CJEU - Judgment C-524/06 Huber 16 Dec 2008

JUDGMENT OF THE COURT (Grand Chamber)

16 December 2008 (*)

(Protection of personal data – European citizenship – Principle of non-discrimination on grounds of nationality – Directive 95/46/EC – Concept of necessity – General processing of personal data relating to citizens of the Union who are nationals of another Member State – Central register of foreign nationals)

In Case C-524/06,

REFERENCE for a preliminary ruling under Article 234 EC from the Oberverwaltungsgericht für das Land Nordrhein-Westfalen (Germany), made by decision of 15 December 2006, received at the Court on 28 December 2006, in the proceedings

Heinz Huber

Bundesrepublik Deutschland,

THE COURT (Grand Chamber),

composed of V. Skouris, President, P. Jann, C.W.A. Timmermans and K. Lenaerts, Presidents of Chambers, P. Kūris, G. Arestis, U. Lõhmus, E. Levits (Rapporteur) and L. Bay Larsen, Judges,

Advocate General: M. Poiares Maduro,

Registrar: B. Fülöp, Administrator,

having regard to the written procedure and further to the hearing on 8 January 2008,

after considering the observations submitted on behalf of:

– Mr Huber, by A. Widmann, Rechtsanwalt,

– the German Government, by M. Lumma and C. Schulze-Bahr, acting as Agents, and by Professor K. Hailbronner,

– the Belgian Government, by L. Van den Broeck, acting as Agent,

– the Danish Government, by B. Weis Fogh, acting as Agent,

– the Greek Government, by E.-M. Mamouna and K. Boskovits, acting as Agents,

– the Italian Government, by I.M. Braguglia, acting as Agent, and by W. Ferrante, avvocato dello Stato,

– the Netherlands Government, by H.G. Sevenster, C.M. Wissels and C. ten Dam, acting as Agents,

– the Finnish Government, by J. Heliskoski, acting as Agent,

– the United Kingdom Government, by E. O’Neill, acting as Agent, and J. Stratford, Barrister,

– the Commission of the European Communities, by C. Docksey and C. Ladenburger, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 3 April 2008,

gives the following

Judgment

1 This reference for a preliminary ruling concerns Article 12(1) EC, read in conjunction with Articles 17 EC and 18 EC, the first paragraph of Article 43 EC, as well as Article 7(e) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).

2 The reference was made in proceedings between Mr Huber, an Austrian national who is resident in Germany, and the Bundesrepublik Deutschland, represented by the Bundesamt für Migration und Flüchtlinge (Federal Office for Migration and Refugees) (‘the Bundesamt’), regarding Mr Huber’s request for the deletion of the data relating to him in the Central Register of Foreign Nationals (Ausländerzentralregister) (‘the AZR’).

Legal context

Community legislation

3 The eighth recital in the preamble to Directive 95/46 states:

‘Whereas, in order to remove the obstacles to flows of personal data, the level of protection of the rights and freedoms of individuals with regard to the processing of such data must be equivalent in all Member States; …’.

4 The tenth recital in the preamble to that directive adds:

‘… the approximation of [the national laws on the processing of personal data] must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community’.

5 Article 1 of Directive 95/46 is entitled ‘Object of the Directive’ and Article 1(1) provides:

‘In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.’

6 Article 2 of that directive includes the following definitions:

‘…

(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

…’.

7 The scope of application of Directive 95/46 is laid down by Article 3, in the following terms:

‘1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.

2. This Directive shall not apply to the processing of personal data:

– in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,

– by a natural person in the course of a purely personal or household activity.’

8 Article 7(e) of Directive 95/46 states:

‘Member States shall provide that personal data may be processed only if:

…

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed;

…’.

9 Article 4 of Council Directive 68/360/EEC of 15 October 1968 on the abolition of restrictions on movement and residence within the Community for workers of Member States and their families (OJ, English Special Edition 1968 (II), p. 485) provides:

‘1. Member States shall grant the right of residence in their territory to the persons referred to in Article 1 who are able to produce the documents listed in paragraph 3.

