{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-645-19","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-645-19)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-14","fingerprint":"ewai:eu:f8b9a4","proof":"sha256:423da4e90f52843a0d395b6a5dbb885c7ce8adf4b1a543aff1a8ee5c1dfe543c","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-645-19","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62019CJ0645","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Grand Chamber)","paragraphs":[]},{"title":"15 June 2021 (\n *1\n )","paragraphs":["para_4","para_5","para_6","para_7","para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27","para_28","para_29","para_30","para_31","para_32","para_33","para_34","para_35","para_36","para_37"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_40"]},{"title":"2","paragraphs":["para_42"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"3","paragraphs":[]},{"title":"Recitals 1, 4, 10, 11, 13, 22, 123, 141 and 145 of Regulation 2016/679 state:","paragraphs":["para_47","para_48","para_49"]},{"title":"(4)","paragraphs":["para_51","para_52"]},{"title":"(10)","paragraphs":["para_54"]},{"title":"(11)","paragraphs":["para_56","para_57"]},{"title":"(13)","paragraphs":["para_59","para_60"]},{"title":"(22)","paragraphs":["para_62","para_63"]},{"title":"(123)","paragraphs":["para_65","para_66"]},{"title":"(141)","paragraphs":["para_68","para_69"]},{"title":"(145)","paragraphs":["para_71"]},{"title":"4","paragraphs":[]},{"title":"Article 3(1) of that regulation, that article being headed ‘Territorial scope’, provides:","paragraphs":["para_74"]},{"title":"5","paragraphs":["para_76","para_77"]},{"title":"(a)","paragraphs":["para_79"]},{"title":"(b)","paragraphs":["para_81","para_82"]},{"title":"(23) “cross-border processing” means either:","paragraphs":[]},{"title":"(a)","paragraphs":["para_85"]},{"title":"(b)","paragraphs":["para_87"]},{"title":"6","paragraphs":[]},{"title":"Article 51 of that regulation, headed ‘Supervisory authority’, provides:","paragraphs":["para_90","para_91","para_92"]},{"title":"7","paragraphs":["para_94","para_95","para_96"]},{"title":"8","paragraphs":["para_98","para_99","para_100","para_101","para_102","para_103","para_104"]},{"title":"9","paragraphs":[]},{"title":"Article 57(1) of Regulation 2016/679, that article being headed ‘Tasks’, provides:","paragraphs":["para_107"]},{"title":"(a)","paragraphs":["para_109","para_110"]},{"title":"(g)","paragraphs":["para_112","para_113"]},{"title":"10","paragraphs":["para_115","para_116"]},{"title":"(a)","paragraphs":["para_118","para_119"]},{"title":"(d)","paragraphs":["para_121","para_122","para_123","para_124"]},{"title":"11","paragraphs":["para_126","para_127","para_128","para_129","para_130","para_131","para_132","para_133","para_134","para_135","para_136","para_137","para_138"]},{"title":"12","paragraphs":[]},{"title":"Article 61(1) of that regulation, that article being headed ‘Mutual assistance’, states:","paragraphs":["para_141"]},{"title":"13","paragraphs":["para_143","para_144","para_145","para_146"]},{"title":"14","paragraphs":["para_148","para_149"]},{"title":"15","paragraphs":[]},{"title":"Article 64(2) of that regulation is worded as follows:","paragraphs":["para_152"]},{"title":"16","paragraphs":["para_154","para_155"]},{"title":"(a)","paragraphs":["para_157"]},{"title":"(b)","paragraphs":["para_159","para_160"]},{"title":"17","paragraphs":["para_162","para_163","para_164"]},{"title":"18","paragraphs":["para_166","para_167","para_168"]},{"title":"19","paragraphs":["para_170","para_171","para_172","para_173","para_174"]},{"title":"20","paragraphs":["para_176","para_177","para_178"]},{"title":"National law","paragraphs":[]},{"title":"21","paragraphs":["para_181"]},{"title":"22","paragraphs":["para_183"]},{"title":"23","paragraphs":[]},{"title":"Article 32(3) of the Law of 8 December 1992 provided:","paragraphs":["para_186"]},{"title":"24","paragraphs":["para_188"]},{"title":"25","paragraphs":[]},{"title":"Article 3 of the Law of 3 December 2017 provides:","paragraphs":["para_191"]},{"title":"26","paragraphs":[]},{"title":"Article 6 of the Law of 3 December 2017 provides:","paragraphs":["para_194"]},{"title":"27","paragraphs":["para_196","para_197"]},{"title":"28","paragraphs":["para_199"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"29","paragraphs":["para_202"]},{"title":"30","paragraphs":["para_204"]},{"title":"31","paragraphs":["para_206"]},{"title":"32","paragraphs":["para_208"]},{"title":"33","paragraphs":["para_210"]},{"title":"34","paragraphs":["para_212"]},{"title":"35","paragraphs":["para_214"]},{"title":"36","paragraphs":["para_216"]},{"title":"37","paragraphs":["para_218"]},{"title":"38","paragraphs":["para_220"]},{"title":"39","paragraphs":["para_222"]},{"title":"40","paragraphs":["para_224"]},{"title":"41","paragraphs":["para_226"]},{"title":"42","paragraphs":["para_228","para_229","para_230"]},{"title":"(2)","paragraphs":["para_232"]},{"title":"(3)","paragraphs":["para_234"]},{"title":"(4)","paragraphs":["para_236"]},{"title":"(5)","paragraphs":["para_238"]},{"title":"(6)","paragraphs":["para_240"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"The first question","paragraphs":[]},{"title":"43","paragraphs":["para_244"]},{"title":"44","paragraphs":["para_246"]},{"title":"45","paragraphs":["para_248"]},{"title":"46","paragraphs":["para_250"]},{"title":"47","paragraphs":["para_252"]},{"title":"48","paragraphs":["para_254"]},{"title":"49","paragraphs":["para_256"]},{"title":"50","paragraphs":["para_258"]},{"title":"51","paragraphs":["para_260"]},{"title":"52","paragraphs":["para_262"]},{"title":"53","paragraphs":["para_264"]},{"title":"54","paragraphs":["para_266"]},{"title":"55","paragraphs":["para_268"]},{"title":"56","paragraphs":["para_270"]},{"title":"57","paragraphs":["para_272"]},{"title":"58","paragraphs":["para_274"]},{"title":"59","paragraphs":["para_276"]},{"title":"60","paragraphs":["para_278"]},{"title":"61","paragraphs":["para_280"]},{"title":"62","paragraphs":["para_282"]},{"title":"63","paragraphs":["para_284"]},{"title":"64","paragraphs":["para_286"]},{"title":"65","paragraphs":["para_288"]},{"title":"66","paragraphs":["para_290"]},{"title":"67","paragraphs":["para_292"]},{"title":"68","paragraphs":["para_294"]},{"title":"69","paragraphs":["para_296"]},{"title":"70","paragraphs":["para_298"]},{"title":"71","paragraphs":["para_300"]},{"title":"72","paragraphs":["para_302"]},{"title":"73","paragraphs":["para_304"]},{"title":"74","paragraphs":["para_306"]},{"title":"75","paragraphs":["para_308"]},{"title":"The second question","paragraphs":[]},{"title":"76","paragraphs":["para_311"]},{"title":"77","paragraphs":["para_313"]},{"title":"78","paragraphs":["para_315"]},{"title":"79","paragraphs":["para_317"]},{"title":"80","paragraphs":["para_319"]},{"title":"81","paragraphs":["para_321"]},{"title":"82","paragraphs":["para_323"]},{"title":"83","paragraphs":["para_325"]},{"title":"84","paragraphs":["para_327"]},{"title":"The third question","paragraphs":[]},{"title":"85","paragraphs":["para_330"]},{"title":"86","paragraphs":["para_332"]},{"title":"87","paragraphs":["para_334"]},{"title":"88","paragraphs":["para_336"]},{"title":"89","paragraphs":["para_338"]},{"title":"90","paragraphs":["para_340"]},{"title":"91","paragraphs":["para_342"]},{"title":"92","paragraphs":["para_344"]},{"title":"93","paragraphs":["para_346"]},{"title":"94","paragraphs":["para_348"]},{"title":"95","paragraphs":["para_350"]},{"title":"96","paragraphs":["para_352"]},{"title":"The fourth question","paragraphs":[]},{"title":"97","paragraphs":["para_355"]},{"title":"98","paragraphs":["para_357"]},{"title":"99","paragraphs":["para_359"]},{"title":"100","paragraphs":["para_361"]},{"title":"101","paragraphs":["para_363"]},{"title":"102","paragraphs":["para_365"]},{"title":"103","paragraphs":["para_367"]},{"title":"104","paragraphs":["para_369"]},{"title":"105","paragraphs":["para_371"]},{"title":"The fifth question","paragraphs":[]},{"title":"106","paragraphs":["para_374"]},{"title":"107","paragraphs":["para_376"]},{"title":"108","paragraphs":["para_378"]},{"title":"109","paragraphs":["para_380"]},{"title":"110","paragraphs":["para_382"]},{"title":"111","paragraphs":["para_384"]},{"title":"112","paragraphs":["para_386"]},{"title":"113","paragraphs":["para_388"]},{"title":"The sixth question","paragraphs":[]},{"title":"114","paragraphs":["para_391"]},{"title":"115","paragraphs":["para_393"]},{"title":"116","paragraphs":["para_395"]},{"title":"117","paragraphs":["para_397"]},{"title":"118","paragraphs":["para_399"]},{"title":"Costs","paragraphs":[]},{"title":"119","paragraphs":["para_402"]},{"title":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraphs":["para_404","para_405","para_406","para_407","para_408","para_409","para_410","para_411","para_412","para_413","para_414","para_415"]}],"paragraphs":[{"text":"62019CJ0645","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Grand