VQ v Land Hessen (C-272/19)

Contents

Judgment of the Court (Third Chamber)9 July 2020^note(Reference for a preliminary ruling — Article 267 TFEU — Concept of court or tribunal — Protection of natural persons with regard to the processing of personal data — Regulation (EU) 2016/679 — Scope — Article 2(2)(a) — Meaning of activity which falls outside the scope of Union law — Article 4(7) — Concept of controller — Petitions Committee of the parliament of a Federated State of a Member State — Article 15 — Right of access by the data subject)In Case C‑272/19,REQUEST for a preliminary ruling under Article 267 TFEU from the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden, Germany), made by decision of 27 March 2019, received at the Court on 1 April 2019, in the proceedingsVQvLand Hessen,THE COURT (Third Chamber),composed of A. Prechal, President of the Chamber, L.S. Rossi (Rapporteur), J. Malenovský, F. Biltgen and N. Wahl, Judges,Advocate General: M. Szpunar,Registrar: A. Calot Escobar,having regard to the written procedure,after considering the observations submitted on behalf of:– VQ, by A.‑K. Pantaleon, genannt Stemberg, Rechtsanwältin,– Land Hessen, by H.‑G. Kamann, M. Braun and L. Hesse, Rechtsanwälte,– the German Government, by J. Möller, M. Hellmann and A. Berg, acting as Agents,– the Czech Government, by M. Smolek, O. Serdula and J. Vláčil, acting as Agents,– the Estonian Government, by N. Grünberg, acting as Agent,– the Polish Government, by B. Majczyna, acting as Agent,– the European Commission, by H. Krämer, D. Nardi and F. Erlbacher, acting as Agents,having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,gives the following

Judgment

1This request for a preliminary ruling concerns the interpretation of (i) Article 4(7) and Article 15 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), and (ii) Article 267 TFEU, read together with the second paragraph of Article 47 of the Charter of Fundamental Rights of the European Union (‘the Charter’).

2The request has been made in proceedings between VQ and Land Hessen (Germany) concerning the lawfulness of the rejection by the President of the Hessischer Landtag (the Parliament of Land Hessen) of VQ’s application for access to the personal data concerning him, as recorded by the Petitions Committee of that parliament.

Legal context

European Union law

Directive 95/46/EC

3Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), which was repealed by Regulation 2016/679, contained an Article 3, headed ‘Scope’, which provided:1. This Directive shall apply to the processing of personal data wholly or partly by automated means, and to the processing otherwise than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.2.This Directive shall not apply to the processing of personal data:– in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,– by a natural person in the course of a purely personal or household activity.’

Regulation 2016/679

4Recitals 16 and 20 of Regulation 2016/679 state:(16) This Regulation does not apply to issues of protection of fundamental rights and freedoms or the free flow of personal data related to activities which fall outside the scope of Union law, such as activities concerning national security. This Regulation does not apply to the processing of personal data by the Member States when carrying out activities in relation to the common foreign and security policy of the Union.…(20) While this Regulation applies, inter alia, to the activities of courts and other judicial authorities, Union or Member State law could specify the processing operations and processing procedures in relation to the processing of personal data by courts and other judicial authorities. The competence of the supervisory authorities should not cover the processing of personal data when courts are acting in their judicial capacity, in order to safeguard the independence of the judiciary in the performance of its judicial tasks, including decision-making. It should be possible to entrust supervision of such data processing operations to specific bodies within the judicial system of the Member State, which should, in particular ensure compliance with the rules of this Regulation, enhance awareness among members of the judiciary of their obligations under this Regulation and handle complaints in relation to such data processing operations.’

5Article 2 of that regulation, headed ‘Material scope’, provides:1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.2.This Regulation does not apply to the processing of personal data:(a) in the course of an activity which falls outside the scope of Union law;(b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the [Treaty on European Union];(c) by a natural person in the course of a purely personal or household activity;(d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.…’

6Article 4 of that regulation, headed ‘Definitions’, provides:‘For the purposes of this Regulation:…(7) “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be provided for by Union or Member State law;…’

7Article 15(1) of that regulation, that article being headed ‘Right of access by the data subject’, provides:‘The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:…’

8Article 23(1) of Regulation 2016/679, that article being headed ‘Restrictions’, provides:‘Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:(a) national security;(b) defence;(c) public security;(d) the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;(e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security;(f) the protection of judicial independence and judicial proceedings;(g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;(h) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (a) to (e) and (g);(i) the protection of the data subject or the rights and freedoms of others;(j) the enforcement of civil law claims.’