2. As proof of the right of residence, a document entitled “Residence Permit for a National of a Member State of the EEC” shall be issued. …

3. For the issue of a Residence Permit for a National of a Member State of the EEC, Member States may require only the production of the following documents:

– by the worker:

(a) the document with which he entered their territory;

(b) a confirmation of engagement from the employer or a certificate of employment;

– by the members of the worker’s family:

(d) a document issued by the competent authority of the State of origin or the State whence they came, proving their relationship;

(e) in the cases referred to in Article 10(1) and (2) of [Council Regulation (EEC) No 1612/68 of 15 October 1968 on freedom of movement for workers within the Community (OJ, English Special Edition 1968 (II), p. 475)], a document issued by the competent authority of the State of origin or the State whence they came, testifying that they are dependent on the worker or that they live under his roof in such country.

…’

10 Article 10 of Directive 68/360 provides:

‘Member States shall not derogate from the provisions of this Directive save on grounds of public policy, public security or public health.’

11 Article 4(1) of Council Directive 73/148/EEC of 21 May 1973 on the abolition of restrictions on movement and residence within the Community for nationals of Member States with regard to establishment and the provision of services (OJ 1973 L 172, p. 14) states:

‘Each Member State shall grant the right of permanent residence to nationals of other Member States who establish themselves within its territory in order to pursue activities as self-employed persons, when the restrictions on these activities have been abolished pursuant to the Treaty.

As proof of the right of residence, a document entitled “Residence Permit for a National of a Member State of the European Communities” shall be issued. This document shall be valid for not less than five years from the date of issue and shall be automatically renewable.

…’

12 Article 6 of Directive 73/148 states:

‘An applicant for a residence permit or right of abode shall not be required by a Member State to produce anything other than the following, namely:

(a) the identity card or passport with which he or she entered its territory;

(b) proof that he or she comes within one of the classes of person referred to in Articles 1 and 4.’

13 Article 8 of that directive sets out the derogation provided for in Article 10 of Directive 68/360.

14 On 29 April 2004, the European Parliament and the Council of the European Union adopted Directive 2004/38/EC on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States amending Regulation (EEC) No 1612/68 and repealing Directives 64/221/EEC, 68/360/EEC, 72/194/EEC, 73/148/EEC, 75/34/EEC, 75/35/EEC, 90/364/EEC, 90/365/EEC and 93/96/EEC (OJ 2004 L 158, p. 77, with Corrigendum, OJ 2004 L 229, p. 35), which required to be transposed by 30 April 2006. Article 5 of that directive provides:

‘1. Without prejudice to the provisions on travel documents applicable to national border controls, Member States shall grant Union citizens leave to enter their territory with a valid identity card or passport and shall grant family members who are not nationals of a Member State leave to enter their territory with a valid passport.

…

5. The Member State may require the person concerned to report his/her presence within its territory within a reasonable and non-discriminatory period of time. Failure to comply with this requirement may make the person concerned liable to proportionate and non-discriminatory sanctions.’

15 Article 7(1) of that directive governs the right of residence for a period of more than three months of Union citizens in a Member State of which they are not nationals in the following terms:

‘All Union citizens shall have the right of residence on the territory of another Member State for a period of longer than three months if they:

(a) are workers or self-employed persons in the host Member State; or

(b) have sufficient resources for themselves and their family members not to become a burden on the social assistance system of the host Member State during their period of residence and have comprehensive sickness insurance cover in the host Member State; or

(c) – are enrolled at a private or public establishment, accredited or financed by the host Member State on the basis of its legislation or administrative practice, for the principal purpose of following a course of study, including vocational training; and

– have comprehensive sickness insurance cover in the host Member State and assure the relevant national authority, by means of a declaration or by such equivalent means as they may choose, that they have sufficient resources for themselves and their family members not to become a burden on the social assistance system of the host Member State during their period of residence; or

…’.

16 Article 8 of Directive 2004/38 provides:

‘1. Without prejudice to Article 5(5), for periods of residence longer than three months, the host Member State may require Union citizens to register with the relevant authorities.

2. The deadline for registration may not be less than three months from the date of arrival. A registration certificate shall be issued immediately, stating the name and address of the person registering and the date of the registration. Failure to comply with the registration requirement may render the person concerned liable to proportionate and non-discriminatory sanctions.