Chamber)","paragraph_id":"para_2"},{"text":"15 June 2021 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 47 – Regulation (EU) 2016/679 – Cross-border processing of personal data – ‘One-stop shop’ mechanism – Sincere and effective cooperation between supervisory authorities – Competences and powers – Power to initiate or engage in legal proceedings)","paragraph_id":"para_4"},{"text":"In Case C‑645/19,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the hof van beroep te Brussel (Court of Appeal, Brussels, Belgium,), made by decision of 8 May 2019, received at the Court on 30 August 2019, in the proceedings","paragraph_id":"para_6"},{"text":"Facebook Ireland Ltd,","paragraph_id":"para_7"},{"text":"Facebook Inc.,","paragraph_id":"para_8"},{"text":"Facebook Belgium BVBA,","paragraph_id":"para_9"},{"text":"v","paragraph_id":"para_10"},{"text":"Gegevensbeschermingsautoriteit,","paragraph_id":"para_11"},{"text":"THE COURT (Grand Chamber),","paragraph_id":"para_12"},{"text":"composed of K. Lenaerts, President, R. Silva de Lapuerta, Vice‑President, A. Arabadjiev, A. Prechal, M. Vilaras, M. Ilešič and N. Wahl, Presidents of Chambers, E. Juhász, D. Šváby, S. Rodin, F. Biltgen, K. Jürimäe, C. Lycourgos, P.G. Xuereb and L.S. Rossi (Rapporteur), Judges,","paragraph_id":"para_13"},{"text":"Advocate General: M. Bobek,","paragraph_id":"para_14"},{"text":"Registrar: M. Ferreira, Principal Administrator,","paragraph_id":"para_15"},{"text":"having regard to the written procedure and further to the hearing on 5 October 2020,","paragraph_id":"para_16"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"Facebook Ireland Ltd, Facebook Inc. and Facebook Belgium BVBA, by S. Raes, P. Lefebvre and D. Van Liedekerke, advocaten,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"the Gegevensbeschermingsautoriteit, by F. Debusseré and R. Roex, advocaten,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the Belgian Government, by J.‑C. Halleux, P. Cottin, and C. Pochet, acting as Agents, and by P. Paepe, advocaat,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"the Czech Government, by M. Smolek, O. Serdula and J. Vláčil, acting as Agents,","paragraph_id":"para_25"},{"text":"–","paragraph_id":"para_26"},{"text":"the Italian Government, by G. Palmieri, acting as Agent, and by G. Natale, avvocato dello Stato,","paragraph_id":"para_27"},{"text":"–","paragraph_id":"para_28"},{"text":"the Polish Government, by B. Majczyna, acting as Agent,","paragraph_id":"para_29"},{"text":"–","paragraph_id":"para_30"},{"text":"the Portuguese Government, by L. Inez Fernandes, A.C. Guerra, P. Barros da Costa and L. Medeiros, acting as Agents,","paragraph_id":"para_31"},{"text":"–","paragraph_id":"para_32"},{"text":"the Finnish Government, by A. Laine and M. Pere, acting as Agents,","paragraph_id":"para_33"},{"text":"–","paragraph_id":"para_34"},{"text":"the European Commission, by H. Kranenborg, D. Nardi and P.J.O. Van Nuffel, acting as Agents,","paragraph_id":"para_35"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 13 January 2021,","paragraph_id":"para_36"},{"text":"gives the following","paragraph_id":"para_37"},{"text":"Judgment","paragraph_id":"para_38"},{"text":"1","paragraph_id":"para_39"},{"text":"This request for a preliminary ruling concerns the interpretation of Article 55(1), Articles 56 to 58 and Articles 60 to 66 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data a …","paragraph_id":"para_40"},{"text":"2","paragraph_id":"para_41"},{"text":"The request has been made in proceedings between Facebook Ireland Ltd, Facebook Inc. and Facebook Belgium BVBA, on the one hand, and the Gegevensbeschermingsautoriteit (the Belgian Data Protection Authority) (‘the DPA’), as the successor of the Commissie ter bescherming van de Persoonlijke Levenssfe …","paragraph_id":"para_42"},{"text":"Legal context","paragraph_id":"para_43"},{"text":"European Union law","paragraph_id":"para_44"},{"text":"3","paragraph_id":"para_45"},{"text":"Recitals 1, 4, 10, 11, 13, 22, 123, 141 and 145 of Regulation 2016/679 state:","paragraph_id":"para_46"},{"text":"‘(1)","paragraph_id":"para_47"},{"text":"The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the [Charter] and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.","paragraph_id":"para_48"},{"text":"…","paragraph_id":"para_49"},{"text":"(4)","paragraph_id":"para_50"},{"text":"The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionali …","paragraph_id":"para_51"},{"text":"…","paragraph_id":"para_52"},{"text":"(10)","paragraph_id":"para_53"},{"text":"In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in …","paragraph_id":"para_54"},{"text":"(11)","paragraph_id":"para_55"},{"text":"Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States.","paragraph_id":"para_56"},{"text":"…","paragraph_id":"para_57"},{"text":"(13)","paragraph_id":"para_58"},{"text":"In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a Regulation is necessary to provide legal certainty and transparency for economic operators, including mic …","paragraph_id":"para_59"},{"text":"…","paragraph_id":"para_60"},{"text":"(22)","paragraph_id":"para_61"},{"text":"Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and …","paragraph_id":"para_62"},{"text":"…","paragraph_id":"para_63"},{"text":"(123)","paragraph_id":"para_64"},{"text":"The supervisory authorities should monitor the application of the provisions pursuant to this Regulation and contribute to its consistent application throughout the Union, in order to protect natural persons in relation to the processing of their personal data and to facilitate the free flow of pers …","paragraph_id":"para_65"},{"text":"…","paragraph_id":"para_66"},{"text":"(141)","paragraph_id":"para_67"},{"text":"Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or …","paragraph_id":"para_68"},{"text":"…","paragraph_id":"para_69"},{"text":"(145)","paragraph_id":"para_70"},{"text":"For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority of a Member State acting in the exercise of its public powers.’","paragraph_id":"para_71"},{"text":"4","paragraph_id":"para_72"},{"text":"Article 3(1) of that regulation, that article being headed ‘Territorial scope’, provides:","paragraph_id":"para_73"},{"text":"‘This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.’","paragraph_id":"para_74"},{"text":"5","paragraph_id":"para_75"},{"text":"Article 4 of that regulation defines, in point (16), the concept of ‘main establishment’ and, in point (23), the concept of ‘cross-border processing’ as follows:","paragraph_id":"para_76"},{"text":"‘(16) “main establishment” means:","paragraph_id":"para_77"},{"text":"(a)","paragraph_id":"para_78"},{"text":"as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment;","paragraph_id":"para_79"},{"text":"(b)","paragraph_id":"para_80"},{"text":"as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;","paragraph_id":"para_81"},{"text":"…","paragraph_id":"para_82"},{"text":"(23) “cross-border processing” means either:","paragraph_id":"para_83"},{"text":"(a)","paragraph_id":"para_84"},{"text":"processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or","paragraph_id":"para_85"},{"text":"(b)","paragraph_id":"para_86"},{"text":"processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.’","paragraph_id":"para_87"},{"text":"6","paragraph_id":"para_88"},{"text":"Article 51 of that regulation, headed ‘Supervisory authority’, provides:","paragraph_id":"para_89"},{"text":"‘1.   Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union …","paragraph_id":"para_90"},{"text":"2.   Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.","paragraph_id":"para_91"},{"text":"…’","paragraph_id":"para_92"},{"text":"7","paragraph_id":"para_93"},{"text":"Article 55 of Regulation 2016/679, headed ‘Competence’, which forms part of Chapter VI of that regulation, entitled ‘Independent supervisory authorities’, provides:","paragraph_id":"para_94"},{"text":"‘1.   Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.","paragraph_id":"para_95"},{"text":"2.   Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply.’","paragraph_id":"para_96"},{"text":"8","paragraph_id":"para_97"},{"text":"Article 56 of that regulation, headed ‘Competence of the lead supervisory authority’, states:","paragraph_id":"para_98"},{"text":"‘1.   Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.","paragraph_id":"para_99"},{"text":"2.   By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.","paragraph_id":"para_100"},{"text":"3.   In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in …","paragraph_id":"para_101"},{"text":"4.   Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3).","paragraph_id":"para_102"},{"text":"5.   Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62.","paragraph_id":"para_103"},{"text":"6.   The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.’","paragraph_id":"para_104"},{"text":"9","paragraph_id":"para_105"},{"text":"Article 57(1) of Regulation 2016/679, that article being headed ‘Tasks’, provides:","paragraph_id":"para_106"},{"text":"‘1. Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:","paragraph_id":"para_107"},{"text":"(a)","paragraph_id":"para_108"},{"text":"monitor and enforce the application of this Regulation;","paragraph_id":"para_109"},{"text":"…","paragraph_id":"para_110"},{"text":"(g)","paragraph_id":"para_111"},{"text":"cooperate with, including sharing information, and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;","paragraph_id":"para_112"},{"text":"…’","paragraph_id":"para_113"},{"text":"10","paragraph_id":"para_114"},{"text":"Article 58(1), (4) and (5) of that regulation, that article being headed ‘Powers’, provide:","paragraph_id":"para_115"},{"text":"‘1.   Each supervisory authority shall have all of the following investigative powers:","paragraph_id":"para_116"},{"text":"(a)","paragraph_id":"para_117"},{"text":"to order the controller and the processor, and, where applicable, the controller’s or the processor’s representative to provide any information it requires for the performance of its tasks;","paragraph_id":"para_118"},{"text":"…","paragraph_id":"para_119"},{"text":"(d)","paragraph_id":"para_120"},{"text":"to notify the controller or the processor of an alleged infringement of this Regulation;","paragraph_id":"para_121"},{"text":"…","paragraph_id":"para_122"},{"text":"4.   The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in [EU law] and Member State law in accordance with the Charter.","paragraph_id":"para_123"},{"text":"5.   Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to initiate or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.’","paragraph_id":"para_124"},{"text":"11","paragraph_id":"para_125"},{"text":"Within Chapter VII of Regulation 2016/679, entitled ‘Cooperation and consistency’, Section I, entitled ‘Cooperation’, contains Articles 60 to 62 of that regulation. Article 60, headed ‘Cooperation between the lead supervisory authority and the other supervisory authorities concerned’, provides:","paragraph_id":"para_126"},{"text":"‘1.   The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other.","paragraph_id":"para_127"},{"text":"2.   The lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State.","paragraph_id":"para_128"},{"text":"3.   The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views.","paragraph_id":"para_129"},{"text":"4.   Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63.","paragraph_id":"para_130"},{"text":"5.   Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision shall be subject to the procedure referred to in paragraph 4 within a period of two weeks.","paragraph_id":"para_131"},{"text":"6.   Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to be in agreement with that draft decision and shall be bound by it.","paragraph_id":"para_132"},{"text":"7.   The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be, and inform the other supervisory authorities concerned and the [European Data Protection] Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.","paragraph_id":"para_133"},{"text":"8.   By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof.","paragraph_id":"para_134"},{"text":"9.   Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. …","paragraph_id":"para_135"},{"text":"10.   After being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union. Th …","paragraph_id":"para_136"},{"text":"11.   Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply.","paragraph_id":"para_137"},{"text":"…’","paragraph_id":"para_138"},{"text":"12","paragraph_id":"para_139"},{"text":"Article 61(1) of that regulation, that article being headed ‘Mutual assistance’, states:","paragraph_id":"para_140"},{"text":"‘Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.’","paragraph_id":"para_141"},{"text":"13","paragraph_id":"para_142"},{"text":"Article 62 of that regulation, headed ‘Joint operations of supervisory authorities’, provides:","paragraph_id":"para_143"},{"text":"‘1.   The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved.","paragraph_id":"para_144"},{"text":"2.   Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. …","paragraph_id":"para_145"},{"text":"…’","paragraph_id":"para_146"},{"text":"14","paragraph_id":"para_147"},{"text":"Section 2, entitled ‘Consistency’, of Chapter VII of Regulation 2016/679 contains Articles 63 to 67 of that regulation. Article 63, headed ‘Consistency mechanism’, is worded as follows:","paragraph_id":"para_148"},{"text":"‘In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section.’","paragraph_id":"para_149"},{"text":"15","paragraph_id":"para_150"},{"text":"Article 64(2) of that regulation is worded as follows:","paragraph_id":"para_151"},{"text":"‘Any supervisory authority, the Chair of the [European Data Protection] Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the [European Data Protection] Board with a view to obtaining an opinion, in particular …","paragraph_id":"para_152"},{"text":"16","paragraph_id":"para_153"},{"text":"Article 65(1) of that regulation, that article being headed ‘Dispute resolution by the Board’, provides:","paragraph_id":"para_154"},{"text":"‘In order to ensure the correct and consistent application of this Regulation in individual cases, the [European Data Protection] Board shall adopt a binding decision in the following cases:","paragraph_id":"para_155"},{"text":"(a)","paragraph_id":"para_156"},{"text":"where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead supervisory authority and the lead supervisory authority has not followed the objection or has rejected such an objection as being not relevan …","paragraph_id":"para_157"},{"text":"(b)","paragraph_id":"para_158"},{"text":"where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;","paragraph_id":"para_159"},{"text":"…’","paragraph_id":"para_160"},{"text":"17","paragraph_id":"para_161"},{"text":"Article 66(1) and (2) of Regulation 2016/679, that article being headed ‘Urgency procedure’, provide:","paragraph_id":"para_162"},{"text":"‘1.   In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65 or the procedure r …","paragraph_id":"para_163"},{"text":"2.   Where a supervisory authority has taken a measure pursuant to paragraph 1 and considers that final measures need urgently be adopted, it may request an urgent opinion or an urgent binding decision from the [European Data Protection] Board, giving reasons for requesting such opinion or decision.’","paragraph_id":"para_164"},{"text":"18","paragraph_id":"para_165"},{"text":"Article 77 of that regulation, headed ‘Right to lodge a complaint with a supervisory authority’, states:","paragraph_id":"para_166"},{"text":"‘1.   Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.","paragraph_id":"para_167"},{"text":"2.   The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.’","paragraph_id":"para_168"},{"text":"19","paragraph_id":"para_169"},{"text":"Article 78 of that regulation, headed ‘Right to an effective judicial remedy against a supervisory authority’, provides:","paragraph_id":"para_170"},{"text":"‘1.   Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.","paragraph_id":"para_171"},{"text":"2.   Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.","paragraph_id":"para_172"},{"text":"3.   Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.","paragraph_id":"para_173"},{"text":"4.   Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the [European Data Protection] Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.’","paragraph_id":"para_174"},{"text":"20","paragraph_id":"para_175"},{"text":"Article 79 of that regulation, headed ‘Right to an effective judicial remedy against a controller or processor’, states:","paragraph_id":"para_176"},{"text":"‘1.   Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.","paragraph_id":"para_177"},{"text":"2.   Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.’","paragraph_id":"para_178"},{"text":"National law","paragraph_id":"para_179"},{"text":"21","paragraph_id":"para_180"},{"text":"The wet tot bescherming van de persoonlijke levensfeer ten opzichte van de verwerking van persoonsgegevens (law on the protection of privacy with regard to the processing of personal data) of 8 December 1992 ( Belgisch Staatsblad , 18 March 1993, p. 5801), as amended by the law of 11 December 1998 ( …","paragraph_id":"para_181"},{"text":"22","paragraph_id":"para_182"},{"text":"The law of 8 December 1992 established the Privacy Commission, an independent body responsible for ensuring that the processing of personal data should comply with that law, in order to protect citizens’ privacy.","paragraph_id":"para_183"},{"text":"23","paragraph_id":"para_184"},{"text":"Article 32(3) of the Law of 8 December 1992 provided:","paragraph_id":"para_185"},{"text":"‘Without prejudice to the jurisdiction of the ordinary courts and tribunals for the application of the general principles relating to the protection of privacy, the President of the [Privacy Commission] may bring before the court of first instance any dispute concerning the application of this legislation and its implementing measures.’","paragraph_id":"para_186"},{"text":"24","paragraph_id":"para_187"},{"text":"The wet tot oprichting van de Gegevensbeschermingsautoriteit (law creating a data protection authority) of 3 December 2017 ( Belgisch Staatsblad , 10 January 2018, p. 989; ‘the law of 3 December 2017’), which entered into force on 25 May 2018, established the DPA as a supervisory authority, within the meaning of Regulation 2016/679.","paragraph_id":"para_188"},{"text":"25","paragraph_id":"para_189"},{"text":"Article 3 of the Law of 3 December 2017 provides:","paragraph_id":"para_190"},{"text":"‘There shall be established at the Belgian Chamber of Representatives a “Data Protection Authority”. It shall succeed the [Privacy Commission].’","paragraph_id":"para_191"},{"text":"26","paragraph_id":"para_192"},{"text":"Article 6 of the Law of 3 December 2017 provides:","paragraph_id":"para_193"},{"text":"‘The [DPA] has the power to bring any infringement of the fundamental principles of personal data protection, within the framework of this law and laws containing provisions on the protection of the processing of personal data, to the attention of the judicial authorities and, where appropriate, to initiate or engage in legal proceedings to have these fundamental principles applied.’","paragraph_id":"para_194"},{"text":"27","paragraph_id":"para_195"},{"text":"There is no specific provision in relation to court proceedings already commenced by the President of the Privacy Commission as at 25 May 2018 on the basis of Article 32(3) of the law of 8 December 1992. As regards solely complaints or applications lodged with the DPA itself, Article 112 of the law of 3 December 2017 states:","paragraph_id":"para_196"},{"text":"‘Chapter VI shall not apply to complaints or applications still pending at the [DPA] at the time when this legislation enters into force. The complaints or applications mentioned in subparagraph 1 shall be dealt with by the [DPA], as the legal successor of the [Privacy Commission], in accordance with the procedure applicable before the entry into force of this legislation.’","paragraph_id":"para_197"},{"text":"28","paragraph_id":"para_198"},{"text":"The law of 8 December 1992 was repealed by the wet betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens (law on the protection of individuals with regard to the processing of personal data) of 30 July 2018 ( Belgisch Staatsblad , 5 September 2018, …","paragraph_id":"para_199"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_200"},{"text":"29","paragraph_id":"para_201"},{"text":"On 11 September 2015 the President of the Privacy Commission brought legal proceedings seeking an injunction against Facebook Ireland, Facebook Inc. and Facebook Belgium before the Nederlandstalige rechtbank van eerste aanleg Brussel (Dutch-language Court of First Instance, Brussels, Belgium). Since …","paragraph_id":"para_202"},{"text":"30","paragraph_id":"para_203"},{"text":"The object of those injunction proceedings was to bring to an end what the Privacy Commission describes, inter alia, as a ‘serious and large‑scale infringement, by Facebook, of the legislation relating to the protection of privacy’ consisting in the collection by that online social network of inform …","paragraph_id":"para_204"},{"text":"31","paragraph_id":"para_205"},{"text":"By judgment of 16 February 2018, the Nederlandstalige rechtbank van eerste aanleg Brussel (Dutch-language Court of First Instance, Brussels) held that it had jurisdiction to give a ruling on those injunction proceedings, in so far as the action concerned Facebook Ireland, Facebook Inc. and Facebook Belgium, and declared that the application for leave to intervene made by the Privacy Commission was inadmissible.","paragraph_id":"para_206"},{"text":"32","paragraph_id":"para_207"},{"text":"On the substance, that court held that Facebook was not adequately informing Belgian internet users of the collection of the information concerned and of the use of that information. Further, the consent given by the internet users to the collection and processing of that data was held to be invalid …","paragraph_id":"para_208"},{"text":"33","paragraph_id":"para_209"},{"text":"On 2 March 2018 Facebook Ireland, Facebook Inc. and Facebook Belgium brought an appeal against that judgment before the hof van beroep te Brussel (Court of Appeal, Brussels, Belgium). Before that court, the DPA acts as the legal successor both of the President of the Privacy Commission, who had brought the injunction proceedings, and of the Privacy Commission itself.","paragraph_id":"para_210"},{"text":"34","paragraph_id":"para_211"},{"text":"The referring court held that it has jurisdiction solely to give a ruling on the appeal brought in so far as that appeal concerns Facebook Belgium. Conversely, the referring court held that it lacked jurisdiction to hear that appeal in relation to Facebook Ireland and Facebook Inc.","paragraph_id":"para_212"},{"text":"35","paragraph_id":"para_213"},{"text":"Before giving a ruling on the substance of the main proceedings, a question raised by the referring court is whether the DPA had the required standing and interest to bring proceedings. In the view of Facebook Belgium, the action brought seeking an injunction is inadmissible, in so far as it concern …","paragraph_id":"para_214"},{"text":"36","paragraph_id":"para_215"},{"text":"The referring court has held that the DPA had not demonstrated the required standing to bring the injunction proceedings in so far as those proceedings related to facts prior to 25 May 2018. As regards the facts subsequent to that date, the referring court is however uncertain as to the effect of th …","paragraph_id":"para_216"},{"text":"37","paragraph_id":"para_217"},{"text":"In particular, in the view of the referring court, the question that now arises is whether, with respect to the facts subsequent to 25 May 2018, the DPA may bring an action against Facebook Belgium, since Facebook Ireland has been identified as the controller of the data concerned. Since that date a …","paragraph_id":"para_218"},{"text":"38","paragraph_id":"para_219"},{"text":"The referring court recalls that, in the judgment of 5 June 2018, Wirtschaftsakademie Schleswig-Holstein ( C‑210/16 , EU:C:2018:388 ), the Court held that the ‘German supervisory authority’ was competent in respect of data processing where the controller of the data concerned was established in Irel …","paragraph_id":"para_220"},{"text":"39","paragraph_id":"para_221"},{"text":"However, in the case that gave rise to that judgment, the Court was required to give a ruling on a request for a preliminary ruling concerning the interpretation of the provisions of Directive 95/46, which has been repealed by Regulation 2016/679. The referring court is uncertain to what extent the Court’s interpretation in that judgment is still of relevance to the application of Regulation 2016/679.","paragraph_id":"para_222"},{"text":"40","paragraph_id":"para_223"},{"text":"The referring court also mentions a decision of the Bundeskartellamt (the German competition authority) of 6 February 2019 (the so-called ‘Facebook’ decision), in which that competition authority took the view that Facebook was abusing its position by merging data from different sources, which is no …","paragraph_id":"para_224"},{"text":"41","paragraph_id":"para_225"},{"text":"Further, the referring court considers that Article 6 of the law of 3 December 2017, which permits, as a general rule, the DPA, where necessary, to initiate or to engage in legal proceedings, does not imply that the action may, in all circumstances, be brought by the DPA before the Belgian courts, s …","paragraph_id":"para_226"},{"text":"42","paragraph_id":"para_227"},{"text":"In those circumstances, the hof van beroep te Brussel (Court of Appeal, Brussels) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_228"},{"text":"‘(1)","paragraph_id":"para_229"},{"text":"Should Article 55(1), Articles 56 to 58 and Articles 60 to 66 of [Regulation 2016/679], read together with Articles 7, 8 and 47 of the [Charter], be interpreted as meaning that a supervisory authority which, pursuant to national law adopted in implementation of Article 58(5) of that regulation, has …","paragraph_id":"para_230"},{"text":"(2)","paragraph_id":"para_231"},{"text":"Does the answer to the first question referred differ if the controller of that cross-border data processing does not have its main establishment in that Member State but does have another establishment there?","paragraph_id":"para_232"},{"text":"(3)","paragraph_id":"para_233"},{"text":"Does the answer to the first question referred differ if the national supervisory authority initiates the legal proceedings