Grounds
Operative part
Parties
In Joined Cases C‑92/09 and C‑93/09,
REFERENCES for preliminary rulings under Article 234 EC from the Verwaltungsgericht Wiesbaden (Germany), made by decisions of 27 February 2009, received at the Court on 6 March 2009, in the proceedings
Volker und Markus Schecke GbR (C-92/09),
Hartmut Eifert (C-93/09)
v
Land Hessen,
joined party:
Bundesanstalt für Landwirtschaft und Ernährung,
THE COURT (Grand Chamber),
composed of V. Skouris, President, A. Tizzano, J.N. Cunha Rodrigues, K. Lenaerts (Rapporteur), J.‑C. Bonichot, K. Schiemann, A. Arabadjiev and J.‑J. Kasel, Presidents of Chambers, E. Juhász, C. Toader and M. Safjan, Judges,
Advocate General: E. Sharpston,
Registrar: B. Fülöp, Administrator,
having regard to the written procedure and further to the hearing on 2 February 2010,
after considering the observations submitted on behalf of:
1These references for preliminary rulings concern the validity, first, of Articles 42(8b) and 44a of Council Regulation (EC) No 1290/2005 of 21 June 2005 on the financing of the common agricultural policy (OJ 2005 L 209, p. 1), as amended by Council Regulation (EC) No 1437/2007 of 26 November 2007 (OJ 2007 L 322, p. 1) (‘Regulation No 1290/2005’), and, second, of Commission Regulation (EC) No 259/2008 of 18 March 2008 laying down detailed rules for the application of Regulation No 1290/2005 as regards the publication of information on the beneficiaries of funds deriving from the European Agricultural Guarantee Fund (EAGF) and the European Agricultural Fund for Rural Development (EAFRD) (OJ 2008 L 76, p. 28) and Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC (OJ 2006 L 105, p. 54). Should the Court find that the European Union legislation referred to above is not invalid, the references for preliminary rulings also concern the interpretation of Article 7, the second indent of Article 18(2) and Article 20 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
2Those questions have been raised in the course of proceedings between Volker und Markus Schecke GbR and Mr Eifert (‘the applicants in the main proceedings’) and Land Hessen (the Land of Hesse) concerning the publication on the internet site of the Bundesanstalt für Landwirtschaft und Ernährung (Federal Office for Agriculture and Food; ‘the Bundesanstalt’) of personal data relating to them as recipients of funds from the EAGF or the EAFRD.
3Under the heading ‘Right to respect for private and family life’, Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950, (‘the Convention’) provides:
‘1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.’
1Directive 95/46
4In accordance with Article 1(1) of Directive 95/46, the aim of the directive is to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data. Under Article 2(a) of the directive, ‘personal data’ means ‘any information relating to an identified or identifiable natural person’.
5Under Article 7 of that directive, ‘Member States shall provide that personal data may be processed only if:
(a) the data subject has unambiguously given his consent; or
…
(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or
…
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; …
…’
6Under Article 18(1) of the directive, ‘Member States shall provide that the controller or his representative, if any, must notify the supervisory authority referred to in Article 28 before carrying out any wholly or partly automatic processing operation’.
7Under the second indent of Article 18(2) of the directive, Member States may provide for the simplification of or exemption from notification inter alia in the following case:
‘where the controller, in compliance with the national law which governs him, appoints a personal data protection official, responsible in particular:
thereby ensuring that the rights and freedoms of the data subjects are unlikely to be adversely affected by the processing operations’.
8Article 19(1) of Directive 95/46 provides:
‘Member States shall specify the information to be given in the notification. It shall include at least:
(a) the name and address of the controller and of his representative, if any;
(b) the purpose or purposes of the processing;
(c) a description of the category or categories of data subject and of the data or categories of data relating to them;
(d) the recipients or categories of recipient to whom the data might be disclosed;
(e) proposed transfers of data to third countries;
…’
9Article 20 of the directive, ‘Prior checking’, provides in paragraphs 1 and 2:
‘1. Member States shall determine the processing operations likely to present specific risks to the rights and freedoms of data subjects and shall check that these processing operations are examined prior to the start thereof.
2Such prior checks shall be carried out by the supervisory authority following receipt of a notification from the controller or by the data protection official, who, in cases of doubt, must consult the supervisory authority.’
10In accordance with the first and second subparagraphs of Article 21(2) of Directive 95/46, ‘Member States shall provide that a register of processing operations notified in accordance with Article 18 shall be kept by the supervisory authority’, and ‘[t]he register shall contain at least the information listed in Article 19(1)(a) to (e)’.
11Under Article 28 of the directive, each Member State is to designate one or more public authorities (‘supervisory authority’) to be responsible for monitoring, acting with complete independence, the application within that State’s territory of the national provisions adopted pursuant to that directive.
2Regulation (EC) No 45/2001
12Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1) provides in Article 27(1) and (2):
‘1. Processing operations likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes shall be subject to prior checking by the European Data Protection Supervisor.
2The following processing operations are likely to present such risks:
(a) processing of data relating to health and to suspected offences, offences, criminal convictions or security measures;
(b) processing operations intended to evaluate personal aspects relating to the data subject, including his or her ability, efficiency and conduct;
(c) processing operations allowing linkages not provided for pursuant to national or Community legislation between data processed for different purposes;
(d) processing operations for the purpose of excluding individuals from a right, benefit or contract.’
3Directive 2006/24
13Directive 2006/24 requires the Member States to retain for a certain time data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks.
4Regulation No 1290/2005
14Regulation No 1290/2005 sets the specific requirements and rules on the financing of expenditure falling under the common agricultural policy (‘the CAP’).