3. For the registration certificate to be issued, Member States may only require that:

– Union citizens to whom point (a) of Article 7(1) applies present a valid identity card or passport, a confirmation of engagement from the employer or a certificate of employment, or proof that they are self-employed persons;

– Union citizens to whom point (b) of Article 7(1) applies present a valid identity card or passport and provide proof that they satisfy the conditions laid down therein;

– Union citizens to whom point (c) of Article 7(1) applies present a valid identity card or passport, provide proof of enrolment at an accredited establishment and of comprehensive sickness insurance cover and the declaration or equivalent means referred to in point (c) of Article 7(1). …’

17 Article 27 of that directive, entitled ‘General principles’, states:

‘1. Subject to the provisions of this Chapter, Member States may restrict the freedom of movement and residence of Union citizens and their family members, irrespective of nationality, on grounds of public policy, public security or public health. These grounds shall not be invoked to serve economic ends.

2. Measures taken on grounds of public policy or public security shall comply with the principle of proportionality and shall be based exclusively on the personal conduct of the individual concerned. Previous criminal convictions shall not in themselves constitute grounds for taking such measures.

The personal conduct of the individual concerned must represent a genuine, present and sufficiently serious threat affecting one of the fundamental interests of society. Justifications that are isolated from the particulars of the case or that rely on considerations of general prevention shall not be accepted.

3. In order to ascertain whether the person concerned represents a danger for public policy or public security, when issuing the registration certificate or, in the absence of a registration system, not later than three months from the date of arrival of the person concerned on its territory or from the date of reporting his/her presence within the territory, as provided for in Article 5(5), or when issuing the residence card, the host Member State may, should it consider this essential, request the Member State of origin and, if need be, other Member States to provide information concerning any previous police record the person concerned may have. Such enquiries shall not be made as a matter of routine. …

…’

18 Lastly, Regulation (EC) No 862/2007 of the European Parliament and of the Council of 11 July 2007 on Community statistics on migration and international protection and repealing Council Regulation (EEC) No 311/76 on the compilation of statistics on foreign workers (OJ 2007 L 199, p. 23) lays down the framework in which the Member States are to supply statistics to the Commission of the European Communities relating to migratory flows in their territories.

National legislation

19 In accordance with Paragraph 1(1) of the Law on the central register of foreign nationals (Gesetz über das Ausländerzentralregister) of 2 September 1994 (BGBl. 1994 I, p. 2265), as amended by the Law of 21 June 2005 (BGBl. 1994 I, p. 1818) (‘the AZRG’), the Bundesamt, which is attached to the Federal Ministry of the Interior, is responsible for the management of the AZR, a centralised register which contains certain personal data relating to foreign nationals who, inter alia, are resident in Germany on a basis which is not purely temporary. The foreign nationals concerned are those who reside in that territory for a period of more than three months, as is shown by the general administrative circular of the Federal Ministry of the Interior relating to the AZRG and to the regulation implementing that Law (Allgemeine Verwaltungsvorschrift des Bundesministeriums des Innern zum Gesetz über das AZR und zur AZRG-Durchführungsverordnung) of 4 June 1996. That information is collected in two databases which are managed separately. One contains personal data relating to foreign nationals who live or have lived in Germany and the other to those who have applied for a visa.

20 In accordance with Paragraph 3 of the AZRG, the first database contains, in particular, the following information:

– the name of the authority which provided the data;

– the reference number allocated by the Bundesamt;

– the grounds of registration;

– surname, surname at birth, given names, date and place of birth, sex and nationality;

– previous and other patronymics, marital status, particulars of identity documents, the last place of residence in the country of origin, and information supplied on a voluntary basis as to religion and the nationality of the spouse or partner;

– particulars of entries into and exits from the territory, residence status, decisions of the Federal Employment Agency relating to a work permit, refugee status granted by another State, date of death;

– decisions relating, inter alia, to any application for asylum, any previous application for a residence permit, and particulars of, inter alia, any expulsion proceedings, arrest warrants, suspected contraventions of the laws on drugs or immigration, and suspected participation in terrorist activities, or convictions in respect of such activities; and

– search warrants.

21 As the authority entrusted with the management of the AZR, the Bundesamt is responsible for the accuracy of the data registered in it.

22 According to Paragraph 1(2) of the AZRG, by registering and supplying personal data relating to foreign nationals, the Bundesamt assists the public authorities responsible for the application of the law on foreign nationals and the law on asylum, together with other public bodies.

23 Paragraph 10(1) of the AZRG provides that every application made by a public authority to consult the AZR or for the making available of personal data contained in it must satisfy certain conditions, compliance with which must be determined by the Bundesamt on a case-by-case basis. The Bundesamt must, in particular, examine whether the data requested by an authority are necessary for the performance of its tasks and must also examine the precise use to which those data are intended to be put. The Bundesamt may reject an application if it does not satisfy the prescribed conditions.