against the main establishment of the controller in respect of the cross‑border data processing rather than against the establishment in its own Member State?","paragraph_id":"para_234"},{"text":"(4)","paragraph_id":"para_235"},{"text":"Does the answer to the first question referred differ if the national supervisory authority had already initiated the legal proceedings before the date on which [Regulation 2016/679] entered into force (25 May 2018)?","paragraph_id":"para_236"},{"text":"(5)","paragraph_id":"para_237"},{"text":"If the first question referred is answered in the affirmative, does Article 58(5) of [Regulation 2016/679] have direct effect, meaning that a national supervisory authority can rely on that provision to initiate or continue legal proceedings against private parties even if Article 58(5) of [Regulation 2016/679] has not been specifically transposed into the legislation of the Member States, notwithstanding the requirement to do so?","paragraph_id":"para_238"},{"text":"(6)","paragraph_id":"para_239"},{"text":"If questions (1) to (5) are answered in the affirmative, could the outcome of such proceedings prevent the lead supervisory authority from making a contrary finding when the lead supervisory authority investigates the same or similar cross-border processing activities in accordance with the mechanism laid down in Articles 56 and 60 of [Regulation 2016/679]?’","paragraph_id":"para_240"},{"text":"Consideration of the questions referred","paragraph_id":"para_241"},{"text":"The first question","paragraph_id":"para_242"},{"text":"43","paragraph_id":"para_243"},{"text":"By its first question, the referring court seeks, in essence, to ascertain whether Article 55(1), Articles 56 to 58 and Articles 60 to 66 of Regulation 2016/679, read together with Articles 7, 8 and 47 of the Charter, must be interpreted as meaning that a supervisory authority of a Member State whic …","paragraph_id":"para_244"},{"text":"44","paragraph_id":"para_245"},{"text":"In that regard, it must recalled, as a preliminary point, that, first, unlike Directive 95/46, which had been adopted on the basis of Article 100 A of the EC Treaty, concerning the harmonisation of the common market, the legal basis of Regulation 2016/679 is Article 16 TFEU, which enshrines the righ …","paragraph_id":"para_246"},{"text":"45","paragraph_id":"para_247"},{"text":"Consequently, as is clear from its Article 1(2), read together with recitals 10, 11 and 13 thereof, Regulation 2016/679 requires the European Union institutions, bodies, offices and agencies, and the competent authorities of the Member States, to ensure a high level of protection of the rights guaranteed in Article 16 TFEU and Article 8 of the Charter.","paragraph_id":"para_248"},{"text":"46","paragraph_id":"para_249"},{"text":"Further, as stated in its recital 4, Regulation 2016/679 respects all fundamental rights and observes the freedoms and principles recognised in the Charter.","paragraph_id":"para_250"},{"text":"47","paragraph_id":"para_251"},{"text":"Against that background, Article 55(1) of Regulation 2016/679 states the general rule that each supervisory authority is to be competent for the performance of the tasks assigned to it and the exercise of the powers conferred on it, in accordance with that regulation, on the territory of its own Member State (see, to that effect, judgment of 16 July 2020, Facebook Ireland and Schrems, C‑311/18 , EU:C:2020:559 , paragraph  147 ).","paragraph_id":"para_252"},{"text":"48","paragraph_id":"para_253"},{"text":"One of the tasks assigned to those supervisory authorities is the task of monitoring the application of Regulation 2016/679 and enforcing its application, as laid down in Article 57(1)(a) of that regulation, while another is the task of cooperating with other supervisory authorities, including shari …","paragraph_id":"para_254"},{"text":"49","paragraph_id":"para_255"},{"text":"The performance of those tasks and the exercise of those powers presupposes, however, that a supervisory authority is competent with respect to a particular instance of data processing.","paragraph_id":"para_256"},{"text":"50","paragraph_id":"para_257"},{"text":"In that regard, without prejudice to the rule on competence set out in Article 55(1) of Regulation 2016/679, Article 56(1) of that regulation establishes, with respect to ‘cross-border processing’, within the meaning of Article 4, point (23), of that regulation, the ‘one-stop shop’ mechanism, based …","paragraph_id":"para_258"},{"text":"51","paragraph_id":"para_259"},{"text":"Article 60 establishes the procedure for cooperation between the lead supervisory authority and the other supervisory authorities concerned. As part of that procedure, the lead supervisory authority is, in particular, required to endeavour to reach consensus. To that end, in accordance with Article …","paragraph_id":"para_260"},{"text":"52","paragraph_id":"para_261"},{"text":"It follows more specifically from Articles 56 and 60 of Regulation 2016/679 that, with respect to ‘cross-border processing’, within the meaning of Article 4, point (23), of that regulation, and subject to Article 56(2) thereof, the various national supervisory authorities concerned must cooperate, i …","paragraph_id":"para_262"},{"text":"53","paragraph_id":"para_263"},{"text":"The application of the ‘one-stop shop’ mechanism consequently requires, as confirmed in recital 13 of Regulation 2016/679, sincere and effective cooperation between the lead supervisory authority and the other supervisory authorities concerned. Accordingly, as the Advocate General stated in point 11 …","paragraph_id":"para_264"},{"text":"54","paragraph_id":"para_265"},{"text":"Thus, in accordance with Article 60(4) of Regulation 2016/679, where one of the other supervisory authorities concerned expresses, within a period of four weeks after having been consulted, such a relevant and reasoned objection to the draft decision, the lead supervisory authority, if it does not f …","paragraph_id":"para_266"},{"text":"55","paragraph_id":"para_267"},{"text":"Under Article 60(5) of Regulation 2016/679, where the lead supervisory authority intends, on the other hand, to follow the relevant and reasoned objection made, it must submit to the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision is to be subject to the procedure referred to in Article 60(4) within a period of two weeks.","paragraph_id":"para_268"},{"text":"56","paragraph_id":"para_269"},{"text":"In accordance with Article 60(7) of that regulation, it is the responsibility of the lead supervisory authority, as a general rule, to adopt a decision with respect to the cross-border processing concerned, to give notice of that decision to the main establishment or the single establishment of the …","paragraph_id":"para_270"},{"text":"57","paragraph_id":"para_271"},{"text":"That said, it must be noted that Regulation 2016/679 establishes exceptions to the general rule that it is the lead supervisory authority which is competent to adopt decisions in the context of the ‘one-stop shop’ mechanism provided for in Article 56(1) of that regulation.","paragraph_id":"para_272"},{"text":"58","paragraph_id":"para_273"},{"text":"The first of those exceptions is to be found in Article 56(2) of Regulation 2016/679, which provides that a supervisory authority which is not the lead supervisory authority is to be competent to handle a complaint lodged with it concerning a cross-border processing of personal data or a possible infringement of that regulation, if the subject matter relates only to an establishment in its own Member State or substantially affects data subjects only in that Member State.","paragraph_id":"para_274"},{"text":"59","paragraph_id":"para_275"},{"text":"The second exception is in Article 66 of Regulation 2016/679, which provides, by way of derogation from the consistency mechanisms referred to in Articles 60 and Article 63 to 65 of that regulation, for an urgency procedure. That urgency procedure makes it possible, in exceptional circumstances, whe …","paragraph_id":"para_276"},{"text":"60","paragraph_id":"para_277"},{"text":"However, the exercise of that competence by the supervisory authorities must be compatible with the need for sincere and effective cooperation with the lead supervisory authority, in accordance with the procedure referred to in Article 56(3) to (5) of Regulation 2016/679. In such circumstances, unde …","paragraph_id":"para_278"},{"text":"61","paragraph_id":"para_279"},{"text":"Under Article 56(4) of Regulation 2016/679, where the lead supervisory authority decides to handle the case, the cooperation procedure laid down in Article 60 of that regulation is applicable. In that context, the supervisory authority which informed the lead supervisory authority may submit to the latter a draft for a decision and the latter must take the utmost account of that draft when preparing the