The Court of Justice of the European Union (CJEU) ruled on Tuesday 15 June on the exercise of the powers of national supervisory authorities in relation to cross-border data processing (Case C-645/19).
These national authorities, the Court ruled, may bring, under certain conditions, any alleged breach of the General Data Protection Regulation (GDPR) before a court in a Member State, even if it is not the ‘lead’ authority (see EUROPE 12635/16).
The GDPR designates the Irish data protection authority as the ‘lead’ authority for taking legal action via the ‘one-stop shop’ mechanism. The Court’s judgment on Tuesday found that an action brought by a national supervisory authority can be upheld where it pre-dates the entry into force of the GDPR at the end of May 2018.
The CJEU recalled that, while the ‘one-stop shop’ mechanism requires close cooperation between authorities, any objection by a national authority blocks - at least temporarily - decision-making by the ‘lead’ authority.
The Court also ruled that the exercise of a national supervisory authority’s power does not require that the cross-border data controller covered by that action has an establishment in the territory of the Member State concerned. However, the controller must have an establishment in the EU.
Finally, the Court recognised the direct effect of the provision of the GDPR according to which any national authority may bring an action against individuals, even if the provision has not been implemented in the legislation of the Member State concerned.
The CJEU’s judgment comes after it was questioned by the Brussels Court of Appeal in a case brought in September 2015 by the Data Protection Authority against Facebook. It wanted the company to stop collecting and using information from Internet users without their knowledge, through the use of cookies.
See the EU Court of Justice judgment: https://bit.ly/3cJeO22 (Original version in French by Thomas Mangin)