German law

Federal law

9Article 97 of the Grundgesetz für die Bundesrepublik Deutschland (Basic Law for the Federal Republic of Germany) provides:(1) Judges shall be independent and subject only to the law.(2) Judges duly appointed for life to full-time judicial office may be involuntarily dismissed, permanently or temporarily suspended, transferred or retired from that office before the expiry of their term of office only by virtue of a judicial decision and on the grounds and in the manner specified by the law. The legislature may set age limits for the retirement of judges appointed for life. In the event of changes in the structure of the courts or in their areas of jurisdiction, judges may be transferred to another court or removed from office, provided that they retain their full salary.’

10Paragraph 26 of the Deutsches Richtergesetz (the German Judiciary Act; ‘the DRiG’) is worded as follows:(1) A judge shall be subject to supervision only to the extent that his or her independence is not adversely affected.(2) Without prejudice to subparagraph (1), supervision shall also include the power to censure a judge for the improper performance of his or her duties and to warn him or her to perform his or her duties promptly and properly.(3) Where a judge maintains that a supervisory measure adversely affects his or her independence, a court shall, at the request of that judge, give a ruling in compliance with this Act.’

The law of Land Hessen

11Article 126 of the Verfassung des Landes Hessen (Constitution of Land Hessen) provides:(1) Judicial authority shall be exercised exclusively by the lawfully established courts and tribunals.(2) Judges shall be independent and subject only to the law.’

12Article 127 of that Constitution is worded as follows:(1) Judges duly appointed to full-time judicial office shall be appointed for life.(2) Judges shall be appointed for life only if, after temporary engagement for a probation period the duration of which is to be determined by statute, their character and judicial activity is demonstrably such as to ensure that they will perform their duties in the spirit of democracy and with understanding of society.(3) A decision on temporary engagement and appointment for life shall be made jointly by the Minister of Justice and a judicial appointments committee.…’

13Paragraph 2b of the Hessisches Richtergesetz (the Land Hessen Judiciary Act; ‘the HRiG’) states:‘The assessment of the ability, competences and professional performance of the judges shall be regulated by the Guidelines of the Minister of Justice.’

14Paragraph 3 of the HRiG provides:‘Judges shall be appointed by the Minister of Justice.’

15Paragraph 18 of the Verwaltungsgerichtsordnung (Code of Administrative Procedure), is worded as follows:‘For the purpose of covering staff requirements of a temporary nature, an established public servant having the requisite qualifications for judicial office may be appointed as an acting judge for a period of at least two years, but for no longer than the duration of his or her main office. Paragraph 15(1), first and third sentences, and (2) of the [DRiG] shall apply mutatis mutandis.’

16Paragraph 30(1) of the Hessisches Datenschutz- und Informationsfreiheitsgesetz (Law of Land Hessen on the protection of data and freedom of information), which adapts the law of Land Hessen in the area of data protection to, inter alia, Regulation 2016/679, provides:‘With the exception of Paragraphs 15 and 29, the provisions of this law shall apply to the [Parliament of Land Hessen] solely to the extent that [that parliament] plays a part in administrative matters, including the economic matters of [that parliament], staff management or the implementation of legislative provisions compliance with which is the responsibility of the President of [that parliament]. Further, [that parliament] shall adopt an internal regulation concerning data protection compatible with its constitutional status. …’

17Annex 2 to the Geschäftsordnung des Hessischen Landtags (Internal regulation of the Parliament of Land Hessen) of 16 December 1993 contains the guidelines relating to the treatment of information that is classified in the hands of the Parliament of Land Hessen of 1986, which state, in Paragraph 13 thereof, headed ‘Protection of private confidential information’:(1) In so far as the protection of personal, professional or business confidential information requires it, the files, other documents and deliberations of the committees must be kept secret. That applies in particular with respect to files relating to tax matters and petitions. …(2) The right to consult such files or documents shall be reserved to the members of the competent committee. The same applies to consultation of the minutes of deliberations of the committees on issues requiring confidentiality, within the meaning of subparagraph 1. The committee shall decide on the distribution of the minutes.’

The dispute in the main proceedings and the questions referred for a preliminary ruling

18After his submission of a petition to the Petitions Committee of the Parliament of Land Hessen, VQ applied to that committee, on the basis of Article 15 of Regulation 2016/679, for access to the personal data concerning him, recorded by that committee when dealing with his petition.