draft decision referred to in Article 60(3) of that regulation.","paragraph_id":"para_280"},{"text":"62","paragraph_id":"para_281"},{"text":"However, under Article 56(5) of Regulation 2016/679, where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the former is to handle the case in accordance with Articles 61 and 62 of that regulation, those provisions requiring the supervisory aut …","paragraph_id":"para_282"},{"text":"63","paragraph_id":"para_283"},{"text":"It follows from the foregoing that, first, in relation to the cross-border processing of personal data, the competence of the lead supervisory authority for the adoption of a decision finding that such processing is an infringement of the rules relating to the protection of the rights of natural per …","paragraph_id":"para_284"},{"text":"64","paragraph_id":"para_285"},{"text":"In that regard, it is stated in recital 10 of Regulation 2016/679 that that regulation seeks, inter alia, to ensure consistent and homogeneous application of the rules for the protection of the freedoms and fundamental rights of natural persons with regard to the processing of personal data throughout the European Union and to remove obstacles to flows of personal data within the Union.","paragraph_id":"para_286"},{"text":"65","paragraph_id":"para_287"},{"text":"That objective, and the effectiveness of the ‘one-stop shop’ mechanism, might be jeopardised if a supervisory authority which is not, with respect to an instance of cross-border data processing, the lead supervisory authority, could exercise the power laid down in Article 58(5) of Regulation 2016/67 …","paragraph_id":"para_288"},{"text":"66","paragraph_id":"para_289"},{"text":"Contrary to what is claimed by the DPA, the fact that a supervisory authority of a Member State which is not the lead supervisory authority may exercise the power laid down in Article 58(5) of Regulation 2016/679 only when that exercise complies with the rules on the allocation of competences to adopt decisions laid down, in particular, in Articles 55 and 56 of that regulation, read together with Article 60 thereof, is compatible with Articles 7, 8 and 47 of the Charter.","paragraph_id":"para_290"},{"text":"67","paragraph_id":"para_291"},{"text":"First, as regards the argument concerning an alleged breach of Articles 7 and 8 of the Charter, it must be recalled that Article 7 guarantees that everyone has the right to respect for his or her private and family life, home and communications, whereas Article 8(1) of the Charter, like Article 16(1 …","paragraph_id":"para_292"},{"text":"68","paragraph_id":"para_293"},{"text":"That means, in particular, that the use of the ‘one-stop shop’ mechanism cannot under any circumstances have the consequence that a national supervisory authority, in particular the lead supervisory authority, does not assume the responsibility incumbent on it under Regulation 2016/679 to contribute …","paragraph_id":"para_294"},{"text":"69","paragraph_id":"para_295"},{"text":"Second, as regards the argument concerning the alleged breach of the right to an effective remedy, guaranteed in Article 47 of the Charter, that argument cannot be accepted either. The manner in which, as set out in paragraphs 64 and 65 of the present judgment, the possibility that a supervisory aut …","paragraph_id":"para_296"},{"text":"70","paragraph_id":"para_297"},{"text":"That is particularly true in the situation described in Article 56(5) of Regulation 2016/679, by virtue of which, as stated in paragraph 62 of the present judgment, the supervisory authority which has given information on the basis of Article 56(3) of that regulation, may handle the case in accordan …","paragraph_id":"para_298"},{"text":"71","paragraph_id":"para_299"},{"text":"That said, it must be emphasised that the exercise of the power of a Member State’s supervisory authority to bring actions before the courts of that State cannot be ruled out where, after the mutual assistance of the lead supervisory authority has been sought, under Article 61 of Regulation 2016/679 …","paragraph_id":"para_300"},{"text":"72","paragraph_id":"para_301"},{"text":"The sharing of competences and responsibilities among the supervisory authorities is of necessity underpinned by the existence of sincere and effective cooperation, between those authorities and with the Commission, in order to ensure the correct and consistent application of that regulation, as Article 51(2) of that regulation confirms.","paragraph_id":"para_302"},{"text":"73","paragraph_id":"para_303"},{"text":"In this instance, it will be for the referring court to determine whether the rules on the allocation of competences and the relevant procedures and mechanisms laid down by Regulation 2016/679 have been correctly applied in the main proceedings. In particular, it will be the task of the referring co …","paragraph_id":"para_304"},{"text":"74","paragraph_id":"para_305"},{"text":"In that regard, the Court observes that the European Data Protection Board, in its Opinion 5/2019 of 12 March 2019 on the interplay between the [Directive on privacy and electronic communications] and the [General Data Protection Regulation], in particular regarding the competence, tasks and powers …","paragraph_id":"para_306"},{"text":"75","paragraph_id":"para_307"},{"text":"In the light of all the foregoing, the answer to the first question referred is that Article 55(1), Articles 56 to 58 and Articles 60 to 66 of Regulation 2016/679, read together with Articles 7, 8 and 47 of the Charter, must be interpreted as meaning that a supervisory authority of a Member State wh …","paragraph_id":"para_308"},{"text":"The second question","paragraph_id":"para_309"},{"text":"76","paragraph_id":"para_310"},{"text":"By its second question, the referring court seeks, in essence, to ascertain whether Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, in the event of cross-border data processing, it is a prerequisite for the exercise of the power of a supervisory authority of a Member State, …","paragraph_id":"para_311"},{"text":"77","paragraph_id":"para_312"},{"text":"In that regard, it must be recalled that, under Article 55(1) of Regulation 2016/679, each supervisory authority is to be competent for the performance of the tasks assigned to it and the exercise of the powers conferred on it, in accordance with that regulation, on the territory of its own Member State.","paragraph_id":"para_313"},{"text":"78","paragraph_id":"para_314"},{"text":"Article 58(5) of Regulation 2016/679 lays down, further, the power of each supervisory authority to bring any alleged infringement of that regulation to the attention of a court of its Member State and, where appropriate, to initiate or engage in legal proceedings, in order to enforce the provisions of that regulation.","paragraph_id":"para_315"},{"text":"79","paragraph_id":"para_316"},{"text":"It must be observed that Article 58(5) of Regulation 2016/679 is worded in general terms and that the EU legislature has not specified that the exercise of that power by a Member State’s supervisory authority is subject to the condition that its legal action should be brought against a controller who has a ‘main establishment’, within the meaning of Article 4, point 16, of that regulation, or another establishment on the territory of that Member State.","paragraph_id":"para_317"},{"text":"80","paragraph_id":"para_318"},{"text":"However, a Member State’s supervisory authority may exercise the power conferred on it by Article 58(5) of Regulation 2016/679 only if it is demonstrated that that power falls within the territorial scope of that regulation.","paragraph_id":"para_319"},{"text":"81","paragraph_id":"para_320"},{"text":"Article 3(1) of Regulation 2016/679, which governs the territorial scope of that regulation, provides, in that regard, that the regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the European Union, whether or not the processing takes place in the European Union.","paragraph_id":"para_321"},{"text":"82","paragraph_id":"para_322"},{"text":"In that connection, recital 22 of Regulation 2016/679 states that the existence of such an establishment implies the effective and real exercise of activity through stable arrangements and that the legal form of such arrangements, whether through a branch or a subsidiary with legal personality, is not the determining factor in that respect.","paragraph_id":"para_323"},{"text":"83","paragraph_id":"para_324"},{"text":"It follows that, in accordance with Article 3(1) of Regulation 2016/679, the territorial scope of that regulation is determined, without prejudice to the situations referred to in paragraphs 2 and 3 of that article, by the condition that the controller or the processor with respect to the cross‑border processing has an establishment in the European Union.","paragraph_id":"para_325"},{"text":"84","paragraph_id":"para_326"},{"text":"Consequently the