24 Paragraphs 14 to 21 and 25 to 27 of the Law specify the personal data which may be made available depending on the body which made the application in respect of them.

25 Thus, Paragraph 14(1) of the AZRG authorises the communication to all German public authorities of data relating to identity and domicile, as well as the date of death and particulars of the authority responsible for the file and of any decision not to make data available.

26 Paragraph 12 of the AZRG provides that applications, termed ‘group applications’, that is to say, which relate to a group of persons having one or more common characteristics, are to be subject to certain substantive and formal conditions. Such applications may be made only by a limited number of public bodies. In addition, every communication of personal data pursuant to such an application must be notified to the Federal and regional regulators responsible for the protection of personal data.

27 In addition, Paragraph 22 of the AZRG permits public bodies authorised for that purpose to consult the AZR directly through an automated procedure. However, the right to do so arises only in strictly defined circumstances and after a weighing up by the Bundesamt of the interests of the data subject and the public interest. Moreover, such consultation is allowed only in the case of so-called group applications. The public bodies having rights under Paragraph 22 of the AZRG are, by virtue of Paragraph 7 of that Law, also authorised to enter data and information directly in the AZR.

28 Lastly, Paragraphs 25 to 27 of the AZRG specify the public bodies which may obtain certain data contained in the AZR.

29 The national court adds that, in Germany, every inhabitant, whether a German national or not, must have his particulars entered in the register kept by the authorities of the district in which he resides (Einwohnermelderegister). The Commission has stated in that regard that that type of register contains only some of the data comprised in the AZR, with those relating, in particular, to a person’s status as regards his right of residence not appearing there. There are currently some 7 700 district registers.

The facts and the questions referred

30 Mr Huber, an Austrian national, moved to Germany in 1996 in order to carry on business there as a self-employed insurance agent.

31 The following data relating to him are stored in the AZR:

– his name, given name, date and place of birth, nationality, marital status, sex;

– a record of his entries into and exits from Germany, and his residence status;

– particulars of passports issued to him;

– a record of his previous statements as to domicile; and

– reference numbers issued by the Bundesamt, particulars of the authorities which supplied the data and the reference numbers used by those authorities.

32 Since he took the view that he was discriminated against by reason of the processing of the data concerning him contained in the AZR, in particular because such a database does not exist in respect of German nationals, Mr Huber requested the deletion of those data on 22 July 2000. That request was rejected on 29 September 2000 by the administrative authority which was responsible for maintaining the AZR at the time.

33 The challenge to that decision also having been unsuccessful, Mr Huber brought an action before the Verwaltungsgericht Köln (Administrative Court, Cologne) which upheld the action by judgment of 19 December 2002. The Verwaltungsgericht Köln held that the general processing, through the AZR, of data regarding a Union citizen who is not a German national constitutes a restriction of Articles 49 EC and 50 EC which cannot be justified by the objective of the swift treatment of cases relating to the right of residence of foreign nationals. In addition, that court took the view that the storage and processing of the data at issue were contrary to Articles 12 EC and 18 EC, as well as Articles 6(1)(b) and 7(e) of Directive 95/46.

34 The Bundesrepublik Deutschland, acting through the Bundesamt, brought an appeal against that judgment before the Oberverwaltungsgericht für das Land Nordrhein-Westfalen (Higher Administrative Court for the Land North-Rhine Westphalia), which considers that certain of the questions of law raised before it require an interpretation of Community law by the Court.

35 First, the national court notes that, according to the Court’s case-law, a citizen of the European Union lawfully resident in the territory of a Member State of which he is not a national can rely on Article 12 EC in all situations which fall within the scope of Community law. It refers in that regard to Case C-85/96 Martínez Sala [1998] ECR I-2691, paragraph 63; Case C-184/99 Grzelczyk [2001] ECR I-6193, paragraph 32; and Case C-209/03 Bidar [2005] ECR I-2119, paragraph 32. Accordingly, having exercised the right to the freedom of movement conferred on him by Article 18(1) EC, Mr Huber was entitled to rely on the prohibition of discrimination laid down by Article 12 EC.