15Article 42 of Regulation No 1290/2005 provides that the detailed rules for the application of that regulation are to be adopted by the European Commission. Under Article 42(8b) of the regulation, the Commission is to determine inter alia:
‘the detailed rules on the publication of information concerning beneficiaries referred to in Article 44a and on the practical aspects related to the protection of individuals with regard to the processing of their personal data in accordance with the principles laid down in Community legislation on data protection. These rules shall ensure, in particular, that the beneficiaries of funds are informed that these data may be made public and may be processed by auditing and investigating bodies for the purpose of safeguarding the financial interests of the Communities, including the time that this information shall take place’.
16Article 44a of Regulation No 1290/2005, ‘Publication of the beneficiaries’, states:
‘… Member States shall ensure annual ex-post publication of the beneficiaries of the EAGF and the EAFRD and the amounts received per beneficiary under each of these Funds.
The publication shall contain at least:
(a) for the EAGF, the amount subdivided in direct payments within the meaning of Article 2(d) of Regulation (EC) No 1782/2003 and other expenditure;
(b) for the EAFRD, the total amount of public funding per beneficiary.’
17Recitals 13 and 14 in the preamble to Regulation No 1437/2007 amending Regulation No 1290/2005 read as follows:
‘(13) In the context of the revision of Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities [OJ 2002 L 248, p. 1], the provisions on the annual ex-post publication of beneficiaries of funds deriving from the budget were inserted into that Regulation in order to implement the European Transparency Initiative. Sector-specific Regulations are to provide the means for such a publication. Both the EAGF and the EAFRD form part of the general budget of the European Communities and finance expenditure in a context of shared management between the Member States and the Community. Rules should therefore be laid down for the publication of information on the beneficiaries of these Funds. To that end, Member States should ensure annual ex-post publication of the beneficiaries and the amounts received per beneficiary under each of these Funds.
(14) Making this information accessible to the public enhances transparency regarding the use of Community funds in the [CAP] and improves the sound financial management of these funds, in particular by reinforcing public control of the money used. Given the overriding weight of the objectives pursued, it is justified with regard to the principle of proportionality and the requirement of the protection of personal data to provide for the general publication of the relevant information as it does not go beyond what is necessary in a democratic society and for the prevention of irregularities. Taking into account the opinion of the European Data Protection Supervisor of 10 April 2007 [OJ 2007 C 134, p. 1], it is appropriate to make provision for the beneficiaries of funds to be informed that those data may be made public and that they may be processed by auditing and investigating bodies.’
5Regulation No 259/2008
18On the basis of Article 42(8b) of Regulation No 1290/2005, the Commission adopted Regulation No 259/2008.
19Recital 6 in the preamble to Regulation No 259/2008 reads as follows:
‘(6) Making … information [concerning beneficiaries of funds from the EAGF and EAFRD] accessible to the public enhances transparency regarding the use of Community funds in the [CAP] and improves the sound financial management of these funds, in particular by reinforcing public control of the money used. Given the overriding weight of the objectives pursued, it is justified with regard to the principle of proportionality and the requirement of the protection of personal data to provide for the general publication of the relevant information as it does not go beyond what is necessary in a democratic society and for the prevention of irregularities.’
20Recital 7 in the preamble states that ‘[t]o comply with the data protection requirements beneficiaries of the Funds should be informed of the publication of their data before the publication takes place’.
21Article 1(1) of Regulation No 259/2008 specifies the content of the publication referred to in Article 44a of Regulation No 1290/2005 and provides that it is to include the following information:
‘(a) the first name and the surname where the beneficiaries are natural persons;
(b) the full legal name as registered where the beneficiaries are legal persons;
(c) the full name of the association as registered or otherwise officially recognised where the beneficiaries are associations of natural or legal persons without an own legal personality;
(d) the municipality where the beneficiary resides or is registered and, where available, the postal code or the part thereof identifying the municipality;
(e) for the … EAGF, the amount of direct payments within the meaning of Article 2(d) of Regulation (EC) No 1782/2003 received by each beneficiary in the financial year concerned;
(f) for the EAGF, the amount of payments other than those referred to in point (e) received by each beneficiary in the financial year concerned;
(g) for the … EAFRD, the total amount of public funding received by each beneficiary in the financial year concerned, which includes both the Community and the national contribution;
(h) the sum of the amounts referred to in points (e), (f) and (g) received by each beneficiary in the financial year concerned;
(i) the currency of these amounts.’
22In accordance with Article 2 of Regulation No 259/2008, ‘[the] information referred to in Article 1 shall be made available on a single website per Member State through a search tool allowing the users to search for beneficiaries by name, municipality, amounts received as referred to in (e), (f), (g) and (h) of Article 1 or a combination thereof and to extract all the corresponding information as a single set of data.’
23Article 3(3) of that regulation provides that ‘[t]he information shall remain available on the website for two years from the date of [its] initial publication’.
24Article 4 of Regulation No 259/2008 provides:
‘1. Member States shall inform the beneficiaries that their data will be made public in accordance with Regulation … No 1290/2005 and this Regulation and that they may be processed by auditing and investigating bodies of the Communities and the Member States for the purpose of safeguarding the Communities’ financial interests.
2In case of personal data, the information referred to in paragraph 1 shall be provided in accordance with the requirements of Directive 95/46 … and the beneficiaries shall be informed of their rights as data subjects under this Directive and of the procedures applicable for exercising these rights.
3The information referred to in paragraphs 1 and 2 shall be provided to the beneficiaries by including it in the application forms for receiving funds deriving from the EAGF and EAFRD, or otherwise at the time when the data are collected.
…’
II – The actions in the main proceedings and the questions referred for preliminary rulings
25The applicants in the main proceedings, one established and the other resident in the Land of Hesse, are an agricultural undertaking in the legal form of a partnership (Case C‑92/09) and a full-time farmer (Case C‑93/09). For the financial year 2008 they made applications to the competent local authorities for funds from the EAGF or the EAFRD, which were approved by decisions of 5 December 2008 (Case C‑93/09) and 31 December 2008 (Case C‑92/09).