19The President of the Parliament of Land Hessen decided to reject that application, on the ground that the petition procedure constitutes a function of the parliament and that the parliament was outside the scope of Regulation 2016/679.

20On 22 March 2013, VQ brought an action before the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden, Germany) challenging the decision of the President of the Parliament of Land Hessen rejecting his application.

21That court notes that, taking into consideration, inter alia, Paragraph 13 of the guidelines relating to the treatment of information that is classified in the hands of the Parliament of Land Hessen of 1986, German law grants no right of access to personal data in the context of a petition such as that in the main proceedings.

22However, that court is uncertain, first, whether the Petitions Committee of the Parliament of Land Hessen can be categorised as a ‘public authority’, within the meaning of Article 4(7) of Regulation 2016/679, and may, in this instance, be considered to be the ‘controller’ of VQ’s personal data. If so, VQ could claim a right of access under Article 15 of that regulation.

23Regulation 2016/679 does not, however, provide any definition of the concept of ‘public authority’. In the view of the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden), that expression can be understood in a functional sense or in an institutional sense. Taking the first sense, ‘public authorities’ comprise all public bodies that carry out public administrative tasks, including, consequently, the Parliament of Land Hessen when it carries out such tasks. Taking the second sense, the Petitions Committee of that parliament is an independent body, and therefore a public authority, in the institutional sense. It does not take part in the legislative activity of that parliament given that, first, its activity has no binding effect and, second, it has no right to initiate legislation and no right to enact regulations, its actions always being dependent on a citizen’s petition being submitted and the content of the petition.

24Further, since Article 2(2) of Regulation 2016/679 does not exclude bodies or institutions acting in a judicial or legislative capacity, that provision implies that the concept of public services and therefore the concept of a public authority should be construed broadly. Accordingly, from the perspective of the right to submit a petition, there is nothing to distinguish that committee from any other administrative authority of Land Hessen.

25The Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) considers, consequently, that the Petitions Committee of the Parliament of Land Hessen is a ‘public authority’, within the meaning of Article 4(7) of that regulation and that there is no reason, in this case, to exclude a right of access under Article 15 of that regulation.

26However, that court is uncertain, in the second place, whether it itself can be considered to be a ‘court or tribunal’, within the meaning of Article 267 TFEU, read together with the second paragraph of Article 47 of the Charter, in the light of the criteria set out by the Court in that regard, in particular the criterion pertaining to the independence of the body concerned.

27In that regard, the referring body states that that the requirement of independence has two aspects. The first aspect, which is external, assumes that the body concerned exercises its functions wholly autonomously, without being subordinated to any other body and without taking orders or instructions from any source whatsoever, and is thus protected against external interventions or pressure liable to jeopardise the independent judgment of its members as regards proceedings before them. The second aspect, which is internal in nature, is linked to the concept of impartiality and seeks to ensure that an equal distance is maintained from the parties to the proceedings and their respective interests with regard to the subject matter of those proceedings. That aspect requires objectivity and the absence of any interest in the outcome of the proceedings apart from the strict application of the rule of law.

28As regards the external aspect of independence, the connection of a court or tribunal to the Ministry of Justice means that that court or tribunal cannot function wholly autonomously. In this case, the organisation of the courts or tribunals in Land Hessen is determined by the Ministry of Justice of that Land. In particular, that ministry determines the means of communication (telephone, fax, Internet and so forth) and the IT facilities, notably the ‘HessenPC’, designed for the public services, with a central service provider, the Hessische Zentrale für Datenverarbeitung (Land Hessen Centre for the data processing), which is part of the Ministry for Finance of Land Hessen. The latter ensures also the maintenance of all those facilities, so that the administrative authority has the possibility of obtaining access to all the data of the courts or tribunals.

29The mere risk of political influence being applied to the courts or tribunals, by means of, inter alia, the facilities or staff allocated by the Ministry of Justice, is sufficient to create a risk of interference in their decisions and to affect the independence of the court or tribunals in the performance of their tasks. It would be sufficient for that purpose if there was an imagined pressure to achieve rapid settlement of cases using a workload statistic managed by that ministry.

30Further, the courts or tribunals of Land Hessen have no independent control in the area of data protection, since the bulk of the processing of data is prescribed, in essence, by the Ministry of Justice of Land Hessen, with no supervision by the courts as mentioned in recital 20 of Regulation 2016/679.

