Decisions made by a national supervisory authority in the context of the indirect exercise of a person’s rights relating to the processing of their personal data are legally binding, ruled the Court of Justice of the European Union (CJEU) in a judgment handed down on Thursday 16 November (Case C-333/22).
In Belgium, a citizen was refused security clearance by the national security authority for professional purposes, on the grounds that he had taken part in demonstrations. He is challenging in court the assertion made by the Supervisory Body for Police Information, which was responsible for verifying the legality of the processing of his data on his behalf, that it had carried out the necessary checks, without providing him with any further information.
Referred to by the Brussels Court of Appeal, the CJEU considers that by informing the data subject of the results of the checks, the competent supervisory authority adopts a legally binding decision which must be amenable to judicial review.
As the Court points out, EU law requires the supervisory authority to inform the data subject ‘at least’ that it has ‘carried out all necessary verifications’ and of ‘his or her right to seek a judicial remedy’. The European Court of Justice adds that, where public interest objectives do not preclude it, Member States must nevertheless provide that the information given to the data subject may go beyond this minimum information so that the data subject is in a position to defend his or her rights.
Furthermore, in cases where the information thus provided to the data subject has been limited to the strict minimum, Member States must ensure that the competent court, in order to verify the justification for such a limitation of the information, is able to balance the public interest objectives pursued (State security, prevention or detection of criminal offences, investigation or prosecution) against the need to guarantee citizens respect for their procedural rights.
In the context of this judicial review, national rules must enable the court to take cognisance not only of the reasons and evidence on which the supervisory authority’s decision is based, but also of the conclusions it has drawn from it.
See the Court’s judgment: https://aeur.eu/f/9me (Original version in French by Mathieu Bion)