Referral C-638/23 (Amt der Tiroler Landesregierung, 24 Oct 2023)

Is Article 4(7) of Regulation (EU) 2016/679 1 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; GDPR), to be interpreted as precluding application of a provision of national law (such as, in the present case, Paragraph 2(1) of the Tiroler Datenverarbeitungsgesetz (Tyrol Law on data processing)) in which a particular controller is provided for within the meaning of the second part of Article 4(7) of the GDPR but

– this is merely a service (such as, in the present case, the Amt der Tiroler Landesregierung (Office of the Provincial Government of Tyrol)) which, although established by law, is not a natural or legal person nor, in the present case, an authority, but functions merely as an auxiliary apparatus for such an authority and has no full or partial legal capacity of its own;

– is nominated without reference to specific processing of personal data, with the result that the purposes and means of specific processing of personal data are not determined by Member State law either;

– neither alone nor jointly with others determined the purposes and means of the processing of personal data at issue in the present case?