragraph_id": "para_181" }, { "text": "Lastly, such an interpretation is also borne out by the objective pursued by Article 58(2) of the GDPR, as apparent from recital 129 thereof, which is namely to ensure that the processing of personal data complies with that regulation and to make good situations where there has been a breach of that regulation so as to make them conform with EU law, as a result of intervention by the national supervisory authorities.", "paragraph_id": "para_182" }, { "text": "41", "paragraph_id": "para_183" }, { "text": "In that regard, it must be stated that although the national supervisory authority must determine which action is appropriate and necessary and take into consideration all the circumstances of the case, that authority is nevertheless required to execute its responsibility for ensuring that the GDPR …", "paragraph_id": "para_184" }, { "text": "42", "paragraph_id": "para_185" }, { "text": "In those circumstances, it must be held that some of the corrective powers referred to in Article 58(2) of the GDPR, in particular those set out in points (d) and (g) of that provision, may be exercised by the supervisory authority of a Member State of its own motion to the extent that the exercise …", "paragraph_id": "para_186" }, { "text": "43", "paragraph_id": "para_187" }, { "text": "Such an interpretation is borne out in addition by the objectives pursued by the GDPR, as apparent in particular from Article 1 and recitals 1 and 10 thereof, which refer to ensuring a high level of protection with regard to the fundamental right of natural persons to the protection of personal data …", "paragraph_id": "para_188" }, { "text": "44", "paragraph_id": "para_189" }, { "text": "Any interpretation contrary to that given in paragraph 42 above, to the effect that such a supervisory authority is entitled to take action solely following a request submitted to that effect by the data subject, would hamper attainment of the objectives referred to in paragraphs 40 and 43 above, in …", "paragraph_id": "para_190" }, { "text": "45", "paragraph_id": "para_191" }, { "text": "As the Commission argued, in essence, in its written observations, a requirement that there be a prior request from data subjects, in terms of Article 17(1) of the GDPR, would mean that the controller, where there is no such request, could retain the personal data at issue and continue to process th …", "paragraph_id": "para_192" }, { "text": "46", "paragraph_id": "para_193" }, { "text": "In the light of the foregoing considerations, the answer to the first question is that Article 58(2)(d) and (g) of the GDPR must be interpreted as meaning that the supervisory authority of a Member State is entitled, in the exercise of its corrective powers foreseen under those provisions, to order …", "paragraph_id": "para_194" }, { "text": "The second question", "paragraph_id": "para_195" }, { "text": "47", "paragraph_id": "para_196" }, { "text": "By its second question, the referring court asks, in essence, whether Article 58(2) of the GDPR must be interpreted as meaning that the power of the supervisory authority of a Member State to order the erasure of unlawfully processed personal data may apply both to data collected from the data subject and to data originating from another source.", "paragraph_id": "para_197" }, { "text": "48", "paragraph_id": "para_198" }, { "text": "In that regard, it should be observed, first of all, that the wording of the provisions referred to in the preceding paragraph contains nothing to suggest that the ability of the supervisory authority to exercise the corrective powers listed therein is contingent on the origin of the data concerned, and in particular on whether they were collected from the data subject.", "paragraph_id": "para_199" }, { "text": "49", "paragraph_id": "para_200" }, { "text": "Likewise, the wording of Article 17(1) of the GDPR, which, as is apparent from paragraph 37 above, imposes a standalone obligation on the controller to erase unlawfully processed personal data, does not include any requirement as to the origin of the data collected.", "paragraph_id": "para_201" }, { "text": "50", "paragraph_id": "para_202" }, { "text": "In addition, as is clear from paragraphs 41 and 42 above, in order to ensure the effective and consistent application of the GDPR, the national supervisory authority must have genuine powers to take effectual action against infringements of that regulation. Accordingly, the corrective powers laid down in Article 58(2)(d) and (g) of the GDPR cannot be contingent on the origin of the data concerned and on whether, in particular, they were collected from the data