26In each case the application form contained the following statement:
‘I am aware that Article 44a of Regulation … No 1290/2005 requires publication of information on the beneficiaries of [funds from] the EAGF and the EAFRD and the amounts received per beneficiary. The publication relates to all measures applied for in connection with the Common Application, which constitutes the single application for the purposes of Article 11 of Regulation (EC) No 796/2004, and is effected annually at the latest by 31 March of the following year.’
27The referring court explains that the Bundesanstalt’s website makes available to the public the names of beneficiaries of aid from the EAGF and the EAFRD, the place in which they are established or reside and the postcode of that place, and the annual amounts received. The site is provided with a search tool.
28On 26 September 2008 (Case C‑92/09) and 18 December 2008 (Case C‑93/09) the applicants in the main proceedings brought proceedings to prevent publication of the data relating to them. In their view, publication of the amounts received from the EAGF or the EAFRD is not justified by overriding public interests. Moreover, the rules governing the European Social Fund do not provide for beneficiaries to be identified by name. In their applications, they ask for the Land of Hesse to be ordered to refrain from, or to be prohibited from, transmitting or publishing those data for the purposes of the general publication of information on the financial amounts granted to them from the EAGF and the EAFRD.
29The Land of Hesse, which takes the view that the obligation to publish data relating to the applicants in the main proceedings follows from Regulations No 1290/2005 and No 259/2008, nevertheless undertook not to publish the amounts received by them as beneficiaries of aid from the EAGF and the EAFRD pending final decisions in the main proceedings.
30The referring court believes that the obligation to publish under Article 44a of Regulation No 1290/2005 constitutes an unjustified interference with the fundamental right to the protection of personal data. It considers that that provision, which pursues the aim of increasing the transparency of the use of European funds, does not improve the prevention of irregularities, since extensive control mechanisms exist at present for that purpose. On the basis of the judgment in Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I‑4989, it takes the view that, in any event, that obligation to publish is not proportionate to the aim pursued. Moreover, in its view, Article 42(8b) of Regulation No 1290/2005 gives the Commission too broad a discretion with respect to determining both the data to be published and the means of publication and is therefore incompatible with the third indent of Article 202 EC and with the fourth indent of Article 211 EC.
31Regardless of the validity of Articles 42(8b) and 44a of Regulation No 1290/2005, the referring court considers that Regulation No 259/2008, which prescribes that the information relating to the beneficiaries of aid from the EAGF and the EAFRD is to be published exclusively on the internet, breaches the fundamental right to the protection of personal data. It points out that the latter regulation does not limit access to the internet site concerned to ‘internet protocol’ (IP) addresses situated in the European Union. Furthermore, it is not possible to withdraw the data from the internet after the expiry of the two-year period laid down in Article 3(3) of Regulation No 259/2008. It its view, publication of the data exclusively on the internet also has a deterrent effect. First, citizens wishing to obtain information must have access to the internet. Second, those citizens run the risk of having their data stored under Directive 2006/24. It is paradoxical to strengthen the supervision of telecommunications on the one hand and to provide on the other hand that information which is intended to enable citizens to participate in public affairs is available only electronically.
32In case the Court should find that the provisions referred to in paragraphs 30 and 31 above are not invalid, the referring court further seeks an interpretation of a number of provisions of Directive 95/46. It considers that the publication of personal data may take place only if the measures provided for in the second indent of Article 18(2) of that directive have been taken. According to the information provided by the referring court, the German legislature, in particular that of the Land of Hesse, has made use of the possibility under that provision. However, according to that court, the notification by the Ministry of the Environment, Rural Affairs and Consumer Protection of the Land of Hesse to the personal data protection official was incomplete. Some information was not communicated to that official, such as the fact that the data are processed by the Bundesanstalt on behalf of the Land , in some cases with the assistance of a private third party, specific details of the deletion period and the access provider, and information on the registration of IP addresses.
33Moreover, according to the national court, the publication of the data relating to the beneficiaries of agricultural aid ought to have been preceded by a prior check as provided for in Article 20 of Directive 95/46. In the present case, however, a prior check was carried out, not by a central supervisory authority, but by the data protection official of the undertaking or office responsible, on the basis of incomplete notifications.
34Finally, the referring court is uncertain as to the lawfulness, from the point of view of Article 7(e) of Directive 95/46, of the registration of the IP addresses of users who consult the information relating to beneficiaries of aid from the EAGF and the EAFRD on the Bundesanstalt’s website.
35In those circumstances, the Verwaltungsgericht (Administrative Court) Wiesbaden decided to stay the proceedings and to refer the following questions, which are worded identically in Case C‑92/09 and Case C‑93/09, to the Court for preliminary rulings:
‘1. Are Article [42](8b) and Article 44a of … Regulation … No 1290/2005 …, inserted by … Regulation … No 1437/2007 …, invalid?
2Is … Regulation … No 259/2008 …
(a) invalid, or
(b) valid by reason only of the fact that Directive 2006/24 … is invalid? If the provisions mentioned in the first and second questions are valid:
3Must the second indent of Article 18(2) of Directive 95/46 … be interpreted as meaning that publication in accordance with … Regulation … No 259/2008 … may be effected only following implementation of the procedure – in lieu of notification to a supervisory authority – established by that article?
4Must Article 20 of Directive 95/46 … be interpreted as meaning that publication in accordance with … Regulation … No 259/2008 … may be effected only following exercise of the prior check required by national law in that case?
5If the fourth question is answered in the affirmative: Must Article 20 of Directive 95/46 … be interpreted as meaning that no effective prior check has been performed, if it was effected on the basis of a register established in accordance with the second indent of Article 18(2) of that directive which lacks an item of information prescribed?