31As regards the internal aspect of independence, the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) states that German constitutional law does not guarantee the institutional independence of the courts or tribunals.

32First, as is clear from Paragraphs 2b and 3 of the HRiG, the appointment, appraisal and promotion of judges, including those who are members of the referring court, are matters for the Minister of Justice of Land Hessen. It follows that the provisions of public service law are applicable to them, so that, inter alia, decisions on work-related travel abroad of judges, such as that undertaken as part of the European Judicial Training Network, have to be made by that minister.

33Next, in accordance with Paragraph 18 of the code of administrative procedure, in order to meet a temporary need for staff, a public official can be appointed as a temporary judge. Such a judge could come from a public authority which is the defendant in judicial proceedings brought before him or her.

34Moreover, the Ministry of Justice of Land Hessen records the professional contact details of all the judges in a human resources information management system which is the responsibility of the government of Land Hessen, so that all the administrative authorities of that Land can obtain access to that data, even when they may be a party in a case brought before those judges.

35Last, the Ministry of Justice also decides on the number of judges and number of posts at each court or tribunal, on the ‘non-judicial’ staff assigned, in fact, to the executive, and on the extent of the IT facilities of each court or tribunal.

36Accordingly, the court or tribunals have merely a functional independence in so far as the judges alone are independent and subject to the law, in accordance with Paragraph 126 of the Constitution of Land Hessen. However, by itself, that functional independence is insufficient to protect the court or tribunals from any external influence.

37The conclusion of the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) is that, probably, it does not satisfy the conditions laid down in the second paragraph of Article 47 of the Charter governing whether it can be regarded as an independent and impartial tribunal.

38In those circumstances, the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) decided to stay the proceedings and to refer the following questions to the Court for a preliminary ruling:(1) Is [Regulation 2016/679], in particular [its] Article 15, [headed “Right of access by the data subject”], applicable to the committee of a parliament of a Federated State of a Member State that is responsible for dealing with the petitions of citizens — in this case the Petitions Committee of the Parliament of Land Hessen — and is that committee to be regarded in that connection as a public authority within the meaning of Article 4(7) of Regulation 2016/679?(2) Is the referring court an independent and impartial court or tribunal within the meaning of Article 267 TFEU read in conjunction with the second paragraph of Article 47 of [the Charter]?’

The jurisdiction of the Court

39In its observations, the Polish Government calls into question the jurisdiction of the Court, in particular its jurisdiction to give a ruling on the second question, given that EU law does not regulate the judicial organisation of the Member States and that, consequently, that question falls solely within the scope of national law.

40Suffice it to state, in that regard, that the request for a preliminary ruling concerns the interpretation of EU law, whether of Regulation 2016/679 or of Article 267 TFEU, read together with Article 47 of the Charter.

41In those circumstances, the Court plainly has jurisdiction to give a ruling on that request in its entirety, that is, on both the first and the second question (see, to that effect, judgment of 19 November 2019, A. K. and Others (Independence of the Disciplinary Chamber of the Supreme Court), C‑585/18, C‑624/18 and C‑625/18, EU:C:2019:982, paragraphs 74 and 75).

The admissibility of the request for a preliminary ruling

42By its second question, the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) expresses doubt as to its own status as a ‘court or tribunal’, within the meaning of Article 267 TFEU, read in the light of Article 47 of the Charter. Accordingly, it is in fact inviting the Court to examine the admissibility of its request for a preliminary ruling, given that being a ‘court or tribunal’, within the meaning of Article 267, is a condition of that admissibility and, consequently, a prerequisite of the interpretation by the Court of the provision of EU law specified in the first question.

43In accordance with settled case-law, in order to determine whether a body making a reference is a ‘court or tribunal’, within the meaning of Article 267 TFEU, which is a question governed by EU law alone, and therefore to determine whether the request for a preliminary ruling is admissible, the Court takes account of a number of factors, such as whether the body is established by law, whether it is permanent, whether its jurisdiction is compulsory, whether its procedure is inter partes, whether it applies rules of law and whether it is independent (see, to that effect, judgment of 21 January 2020, Banco de Santander, C‑274/14, EU:C:2020:17, paragraph 51 and the case-law cited).