answer to the second question referred is that Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, in the event of cross‑border data processing, it is not a prerequisite for the exercise of the power of a supervisory authority of a Member State, other than the …","paragraph_id":"para_327"},{"text":"The third question","paragraph_id":"para_328"},{"text":"85","paragraph_id":"para_329"},{"text":"By its third question, the referring court seeks, in essence, to ascertain whether Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, in the event of cross-border data processing, it is a prerequisite of the exercise by a supervisory authority of a Member State, other than the …","paragraph_id":"para_330"},{"text":"86","paragraph_id":"para_331"},{"text":"It is clear from the order for reference that that question has arisen in the context of argument by the parties in relation to the issue whether the referring court has jurisdiction to hear the injunction proceedings in so far as those proceedings are brought against Facebook Belgium, given that, f …","paragraph_id":"para_332"},{"text":"87","paragraph_id":"para_333"},{"text":"As stated in paragraph 47 of the present judgment, Article 55(1) of Regulation 2016/679 establishes the competence, as a general rule, of each supervisory authority for the performance of the tasks assigned to it and the exercise of the powers conferred on it, in accordance with that regulation, on the territory of its own Member State.","paragraph_id":"para_334"},{"text":"88","paragraph_id":"para_335"},{"text":"As regards the power of a supervisory authority of a Member State to bring legal proceedings, within the meaning of Article 58(5) of Regulation 2016/679, it must be recalled, as the Advocate General stated in point 150 of his Opinion, that that provision is worded in general terms and that it does not specify against which entities the supervisory authorities should or might direct legal proceedings in relation to any infringement of that regulation.","paragraph_id":"para_336"},{"text":"89","paragraph_id":"para_337"},{"text":"Consequently, that provision does not restrict the exercise of the power to initiate or engage in legal proceedings in such a way that those proceedings can solely be brought against a ‘main establishment’ or against some other ‘establishment’ of the controller. On the contrary, under Article 58(5) …","paragraph_id":"para_338"},{"text":"90","paragraph_id":"para_339"},{"text":"However, the exercise of the power conferred on each supervisory authority in Article 58(5) of Regulation 2016/679 presupposes that that regulation is applicable. In that regard, and as stated in paragraph 81 of the present judgment, Article 3(1) of that regulation provides that it is applicable to …","paragraph_id":"para_340"},{"text":"91","paragraph_id":"para_341"},{"text":"Having regard to the objective pursued by Regulation 2016/679, which is to ensure effective protection of the freedoms and fundamental rights of individuals, in particular, their right to protection of privacy and the protection of personal data, the condition that the processing of personal data mu …","paragraph_id":"para_342"},{"text":"92","paragraph_id":"para_343"},{"text":"In this instance, it is clear from the order for reference and from the written observations lodged by Facebook Belgium that the function of that company is, primarily, to engage with the EU institutions and, secondarily, to promote the advertising and marketing of the Facebook group aimed at people residing in Belgium.","paragraph_id":"para_344"},{"text":"93","paragraph_id":"para_345"},{"text":"The objective of the processing of personal data at issue in the main proceedings, which is carried out within the European Union exclusively by Facebook Ireland and which consists in the collection of information on the internet browsing behaviour both of Facebook account holders and of non-users o …","paragraph_id":"para_346"},{"text":"94","paragraph_id":"para_347"},{"text":"It must be observed that, first, a social network such as Facebook generates a substantial proportion of its income from, inter alia, the advertising that is disseminated on that social network, and that the activity carried out by the establishment located in Belgium is intended to ensure, within B …","paragraph_id":"para_348"},{"text":"95","paragraph_id":"para_349"},{"text":"In those circumstances, the activities of the establishment of the Facebook group located in Belgium must be considered to be inextricably linked to the processing of personal data at issue in the main proceedings, with respect to which Facebook Ireland is the controller within the European Union. A …","paragraph_id":"para_350"},{"text":"96","paragraph_id":"para_351"},{"text":"In the light of all the foregoing, the answer to the third question referred is that Article 58(5) of Regulation 2016/679 must be interpreted as meaning that the power of a supervisory authority of a Member State, other than the lead supervisory authority, to bring any alleged infringement of that r …","paragraph_id":"para_352"},{"text":"The fourth question","paragraph_id":"para_353"},{"text":"97","paragraph_id":"para_354"},{"text":"By its fourth question, the referring court seeks, in essence, to ascertain whether Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, where a supervisory authority of a Member State which is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that reg …","paragraph_id":"para_355"},{"text":"98","paragraph_id":"para_356"},{"text":"The claim made before that court by Facebook Ireland, Facebook Inc. and Facebook Belgium is that the consequence of Regulation 2016/679 becoming applicable after 25 May 2018 is that the continuation of an action brought before that date is inadmissible, or unfounded.","paragraph_id":"para_357"},{"text":"99","paragraph_id":"para_358"},{"text":"It must be noted, first, that Article 99(1) of Regulation 2016/679 provides that that regulation is to enter into force on the twentieth day following that of its publication in the Official\n Journal of the European Union . Since that regulation was published in the Official Journal on 4 May 2016, it therefore entered into force on 25 May 2016. Further, Article 99(2) of that regulation provides that it is to apply from 25 May 2018.","paragraph_id":"para_359"},{"text":"100","paragraph_id":"para_360"},{"text":"In that regard, it should be borne in mind that a new rule of law applies from the entry into force of the act introducing it, and, while it does not apply to legal situations that have arisen and become definitive under the old law, it does apply to their future effects, and to new legal situations …","paragraph_id":"para_361"},{"text":"101","paragraph_id":"para_362"},{"text":"Regulation 2016/679 contains no transitional rule nor any other rule governing the status of court proceedings which were initiated before that regulation became applicable and which were still ongoing when it became applicable. In particular, there is no provision of that regulation which states th …","paragraph_id":"para_363"},{"text":"102","paragraph_id":"para_364"},{"text":"In this instance, Article 58(5) of Regulation 2016/679 lays down rules governing the power of a supervisory authority to bring any infringement of that regulation to the attention of the judicial authorities and, where appropriate, to initiate or engage otherwise in legal proceedings, in order to enforce the provisions of that regulation.","paragraph_id":"para_365"},{"text":"103","paragraph_id":"para_366"},{"text":"In those circumstances, a distinction must be drawn between actions brought by a supervisory authority of a Member State with respect to infringements of the rules for the protection of personal data committed by controllers or processors before the date when Regulation 2016/679 became applicable and actions brought with respect to infringements committed after that date.","paragraph_id":"para_367"},{"text":"104","paragraph_id":"para_368"},{"text":"In the first situation, from the perspective of EU law, a legal action, such as that at issue in the main proceedings, may be continued on the basis of the provisions of Directive 95/46, which remains applicable in relation to infringements committed up to the date of its repeal, namely 25 May 2018. …","paragraph_id":"para_369"},{"text":"105","paragraph_id":"para_370"},{"text":"In the light of all the foregoing, the answer to the fourth question referred is that Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, where a supervisory authority of a Member State which is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that r …","paragraph_id":"para_371"},{"text":"The fifth question","paragraph_id":"para_372"},{"text":"106","paragraph_id":"para_373"},{"text":"By its fifth question, the referring court seeks, in essence, to ascertain whether, if the answer to the first question referred is in the affirmative, Article 