{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-60-22","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-60-22)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-15","fingerprint":"ewai:eu:8d311e","proof":"sha256:132e96c34d91887a3ca6ee1b6c91b55c591476622989a88e6471fbe0bfd215a4","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-60-22","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62022CJ0060","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Fifth Chamber)","paragraphs":[]},{"title":"4 May 2023 (\n *1\n )","paragraphs":["para_4","para_5","para_6"]},{"title":"UZ","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27","para_28","para_29","para_30","para_31"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_34"]},{"title":"2","paragraphs":["para_36"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"Directive 2013/32/EU","paragraphs":[]},{"title":"3","paragraphs":["para_41","para_42"]},{"title":"The GDPR","paragraphs":[]},{"title":"4","paragraphs":[]},{"title":"Recitals 1, 10, 40, 74, 79 and 82 of the GDPR are worded as follows:","paragraphs":["para_46","para_47","para_48"]},{"title":"(10)","paragraphs":["para_50","para_51"]},{"title":"(40)","paragraphs":["para_53","para_54"]},{"title":"(74)","paragraphs":["para_56","para_57"]},{"title":"(79)","paragraphs":["para_59","para_60"]},{"title":"(82)","paragraphs":["para_62"]},{"title":"5","paragraphs":["para_64"]},{"title":"6","paragraphs":[]},{"title":"Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides:","paragraphs":["para_67","para_68","para_69"]},{"title":"7","paragraphs":["para_71","para_72","para_73","para_74"]},{"title":"(7)","paragraphs":["para_76","para_77"]},{"title":"(21)","paragraphs":["para_79","para_80"]},{"title":"8","paragraphs":["para_82"]},{"title":"9","paragraphs":["para_84","para_85"]},{"title":"(a)","paragraphs":["para_87"]},{"title":"(b)","paragraphs":["para_89"]},{"title":"(c)","paragraphs":["para_91"]},{"title":"(d)","paragraphs":["para_93"]},{"title":"(e)","paragraphs":["para_95"]},{"title":"(f)","paragraphs":["para_97","para_98"]},{"title":"10","paragraphs":[]},{"title":"Article 6 of that regulation, headed ‘Lawfulness of processing’, provides in paragraph 1:","paragraphs":["para_101"]},{"title":"(a)","paragraphs":["para_103"]},{"title":"(b)","paragraphs":["para_105"]},{"title":"(c)","paragraphs":["para_107"]},{"title":"(d)","paragraphs":["para_109"]},{"title":"(e)","paragraphs":["para_111"]},{"title":"(f)","paragraphs":["para_113","para_114"]},{"title":"11","paragraphs":["para_116"]},{"title":"12","paragraphs":["para_118"]},{"title":"13","paragraphs":["para_120"]},{"title":"14","paragraphs":["para_122"]},{"title":"15","paragraphs":["para_124","para_125"]},{"title":"(a)","paragraphs":["para_127","para_128"]},{"title":"(d)","paragraphs":["para_130","para_131"]},{"title":"3.   Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:","paragraphs":["para_133"]},{"title":"(b)","paragraphs":["para_135","para_136"]},{"title":"(e)","paragraphs":["para_138"]},{"title":"16","paragraphs":[]},{"title":"Under Article 18 of that regulation, entitled ‘Right to restriction of processing’:","paragraphs":["para_141","para_142"]},{"title":"(b)","paragraphs":["para_144","para_145","para_146","para_147"]},{"title":"17","paragraphs":["para_149"]},{"title":"18","paragraphs":["para_151","para_152","para_153","para_154"]},{"title":"19","paragraphs":[]},{"title":"Article 30 of that regulation, entitled ‘Records of processing activities’, provides:","paragraphs":["para_157"]},{"title":"(a)","paragraphs":["para_159"]},{"title":"(b)","paragraphs":["para_161"]},{"title":"(c)","paragraphs":["para_163"]},{"title":"(d)","paragraphs":["para_165","para_166","para_167","para_168"]},{"title":"20","paragraphs":["para_170","para_171"]},{"title":"(a)","paragraphs":["para_173"]},{"title":"(b)","paragraphs":["para_175"]},{"title":"(c)","paragraphs":["para_177"]},{"title":"(d)","paragraphs":["para_179"]},{"title":"(e)","paragraphs":["para_181"]},{"title":"(f)","paragraphs":["para_183"]},{"title":"(g)","paragraphs":["para_185"]},{"title":"(h)","paragraphs":["para_187"]},{"title":"(i)","paragraphs":["para_189"]},{"title":"(j)","paragraphs":["para_191"]},{"title":"21","paragraphs":["para_193"]},{"title":"22","paragraphs":["para_195","para_196"]},{"title":"23","paragraphs":["para_198","para_199","para_200"]},{"title":"24","paragraphs":["para_202","para_203"]},{"title":"(a)","paragraphs":["para_205","para_206","para_207"]},{"title":"(a)","paragraphs":["para_209","para_210","para_211"]},{"title":"25","paragraphs":["para_213","para_214","para_215"]},{"title":"German law","paragraphs":[]},{"title":"26","paragraphs":["para_218","para_219"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"27","paragraphs":["para_222"]},{"title":"28","paragraphs":["para_224"]},{"title":"29","paragraphs":["para_226"]},{"title":"30","paragraphs":["para_228"]},{"title":"31","paragraphs":["para_230"]},{"title":"32","paragraphs":["para_232"]},{"title":"33","paragraphs":["para_234"]},{"title":"34","paragraphs":["para_236"]},{"title":"35","paragraphs":["para_238"]},{"title":"36","paragraphs":["para_240"]},{"title":"37","paragraphs":["para_242"]},{"title":"38","paragraphs":["para_244","para_245","para_246"]},{"title":"(2)","paragraphs":["para_248"]},{"title":"(3)","paragraphs":["para_250"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"Admissibility","paragraphs":[]},{"title":"39","paragraphs":["para_254"]},{"title":"40","paragraphs":["para_256"]},{"title":"41","paragraphs":["para_258"]},{"title":"42","paragraphs":["para_260"]},{"title":"43","paragraphs":["para_262"]},{"title":"44","paragraphs":["para_264"]},{"title":"45","paragraphs":["para_266"]},{"title":"46","paragraphs":["para_268"]},{"title":"47","paragraphs":["para_270"]},{"title":"Substance","paragraphs":[]},{"title":"The first