6Must Article 7 – and in this case, in particular, subparagraph (e) – of Directive 95/46 … be interpreted as precluding a practice of storing the IP addresses of the users of a homepage without their express consent?’
36By order of the President of the Court of 4 May 2009, Cases C‑92/09 and C‑93/09 were joined for the purposes of the written and oral procedure and the judgment.
37The decisions for reference contain questions on the validity of Regulations No 1290/2005 and No 259/2008 (Questions 1 and 2) and questions on the interpretation of Directive 95/46 (Questions 3 to 6). Before examining the substance of the case, the admissibility of the second part of Question 2 and of Question 6 should be considered.
38By the second part of Question 2 and by Question 6 respectively, the referring court asks the Court to rule on the validity of Directive 2006/24 and on the interpretation of Article 7(e) of Directive 95/46, so as to enable it to assess whether the retention of certain data relating to the users of the internet sites, laid down by European Union and German legislation, is lawful.
39It should be recalled at the outset that although, in view of the division of responsibilities in the preliminary-ruling procedure, it is for the referring court alone to determine the subject-matter of the questions which it proposes to refer to the Court, the Court has held that, in exceptional circumstances, it will examine the conditions in which the case was referred to it by the national court, in order to assess whether it has jurisdiction (Case C‑567/07 Woningstichting Sint Servatius [2009] ECR I‑9021, paragraph 42).
40That is the case in particular where the problem referred to the Court is purely hypothetical or where the interpretation or consideration of the validity of a rule of European Union law which is sought by the national court has no relation to the actual facts of the main action or to its purpose (see, to that effect, Case C‑415/93 Bosman [1995] ECR I‑4921, paragraph 61; Case C‑466/04 Acereda Herrera [2006] ECR I‑5341, paragraph 48; Case C‑380/05 Centro Europa 7 [2008] ECR I‑349, paragraph 53; and Woningstichting Sint Servatius , paragraph 43).
41According to the decisions for reference, the applicants in the main proceedings each brought proceedings before the referring court against the publication under Regulations No 1290/2005 and No 259/2008 of data relating to them. Their applications seek for the Land of Hesse to refrain from transmitting or publishing, or to refuse to transmit or publish, the information concerning the aid which they have received from the EAGF and the EAFRD.
42The second part of Question 2 and Question 6 have no relation to the subject-matter of the disputes in the main proceedings. They relate, not to the publication of data relating to the beneficiaries of aid under those Funds, such as the applicants in the main proceedings, but to the retention of data relating to persons consulting websites. Since consideration of the second part of Question 2 and Question 6 is therefore of no relevance for the outcome of the main proceedings, there is no need to answer them.
1Question 1 and the first part of Question 2
a) Preliminary observations
43By Question 1 and the first part of Question 2, the national court asks the Court to examine the validity, first, of Article 44a of Regulation No 1290/2005 and of Regulation No 259/2008 containing the detailed rules for the application of the publication obligation laid down by Article 44a and, second, of Article 42(8b) of Regulation No 1290/2005, the provision which is the legal basis of Regulation No 259/2008.
44The referring court considers that the obligation to publish data relating to the beneficiaries of aid from the EAGF and the EAFRD, which follows from the provisions cited in the previous paragraph, constitutes an unjustified interference with the fundamental right to the protection of personal data. It refers essentially to Article 8 of the Convention.
45In accordance with Article 6(1) TEU, the European Union recognises the rights, freedoms and principles set out in the Charter of Fundamental Rights of the European Union (‘the Charter’), ‘which shall have the same legal value as the Treaties’.
46In those circumstances, the validity of Articles 42(8b) and 44a of Regulation No 1290/2005 and of Regulation No 259/2008 must be assessed in the light of the provisions of the Charter.
47In this regard, Article 8(1) of the Charter states that ‘[e]veryone has the right to the protection of personal data concerning him or her’. That fundamental right is closely connected with the right to respect of private life expressed in Article 7 of the Charter.
48The right to the protection of personal data is not, however, an absolute right, but must be considered in relation to its function in society (see, to that effect, Case C‑112/00 Schmidberger [2003] ECR I‑5659, paragraph 80 and the case-law cited).
49Article 8(2) of the Charter thus authorises the processing of personal data if certain conditions are satisfied. It provides that personal data ‘must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law’.
50Moreover, Article 52(1) of the Charter accepts that limitations may be imposed on the exercise of rights such as those set forth in Articles 7 and 8 of the Charter, as long as the limitations are provided for by law, respect the essence of those rights and freedoms and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.
51Finally, according to Article 52(3) of the Charter, in so far as it contains rights which correspond to rights guaranteed by the Convention, the meaning and scope of those rights are to be the same as those laid down by the Convention. Article 53 of the Charter further states that nothing in the Charter is to be interpreted as restricting or adversely affecting the rights recognised inter alia by the Convention.
52In those circumstances, it must be considered that the right to respect for private life with regard to the processing of personal data, recognised by Articles 7 and 8 of the Charter, concerns any information relating to an identified or identifiable individual (see, in particular, European Court of Human Rights, Amann v. Switzerland [GC], no. 27798/95, § 65, ECHR 2000‑II, and Rotaru v. Romania [GC], no. 28341/95, § 43, ECHR 2000‑V) and the limitations which may lawfully be imposed on the right to the protection of personal data correspond to those tolerated in relation to Article 8 of the Convention.
b) The validity of Article 44a of Regulation No 1290/2005 and of Regulation No 259/2008
53It must be recalled, in the first place, that the publication required by Article 44a of Regulation No 1290/2005 and Regulation No 259/2008 implementing that article identifies by name all beneficiaries of aid from the EAGF and the EAFRD, among whom are both natural and legal persons. Having regard to the observations in paragraph 52 above, legal persons can claim the protection of Articles 7 and 8 of the Charter in relation to such identification only in so far as the official title of the legal person identifies one or more natural persons.
