CJEU - C-461/22 MK 11 Jul 2024

JUDGMENT OF THE COURT (Ninth Chamber)

11 July 2024 (*)

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 2(2)(c) – Scope – Exclusion – Purely personal or household activity – Article 4(7) – Controller – Former guardian who performed his or her duties in a professional capacity – Article 15 – Access of the person who has been placed under legal guardianship to data collected by that former guardian during the performance of his or her duties)

In Case C-461/22,

REQUEST for a preliminary ruling under Article 267 TFEU from the Landgericht Hannover (Regional Court, Hanover, Germany), made by decision of 28 June 2022, received at the Court on 12 July 2022, in the proceedings

WB,

THE COURT (Ninth Chamber),

composed of O. Spineanu-Matei, President of the Chamber, J.-C. Bonichot and L.S. Rossi (Rapporteur), Judges,

Advocate General: P. Pikamäe,

Registrar: A. Calot Escobar,

having regard to the written procedure,

after considering the observations submitted on behalf of:

– the European Commission, by A. Bouchagiar, F. Erlbacher and H. Kranenborg, acting as Agents,

having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,

gives the following

Judgment

1 This request for a preliminary ruling concerns the interpretation of Article 4(7) and Article 15 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).

2 The request has been made in proceedings between MK, a natural person residing in Germany and placed under legal guardianship, and WB, his former guardian, on the subject of that person’s access to data and information concerning him, collected by WB while he was charged with his guardianship.

Legal context

European Union law

3 Under recital 18 of the GDPR:

‘This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.’

4 Article 2 of that regulation, headed ‘Material scope’, provides:

‘1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

2. This Regulation does not apply to the processing of personal data:

…

…’

5 Article 4 of the regulation, entitled ‘Definitions’, is worded as follows:

‘For the purposes of this Regulation:

…

(7) “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

…’

6 Article 15 of that regulation, entitled ‘Right of access by the data subject’, provides:

‘1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

…

3. The controller shall provide a copy of the personal data undergoing processing. …

…’

German law

7 The first sentence of Paragraph 1896(1) of the Bürgerliches Gesetzbuch (German Civil Code), in the version published on 2 January 2002 (BGBl. 2002 I, p. 42) (‘the BGB’), provides that, where an adult is unable to manage his or her affairs in whole or in part by reason of a mental illness or a physical, intellectual or sensory disability, the guardianship court shall appoint a guardian for him or her on application by him or her or of its own motion.

8 According to Paragraph 1897(1) of the BGB, the guardianship court shall appoint as a guardian a natural person who is suitable for legally managing the affairs of the person under guardianship and to assist him or her personally. Paragraph 1897(6) of the BGB states that persons who perform guardianship in a professional capacity shall be appointed as a guardian only if there is no other suitable person willing to act as a guardian.

9 In accordance with Paragraph 1902 of the BGB, as part of the duties within his or her areas of responsibility, the guardian shall represent the person under guardianship both in and out of court.

The dispute in the main proceedings and the questions referred for a preliminary ruling

10 WB, a German lawyer, and a member of MK’s personal circle, was appointed by a German court to exercise, in the context of his professional activities, the duties of a guardian of MK for a certain period, until he was relieved of those duties and a new guardian was appointed.

11 MK wishes to bring an action in order to gain a rendering of accounts and access, in accordance with Article 15 of the GDPR, to the personal data concerning him that WB collected while performing those duties.

12 To that end, MK made an application for legal aid to the Amtsgericht Hannover (Local Court, Hanover, Germany), which refused that application in so far as it concerned the introduction of a request for information under Article 15 of the GDPR, on the ground that a guardian performing his or her duties in the context of his or her professional activities does not constitute a ‘controller’ within the meaning of Article 4(7) of that regulation. Furthermore, the GDPR regulates the relationship between a data subject and a controller. Under Paragraph 1902 of the BGB, a legal guardian is the legal representative of the person concerned. Consequently, the guardian may process the personal data on behalf of the person concerned without there being a ‘dichotomy between the guardian and the person concerned’, according to the expression used in the case-law of the German courts.

13 MK challenged the rejection of his application for legal aid before the referring court.

14 That court entertains doubts as to the question of whether a person who has acted as a guardian in a professional capacity may be classified as a ‘controller’ within the meaning of the GDPR.

15 In addition, that court wonders whether, in view of Article 2(2)(c) of the GDPR, that regulation applies in the main proceedings, since WB is a member of MK’s personal circle, although it did not formally submit a question for a preliminary ruling in that regard.

16 In those circumstances, the Landgericht Hannover (Regional Court, Hanover, Germany) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1) Is a legally appointed [guardian] who performs that activity in a professional capacity a controller within the meaning of Article 4(7) of [the GDPR]?

(2) Is he or she required to provide information in accordance with Article 15 of the GDPR?’