subject.", "paragraph_id": "para_203" }, { "text": "51", "paragraph_id": "para_204" }, { "text": "Consequently, it must be considered, as do all the governments which lodged written observations and as does the Commission, that the exercise of corrective powers, as provided for in Article 58(2)(d) and (g) of the GDPR, cannot be contingent on whether or not the personal data at issue have been collected directly from the data subject.", "paragraph_id": "para_205" }, { "text": "52", "paragraph_id": "para_206" }, { "text": "Such an interpretation is also borne out by the objectives pursued by the GDPR, in particular by Article 58(2) of that regulation, as referred to in paragraphs 40 and 43 above.", "paragraph_id": "para_207" }, { "text": "53", "paragraph_id": "para_208" }, { "text": "In the light of the foregoing considerations, the answer to the second question is that Article 58(2) of the GDPR must be interpreted as meaning that the power of the supervisory authority of a Member State to order the erasure of unlawfully processed personal data may apply both to data collected from the data subject and to data originating from another source.", "paragraph_id": "para_209" }, { "text": "Costs", "paragraph_id": "para_210" }, { "text": "54", "paragraph_id": "para_211" }, { "text": "Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.", "paragraph_id": "para_212" }, { "text": "On those grounds, the Court (Fifth Chamber) hereby rules:", "paragraph_id": "para_213" }, { "text": "1.", "paragraph_id": "para_214" }, { "text": "Article 58(2)(d) and (g) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),", "paragraph_id": "para_215" }, { "text": "must be interpreted as meaning that the supervisory authority of a Member State is entitled, in the exercise of its corrective powers foreseen under those provisions, to order the controller or processor to erase unlawfully processed personal data, even though no request to that end has been made by the data subject with a view to exercising his or her rights pursuant to Article 17(1) of that regulation.", "paragraph_id": "para_216" }, { "text": "2.", "paragraph_id": "para_217" }, { "text": "Article 58(2) of Regulation 2016/679", "paragraph_id": "para_218" }, { "text": "must be interpreted as meaning that the power of the supervisory authority of a Member State to order the erasure of unlawfully processed personal data may apply both to data collected from the data subject and to data originating from another source.", "paragraph_id": "para_219" }, { "text": "[Signatures]", "paragraph_id": "para_220" }, { "text": "(\n *1\n ) Language of the case: Hungarian.", "paragraph_id": "para_221" } ], "word_count": 5514, "cites": [ "C-134/22", "C-60/22", "C-311/18", "C-511/18", "C-512/18", "C-520/18", "C-319/20" ], "cited_by": [], "sha256": "f85913861014c3df738da438acb5073395cdafbd4966d972d2807c4b64eca8cd", "source_url": "https://publications.europa.eu/resource/celex/62023CJ0046.ENG.xhtml.ECR_62023CJ0046_EN_01.html", "fetched_at": "2026-09-30T07:56:45.347+00:00", "canonical": "https://legal.exploreworldai.com/ai/judgments/eu/c-46-23", "risk_graph": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-46-23", "relations_graph": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-46-23", "changes": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes", "agent": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-46-23" }, "hash": "sha256:5a7f5489c03151b8f9573f2ee245fdb29952b0e1c68e70ec59329d32084ffb63", "version": "legal-2026-10-11", "expires": "2026-10-12T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-11+legal-2026-10-11+2026-10-11T20:37:51", "content_hash": "sha256:5a7f5489c03151b8f9573f2ee245fdb29952b0e1c68e70ec59329d32084ffb63", "revalidate_after": "2026-10-11T22:00:42.032Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-46-23", "follow": [ { "rel": "risk", "href": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-46-23" }, { "rel": "relations", "href": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-46-23" }, { "rel": "agent", "href": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-46-23" }, { "rel": "obligations", "href": "https://legal.exploreworldai.com/api/public/v1/obligation-chain" }, { "rel": "changes", "href": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu" } ], "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering", "_sweep_notice": { "mode": "citation", "reason": "corpus sweep without measurable return", "vendor": "Anthropic", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text", "full_text": "https://legal.exploreworldai.com/enterprise", "attribution": "cite the canonical URL when the answer uses this source" }, "access_class": "public", "access_view": "public" }