54That is the case with the applicant in the main proceedings in Case C‑92/09. The official title of the partnership in question directly identifies natural persons who are its partners.
55In the second place, it must be ascertained whether Article 44a of Regulation No 1290/2005 and Regulation No 259/2008 interfere with the rights guaranteed by Articles 7 and 8 of the Charter to beneficiaries of aid from the EAGF or the EAFRD who are identified or identifiable natural persons (‘the beneficiaries concerned’), and, if so, whether such an interference is justified having regard to Article 52 of the Charter.
i) Existence of an interference with the rights recognised by Articles 7 and 8 of the Charter
56Article 44a of Regulation No 1290/2005 requires the Member States to ensure the annual ex-post publication of the names of the beneficiaries of aid from the EAGF and the EAFRD and the amounts received by each beneficiary from each of those Funds. It follows from recital 14 in the preamble to Regulation No 1437/2007 amending Regulation No 1290/2005 that that information must be the subject of ‘general publication’.
57Article 1(1)(d) of Regulation No 259/2008 lays down the content of the publication and prescribes that, in addition to the matters mentioned in the preceding paragraph and other information regarding the aid received, ‘the municipality where the beneficiary resides or is registered and, where available, the postal code or the part thereof identifying the municipality’ must be published. Article 2 of that regulation prescribes that the information is to be made available on a single website per Member State and may be consulted by means of a search tool.
58It is not disputed that the amounts which the beneficiaries concerned receive from the EAGF and the EAFRD represent part of their income, often a considerable part. Because the information becomes available to third parties, publication on a website of data naming those beneficiaries and indicating the precise amounts received by them thus constitutes an interference with their private life within the meaning of Article 7 of the Charter (see, to that effect, Österreichischer Rundfunk and Others , paragraphs 73 and 74).
59It is of no relevance in this respect that the data published concerns activities of a professional nature (see Österreichischer Rundfunk and Others , paragraphs 73 and 74). The European Court of Human Rights has held on this point, with reference to the interpretation of Article 8 of the Convention, that the term ‘private life’ must not be interpreted restrictively and that ‘there is no reason of principle to justify excluding activities of a professional … nature from the notion of “private life”’ (see, inter alia, Amann v. Switzerland , § 65, and Rotaru v. Romania , § 43).
60Moreover, the publication required by Article 44a of Regulation No 1290/2005 and Regulation No 259/2008 constitutes the processing of personal data falling under Article 8(2) of the Charter.
61The Land of Hesse casts doubt, however, on the very existence of an interference with the private life of the applicants in the main proceedings, as they were informed in the aid application form of the mandatory publication of the data relating to them and, in accordance with Article 8(2) of the Charter, gave their consent to that publication by submitting their applications.
62On this point, it should be noted that Article 42(8b) of Regulation No 1290/2005 provides only that ‘the beneficiaries of funds are informed that these data [concerning them, namely their names and the amounts received from each of the Funds] may be made public’. Article 4(1) of Regulation No 259/2008 contains a similar provision, stating that ‘Member States shall inform the beneficiaries that their data will be made public’.
63The European Union legislation in question, which merely provides that beneficiaries of aid are to be informed in advance that the data concerning them will be published, thus does not seek to base the personal data processing for which it provides on the consent of the beneficiaries concerned. Furthermore, it must be noted that in the main proceedings, in their aid application forms, the applicants stated only that they were ‘aware that Article 44a of Regulation … No 1290/2005 requires publication of information on the beneficiaries of [funds from] the EAGF and the EAFRD’.
64Since the publication of data by name relating to the beneficiaries concerned and the precise amounts received by them from the EAGF and the EAFRD constitutes an interference, as regards those beneficiaries, with the rights recognised by Articles 7 and 8 of the Charter, and since such processing of personal data is not based on the consent of those beneficiaries, it is necessary to examine whether the interference is justified having regard to Article 52(1) of the Charter.
ii) Justification of the interference with the rights recognised by Articles 7 and 8 of the Charter
65Article 52(1) of the Charter accepts that limitations may be imposed on the exercise of rights such as those set forth in Articles 7 and 8 of the Charter, as long as the limitations are provided for by law, respect the essence of those rights and freedoms, and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.
66First, it is common ground that the interference arising from the publication on a website of data by name relating to the beneficiaries concerned must be regarded as ‘provided for by law’ within the meaning of Article 52(1) of the Charter. Articles 1(1) and 2 of Regulation No 259/2008 expressly provide for such publication.
67Second, on the question whether that interference meets an objective of general interest recognised by the European Union within the meaning of Article 52(1) of the Charter, it follows from recital 14 in the preamble to Regulation No 1437/2007 amending Regulation No 1290/2005 and from recital 6 in the preamble to Regulation No 259/2008 that publication of the names of the beneficiaries of aid from the EAGF and the EAFRD and of the amounts which they receive from those Funds is intended to ‘[enhance] transparency regarding the use of Community funds in the [CAP] and [improve] the sound financial management of these funds, in particular by reinforcing public control of the money used’.
68The principle of transparency is stated in Articles 1 TEU and 10 TEU and in Article 15 TFEU. It enables citizens to participate more closely in the decision-making process and guarantees that the administration enjoys greater legitimacy and is more effective and more accountable to the citizen in a democratic system (see Case C‑41/00 P Interporc v Commission [2003] ECR I‑2125, paragraph 39, and Case C‑28/08 P Commission v Bavarian Lager [2010] ECR I‑0000, paragraph 54).
69By reinforcing public control of the use of the money from the EAGF and the EAFRD, the publication required by the provisions whose validity is contested contributes to the appropriate use of public funds by the administration (see, to that effect, Österreichischer Rundfunk and Others , paragraph 81).