36 The national court states that the general processing of personal data relating to Mr Huber in the AZR differs from the processing of data relating to a German national in two respects: first, some of the data relating to Mr Huber are stored not only in the register of the district in which he resides but also in the AZR, and, secondly, the AZR contains additional data.

37 The national court doubts whether such a difference in treatment can be justified by the need to monitor the residence of foreign nationals in Germany. It also raises the question whether the general processing of personal data relating to Union citizens who are not German nationals and who reside or have resided in Germany is proportionate to the objective of protecting public security, inasmuch as the AZR covers all of those citizens and not only those who are subject to an expulsion order or a prohibition on residing in Germany.

38 Secondly, the national court is of the opinion that, in the circumstances of the main proceedings, Mr Huber falls within the scope of application of Article 43 EC. Since the freedom of establishment extends not only to the taking up of activities as a self-employed person but also the framework conditions for that activity, the national court raises the question whether the general processing of data relating to Mr Huber in the AZR is liable to affect those conditions to such an extent that it comprises a restriction on the exercise of that freedom.

39 Thirdly, the national court raises the question whether the criterion of necessity imposed by Article 7(e) of Directive 95/46 can be a criterion for assessing a system of general data processing such as the system put in place under the AZR. The national court does not, in fact, rule out the possibility that the directive may leave it open to the national legislature itself to define that requirement of necessity. However, should that not be the case, the question arises how that requirement is to be understood, and more particularly whether the objective of administrative simplification might justify data processing of the kind put in place by the AZRG.

40 In those circumstances, the Oberverwaltungsgericht für das Land Nordrhein-Westfalen decided to stay the proceedings and refer the following questions to the Court of Justice for a preliminary ruling:

‘(1) Is the general processing of personal data of foreign citizens of the Union in a central register of foreign nationals compatible with … the prohibition of discrimination on grounds of nationality against citizens of the Union who exercise their right to move and reside freely within the territory of the Member States (Article 12(1) EC, in conjunction with Articles 17 EC and 18(1) EC)[?]

(2) [Is such processing compatible with] the prohibition of restrictions on the freedom of establishment of nationals of a Member State in the territory of another Member State (first paragraph of Article 43 EC)[?]

(3) [Is such treatment compatible with] the requirement of necessity under Article 7(e) of Directive 95/46 …?’

The questions referred

Preliminary observations

41 By its questions, the national court asks the Court whether the processing of personal data which is undertaken in a register such as the AZR is compatible with Community law.

42 In that regard, it must be noted that Paragraph 1(2) of the AZRG provides that, through the storage of certain personal data relating to foreign nationals in the AZR and the making available of those data, the Bundesamt, which is responsible for maintaining that register, assists the public authorities responsible for the application of the legislation relating to the law on foreign nationals and the law on asylum, together with other public bodies. In particular, the German Government has stated in its written observations that the AZR is used for statistical purposes and on the exercise by the security and police services and by the judicial authorities of their powers in relation to the prosecution and investigation of activities which are criminal or threaten public security.

43 At the outset, it must be stated that data such as those which, according to the order for reference, the AZR contains in relation to Mr Huber constitute personal data within the meaning of Article 2(a) of Directive 95/46, because they represent ‘information relating to an identified or identifiable natural person’. Their collection, storage and transmission by the body responsible for the management of the register in which they are kept thus represents the ‘processing of personal data’ within the meaning of Article 2(b) of that directive.

44 However, Article 3(2) of Directive 95/46 expressly excludes from its scope of application, inter alia, the processing of personal data concerning public security, defence, State security and the activities of the State in areas of criminal law.

45 It follows that, while the processing of personal data for the purposes of the application of the legislation relating to the right of residence and for statistical purposes falls within the scope of application of Directive 95/46, the position is otherwise where the objective of processing those data is connected with the fight against crime.

46 Consequently, the compatibility with Community law of the processing of personal data undertaken through a register such as the AZR should be examined, first, in the context of its function of providing support to the authorities responsible for the application of the legislation relating to the right of residence and to its use for statistical purposes, by having regard to Directive 95/46 and more particularly, in view of the third question, to the condition of necessity laid down by Article 7(e) of that directive, as interpreted in the light of the requirements of the Treaty including in particular the prohibition of any discrimination on grounds of nationality under Article 12(1) EC, and, secondly, in the context of its function in the fight against crime, by having regard to primary Community law.

