The Court of Justice of the EU (CJEU) on May 4, 2023 issued its decision on the preliminary ruling subject of Case C-60/22, UZ v. Bundesrepublik Deutschland.
The questions submitted to the CJEU concerned the following aspects of the GDPR:
- Whether the lack of maintaining the register of processing activities (“ROPA,” Art. 30, GDPR) or the contract regulating the mutual responsibilities of the joint controllers (Art. 26, GDPR) result in the unlawfulness of the processing of personal data;
- If so, whether the right to data erasure (Art. 17, GDPR) and the right to restriction of processing (Art. 18, GDPR) can be exercised on such processing; or, if not, what the consequences are;
- Whether a court in the exercise of its jurisdictional powers, in the presence of such deficiencies (omission of ROPA and absence of the contract between joint controllers) in order to carry out the relevant processing of personal data is subject to the consent of the data subject.
The reference for a preliminary ruling arises from a dispute between a third-country citizen (UZ) and the Federal Republic of Germany regarding the examination of that person’s application for international protection. Following the rejection decision, the Federal Office of Competence shared the electronic file containing Mr. UZ’s case file and personal data with the administrative court via the mailbox operated by a public body.
The referring court notes that:
- the maintenance of the electronic file and its transmission constitutes processing of personal data to which the GDPR applies
- that the receiving judicial offices, following appropriate assessment, have not implemented a ROPA
- between the federal office and the judicial offices, which co-manage the relevant processing, there is no contract in place to regulate their respective responsibilities under the GDPR (Article 26 of the Regulation).