According to CJEU, a parliamentary committee of inquiry must comply with provisions of GDPR where there is no question of national security

On Tuesday 16 January, the Court of Justice of the EU handed down a judgment in which it ruled that a parliamentary committee of inquiry must, in principle, comply with the General Data Protection Regulation (GDPR) (Case C-33/22).

This judgment is the conclusion of a case involving a witness heard by a committee of inquiry set up by the Austrian Parliament to investigate the existence of possible political influence on the Austrian Federal Office for the Protection of the Constitution and for Counterterrorism.

The minutes of this hearing were published on the Austrian Parliament’s website and, despite the witness’ request for anonymity, contained their full name. Taking the view that this was contrary to the provisions of the GDPR, the witness lodged a complaint with the Austrian data protection authority.

The latter rejected the request on the grounds that the principle of the separation of powers precluded this authority, as a part of the executive branch, from monitoring compliance with the GDPR by the committee of inquiry, which comes under the legislative power.

Questioned by the Austrian administrative court, the CJEU ruled that “even a committee of inquiry set up by the parliament of a Member State in the exercise of its power of scrutiny over the executive must, in principle, comply with the GDPR”.

However, it states that the GDPR does not apply to the processing of personal data carried out by national authorities in the context of an activity aimed at safeguarding national security, which, subject to verification by the Austrian administrative court, is not the case here.

In addition, the judgment points out that since Austria has chosen to establish only one supervisory authority within the meaning of the GDPR- the Austrian Data Protection Authority - this authority is, in principle, competent to monitor compliance with the Regulation by a committee of inquiry, notwithstanding the principle of separation of powers, due to the primacy of EU law.

To see the judgment: https://aeur.eu/f/aeh (Original version in French by Thomas Mangin)