Requested by the Budapest High Court (Hungary) to interpret the General Data Protection Regulation (GDPR), the Court of Justice of the EU handed down a judgment on Thursday 14 March in which it ruled that the data protection authority of a Member State may order that Member State to delete data processed unlawfully, even in the absence of a prior request from the data subject (Case C-46/23).
This ruling follows a case between the Hungarian Data Protection Authority and the municipal administration of Újpest. In 2020, in order to provide financial aid to people made vulnerable by the Covid-19 pandemic, the Hungarian Treasury was asked to provide the personal data needed to verify the eligibility conditions for the aid.
The Hungarian authority had ruled that the Újpest administration, the State Treasury and the Government Office had breached the rules of the GDPR and had imposed fines on them for failing to inform data subjects, within the one-month period set for this purpose, either of the fact and purpose of the use of their data or of their data protection rights.
The Újpest administration had also been ordered to delete the data of eligible people who had not applied for aid. It challenged this decision before the national courts.
In its ruling, the CJEU states that the supervisory authority of a Member State may order of its own motion - even in the absence of a prior request from the data subject - the erasure of unlawfully processed data, if such a measure is necessary to fulfil its task of ensuring full compliance with the GDPR.
In addition, it specifies that the competent authority may order the deletion of data when it comes directly from the data subject and also when it comes from another source.
To see the judgment, go to https://aeur.eu/f/bbo (Original version in French by Thomas Mangin)