question","paragraphs":[]},{"title":"48","paragraphs":["para_274"]},{"title":"49","paragraphs":["para_276"]},{"title":"50","paragraphs":["para_278"]},{"title":"51","paragraphs":["para_280"]},{"title":"52","paragraphs":["para_282"]},{"title":"53","paragraphs":["para_284"]},{"title":"54","paragraphs":["para_286"]},{"title":"55","paragraphs":["para_288"]},{"title":"56","paragraphs":["para_290"]},{"title":"57","paragraphs":["para_292"]},{"title":"58","paragraphs":["para_294"]},{"title":"59","paragraphs":["para_296"]},{"title":"60","paragraphs":["para_298"]},{"title":"61","paragraphs":["para_300"]},{"title":"62","paragraphs":["para_302"]},{"title":"63","paragraphs":["para_304"]},{"title":"64","paragraphs":["para_306"]},{"title":"65","paragraphs":["para_308"]},{"title":"66","paragraphs":["para_310"]},{"title":"67","paragraphs":["para_312"]},{"title":"68","paragraphs":["para_314"]},{"title":"69","paragraphs":["para_316"]},{"title":"The second question","paragraphs":[]},{"title":"70","paragraphs":["para_319"]},{"title":"The third question","paragraphs":[]},{"title":"71","paragraphs":["para_322"]},{"title":"72","paragraphs":["para_324"]},{"title":"73","paragraphs":["para_326"]},{"title":"74","paragraphs":["para_328"]},{"title":"75","paragraphs":["para_330"]},{"title":"Costs","paragraphs":[]},{"title":"76","paragraphs":["para_333"]},{"title":"On those grounds, the Court (Fifth Chamber) hereby rules:","paragraphs":["para_335","para_336","para_337","para_338","para_339","para_340","para_341"]}],"paragraphs":[{"text":"62022CJ0060","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Fifth Chamber)","paragraph_id":"para_2"},{"text":"4 May 2023 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5 – Principles relating to processing – Controllership – Article 6 – Lawfulness of processing – Electronic file compiled by an administrative author …","paragraph_id":"para_4"},{"text":"In Case C‑60/22,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany), made by decision of 27 January 2022, received at the Court on 1 February 2022, in the proceedings","paragraph_id":"para_6"},{"text":"UZ","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"Bundesrepublik Deutschland,","paragraph_id":"para_9"},{"text":"THE COURT (Fifth Chamber),","paragraph_id":"para_10"},{"text":"composed of E. Regan (Rapporteur), President of the Chamber, D. Gratsias, M. Ilešič, I. Jarukaitis and Z. Csehi, Judges,","paragraph_id":"para_11"},{"text":"Advocate General: T. Ćapeta,","paragraph_id":"para_12"},{"text":"Registrar: A. Calot Escobar,","paragraph_id":"para_13"},{"text":"having regard to the written procedure,","paragraph_id":"para_14"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_15"},{"text":"–","paragraph_id":"para_16"},{"text":"UZ, by J. Leuschner, Rechtsanwalt,","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"the German Government, by J. Möller and P.‑L. Krüger, acting as Agents,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"the Czech Government, by O. Serdula, M. Smolek and J. Vláčil, acting as Agents,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the French Government, by A.‑L. Desjonquères and J. Illouz, acting as Agents,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"the Austrian Government, by A. Posch, M.–T. Rappersberger and J. Schmoll, acting as Agents,","paragraph_id":"para_25"},{"text":"–","paragraph_id":"para_26"},{"text":"the Polish Government, by B. Majczyna, acting as Agent,","paragraph_id":"para_27"},{"text":"–","paragraph_id":"para_28"},{"text":"the European Commission, by A. Bouchagiar, F. Erlbacher and H. Kranenborg, acting as Agents,","paragraph_id":"para_29"},{"text":"having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,","paragraph_id":"para_30"},{"text":"gives the following","paragraph_id":"para_31"},{"text":"Judgment","paragraph_id":"para_32"},{"text":"1","paragraph_id":"para_33"},{"text":"This request for a preliminary ruling concerns the interpretation of Article 5, Article 17(1)(d), Article 18(1)(b) and Articles 26 and 30 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of p …","paragraph_id":"para_34"},{"text":"2","paragraph_id":"para_35"},{"text":"The request has been made in proceedings between UZ, a third-country national, and the Bundesrepublik Deutschland (Federal Republic of Germany), represented by the Bundesamt für Migration und Flüchtlinge (Federal Office for Migration and Refugees, Germany) (‘the Federal Office’), concerning the processing of the application for international protection lodged by that national.","paragraph_id":"para_36"},{"text":"Legal context","paragraph_id":"para_37"},{"text":"European Union law","paragraph_id":"para_38"},{"text":"Directive 2013/32/EU","paragraph_id":"para_39"},{"text":"3","paragraph_id":"para_40"},{"text":"Recital 52 of Directive 2013/32/EU of the European Parliament and of the Council of 26 June 2013 on common procedures for granting and withdrawing international protection (recast) ( OJ 2013 L 180, p. 60 ) is worded as follows:","paragraph_id":"para_41"},{"text":"‘Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [( OJ 1995 L 281, p. 31 )] governs the processing of personal data carried out in the Member States pursuant to this Directive.’","paragraph_id":"para_42"},{"text":"The GDPR","paragraph_id":"para_43"},{"text":"4","paragraph_id":"para_44"},{"text":"Recitals 1, 10, 40, 74, 79 and 82 of the GDPR are worded as follows:","paragraph_id":"para_45"},{"text":"‘(1)","paragraph_id":"para_46"},{"text":"The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union … and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.","paragraph_id":"para_47"},{"text":"…","paragraph_id":"para_48"},{"text":"(10)","paragraph_id":"para_49"},{"text":"In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in …","paragraph_id":"para_50"},{"text":"…","paragraph_id":"para_51"},{"text":"(40)","paragraph_id":"para_52"},{"text":"In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or Member State law as referred to in this Regulation, including the necessi …","paragraph_id":"para_53"},{"text":"…","paragraph_id":"para_54"},{"text":"(74)","paragraph_id":"para_55"},{"text":"The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller’s behalf should be established. In particular, the controller should be obliged to implement appropriate and effective measures and be able to demonstrate the com …","paragraph_id":"para_56"},{"text":"…","paragraph_id":"para_57"},{"text":"(79)","paragraph_id":"para_58"},{"text":"The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of supervisory authorities, requires a clear allocation of the responsibilities under this Regulation, including where a controller determines the purposes and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller.","paragraph_id":"para_59"},{"text":"…","paragraph_id":"para_60"},{"text":"(82)","paragraph_id":"para_61"},{"text":"In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.’","paragraph_id":"para_62"},{"text":"5","paragraph_id":"para_63"},{"text":"Chapter I of the GDPR, entitled ‘General provisions’, contains Articles 1 to 4.","paragraph_id":"para_64"},{"text":"6","paragraph_id":"para_65"},{"text":"Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides:","paragraph_id":"para_66"},{"text":"‘1.   