Purpose limitation
3 pending referralsReferral C-17/22 (HTB Neunte Immobilien Portfolio, 7 Jan 2022) 
Referral C-18/22 (Ökorenta Neue Energien Ökostabil IV, 7 Jan 2022)
Referral C-446/21 (Schrems, 20 Jul 2021)
7 preliminary rulings
of 20 Oct 2022, C-77/21 (Digi)
Article 5(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that:
the principle of ‘purpose limitation’, laid down in that provision, does not preclude the recording and storage by the controller, in a database set up for the purpose of testing and correcting errors, of personal data previously collected and stored in another database, where such further processing is compatible with the specific purposes for which the personal data were initially collected, which must be determined in the light of the criteria referred to in Article 6(4) of that regulation.
Article 5(1)(e) of Regulation 2016/679 must be interpreted as meaning that:
the principle of ‘storage limitation’, laid down in that provision, precludes the storage by the controller, in a database set up for the purpose of testing and correcting errors, of personal data previously collected for other purposes for a period exceeding that necessary for carrying out those tests and correcting those errors.
of 24 Feb 2022, C-175/20 (Valsts ieņēmumu dienests)
1. The provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the collection by the tax authorities of a Member State from an economic operator of information involving a significant amount of personal data is subject to the requirements of that regulation, in particular those set out in Article 5(1) thereof.
2. The provisions of Regulation 2016/679 must be interpreted as meaning that the tax authorities of a Member State may not derogate from the provisions of Article 5(1) of that regulation where such a right has not been granted to them by a legislative measure within the meaning of Article 23(1) thereof.
3. The provisions of Regulation 2016/679 must be interpreted as not precluding the tax authorities of a Member State from requiring a provider of internet advertisement services to disclose to them information relating to taxpayers who have published advertisements in one of the sections of their internet portal, provided, in particular, that those data are necessary in the light of the specific purposes for which they are collected and that the period to which the data collection relates does not exceed the period strictly necessary to achieve the objective of general interest sought.
of 22 Jun 2021, C-439/19 (Latvijas Republikas Saeima)
The provisions of Regulation (EU) 2016/679, in particular Article 5(1), Article 6(1)(e) and Article 10 thereof, must be interpreted as precluding national legislation which obliges the public body responsible for the register in which penalty points imposed on drivers of vehicles for road traffic offences are entered to make those data accessible to the public, without the person requesting access having to establish a specific interest in obtaining the data.
The provisions of Regulation (EU) 2016/679, in particular Article 5(1), Article 6(1)(e) and Article 10 thereof, must be interpreted as precluding national legislation which authorises the public body responsible for the register in which penalty points imposed on drivers of vehicles for road traffic offences are entered to disclose those data to economic operators for re-use.
of 27 Sep 2017, C-73/16 (Puškár)
Article 47 of the Charter of Fundamental Rights of the European Union must be interpreted as precluding that a national court rejects, as evidence of an infringement of the protection of personal data conferred by Directive 95/46, a list, such as the contested list, submitted by the data subject and containing personal data relating to him, if that person had obtained that list without the consent, legally required, of the person responsible for processing that data, unless such rejection is laid down by national legislation and respects both the essential content of the right to an effective remedy and the principle of proportionality.
Article 7(e) Directive 95/46 must be interpreted as not precluding the processing of personal data by the authorities of a Member State for the purpose of collecting tax and combating tax fraud such as that effected by drawing up of a list of persons such as that at issue in the main proceedings, without the consent of the data subjects, provided that, first, those authorities were invested by the national legislation with tasks carried out in the public interest within the meaning of that article, that the drawing-up of that list and the inclusion on it of the names of the data subjects in fact be adequate and necessary for the attainment of the objectives pursued and that there be sufficient indications to assume that the data subjects are rightly included in that list and, second, that all of the conditions for the lawfulness of that processing of personal data imposed by Directive 95/46 be satisfied.
Judgment of 16 Apr 2015, C-446/12 (Willems and Others)
Article 4(3) of Regulation No 2252/2004, as amended by Regulation No 444/2009, must be interpreted as meaning that it does not require the Member States to guarantee, in their legislation, that biometric data collected and stored in accordance with that regulation will not be collected, processed and used for purposes other than the issue of the passport or travel document, since that is not a matter which falls within the scope of that regulation.
Judgment of 17 Oct 2013, C-291/12 (Schwarz)
Examination of the question referred has revealed nothing capable of affecting the validity of Article 1(2) of Council Regulation (EC) No 2252/2004 of 13 December 2004 on standards for security features and biometrics in passports and travel documents issued by Member States, as amended by Regulation (EC) No 444/2009 of the European Parliament and of the Council of 6 May 2009.
Judgment of 30 May 2013, C-342/12 (Worten)
Article 6(1)(b) and (c) and Article 7(c) and (e) of Directive 95/46 do not preclude national legislation, such as that at issue in the main proceedings, which requires an employer to make the record of working time available to the national authority responsible for monitoring working conditions so as to allow its immediate consultation, provided that this obligation is necessary for the purposes of the performance by that authority of its task of monitoring the application of the legislation relating to working conditions, in particular as regards working time.
Disclaimer