44The doubts expressed by the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) concern its own independence from the legislature or from the executive. Those doubts are based on the following circumstances: (i) the judges are appointed and promoted by the Minister of Justice; (ii) the appraisal of judges is undertaken by the Ministry of Justice according to the same rules as are applicable to public officials; (iii) the personal data and professional contact details of the judges are managed by that ministry, which thus has access to that data; (iv) to cover temporary staff requirements, public officials can be appointed as temporary judges; and (v) the Minister of Justice prescribes the external and internal organisation of the courts or tribunals, determines the allocation of staff, means of communication and IT facilities of the courts or tribunals and also decides on the work-related travel abroad undertaken by the judges.

45In that regard, it must be recalled that the independence of the judges of the Member States is of fundamental importance for the EU legal order in various respects. It is informed, first, by the principle of the rule of law, which is one of the values on which, under Article 2 TEU, the Union is founded and which are common to the Member States, and by Article 19 TEU, which gives concrete expression to that value and entrusts shared responsibility for ensuring judicial review within the EU legal order to national courts or tribunals (see, to that effect, judgment of 27 February 2018, Associação Sindical dos Juízes Portugueses, C‑64/16, EU:C:2018:117, paragraph 32). Second, that independence is a necessary condition if individuals are to be guaranteed, within the scope of EU law, the fundamental right to an independent and impartial tribunal laid down in Article 47 of the Charter, which is of cardinal importance as a guarantee of the protection of all the rights that individuals derive from EU law (see, to that effect, inter alia, judgment of 26 March 2020, Review Simpson v Council and HG v Commission, C‑542/18 RX‑II and C‑543/18 RX II, EU:C:2020:232, paragraphs 70 and 71 and the case-law cited). Last, that independence is essential to the proper working of the judicial cooperation system embodied by the preliminary ruling mechanism under Article 267 TFEU, in that that mechanism may be activated only by a body responsible for applying EU law, which satisfies, inter alia, that criterion of independence (see, in particular, judgment of 21 January 2020, Banco de Santander, C‑274/14, EU:C:2020:17, paragraph 56 and the case-law cited).

46Accordingly, in order to determine the admissibility of a request for a preliminary ruling, the criterion relating to independence which the referring body must satisfy before it can be considered to be a ‘court or tribunal’, within the meaning of Article 267 TFEU, may be assessed solely in the light of that provision.

47It follows, as stated by the European Commission, that, in this instance, that assessment must relate to the independence of the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) solely in the context of the dispute in the main proceedings, which relates, as is stated in paragraphs 22 to 25 of the present judgment, to the interpretation of EU law, namely Regulation 2016/679.

48In that regard, some factors to which the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) draws attention are plainly of no relevance for that assessment.

49That must be said, in the first place, of the rules relating to the procedures for the appointment of temporary judges, since such judges are not members of the formation of the court, in this instance, which consists solely of the President of the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden).

50As regards, in the second place, the role of the Ministry of Justice of Land Hessen with respect to the management of work-related travel of judges or the organisation of the court or tribunals, the determination of staff numbers, the management of means of communication and IT facilities, as well as the management of personal data, suffice it to state that the request for a preliminary ruling contains no information from which it can be ascertained to what extent those factors are liable to call into question, in the main proceedings, the independence of the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden).

51It remains, therefore, in essence, necessary to determine the alleged influence that the legislature or the executive are capable of exercising over judges who are members of that administrative court by reason of their involvement in the appointment, promotion and appraisal of those judges.

52In accordance with settled case-law, the guarantees of the independence and impartiality of the courts and tribunals of the Member States require rules, particularly as regards the composition of the body and the appointment and length of service of its members, and as regards grounds for withdrawal by, objection to, and dismissal of its members, in order to dispel any reasonable doubt in the minds of litigants as to the imperviousness of that body to external factors and its neutrality with respect to the interests before it (judgment of 21 January 2020, Banco de Santander, C‑274/14, EU:C:2020:17, paragraph 63 and the case-law cited).

53In that regard, the German Government states that, in this instance, the judiciary has an autonomous status within the public service, which is ensured, inter alia, by the guarantee of irremovability laid down in Paragraph 97 of the Basic Law for the Federal Republic of Germany, by the fact that there exist civil service courts with jurisdiction over judges for the judicial protection of judges, and by the appointment procedure, in which the Judicial Appointments Committee plays a crucial role. That committee, provided for in Article 127 of the Constitution of Land Hessen, is composed of seven members designated by the parliament of that Land, five members of the judiciary and, by annual rotation, the President of one of the two Bar Associations of Land Hessen. The members designated by the parliament, in proportion to the composition of that institution, serve to ensure the democratic legitimacy of that committee.