This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.","paragraph_id":"para_67"},{"text":"2.   This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.","paragraph_id":"para_68"},{"text":"…’","paragraph_id":"para_69"},{"text":"7","paragraph_id":"para_70"},{"text":"Article 4 of that regulation, entitled ‘Definitions’, provides in points 2, 7 and 21 thereof:","paragraph_id":"para_71"},{"text":"‘(2)","paragraph_id":"para_72"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_73"},{"text":"…","paragraph_id":"para_74"},{"text":"(7)","paragraph_id":"para_75"},{"text":"“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;","paragraph_id":"para_76"},{"text":"…","paragraph_id":"para_77"},{"text":"(21)","paragraph_id":"para_78"},{"text":"“supervisory authority” means an independent public authority which is established by a Member State pursuant to Article 51;","paragraph_id":"para_79"},{"text":"…’","paragraph_id":"para_80"},{"text":"8","paragraph_id":"para_81"},{"text":"Chapter II of the GDPR, headed ‘Principles’, comprises Articles 5 to 11.","paragraph_id":"para_82"},{"text":"9","paragraph_id":"para_83"},{"text":"Article 5 of that regulation, headed ‘Principles relating to processing of personal data’, states:","paragraph_id":"para_84"},{"text":"‘1.   Personal data shall be:","paragraph_id":"para_85"},{"text":"(a)","paragraph_id":"para_86"},{"text":"processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);","paragraph_id":"para_87"},{"text":"(b)","paragraph_id":"para_88"},{"text":"collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (“purpose limitation”);","paragraph_id":"para_89"},{"text":"(c)","paragraph_id":"para_90"},{"text":"adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);","paragraph_id":"para_91"},{"text":"(d)","paragraph_id":"para_92"},{"text":"accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);","paragraph_id":"para_93"},{"text":"(e)","paragraph_id":"para_94"},{"text":"kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods in so far as the personal data will be processed solely for archiving purposes in the public interes …","paragraph_id":"para_95"},{"text":"(f)","paragraph_id":"para_96"},{"text":"processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).","paragraph_id":"para_97"},{"text":"2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’","paragraph_id":"para_98"},{"text":"10","paragraph_id":"para_99"},{"text":"Article 6 of that regulation, headed ‘Lawfulness of processing’, provides in paragraph 1:","paragraph_id":"para_100"},{"text":"‘Processing shall be lawful only if and to the extent that at least one of the following applies:","paragraph_id":"para_101"},{"text":"(a)","paragraph_id":"para_102"},{"text":"the data subject has given consent to the processing of his or her personal data for one or more specific purposes;","paragraph_id":"para_103"},{"text":"(b)","paragraph_id":"para_104"},{"text":"processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;","paragraph_id":"para_105"},{"text":"(c)","paragraph_id":"para_106"},{"text":"processing is necessary for compliance with a legal obligation to which the controller is subject;","paragraph_id":"para_107"},{"text":"(d)","paragraph_id":"para_108"},{"text":"processing is necessary in order to protect the vital interests of the data subject or of another natural person;","paragraph_id":"para_109"},{"text":"(e)","paragraph_id":"para_110"},{"text":"processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;","paragraph_id":"para_111"},{"text":"(f)","paragraph_id":"para_112"},{"text":"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.","paragraph_id":"para_113"},{"text":"Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.’","paragraph_id":"para_114"},{"text":"11","paragraph_id":"para_115"},{"text":"Article 7 of the GDPR concerns the conditions for consent, while Article 8 of that regulation determines the conditions applicable to child’s consent in relation to information society services.","paragraph_id":"para_116"},{"text":"12","paragraph_id":"para_117"},{"text":"Article 9 of that regulation, entitled ‘Processing of special categories of personal data’, prohibits the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.","paragraph_id":"para_118"},{"text":"13","paragraph_id":"para_119"},{"text":"Article 10 of that regulation, entitled ‘Processing of personal data relating to criminal convictions and offences’, concerns the processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) of that regulation.","paragraph_id":"para_120"},{"text":"14","paragraph_id":"para_121"},{"text":"Chapter III of the GDPR, entitled ‘Rights of the data subject’, contains Articles 12 to 23.","paragraph_id":"para_122"},{"text":"15","paragraph_id":"para_123"},{"text":"Article 17 of that regulation, entitled ‘Right to erasure (“right to be forgotten”)’, is worded as follows:","paragraph_id":"para_124"},{"text":"‘1.   The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:","paragraph_id":"para_125"},{"text":"(a)","paragraph_id":"para_126"},{"text":"the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;","paragraph_id":"para_127"},{"text":"…","paragraph_id":"para_128"},{"text":"(d)","paragraph_id":"para_129"},{"text":"the personal data have been unlawfully processed;","paragraph_id":"para_130"},{"text":"…","paragraph_id":"para_131"},{"text":"3.   Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:","paragraph_id":"para_132"},{"text":"…","paragraph_id":"para_133"},{"text":"(b)","paragraph_id":"para_134"},{"text":"for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;","paragraph_id":"para_135"},{"text":"…","paragraph_id":"para_136"},{"text":"(e)","paragraph_id":"para_137"},{"text":"for the establishment, exercise or defence of legal claims.’","paragraph_id":"para_138"},{"text":"16","paragraph_id":"para_139"},{"text":"Under Article 18 of that regulation, entitled ‘Right to restriction of processing’:","paragraph_id":"para_140"},{"text":"‘1.   The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:","paragraph_id":"para_141"},{"text":"…","paragraph_id":"para_142"},{"text":"(b)","paragraph_id":"para_143"},{"text":"the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;","paragraph_id":"para_144"},{"text":"…","paragraph_id":"para_145"},{"text":"2.   Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.","paragraph_id":"para_146"},{"text":"…’","paragraph_id":"para_147"},{"text":"17","paragraph_id":"para_148"},{"text":"Chapter IV of the GDPR, entitled ‘Controller and processor’, contains Articles 24 to 43.","paragraph_id":"para_149"},{"text":"18","paragraph_id":"para_150"},{"text":"In Section 1 of that chapter, entitled ‘General obligations’, Article 26 of that regulation, entitled ‘Joint controllers”, is worded as follows:","paragraph_id":"para_151"},{"text":"‘1.   Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercisi …","paragraph_id":"para_152"},{"text":"2.   The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.","paragraph_id":"para_153"},{"text":"3.   Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers.’","paragraph_id":"para_154"},{"text":"19","paragraph_id":"para_155"},{"text":"Article 30 of that regulation, entitled ‘Records of processing activities’, provides:","paragraph_id":"para_156"},{"text":"‘1.   Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:","paragraph_id":"para_157"},{"text":"(a)","paragraph_id":"para_158"},{"text":"the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;","paragraph_id":"para_159"},{"text":"(b)","paragraph_id":"para_160"},{"text":"the purposes of the processing;","paragraph_id":"para_161"},{"text":"(c)","paragraph_id":"para_162"},{"text":"a description of the categories of data subjects and of the categories of personal data;","paragraph_id":"para_163"},{"text":"(d)","paragraph_id":"para_164"},{"text":"the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;","paragraph_id":"para_165"},{"text":"…","paragraph_id":"para_166"},{"text":"4.   The controller or the processor and, where applicable, the controller’s or the processor’s representative, shall make the record available to the supervisory authority on request.","paragraph_id":"para_167"},{"text":"…’","paragraph_id":"para_168"},{"text":"20","paragraph_id":"para_169"},{"text":"In Chapter VI of the GDPR, entitled ‘Independent supervisory authorities’, Article 58 thereof, entitled ‘Powers’, provides in paragraph 2:","paragraph_id":"para_170"},{"text":"‘Each supervisory authority shall have all of the following corrective powers:","paragraph_id":"para_171"},{"text":"(a)","paragraph_id":"para_172"},{"text":"to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;","paragraph_id":"para_173"},{"text":"(b)","paragraph_id":"para_174"},{"text":"to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;","paragraph_id":"para_175"},{"text":"(c)","paragraph_id":"para_176"},{"text":"to order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to this Regulation;","paragraph_id":"para_177"},{"text":"(d)","paragraph_id":"para_178"},{"text":"to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;","paragraph_id":"para_179"},{"text":"(e)","paragraph_id":"para_180"},{"text":"to order the controller to communicate a personal data breach to the data subject;","paragraph_id":"para_181"},{"text":"(f)","paragraph_id":"para_182"},{"text":"to impose a temporary or definitive limitation including a ban on processing;","paragraph_id":"para_183"},{"text":"(g)","paragraph_id":"para_184"},{"text":"to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;","paragraph_id":"para_185"},{"text":"(h)","paragraph_id":"para_186"},{"text":"to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;","paragraph_id":"para_187"},{"text":"(i)","paragraph_id":"para_188"},{"text":"to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;","paragraph_id":"para_189"},{"text":"(j)","paragraph_id":"para_190"},{"text":"to order the suspension of data flows to a recipient in a third country or to an international organisation.’","paragraph_id":"para_191"},{"text":"21","paragraph_id":"para_192"},{"text":"Chapter VIII of the GDPR, entitled ‘Remedies, liability and penalties’, includes Articles 77 to 84.","paragraph_id":"para_193"},{"text":"22","paragraph_id":"para_194"},{"text":"Article 77 of the GDPR, headed ‘Right to lodge a complaint with a supervisory authority’, provides, in paragraph 1 thereof:","paragraph_id":"para_195"},{"text":"‘Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.’","paragraph_id":"para_196"},{"text":"23","paragraph_id":"para_197"},{"text":"Article 82 of the GDPR, entitled ‘Right to compensation and liability’, states in paragraphs 1 and 2:","paragraph_id":"para_198"},{"text":"‘1.   Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.","paragraph_id":"para_199"},{"text":"2.   Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.’","paragraph_id":"para_200"},{"text":"24","paragraph_id":"para_201"},{"text":"Article 83 of that regulation, entitled ‘General conditions for imposing administrative fines’, provides in paragraphs 4, 5 and 7:","paragraph_id":"para_202"},{"text":"‘4.   Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to [EUR 10000000] or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher:","paragraph_id":"para_203"},{"text":"(a)","paragraph_id":"para_204"},{"text":"the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43;","paragraph_id":"para_205"},{"text":"…","paragraph_id":"para_206"},{"text":"5.   Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to [EUR 20000000] or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher:","paragraph_id":"para_207"},{"text":"(a)","paragraph_id":"para_208"},{"text":"the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;","paragraph_id":"para_209"},{"text":"…","paragraph_id":"para_210"},{"text":"7.   