The processing of personal data for the purpose of the application of the legislation relating to the right of residence and for statistical purposes

The concept of necessity

47 Article 1 of Directive 95/46 requires Member States to ensure the protection of the fundamental rights and freedoms of natural persons, and in particular their privacy, in relation to the handling of personal data.

48 Chapter II of Directive 95/46, entitled ‘General rules on the lawfulness of the processing of personal data’, provides that, subject to the exceptions permitted under Article 13, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and, secondly, with one of the criteria for making data processing legitimate listed in Article 7 (see, to that effect, Joined Cases C-465/00, C-138/01 and C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989, paragraph 65).

49 In particular, Article 7(e) provides that personal data may lawfully be processed if ‘it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed’.

50 In that context, it must be noted that Directive 95/46 is intended, as appears from the eighth recital in the preamble thereto, to ensure that the level of protection of the rights and freedoms of individuals with regard to the processing of personal data is equivalent in all Member States. The tenth recital adds that the approximation of the national laws applicable in this area must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community.

51 Thus, it has been held that the harmonisation of those national laws is not limited to minimal harmonisation but amounts to harmonisation which is generally complete (see Case C-101/01 Lindqvist [2003] ECR I-12971, paragraph 96).

52 Consequently, having regard to the objective of ensuring an equivalent level of protection in all Member States, the concept of necessity laid down by Article 7(e) of Directive 95/46, the purpose of which is to delimit precisely one of the situations in which the processing of personal data is lawful, cannot have a meaning which varies between the Member States. It therefore follows that what is at issue is a concept which has its own independent meaning in Community law and which must be interpreted in a manner which fully reflects the objective of that directive, as laid down in Article 1(1) thereof.

The necessity for the processing of personal data, such as the processing undertaken through the AZR, for the purpose of the application of the legislation relating to the right of residence and for statistical purposes

53 It is apparent from the order for reference that the AZR is a centralised register which contains certain personal data relating to Union citizens who are not German nationals and that it may be consulted by a number of public and private bodies.

54 As regards the use of a register such as the AZR for the purpose of the application of the legislation relating to the right of residence, it is important to bear in mind that, as Community law presently stands, the right of free movement of a Union citizen in the territory of a Member State of which he is not a national is not unconditional but may be subject to the limitations and conditions imposed by the Treaty and by the measures adopted to give it effect (see, to that effect, Case C-33/07 Jippa [2008] ECR I-0000, paragraph 21 and the case-law cited).

55 Thus, Article 4 of Directive 68/360, read in conjunction with Article 1 thereof, and Article 6 of Directive 73/148, read in conjunction with Article 1 thereof, provided that, in order for a national of a Member State to be entitled to reside for a period of more than three months in the territory of another Member State, that person had to belong to one of the categories laid down by those directives and provided for that entitlement to be subject to certain formalities linked to the presentation or the provision by the applicant of a residence permit together with various documents and particulars.

56 In addition, Article 10 of Directive 68/360 and Article 8 of Directive 73/148 permitted Member States to derogate from the provisions of those directives on grounds of public policy, public security or public health and to limit the right of entry and residence of a national of another Member State in their territory.

57 While Directive 2004/38, which fell to be transposed by 30 April 2006 and which accordingly did not apply at the time of the facts of the present case, repealed both of the abovementioned directives, it sets out, in Article 7, conditions which are generally equivalent to those laid down under its predecessors as regards the right of residence of nationals of other Member States and, in Article 27(1), restrictions relating to that right which are essentially identical to those laid down under its predecessors. It also provides, in Article 8(1), that the host Member State may require every Union citizen who is a national of another Member State and who wishes to reside in its territory for a period of more than three months to register with the relevant authorities. In that regard, the host Member State may, by virtue of Article 8(3), require certain documents and particulars to be provided in order to enable those authorities to determine that the conditions for entitlement to a right of residence are satisfied.

58 It must therefore be held that it is necessary for a Member State to have the relevant particulars and documents available to it in order to ascertain, within the framework laid down under the applicable Community legislation, whether a right of residence in its territory exists in relation to a national of another Member State and to establish that there are no grounds which would justify a restriction on that right. It follows that the use of a register such as the AZR for the purpose of providing support to the authorities responsible for the application of the legislation relating to the right of residence is, in principle, legitimate and, having regard to its nature, compatible with the prohibition of discrimination on grounds of nationality laid down by Article 12(1) EC.