Admissibility of the request for a preliminary ruling

17 According to the European Commission, the request for a preliminary ruling does not comply with Article 94(c) of the Rules of Procedure of the Court of Justice, since it does not contain a sufficient description of the reasons which led the referring court to inquire about the interpretation of the provisions of EU law at issue. The referring court simply criticises the decision of the Amtsgericht Hannover (Local Court, Hanover), without setting out the reasons which led it to doubt that court’s interpretation of the GDPR.

18 In that regard, it should be borne in mind that the need to arrive at an interpretation of EU law which will be of use to the referring court requires that court to define the factual and legislative context of the questions it is asking, or at the very least to explain the factual circumstances on which those questions are based. The requirements concerning the content of a request for a preliminary ruling are expressly set out in Article 94 of the Rules of Procedure of the Court, of which the referring court should, in the context of the cooperation instituted by Article 267 TFEU, be aware and which it is bound to observe scrupulously (judgment of 5 July 2016, Ognyanov, C-614/14, EU:C:2016:514, paragraphs 18 and 19 and the case-law cited).

19 In this case, the referring court is uncertain as to whether the interpretation of the GDPR adopted by the Amtsgericht Hannover (Local Court, Hanover) – according to which, in essence, that regulation is not applicable to the dispute in the main proceedings and, in any event, a former guardian may not be considered to be a ‘controller’, within the meaning of the regulation – is correct. While it is true that the referring court does not provide the reasons that led it to doubt that interpretation, the fact remains that it sets out in a precise manner the reasoning of the Amtsgericht Hannover (Local Court, Hanover), which allows the scope of the questions asked to be understood.

20 Moreover, the interpretation of those provisions is relevant for the purpose of the ruling on the dispute in the main proceedings, since the application for legal aid submitted by MK was made for the purpose of bringing an action based on Article 15 of the GDPR, the application of which presupposes an interpretation of the concept of ‘controller’, within the meaning of Article 4(7) of that regulation.

21 Consequently, the request for a preliminary ruling is admissible.

Consideration of the questions referred

22 By its questions, which it is appropriate to consider together, the referring court asks, in essence, whether Article 4(7) of the GDPR must be interpreted as meaning that a former guardian who performed his or her duties in a professional capacity with regard to a person placed under his or her guardianship must be classified as a ‘controller’, within the meaning of that provision, of the personal data of that person in his or her possession and that such processing must comply with all the provisions of that regulation, including Article 15 thereof.

23 At the outset, it should be clarified, in response to the doubts expressed by that court concerning the application of the GDPR to the dispute before it that, under Article 2(2)(c) of the regulation, the scope of which is clarified by recital 18 thereof, that regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity, thus having no connection with a professional or commercial activity.

24 That provision cannot be interpreted as excluding the activity of a guardian acting in a professional capacity by a natural person from the scope of the GDPR.

25 The fact, mentioned by the referring court, that the guardian at issue in the main proceedings was chosen from the personal circle of the person placed under his or her guardianship, cannot call that conclusion into question.

26 As regards the question of whether a former guardian having performed his or her duties in a professional capacity, in respect of a person placed under his or her guardianship, must be classified as a ‘controller’ of personal data concerning that person, it should be noted that a guardian, due to the responsibilities attributed to him or her by national law, is required to perform various activities for that person, in the context of which that guardian also determines the purposes and means of the processing of that person’s personal data, within the meaning of Article 4(7) of the GDPR.

27 The doubts of the referring court relate to the fact that, in accordance with the rules of German law governing guardianship, the guardian is the legal representative of the person placed under his or her guardianship and acts on behalf of and in the name of that person.

28 However, as clarified by the referring court itself in this case, MK requests, in any event, access to the personal data concerning him held, not by his present guardian, but by his former guardian, WB, now relieved of his duties, and which is still in WB’s possession.

29 As the Commission notes, a former guardian is a third party in relation to a person who was placed under his or her guardianship in the past.

30 It follows that a former guardian who performed his or her duties in a professional capacity in respect of a person placed under his or her guardianship must be classified as a ‘controller’ of the personal data in his or her possession concerning that person and that he or she is, consequently, required to process those data with due regard to the GDPR and, especially, his or her obligations under Article 15 thereof, as possibly limited pursuant to Article 23 of that regulation (see, to that effect, judgment of 16 January 2024, Österreichische Datenschutzbehörde, C-33/22, EU:C:2024:46, paragraphs 54 to 56).

31 In the light of all the foregoing considerations, the answer to the questions referred is that Article 4(7) of Regulation 2016/679 must be interpreted as meaning that a former guardian who performed his or her duties in a professional capacity in respect of a person placed under his or her guardianship must be classified as a ‘controller’, within the meaning of that provision, of the personal data in his or her possession concerning that person and that such processing must comply with all the provisions of that regulation, including Article 15 thereof.

Costs

32 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Ninth Chamber) hereby rules:

Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as meaning that a former guardian who performed his or her duties in a professional capacity in respect of a person placed under his or her guardianship must be classified as a ‘controller’, within the meaning of that provision, of personal data in his or her possession concerning that person and that such processing must comply with all the provisions of that regulation, including Article 15 thereof.

[Signatures]

* Language of the case: German.

of 11 Jul 2024, C-461/22 (MK)