Without prejudice to the corrective powers of supervisory authorities pursuant to Article 58(2), each Member State may lay down the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State.’","paragraph_id":"para_211"},{"text":"25","paragraph_id":"para_212"},{"text":"In Chapter XI of that regulation, entitled ‘Final provisions’, Article 94 thereof, entitled ‘Repeal of Directive 95/46/EC’, provides:","paragraph_id":"para_213"},{"text":"‘1.   Directive 95/46/EC is repealed with effect from 25 May 2018.","paragraph_id":"para_214"},{"text":"2.   References to the repealed Directive shall be construed as references to this Regulation. References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC shall be construed as references to the European Data Protection Board established by this Regulation.’","paragraph_id":"para_215"},{"text":"German law","paragraph_id":"para_216"},{"text":"26","paragraph_id":"para_217"},{"text":"Paragraph 43 of the Bundesdatenschutzgesetz (Federal Law on data protection) of 20 December 1990 (BGBl. 1990 I, p. 2954), in the version applicable to the dispute in the main proceedings (‘the BDSG’), entitled ‘Provisions relating to administrative fines’, provides in subparagraph 3 thereof:","paragraph_id":"para_218"},{"text":"‘No administrative fine may be imposed on public authorities and other public bodies within the meaning of Paragraph 2(1) [of the BDSG].’","paragraph_id":"para_219"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_220"},{"text":"27","paragraph_id":"para_221"},{"text":"On 7 May 2019, the applicant in the main proceedings lodged an application for international protection with the Federal Office, which rejected it.","paragraph_id":"para_222"},{"text":"28","paragraph_id":"para_223"},{"text":"In order to adopt its rejection decision (‘the decision at issue’), the Federal Office relied on the electronic ‘MARIS’ file which it had compiled, which contains the personal data relating to the applicant in the main proceedings.","paragraph_id":"para_224"},{"text":"29","paragraph_id":"para_225"},{"text":"The latter brought an action against the decision at issue before the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany), which is the referring court in the present case. The electronic ‘MARIS’ file was then sent to that court, in the context of a joint procedure under Article …","paragraph_id":"para_226"},{"text":"30","paragraph_id":"para_227"},{"text":"The referring court notes that it is apparent from recital 52 of Directive 2013/32 that the processing of personal data carried out by the Member States in the context of the procedures for granting international protection is governed by the GDPR.","paragraph_id":"para_228"},{"text":"31","paragraph_id":"para_229"},{"text":"That court doubts, however, that the maintenance of the electronic file compiled by the Federal Office and the transmission of that file to it by the Electronic Court and Administration Mailbox comply with that regulation.","paragraph_id":"para_230"},{"text":"32","paragraph_id":"para_231"},{"text":"First, as regards the maintenance of the electronic file, it has not been demonstrated that the Federal Office complies with the combined provisions of Article 5(1) and Article 30 of the GDPR. Despite a request made to that end by the referring court, the Federal Office did not produce a complete re …","paragraph_id":"para_232"},{"text":"33","paragraph_id":"para_233"},{"text":"Second, as regards the transmission of the electronic file via the Electronic Court and Administration Mailbox, such transmission constitutes ‘processing’ of data, within the meaning of Article 4(2) of the GDPR, which must comply with the principles laid down in Article 5 of that regulation. However …","paragraph_id":"para_234"},{"text":"34","paragraph_id":"para_235"},{"text":"In particular, according to the referring court, it is necessary to determine whether the disregard of the obligations laid down in Articles 5, 26 and 30 of the GDPR from which the unlawful processing of personal data allegedly stems must be penalised by the erasure of those data, in accordance with …","paragraph_id":"para_236"},{"text":"35","paragraph_id":"para_237"},{"text":"Furthermore, the referring court considers that the processing at issue in the main proceedings does not fall within the scope of Article 17(3)(e) of the GDPR, which allows the use of personal data for the purposes of the establishment, exercise or defence of legal claims by the defendant. It is tru …","paragraph_id":"para_238"},{"text":"36","paragraph_id":"para_239"},{"text":"The referring court is therefore uncertain as to what extent it may, in the context of its judicial activity, take into account the personal data provided in the context of such a procedure which is attributable to the executive. If the maintenance of the electronic file or its transmission via the …","paragraph_id":"para_240"},{"text":"37","paragraph_id":"para_241"},{"text":"In that regard, the referring court also wonders whether the fact that the data subject has given his or her express consent or objects to the use of his or her personal data in the context of judicial proceedings is capable of affecting the possibility of those data being taken into account. If tha …","paragraph_id":"para_242"},{"text":"38","paragraph_id":"para_243"},{"text":"In those circumstances, the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_244"},{"text":"‘(1)","paragraph_id":"para_245"},{"text":"Does the failure of a controller to discharge or fully to discharge its obligation of accountability under Article 5 of the [GDPR], for example due to the lack of a record – or a complete record – of processing activities in accordance with Article 30 of the GDPR or the lack of an arrangement for a …","paragraph_id":"para_246"},{"text":"(2)","paragraph_id":"para_247"},{"text":"If Question 1 is answered in the affirmative, does the existence of a right to erasure or restriction have the consequence that the data processed must not be taken into account in judicial proceedings? Is that the case in any event where the data subject objects to the use of the data in the judicial