Referral C-60/22 (Bundesrepublik Deutschland, 1 Feb 2022)

1. Does the failure of a controller to discharge or fully to discharge its obligation of accountability under Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), for example due to the lack of a record – or a complete record – of processing activities in accordance with Article 30 of the GDPR or the lack of an arrangement for a joint procedure in accordance with Article 26 of the GDPR, result in the data processing in question being unlawful within the meaning of Article 17(1)(d) of the GDPR and Article 18(1)(b) of the GDPR, so that the data subject has a right to erasure or restriction?

2. If Question 1 is answered in the affirmative, does the existence of a right to erasure or restriction have the consequence that the data processed must not be taken into account in judicial proceedings? Is that the case in any event where the data subject objects to the use of the data in the judicial proceedings?

3. If Question 1 is answered in the negative, does an infringement by a controller of Article 5, 30 or 26 of the GDPR have the consequence that, with regard to the question as to the use of the processed data in judicial proceedings, a national court may take the data into account only if the data subject expressly consents to that use?