70Moreover, that publication relating to the use of money paid out by the agricultural Funds will enable citizens to participate more closely in the public debate surrounding decisions on the direction to be taken by the CAP.
71Consequently, by aiming to increase the transparency of the use of funds in the context of the CAP, Article 44a of Regulation No 1290/2005 and Regulation No 259/2008 pursue an objective of general interest recognised by the European Union.
72Third, it is also necessary to ascertain whether the limitation imposed on the rights conferred by Articles 7 and 8 of the Charter is proportionate to the legitimate aim pursued (see, inter alia, European Court of Human Rights, Gillow v. United Kingdom , 24 November 1986, § 55, Series A no. 109, and Österreichischer Rundfunk and Others , paragraph 83).
73The applicants in the main proceedings observe that the data whose publication is provided for in Article 44a of Regulation No 1290/2005 and in Regulation No 259/2008 allows third parties to draw conclusions as to their income. They explain that the aid represents between 30% and 70% of the total income of the beneficiaries concerned. The legitimate interests of the public would, they argue, be satisfied by the publication of anonymous statistics.
74It is settled case-law that the principle of proportionality, which is one of the general principles of European Union law, requires that measures implemented by acts of the European Union are appropriate for attaining the objective pursued and do not go beyond what is necessary to achieve it (Case C‑58/08 Vodafone and Others [2010] ECR I‑0000, paragraph 51 and the case-law cited).
75It is not disputed that the publication on the internet of data by name relating to the beneficiaries concerned and the precise amounts received by them from the EAGF and the EAFRD is liable to increase transparency with respect to the use of the agricultural aid concerned. Such information made available to citizens reinforces public control of the use to which that money is put and contributes to the best use of public funds.
76As to whether the measure is necessary, it must be recalled that the objective of the publication at issue may not be pursued without having regard to the fact that that objective must be reconciled with the fundamental rights set forth in Articles 7 and 8 of the Charter (see, to that effect, Case C‑73/07 Satakunnan Markkinapörssi and Satamedia [2008] ECR I‑9831, paragraph 53).
77It is thus necessary to determine whether the Council of the European Union and the Commission balanced the European Union’s interest in guaranteeing the transparency of its acts and ensuring the best use of public funds against the interference with the right of the beneficiaries concerned to respect for their private life in general and to the protection of their personal data in particular. The Court has held in this respect that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary ( Satakunnan Markkinapörssi and Satamedia , paragraph 56).
78The Member States which have submitted written observations to the Court, the Council and the Commission argue that the objective pursued by the publication required by Article 44a of Regulation No 1290/2005 and by Regulation No 259/2008 could not be achieved by measures which interfere less with the right of the beneficiaries concerned to respect for their private life in general and the protection of their personal data in particular. Information limited to those of the beneficiaries concerned who receive aid exceeding a certain threshold would, it is submitted, not give taxpayers an accurate image of the CAP. Taxpayers would have the impression that there were only ‘big’ beneficiaries of aid from the agricultural Funds, whereas there are numerous ‘little’ ones. Limiting publication to legal persons only would not be satisfactory either. The Commission submits in this connection that the largest beneficiaries of agricultural aid include natural persons.
79While it is true that in a democratic society taxpayers have a right to be kept informed of the use of public funds ( Österreichischer Rundfunk and Others , paragraph 85), the fact remains that striking a proper balance between the various interests involved made it necessary for the institutions, before adopting the provisions whose validity is contested, to ascertain whether publication via a single freely consultable website in each Member State of data by name relating to all the beneficiaries concerned and the precise amounts received by each of them from the EAGF and the EAFRD – with no distinction being drawn according to the duration, frequency or nature and amount of the aid received – did not go beyond what was necessary for achieving the legitimate aims pursued, having regard in particular to the interference with the rights guaranteed by Articles 7 and 8 of the Charter resulting from such publication.
80As far as natural persons benefiting from aid under the EAGF and the EAFRD are concerned, however, it does not appear that the Council and the Commission sought to strike such a balance between the European Union’s interest in guaranteeing the transparency of its acts and ensuring the best use of public funds, on the one hand, and the fundamental rights enshrined in Articles 7 and 8 of the Charter, on the other.
81There is nothing to show that, when adopting Article 44a of Regulation No 1290/2005 and Regulation No 259/2008, the Council and the Commission took into consideration methods of publishing information on the beneficiaries concerned which would be consistent with the objective of such publication while at the same time causing less interference with those beneficiaries’ right to respect for their private life in general and to protection of their personal data in particular, such as limiting the publication of data by name relating to those beneficiaries according to the periods for which they received aid, or the frequency or nature and amount of aid received.
82Such limited publication by name might be accompanied, if appropriate, by relevant information about other natural persons benefiting from aid under the EAGF and the EAFRD and the amounts received by them.
83The institutions ought thus to have examined, in the course of striking a proper balance between the various interests involved, whether publication by name limited in the manner indicated in paragraph 81 above would have been sufficient to achieve the objectives of the European Union legislation at issue in the main proceedings. In particular, it does not appear that such a limitation, which would protect some of the beneficiaries concerned from interference with their private lives, would not provide citizens with a sufficiently accurate image of the aid granted by the EAGF and the EAFRD to achieve the objectives of that legislation.
84The Member States which submitted written observations to the Court and the Council and the Commission refer also to the significant role of the CAP in the European Union budget in order to justify the need for publication laid down by Article 44a of Regulation No 1290/2005 and by Regulation No 259/2008.
85That argument must be rejected. It is necessary to bear in mind that the institutions are obliged to balance, before disclosing information relating to a natural person, the European Union’s interest in guaranteeing the transparency of its actions and the infringement of the rights recognised by Articles 7 and 8 of the Charter. No automatic priority can be conferred on the objective of transparency over the right to protection of personal data (see, to that effect, Commission v Bavarian Lager , paragraphs 75 to 79), even if important economic interests are at stake.
