The House of Data Imperiali bulletins are extracts from the articles of the Legal Information Service (SIG) edited by Mr. Rosario Imperiali d’Afflitto.

The SIG is available by subscription only.

For further information, please email: segreteria@imperialida.com

Does the violation of the ROPA cause unlawful processing?

The Court of Justice of the EU (CJEU) on May 4, 2023 issued its decision on the preliminary ruling subject of Case C-60/22, UZ v. Bundesrepublik Deutschland.

The questions submitted to the CJEU concerned the following aspects of the GDPR:

  • Whether the lack of maintaining the register of processing activities (“ROPA,” Art. 30, GDPR) or the contract regulating the mutual responsibilities of the joint controllers (Art. 26, GDPR) result in the unlawfulness of the processing of personal data;
  • If so, whether the right to data erasure (Art. 17, GDPR) and the right to restriction of processing (Art. 18, GDPR) can be exercised on such processing; or, if not, what the consequences are;
  • Whether a court in the exercise of its jurisdictional powers, in the presence of such deficiencies (omission of ROPA and absence of the contract between joint controllers) in order to carry out the relevant processing of personal data is subject to the consent of the data subject.

gdpr_lawfulness_processing_data

Facts

The reference for a preliminary ruling arises from a dispute between a third-country citizen (UZ) and the Federal Republic of Germany regarding the examination of that person’s application for international protection. Following the rejection decision, the Federal Office of Competence shared the electronic file containing Mr. UZ’s case file and personal data with the administrative court via the mailbox operated by a public body.

The referring court notes that:

  • the maintenance of the electronic file and its transmission constitutes processing of personal data to which the GDPR applies
  • that the receiving judicial offices, following appropriate assessment, have not implemented a ROPA
  • between the federal office and the judicial offices, which co-manage the relevant processing, there is no contract in place to regulate their respective responsibilities under the GDPR (Article 26 of the Regulation).
On the basis of these findings, the referring court asks the CJEU to clarify whether the found violations of the GDPR result in the unlawfulness of the processing of personal data in respect of which the data subject can exercise the right to erasure or restriction of processing. In addition, the German court asks whether it is required to seek the consent of the data subject in order to carry out the processing of personal data in the presence of these omissions.