58(5) of Regulation 2016/679 must be interpreted as meaning that that provision has direct effect, with the result that a national superviso …","paragraph_id":"para_374"},{"text":"107","paragraph_id":"para_375"},{"text":"Article 58(5) of Regulation 2016/679 states that each Member State is to provide by law that its supervisory authority is to have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to initiate or engage otherwise in legal proceedings, in order to enforce the provisions of that regulation.","paragraph_id":"para_376"},{"text":"108","paragraph_id":"para_377"},{"text":"First, it must be observed that, as submitted by the Belgian Government, Article 58(5) of Regulation 2016/679 has been implemented in the Belgian legal order by Article 6 of the law of 3 December 2017. Under that Article 6, the wording of which is essentially the same as that of Article 58(5) of Reg …","paragraph_id":"para_378"},{"text":"109","paragraph_id":"para_379"},{"text":"Further, for the sake of completeness, it must be observed that, under the second paragraph of Article 288 TFEU, a regulation is to be binding in its entirety and is to be directly applicable in all Member States, so that its provisions do not, as a general rule, require the adoption of any implementing measures by the Member States.","paragraph_id":"para_380"},{"text":"110","paragraph_id":"para_381"},{"text":"In that regard, it must be recalled that, according to the Court’s settled case-law, pursuant to Article 288 TFEU and by virtue of the very nature of regulations and of their function in the system of sources of EU law, the provisions of those regulations generally have immediate effect in the natio …","paragraph_id":"para_382"},{"text":"111","paragraph_id":"para_383"},{"text":"However, as the Advocate General stated, in essence, in point 167 of his Opinion, Article 58(5) of Regulation 2016/679 lays down a specific and directly applicable rule which states that the supervisory authorities must have legal standing before the national courts and must have the power to initiate or engage in legal proceedings under national law.","paragraph_id":"para_384"},{"text":"112","paragraph_id":"para_385"},{"text":"It is not stated in Article 58(5) of Regulation 2016/679 that Member States should determine by means of an express legal provision under what circumstances the national supervisory authorities may initiate or engage in legal proceedings, within the meaning of Article 58(5). It is sufficient that th …","paragraph_id":"para_386"},{"text":"113","paragraph_id":"para_387"},{"text":"In the light of all the foregoing, the answer to the fifth question referred is that Article 58(5) of Regulation 2016/679 must be interpreted as meaning that that provision has direct effect, with the result that a national supervisory authority may rely on that provision in order to bring or continue a legal action against private parties, even where that provision has not been specifically implemented in the legislation of the Member State concerned.","paragraph_id":"para_388"},{"text":"The sixth question","paragraph_id":"para_389"},{"text":"114","paragraph_id":"para_390"},{"text":"By its sixth question, the referring court seeks, in essence, to ascertain whether, in the event that the answer to the questions (1) to (5) referred is in the affirmative, the outcome of legal proceedings brought by a Member State’s supervisory authority in relation to an instance of cross‑border p …","paragraph_id":"para_391"},{"text":"115","paragraph_id":"para_392"},{"text":"In that regard, it should be borne in mind that, according to settled case‑law, questions on the interpretation of EU law enjoy a presumption of relevance. The Court may refuse to give a ruling on a question referred for a preliminary ruling by a national court only where it is quite obvious that th …","paragraph_id":"para_393"},{"text":"116","paragraph_id":"para_394"},{"text":"Moreover, according to equally settled case-law, the justification for a reference for a preliminary ruling is not that it enables advisory opinions on general or hypothetical questions to be delivered but rather that it is necessary for the effective resolution of a dispute (judgment of 10 December 2018, Wightman and Others, C‑621/18 , EU:C:2018:999 , paragraph  28 and the case-law cited).","paragraph_id":"para_395"},{"text":"117","paragraph_id":"para_396"},{"text":"In this instance, it is clear that, as observed by the Belgian Government, the factual premiss of the sixth question referred has not been shown to have any reality in the context of the main proceedings, namely the premiss that, with respect to the cross-border processing that is the object of the …","paragraph_id":"para_397"},{"text":"118","paragraph_id":"para_398"},{"text":"In those circumstances, it must be stated that the sixth question referred bears no relation to the actual facts of the main proceedings or their purpose, and concerns a hypothetical problem. Consequently, that question must be declared to be inadmissible.","paragraph_id":"para_399"},{"text":"Costs","paragraph_id":"para_400"},{"text":"119","paragraph_id":"para_401"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_402"},{"text":"On those grounds, the Court (Grand Chamber) hereby rules:","paragraph_id":"para_403"},{"text":"1.","paragraph_id":"para_404"},{"text":"Article 55(1), Articles 56 to 58 and Articles 60 to 66 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/E …","paragraph_id":"para_405"},{"text":"2.","paragraph_id":"para_406"},{"text":"Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, in the event of cross-border data processing, it is not a prerequisite for the exercise of the power of a supervisory authority of a Member State, other than the lead supervisory authority, to initiate or engage in legal proce …","paragraph_id":"para_407"},{"text":"3.","paragraph_id":"para_408"},{"text":"Article 58(5) of Regulation 2016/679 must be interpreted as meaning that the power of a supervisory authority of a Member State, other than the lead supervisory authority, to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where appropriate, to …","paragraph_id":"para_409"},{"text":"4.","paragraph_id":"para_410"},{"text":"Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, where a supervisory authority of a Member State which is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, has brought a legal action, the object of which is an instance of cross-bor …","paragraph_id":"para_411"},{"text":"5.","paragraph_id":"para_412"},{"text":"Article 58(5) of Regulation 2016/679 must be interpreted as meaning that that provision has direct effect, with the result that a national supervisory authority may rely on that provision in order to bring or continue a legal action against private parties, even where that provision has not been specifically implemented in the legislation of the Member State concerned.","paragraph_id":"para_413"},{"text":"[Signatures]","paragraph_id":"para_414"},{"text":"(\n *1\n ) Language of the case: Dutch.","paragraph_id":"para_415"}],"word_count":14902,"cites":["C-210/16","C-311/18","C-507/17","C-129/20","C-528/15","C-62/14","C-304/16","C-621/18"],"sha256":"dfa53a92579655ee026bd8e0a608aa9bf10e60f8f27a4a9799368d2e2a39467a","source_url":"https://publications.europa.eu/resource/celex/62019CJ0645.ENG.xhtml.ECR_62019CJ0645_EN_01.html","fetched_at":"2026-10-02T11:39:28.353+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-645-19","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-645-19","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-645-19","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-645-19","verification":{"stored_sha256":"dfa53a92579655ee026bd8e0a608aa9bf10e60f8f27a4a9799368d2e2a39467a","recomputed_sha256":"dfa53a92579655ee026bd8e0a608aa9bf10e60f8f27a4a9799368d2e2a39467a","intact":true,"checked_at":"2026-10-14T12:04:28.114Z"}},"hash":"sha256:423da4e90f52843a0d395b6a5dbb885c7ce8adf4b1a543aff1a8ee5c1dfe543c","version":"legal-2026-10-14","expires":"2026-10-15T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-14+legal-2026-10-14+2026-10-14T08:26:07","content_hash":"sha256:423da4e90f52843a0d395b6a5dbb885c7ce8adf4b1a543aff1a8ee5c1dfe543c","revalidate_after":"2026-10-14T13:04:28.906Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-645-19","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-645-19"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-645-19"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-645-19"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-645-19","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-83310baef1087dfab006c4cafed0016b","response_hash":"sha256:423da4e90f52843a0d395b6a5dbb885c7ce8adf4b1a543aff1a8ee5c1dfe543c"}},"freshness":{"freshness_class":"live","as_of":"2026-11-04T02:59:59.288Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-645-19&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":28263}}