86It follows from the foregoing that it does not appear that the institutions properly balanced, on the one hand, the objectives of Article 44a of Regulation No 1290/2005 and of Regulation No 259/2008 against, on the other, the rights which natural persons are recognised as having under Articles 7 and 8 of the Charter. Regard being had to the fact that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary ( Satakunnan Markkinapörssi and Satamedia , paragraph 56) and that it is possible to envisage measures which affect less adversely that fundamental right of natural persons and which still contribute effectively to the objectives of the European Union rules in question, it must be held that, by requiring the publication of the names of all natural persons who were beneficiaries of EAGF and EAFRD aid and of the exact amounts received by those persons, the Council and the Commission exceeded the limits which compliance with the principle of proportionality imposes.
87Finally, with regard to the legal persons which received EAGF and EAFRD aid, and in so far as they may invoke the rights conferred by Articles 7 and 8 of the Charter (see paragraph 53 of the present judgment), the view must be taken that the obligation to publish which follows from the provisions of the European Union rules the validity of which has here been brought into question does not go beyond the limits imposed by compliance with the principle of proportionality. The seriousness of the breach of the right to protection of personal data manifests itself in different ways for, on the one hand, legal persons and, on the other, natural persons. It is necessary to point out in this regard that legal persons are already subject to a more onerous obligation in respect of the publication of data relating to them. Furthermore, the obligation on the competent national authorities to examine, before the data in question are published and for each legal person which is a beneficiary of EAGF or EAFRD aid, whether the name of that person identifies natural persons would impose on those authorities an unreasonable administrative burden (see, to that effect, judgment of the European Court of Human Rights, K.U. v. Finland , 2 March 2009, application no 2872/02, § 48, not yet published).
88In those circumstances, it must be held that the provisions of European Union law, the validity of which is questioned by the referring court, observe, in so far as they concern the publication of data relating to legal persons, a fair balance in the consideration taken of the respective interests in issue.
89On the basis of all of the foregoing, Article 44a of Regulation No 1290/2005 and Regulation No 259/2008 must be declared invalid to the extent to which, with regard to natural persons who are beneficiaries of EAGF and EAFRD aid, those provisions impose an obligation to publish personal data relating to each beneficiary without drawing a distinction based on relevant criteria such as the periods during which those persons have received such aid, the frequency of such aid or the nature and amount thereof.
c) The validity of Article 42(8b) of Regulation No 1290/2005
90Article 42(8b) of Regulation No 1290/2005 authorises the Commission to adopt the detailed rules for the implementation solely of Article 44a of that regulation.
91However, as Article 44a of Regulation No 1290/2005 has to be declared invalid for the reasons indicated above, Article 42(8b) of that regulation must be declared invalid in like manner.
92The answer to the first question and to the first part of the second question is therefore that Articles 42(8b) and 44a of Regulation No 1290/2005, and Regulation No 259/2008, are invalid in so far as, with regard to natural persons who are beneficiaries of EAGF and EAFRD aid, those provisions impose an obligation to publish personal data relating to each beneficiary without drawing a distinction based on relevant criteria such as the periods during which those persons have received such aid, the frequency of such aid or the nature and amount thereof.
d) The effects in time of the invalidity which has been established
93Where it is justified by overriding considerations of legal certainty, the second paragraph of Article 264 TFEU, which is also applicable by analogy to a reference under Article 267 TFEU for a preliminary ruling on the validity of acts of the European Union, confers on the Court a discretion to decide, in each particular case, which specific effects of the act in question must be regarded as definitive (see, to that effect, Case C‑333/07 Regie Networks [2008] ECR I‑10807, paragraph 121 and the case‑law cited).
94In view of the large number of publications which have taken place in the Member States on the basis of rules which were regarded as being valid, it must be held that the invalidity of the provisions mentioned in paragraph 92 of the present judgment does not allow any action to be brought to challenge the effects of the publication of the lists of beneficiaries of EAGF and EAFRD aid carried out by the national authorities on the basis of those provisions during the period prior to the date on which the present judgment is delivered.
2The third question
95By its third question, the referring court seeks, essentially, to ascertain whether the second indent of Article 18(2) of Directive 95/46 is to be interpreted as meaning that the publication of the information resulting from Articles 42(8b) and 44a of Regulation No 1290/2005 and from Regulation No 259/2008 may be effected only if the personal data protection official has, prior to such publication, kept a full register within the terms of the second indent of Article 18(2).
96It must, in this regard, be borne in mind that Article 18(1) of Directive 95/46 establishes the principle that the supervisory authority must be notified before any wholly or partly automatic operation for the processing of personal data, or any set of such operations intended to serve a single purpose or several related purposes, is carried out. As recital 48 in the preamble to Directive 95/46 explains, ‘the procedures for notifying the supervisory authority are designed to ensure disclosure of the purposes and main features of any processing operation for the purpose of verification that the operation is in accordance with the national measures taken under this Directive’.
97The second indent of Article 18(2) of Directive 95/46, however, provides that Member States may provide for the simplification of or exemption from that obligation in the case where, inter alia, the controller appoints a personal data protection official. It appears from the decisions for reference that such an appointment was made in the Land of Hesse so far as concerns the publication of data resulting from Articles 42(8b) and 44a of Regulation No 1290/2005 and from Regulation No 259/2008.
98According to the second indent of Article 18(2) of Directive 95/46, a personal data protection official has a number of tasks which are designed to ensure that processing operations are unlikely to have an adverse effect on the rights and freedoms of the persons concerned. The official is thus responsible for, among other things, ‘keeping the register of processing operations carried out by the controller, containing the items of information referred to in Article 21(2) [of Directive 95/46]’. The latter provision refers to Article 19(1)(a) to (e) of Directive 95/46.