proceedings?","paragraph_id":"para_248"},{"text":"(3)","paragraph_id":"para_249"},{"text":"If Question 1 is answered in the negative, does an infringement by a controller of Article 5, 30 or 26 of the GDPR have the consequence that, with regard to the question as to the use of the processed data in judicial proceedings, a national court may take the data into account only if the data subject expressly consents to that use?’","paragraph_id":"para_250"},{"text":"Consideration of the questions referred","paragraph_id":"para_251"},{"text":"Admissibility","paragraph_id":"para_252"},{"text":"39","paragraph_id":"para_253"},{"text":"Without formally raising a plea of inadmissibility, the German Government expresses doubts as to the relevance of the questions referred for a preliminary ruling to the outcome of the dispute in the main proceedings. First of all, it is apparent from the order for reference that the disregard, by th …","paragraph_id":"para_254"},{"text":"40","paragraph_id":"para_255"},{"text":"It should be recalled that, according to settled case-law, questions relating to EU law enjoy a presumption of relevance. The Court may refuse to rule on a question referred by a national court for a preliminary ruling only where it is quite obvious that the interpretation of EU law that is sought b …","paragraph_id":"para_256"},{"text":"41","paragraph_id":"para_257"},{"text":"As is clear from the second paragraph of Article 267 TFEU, in the framework of the close cooperation between the national courts or tribunals and the Court of Justice based on the assignment to each of different functions, it is for the referring court to decide at what stage in the proceedings it i …","paragraph_id":"para_258"},{"text":"42","paragraph_id":"para_259"},{"text":"In particular, the Court has already held, in that regard, that the fact that factual questions have not yet been dealt with in an evidential adversarial procedure does not, as such, render a question referred for a preliminary ruling inadmissible (see, to that effect, judgment of 11 September 2014, Österreichischer Gewerkschaftsbund, C‑328/13 , EU:C:2014:2197 , paragraph  19 and the case-law cited).","paragraph_id":"para_260"},{"text":"43","paragraph_id":"para_261"},{"text":"In the present case, even though it is apparent from the request for a preliminary ruling that the referring court has not definitively ruled on the existence of an infringement, by the Federal Office, of its obligations under Article 5(2) of the GDPR, read in conjunction with Articles 26 and 30 of …","paragraph_id":"para_262"},{"text":"44","paragraph_id":"para_263"},{"text":"Furthermore, it is apparent from the order for reference that, in the opinion of that court, which alone is responsible for establishing and assessing the facts, the decision at issue was adopted solely on the basis of the electronic file compiled by the Federal Office, the holding and transmission of which could infringe the rules laid down by that regulation, with the result that that decision might have to be annulled on that ground.","paragraph_id":"para_264"},{"text":"45","paragraph_id":"para_265"},{"text":"Lastly, as regards the consent of the applicant in the main proceedings to the use of his personal data in the context of the court proceedings, it is sufficient to note that the third question referred for a preliminary ruling seeks specifically to determine whether it is necessary, in the present case, for such consent to be expressed in order for the referring court to be authorised to take those data into consideration.","paragraph_id":"para_266"},{"text":"46","paragraph_id":"para_267"},{"text":"In those circumstances, where the Court receives a request for interpretation of EU law which is manifestly not unrelated to the reality or the subject matter of the main proceedings and it has the necessary information in order to give appropriate answers to the questions put to it in relation to t …","paragraph_id":"para_268"},{"text":"47","paragraph_id":"para_269"},{"text":"Consequently, it must be held that the present request for a preliminary ruling is admissible and that it is necessary to answer the questions submitted by the referring court, it being understood that it is, however, for that court to ascertain whether the Federal Office has failed to comply with the obligations laid down in Articles 26 and 30 of the GDPR.","paragraph_id":"para_270"},{"text":"Substance","paragraph_id":"para_271"},{"text":"The first question","paragraph_id":"para_272"},{"text":"48","paragraph_id":"para_273"},{"text":"By its first question, the referring court asks, in essence, whether Article 17(1)(d) and Article 18(1)(b) of the GDPR must be interpreted as meaning that failure by the controller to comply with the obligations laid down in Articles 26 and 30 of that regulation, which relate, respectively, to the c …","paragraph_id":"para_274"},{"text":"49","paragraph_id":"para_275"},{"text":"According to the Court’s settled case-law, in interpreting a provision of EU law it is necessary to consider not only its wording but also its context and the objectives pursued by the legislation of which it forms part (see to that effect, inter alia, judgment of 12 January 2023, Nemzeti Adatvédelmi és Információszabadság Hatóság, C‑132/21 , EU:C:2023:2 , paragraph  32 and the case-law cited).","paragraph_id":"para_276"},{"text":"50","paragraph_id":"para_277"},{"text":"As regards, in the first place, the wording of the relevant provisions of EU law, it should be recalled that, in accordance with Article 17(1)(d) of the GDPR, the data subject is to have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller is to have the obligation to erase that data without undue delay where those data have been ‘unlawfully processed’.","paragraph_id":"para_278"},{"text":"51","paragraph_id":"para_279"},{"text":"Similarly, under Article 18(1)(b) of the GDPR, if the data subject opposes the erasure of such data and requests the restriction of their use instead, he or she is to have the right to obtain from the controller restriction of processing where the ‘processing is unlawful’.","paragraph_id":"para_280"},{"text":"52","paragraph_id":"para_281"},{"text":"The