59 However, such a register must not contain any information other than what is necessary for that purpose. In that regard, as Community law presently stands, the processing of personal data contained in the documents referred to in Articles 8(3) and 27(1) of Directive 2004/38 must be considered to be necessary, within the meaning of Article 7(e) of Directive 95/46, for the application of the legislation relating to the right of residence.

60 Moreover, while the collection of the data required for the application of the legislation relating to the right of residence would be of no practical benefit if those data were not to be stored, it must be emphasised that, since a change in the personal situation of a party entitled to a right of residence may have an impact on his status in relation to that right, it is incumbent on the authority responsible for a register such as the AZR to ensure that the data which are stored are, where appropriate, brought up to date so that, first, they reflect the actual situation of the data subjects and, secondly, irrelevant data are removed from that register.

61 As regards the detailed rules for the use of such a register for the purposes of the application of the legislation relating to the right of residence, only the grant of access to authorities having powers in that field could be considered to be necessary within the meaning of Article 7(e) of Directive 95/46.

62 Lastly, with respect to the necessity that a centralised register such as the AZR be available in order to meet the requirements of the authorities responsible for the application of the legislation relating to the right of residence, even if it were to be assumed that decentralised registers such as the district population registers contain all the data which are relevant for the purposes of allowing the authorities to undertake their duties, the centralisation of those data could be necessary, within the meaning of Article 7(e) of Directive 95/46, if it contributes to the more effective application of that legislation as regards the right of residence of Union citizens who wish to reside in a Member State of which they are not nationals.

63 As regards the statistical function of a register such as the AZR, it must be recalled that, by creating the principle of freedom of movement for persons and by conferring on any person falling within its ambit the right of access to the territory of the Member States for the purposes intended by the Treaty, Community law has not excluded the power of Member States to adopt measures enabling the national authorities to have an exact knowledge of population movements affecting their territory (see Case 118/75 Watson and Belmann [1976] ECR 1185, paragraph 17).

64 Similarly, Regulation No 862/2007, which provides for the transmission of statistics relating to migratory flows in the territory of the Member States, presupposes that information will be collected by those States which allows those statistics to be determined.

65 However, the exercise of that power does not, of itself, mean that the collection and storage of individualised personal information in a register such as the AZR is necessary, within the meaning of Article 7(e) of Directive 95/46. As the Advocate General stated at point 23 of his Opinion, it is only anonymous information that requires to be processed in order for such an objective to be attained.

66 It follows from all of the above that a system for processing personal data relating to Union citizens who are not nationals of the Member State concerned, such as that put in place by the AZRG and having as its object the provision of support to the national authorities responsible for the application of the legislation relating to the right of residence, does not satisfy the requirement of necessity laid down by Article 7(e) of Directive 95/46, interpreted in the light of the prohibition on any discrimination on grounds of nationality, unless:

– it contains only the data which are necessary for the application by those authorities of that legislation, and

– its centralised nature enables that legislation to be more effectively applied as regards the right of residence of Union citizens who are not nationals of that Member State.

67 It is for the national court to ascertain whether those conditions are satisfied in the main proceedings.

68 The storage and processing of personal data containing individualised personal information in a register such as the AZR for statistical purposes cannot, on any basis, be considered to be necessary within the meaning of Article 7(e) of Directive 95/46.

The processing of personal data relating to Union citizens who are nationals of other Member States for the purposes of fighting crime

69 As a preliminary point, it should be noted that, according to settled case-law, citizenship of the Union is destined to be the fundamental status of nationals of the Member States, enabling those who find themselves in the same situation to receive the same treatment in law irrespective of their nationality, subject to such exceptions as are expressly provided for (see, to that effect, Grzelczyk, paragraphs 30 and 31; Case C-148/02 Garcia Avello [2003] ECR I-11613, paragraphs 22 and 23; and Bidar, paragraph 31).

70 In that regard, a Union citizen lawfully resident in the territory of the host Member State can rely on Article 12 EC in all situations which fall within the scope ratione materiae of Community law (see Martínez Sala, paragraph 63; Grzelczyk, paragraph 32; and Bidar, paragraph 32).

71 Those situations include those involving the exercise of the fundamental freedoms guaranteed by the Treaty and those involving the exercise of the right to move and reside within the territory of the Member States, as conferred by Article 18 EC (see, to that effect, Bidar, paragraph 33 and the case-law cited).

