Data protection case law Court of Justice

Security of processing

5 pending referrals

Referral C-563/23 (Natsionalnata agentsia za prihodite, 12 Sep 2023)


Referral C-332/23 (Inspektorat kam Visshia sadeben savet, 25 May 2023)


Referral C-169/23 (Másdi, 17 Mar 2023)


Referral C-280/22 (Kinderrechtencoalitie Vlaanderen and Liga voor Mensenrechten, 25 Apr 2022)


Referral C-340/21 (Natsionalna agentsia za prihodite, 2 Jun 2021)


2 preliminary rulings

Judgment of 30 May 2013, C-342/12 (Worten)

Article 6(1)(b) and (c) and Article 7(c) and (e) of Directive 95/46 do not preclude national legislation, such as that at issue in the main proceedings, which requires an employer to make the record of working time available to the national authority responsible for monitoring working conditions so as to allow its immediate consultation, provided that this obligation is necessary for the purposes of the performance by that authority of its task of monitoring the application of the legislation relating to working conditions, in particular as regards working time.

Judgment of 22 Nov 2012, C-119/12 (Probst)

Article 6(2) and (5) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) must be interpreted as authorising a provider of public communications networks and of publicly-accessible electronic communications services to pass traffic data to the assignee of its claims for payment in respect of the supply of telecommunications services for the purpose of recovery of those claims, and as authorising that assignee to process those data on condition, first, that the latter acts under the authority of the service provider as regards the processing of those data and, second, that that assignee confines itself to processing the traffic data necessary for the purposes of recovering the claims assigned.Irrespective of the classification of the contract of assignment, the assignee is deemed to act under the authority of the service provider, within the meaning of Article 6(5) of Directive 2002/58, where, for the processing of traffic data, it acts exclusively on the instructions and under the control of that provider. In particular, the contract concluded between them must contain provisions capable of guaranteeing the lawful processing, by the assignee, of the traffic data and of enabling the service provider to ensure, at all times, that that assignee is complying with those provisions.


Disclaimer