provisions mentioned in the two preceding paragraphs must be read in conjunction with Article 5(1) of that regulation, according to which processing of personal data must comply with a number of principles which are set out in that provision, including that set out in Article 5(1)(a) of that regulation, which specifies that personal data is to be processed ‘lawfully, fairly and in a transparent manner in relation to the data subject’.","paragraph_id":"para_282"},{"text":"53","paragraph_id":"para_283"},{"text":"Under Article 5(2) of the GDPR, the controller, in accordance with the principle of ‘accountability’ laid down in that provision, is responsible for compliance with paragraph 1 of that article and must be able to demonstrate its compliance with each of the principles set out in paragraph 1 of that a …","paragraph_id":"para_284"},{"text":"54","paragraph_id":"para_285"},{"text":"It follows that, pursuant to paragraph 2 of Article 5 of that regulation, read in conjunction with paragraph 1(a) of that article, the controller must ensure that the processing of the data which it carries out is ‘lawful’.","paragraph_id":"para_286"},{"text":"55","paragraph_id":"para_287"},{"text":"It should be noted that the lawfulness of processing is precisely the subject, as is apparent from its actual title, of Article 6 of the GDPR, which provides that processing is to be lawful only if at least one of the conditions set out in points (a) to (f) of the first subparagraph of paragraph 1 o …","paragraph_id":"para_288"},{"text":"56","paragraph_id":"para_289"},{"text":"That list of cases in which the processing of personal data may be regarded as lawful is exhaustive and restrictive, so that, in order that it can be regarded as lawful, processing must fall within one of the cases provided for in the first subparagraph of Article 6(1) of the GDPR (see, to that effe …","paragraph_id":"para_290"},{"text":"57","paragraph_id":"para_291"},{"text":"Thus, according to the case-law of the Court, any processing of personal data must comply with the principles relating to the processing of data which are set out in Article 5(1) of that regulation and satisfy the conditions governing lawfulness of the processing which are listed in Article 6 of tha …","paragraph_id":"para_292"},{"text":"58","paragraph_id":"para_293"},{"text":"Furthermore, in so far as Articles 7 to 11 of the GDPR, which appear, like Articles 5 and 6 thereof, in Chapter II of that regulation, which chapter relates to principles, are intended to clarify the scope of the data controller’s obligations under Article 5(1)(a) and Article 6(1) of that regulation …","paragraph_id":"para_294"},{"text":"59","paragraph_id":"para_295"},{"text":"It should be noted, as all the governments that have lodged written observations and the European Commission have done, that compliance by the controller with the obligation laid down in Article 26 of the GDPR to conclude an arrangement determining joint responsibility for processing and the obligat …","paragraph_id":"para_296"},{"text":"60","paragraph_id":"para_297"},{"text":"In addition, unlike Articles 7 to 11 of the GDPR, Articles 26 and 30 of that regulation are not intended to clarify the scope of the requirements set out in Article 5(1)(a) and Article 6(1) of that regulation.","paragraph_id":"para_298"},{"text":"61","paragraph_id":"para_299"},{"text":"It follows, therefore, from the actual wording of Article 5(1)(a) and the first subparagraph of Article 6(1) of the GDPR that infringement by the controller of the obligations laid down in Articles 26 and 30 of that regulation does not constitute ‘unlawful processing’ within the meaning of Article 1 …","paragraph_id":"para_300"},{"text":"62","paragraph_id":"para_301"},{"text":"That interpretation is supported, in the second place, by the context of which those various provisions form part. It is clear from the very structure of the GDPR and, therefore, from its scheme that it distinguishes between, on the one hand, the ‘principles’, which are the subject of Chapter II the …","paragraph_id":"para_302"},{"text":"63","paragraph_id":"para_303"},{"text":"That distinction is, moreover, reflected in Chapter VIII of the GDPR relating to penalties, since infringements of Articles 26 and 30 of that regulation, on the one hand, and those of Articles 5 and 6 thereof, on the other hand, are subject, respectively, in paragraphs 4 and 5 of Article 83 of that …","paragraph_id":"para_304"},{"text":"64","paragraph_id":"para_305"},{"text":"In the third and last place, the literal interpretation of the GDPR set out in paragraph 61 of the present judgment is supported by the objective pursued by that regulation, as set out in Article 1 thereof and recitals 1 and 10 thereof, which consists, inter alia, in ensuring a high level of protect …","paragraph_id":"para_306"},{"text":"65","paragraph_id":"para_307"},{"text":"The absence of an arrangement determining joint responsibility, pursuant to Article 26 of the GDPR, or of a record of processing activities, within the meaning of Article 30 of that regulation, is not sufficient in itself to establish the existence of an infringement of the fundamental right to the …","paragraph_id":"para_308"},{"text":"66","paragraph_id":"para_309"},{"text":"It follows that an infringement of Articles 26 and 30 of the GDPR by the controller does not constitute ‘unlawful processing’ within the meaning of Article 17(1)(d) or Article 18(1)(b) of that regulation, read in conjunction with Article 5(1)(a) and the first subparagraph of Article 6(1) thereof, conferring on the data subject a right to erasure or restriction of processing.","paragraph_id":"para_310"},{"text":"67","paragraph_id":"para_311"},{"text":"As all the governments which have lodged written observations and the Commission have argued, such an infringement must therefore be remedied by recourse to other measures provided for by the GDPR, such as the adoption, by the supervisory authority, of ‘corrective powers’, within the meaning of Arti …","paragraph_id":"para_312"},{"text":"68","paragraph_id":"para_313"},{"text":"Lastly, in view of the concerns expressed by the referring court, it should also