72 It is apparent from Paragraph 1 of the AZRG, read in conjunction with the general administrative circular of the Federal Ministry of the Interior of 4 June 1996 relating to the AZRG and to the regulation implementing that Law, that the system of storage and processing of personal data put in place through the AZR concerns all Union citizens who are not nationals of the Federal Republic of Germany and who reside in Germany for a period of over three months, irrespective of the reasons which lead them to reside there.

73 That being the case, since Mr Huber exercised his freedom to move and reside within that territory as conferred by Article 18 EC, reference should, having regard to the circumstances of the main proceedings, be made to Article 12(1) EC in order to determine whether a system for the storage and processing of personal data such as that at issue in the main proceedings is compatible with the principle that any discrimination on grounds of nationality is prohibited, in so far as those data are stored and processed for the purposes of fighting crime.

74 In that context, it should be pointed out that the order for reference does not contain any detailed information which would allow it to be established whether the situation at issue in the main proceedings is covered by Article 43 EC. However, even if the national court were to consider that to be the case, the application of the principle of non-discrimination cannot vary depending on whether it finds its basis in that provision or on Article 12(1) EC, read in conjunction with Article 18(1) EC.

75 It is settled case-law that the principle of non-discrimination, which has its basis in Articles 12 EC and 43 EC, requires that comparable situations must not be treated differently and that different situations must not be treated in the same way. Such treatment may be justified only if it is based on objective considerations independent of the nationality of the persons concerned and is proportionate to the objective being legitimately pursued (see, to that effect, Case C-164/07 Wood [2008] ECR I-0000, paragraph 13 and the case-law cited).

76 It is therefore, in circumstances such as those at issue in the main proceedings, necessary to compare the situation of Union citizens who are not nationals of the Member State concerned and who are resident in the territory of that Member State with that of nationals of that Member State as regards the objective of fighting crime. In fact, the German Government relies only on that aspect of the protection of public order.

77 Although that objective is a legitimate one, it cannot be relied on in order to justify the systematic processing of personal data when that processing is restricted to the data of Union citizens who are not nationals of the Member State concerned.

78 As the Advocate General noted at point 21 of his Opinion, the fight against crime, in the general sense in which that term is used by the German Government in its observations, necessarily involves the prosecution of crimes and offences committed, irrespective of the nationality of their perpetrators.

79 It follows that, as regards a Member State, the situation of its nationals cannot, as regards the objective of fighting crime, be different from that of Union citizens who are not nationals of that Member State and who are resident in its territory.

80 Therefore, the difference in treatment between those nationals and those Union citizens which arises by virtue of the systematic processing of personal data relating only to Union citizens who are not nationals of the Member State concerned for the purposes of fighting crime constitutes discrimination which is prohibited by Article 12(1) EC.

81 Consequently, Article 12(1) EC must be interpreted as meaning that it precludes the putting in place by a Member State, for the purpose of fighting crime, of a system for processing personal data specific to Union citizens who are not nationals of that Member State.

Costs

82 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Grand Chamber) hereby rules:

1. A system for processing personal data relating to Union citizens who are not nationals of the Member State concerned, such as that put in place by the Law on the central register of foreign nationals (Gesetz über das Ausländerzentralregister) of 2 September 1994, as amended by the Law of 21 June 2005, and having as its object the provision of support to the national authorities responsible for the application of the law relating to the right of residence does not satisfy the requirement of necessity laid down by Article 7(e) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, interpreted in the light of the prohibition on any discrimination on grounds of nationality, unless:

– it contains only the data which are necessary for the application by those authorities of that legislation, and

– its centralised nature enables the legislation relating to the right of residence to be more effectively applied as regards Union citizens who are not nationals of that Member State.

It is for the national court to ascertain whether those conditions are satisfied in the main proceedings.

The storage and processing of personal data containing individualised personal information in a register such as the Central Register of Foreign Nationals for statistical purposes cannot, on any basis, be considered to be necessary within the meaning of Article 7(e) of Directive 95/46.

2. Article 12(1) EC must be interpreted as meaning that it precludes the putting in place by a Member State, for the purpose of fighting crime, of a system for processing personal data specific to Union citizens who are not nationals of that Member State.

[Signatures]

* Language of the case: German.

Judgment of 16 Dec 2008, C-524/06 (Huber)