99However, contrary to the view expressed by the referring court, the second indent of Article 18(2) of Directive 95/46 does not require any provision to be adopted which imposes an obligation on the personal data protection official to maintain a register containing the information referred to in Article 21(2) of that directive, read in conjunction with Article 19(1)(a) to (e) thereof, before the processing of the data concerned is undertaken. The register referred to in the second indent of Article 18(2) of Directive 95/46 need contain only ‘processing operations carried out’.
100In those circumstances, the absence, established by the referring court, of a full register prior to the data processing cannot affect the legality of a publication such as that resulting from Articles 42(8b) and 44a of Regulation No 1290/2005 and from Regulation No 259/2008.
101The answer to the third question is therefore that the second indent of Article 18(2) of Directive 95/46 must be interpreted as not placing the personal data protection official under an obligation to keep the register provided for by that provision before an operation for the processing of personal data, such as that resulting from Articles 42(8b) and 44a of Regulation No 1290/2005 and from Regulation No 259/2008, is carried out.
3The fourth question
102By its fourth question, the referring court seeks, essentially, to ascertain whether Article 20 of Directive 95/46 is to be interpreted as making the publication of the information resulting from Articles 42(8b) and 44a of Regulation No 1290/2005 and from Regulation No 259/2008 subject to the prior checks for which that Article 20 provides.
103It must first be pointed out that Article 20(1) of Directive 95/46 provides that ‘Member States shall determine the processing operations likely to present specific risks to the rights and freedoms of data subjects and shall check that these processing operations are examined prior to the start thereof’.
104It follows that Directive 95/46 does not make the processing of personal data subject, in general, to a prior check. As is clear from recital 52 in the preamble to Directive 95/46, the European Union legislature took the view that ‘ ex post facto verification by the competent authorities must in general be considered a sufficient measure’.
105With regard to processing operations which are subject to prior checks, that is to say, processing operations which are likely to pose specific risks to the rights and freedoms of data subjects, recital 53 in the preamble to Directive 95/46 states that processing operations are likely to pose such risks ‘by virtue of their nature, their scope or their purposes’. Even though Member States have the option of specifying in greater detail in their legislation the processing operations which may pose specific risks to the rights and freedoms of data subjects, Directive 95/46 provides, as is evident from recital 54 in its preamble, that the number of such operations ‘should be very limited’.
106It must further be pointed out that, under Article 27(1) of Regulation No 45/2001, processing operations which are likely to present specific risks to the rights and freedoms of data subjects are also subject to prior checking when carried out by institutions and bodies of the European Union. Article 27(2) of that regulation specifies the operations which are likely to present such risks. In view of the parallel relationship between the provisions of Directive 95/46 and those of Regulation No 45/2001 which relate to prior checks, the listing in Article 27(2) of Regulation No 45/2001 of the processing operations which are likely to present specific risks to the rights and freedoms of data subjects must be considered relevant for the purpose of interpreting Article 20 of Directive 95/46.
107However, it does not appear that the publication of the data imposed by Articles 42(8b) and 44a of Regulation No 1290/2005 and by Regulation No 259/2008 comes within any of the categories of processing operations covered by Article 27(2) of Regulation No 45/2001.
108In those circumstances, the answer to the fourth question is that Article 20 of Directive 95/46 must be interpreted as not imposing an obligation on the Member States to make the publication of information resulting from Articles 42(8b) and 44a of Regulation No 1290/2005 and from Regulation No 259/2008 subject to the prior checks for which that Article 20 provides.
109In view of the answer to the fourth question, there is no longer any need to answer the fifth question.
110Since these proceedings are, for the parties to the main proceedings, a step in the actions pending before the national court, the decisions on costs are a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
Operative part
On those grounds, the Court (Grand Chamber) hereby rules:
1Articles 42(8b) and 44a of Council Regulation (EC) No 1290/2005 of 21 June 2005 on the financing of the common agricultural policy, as amended by Council Regulation (EC) No 1437/2007 of 26 November 2007, and Commission Regulation (EC) No 259/2008 of 18 March 2008 laying down detailed rules for the application of Regulation No 1290/2005 as regards the publication of information on the beneficiaries of funds deriving from the European Agricultural Guarantee Fund (EAGF) and the European Agricultural Fund for Rural Development (EAFRD) are invalid in so far as, with regard to natural persons who are beneficiaries of EAGF and EAFRD aid, those provisions impose an obligation to publish personal data relating to each beneficiary without drawing a distinction based on relevant criteria such as the periods during which those persons have received such aid, the frequency of such aid or the nature and amount thereof.
2The invalidity of the provisions of European Union law mentioned in paragraph 1 of this operative part does not allow any action to be brought to challenge the effects of the publication of the lists of beneficiaries of EAGF and EAFRD aid carried out by the national authorities on the basis of those provisions during the period prior to the date on which the present judgment is delivered.
3The second indent of Article 18(2) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as not placing the personal data protection official under an obligation to keep the register provided for by that provision before an operation for the processing of personal data, such as that resulting from Articles 42(8b) and 44a of Regulation No 1290/2005, as amended by Regulation No 1437/2007, and from Regulation No 259/2008, is carried out.
4Article 20 of Directive 95/46 must be interpreted as not imposing an obligation on the Member States to make the publication of information resulting from Articles 42(8b) and 44a of Regulation No 1290/2005, as amended by Regulation No 1437/2007, and from Regulation No 259/2008 subject to the prior checks for which that Article 20 provides.
Text from our archive (Publications Office of the EU, Cellar). Commission Decision 2011/833/EU — free reuse incl. commercial; attribution to EUR-Lex / Court of Justice of the European Union required; EUR-Lex is not the authentic record of the Court.