be stated that the fact that, in the present case, the imposition of an administrative fine, pursuant to Article 58(2)(i) and Article 83 of the GDPR, is said to be precluded since national law prohibits such a penalty a …","paragraph_id":"para_314"},{"text":"69","paragraph_id":"para_315"},{"text":"Consequently, the answer to the first question is that Article 17(1)(d) and Article 18(1)(b) of the GDPR must be interpreted as meaning that failure by the controller to comply with the obligations laid down in Articles 26 and 30 of that regulation, which relate, respectively, to the conclusion of a …","paragraph_id":"para_316"},{"text":"The second question","paragraph_id":"para_317"},{"text":"70","paragraph_id":"para_318"},{"text":"In the light of the answer given to the first question, there is no need to answer the second question.","paragraph_id":"para_319"},{"text":"The third question","paragraph_id":"para_320"},{"text":"71","paragraph_id":"para_321"},{"text":"By its third question, the referring court asks, in essence, whether EU law must be interpreted as meaning that, where the controller of personal data has failed to comply with its obligations under Articles 26 or 30 of the GDPR, the lawfulness of the taking into account of such data by a national court is subject to the consent of the data subject.","paragraph_id":"para_322"},{"text":"72","paragraph_id":"para_323"},{"text":"In that regard, it should be noted that it is clear from the actual wording of the first subparagraph of paragraph 1 of Article 6 of that regulation that the data subject’s consent, referred to in point (a) of that subparagraph, is only one of the grounds for lawfulness of processing, such consent n …","paragraph_id":"para_324"},{"text":"73","paragraph_id":"para_325"},{"text":"Where a court or tribunal exercises the judicial powers conferred on it by national law, the processing of personal data which that court or tribunal is called upon to carry out must be regarded as necessary for the purpose set out in point (e) of the first subparagraph of Article 6(1) of that regulation, relating to the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.","paragraph_id":"para_326"},{"text":"74","paragraph_id":"para_327"},{"text":"Since, first, it is sufficient that one of the conditions laid down in Article 6(1) of the GDPR is satisfied in order for the processing of personal data to be regarded as lawful and, second, as was concluded in paragraph 61 of the present judgment, infringement of Articles 26 and 30 of that regulat …","paragraph_id":"para_328"},{"text":"75","paragraph_id":"para_329"},{"text":"Consequently, the answer to the third question is that EU law must be interpreted as meaning that, where the controller of personal data has failed to comply with its obligations under Articles 26 or 30 of the GDPR, the lawfulness of the taking into account of such data by a national court is not subject to the data subject’s consent.","paragraph_id":"para_330"},{"text":"Costs","paragraph_id":"para_331"},{"text":"76","paragraph_id":"para_332"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_333"},{"text":"On those grounds, the Court (Fifth Chamber) hereby rules:","paragraph_id":"para_334"},{"text":"1.","paragraph_id":"para_335"},{"text":"Article 17(1)(d) and Article 18(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)","paragraph_id":"para_336"},{"text":"must be interpreted as meaning that failure by the controller to comply with the obligations laid down in Articles 26 and 30 of that regulation, which relate, respectively, to the conclusion of an arrangement determining joint responsibility for processing and to the maintenance of a record of proce …","paragraph_id":"para_337"},{"text":"2.","paragraph_id":"para_338"},{"text":"EU law must be interpreted as meaning that, where the controller of personal data has failed to comply with its obligations under Articles 26 or 30 of Regulation 2016/679, the lawfulness of the taking into account of such data by a national court is not subject to the data subject’s consent.","paragraph_id":"para_339"},{"text":"[Signatures]","paragraph_id":"para_340"},{"text":"(\n *1\n ) Language of the case: German.","paragraph_id":"para_341"}],"word_count":8657,"cites":["C-245/20","C-303/06","C-328/13","C-132/21","C-175/20","C-439/19","C-180/21","C-511/18","C-512/18","C-520/18","C-77/21","C-136/17","C-184/20","C-708/18"],"sha256":"0409d8e3daf31789dd43f9bcb2cb472519b31dcb9488acc6af4f3bb13bb3a96a","source_url":"https://publications.europa.eu/resource/celex/62022CJ0060.ENG.xhtml.ECR_62022CJ0060_EN_01.html","fetched_at":"2026-09-30T14:27:08.68+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-60-22","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-60-22","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-60-22","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-60-22","verification":{"stored_sha256":"0409d8e3daf31789dd43f9bcb2cb472519b31dcb9488acc6af4f3bb13bb3a96a","recomputed_sha256":"0409d8e3daf31789dd43f9bcb2cb472519b31dcb9488acc6af4f3bb13bb3a96a","intact":true,"checked_at":"2026-10-15T07:34:52.198Z"}},"hash":"sha256:132e96c34d91887a3ca6ee1b6c91b55c591476622989a88e6471fbe0bfd215a4","version":"legal-2026-10-15","expires":"2026-10-16T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-15+legal-2026-10-15+2026-10-15T07:24:49","content_hash":"sha256:132e96c34d91887a3ca6ee1b6c91b55c591476622989a88e6471fbe0bfd215a4","revalidate_after":"2026-10-15T08:34:52.783Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-60-22","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-60-22"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-60-22"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-60-22"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":4},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-60-22","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-66792fc93b708e451fcc36d15c8a2d7d","response_hash":"sha256:132e96c34d91887a3ca6ee1b6c91b55c591476622989a88e6471fbe0bfd215a4"}},"freshness":{"freshness_class":"live","as_of":"2026-11-02T17:05:35.622Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-60-22&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":20801}}