54As regards the conditions governing the appointment of the judge sitting in the referring court, it must be recalled at the outset that the mere fact that the legislative authorities play a part in the process for appointing a judge does not give rise to a relationship of subordination to those authorities or to doubts as to the judge’s impartiality, if, once appointed, he or she is not subject to any pressure and does not receive any instruction in performing the duties of his or her office (see, to that effect, judgment of 19 November 2019, A. K. and Others (Independence of the Disciplinary Chamber of the Supreme Court), C‑585/18, C‑624/18 and C‑625/18, EU:C:2019:982, paragraph 133 and the case-law cited).

55The Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) appears, however, also to have doubts as to the compatibility of the composition of the Judicial Appointments Committee with the principle of independence, given that the majority of its members are chosen by the legislature.

56However, that fact cannot, in itself, give rise to any doubt as to the independence of the referring court. The assessment of the independence of a national court or tribunal must, including from the perspective of the conditions governing the appointment of its members, be made in the light of all the relevant factors.

57It must be recalled, in that regard, that, where a national court or tribunal has submitted to the Court a number of factors which, in its view, call into question the independence of a committee involved in the appointment of judges, the Court has held that, although one or other of the factors indicated by that court or tribunal may be such as to escape criticism per se and may fall, in that case, within the competence of, and choices made by, the Member States, those factors, when taken together, in addition to the circumstances in which those choices were made, may, by contrast, throw doubt on the independence of a body involved in the procedure for the appointment of judges, despite the fact that, when those factors are taken individually, that conclusion is not inevitable (judgment of 19 November 2019, A. K. and Others (Independence of the Disciplinary Chamber of the Supreme Court), C‑585/18, C‑624/18 and C‑625/18, EU:C:2019:982, paragraph 142).

58In this instance, it cannot be concluded that a committee such as that at issue in the main proceedings is not independent solely because of the factor mentioned in paragraph 55 of the present judgment.

59As regards the conditions governing the appraisal and promotion of judges, which are also called into question by the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden), suffice it to state that the documents submitted to the Court contain no indication as to how the manner in which the executive uses its powers in that regard are such as to engender legitimate doubts, particularly in the minds of litigants, concerning whether the judge concerned is impervious to external elements and whether he or she is impartial with respect to the opposing interests that may be brought before him or her.

60In the light of the foregoing, the factors to which the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) draws attention in support of the doubts that it expresses in relation to its own independence cannot, in themselves, be sufficient ground for a conclusion that those doubts are well-founded and that that court is not independent, notwithstanding all the other rules laid down by the legal order of which that administrative tribunal forms part and designed to ensure its independence, rules which include, in particular, those mentioned in paragraph 53 of the present judgment.

61In those circumstances, the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden) must, in this instance, be considered to be a ‘court or tribunal’, within the meaning of Article 267 TFEU. The request for a preliminary ruling is therefore admissible.

62It must be made clear that that conclusion has no effect on the examination of the admissibility of the second question referred for a preliminary ruling, which, as such, is inadmissible. Since that question concerns the interpretation of Article 267 TFEU itself, which is not at issue for the purposes of resolving the dispute in the main proceedings, the interpretation requested by that question is not objectively required for the decision which must be made by the referring court (see, to that effect, order of 25 May 1998, Nour, C‑361/97, EU:C:1998:250, paragraph 15 and the case-law cited).

The request for a preliminary ruling

63By its request for a preliminary ruling, the referring court asks the Court, in essence, whether Article 4(7) of Regulation 2016/679 must be interpreted as meaning that the Petitions Committee of the parliament of a Federated State of a Member State must be categorised as a ‘controller’, within the meaning of that provision, so that the processing of personal data carried out by that committee falls within the scope of that regulation, and, in particular, of Article 15 thereof.

64In order to answer that question, it must, first, be noted that Article 4(7) of that regulation defines the ‘controller’ as being the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

65Accordingly, the definition of the concept of ‘controller’ in Regulation 2016/679 is not confined to public authorities, but, as emphasised by the Czech Government, is sufficiently wide to include any body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

66As regards, second, the observations of Land Hessen to the effect that the activities of a parliamentary committee fall outside the scope of EU law, within the meaning of Article 2(2) of Regulation 2016/679, it must be recalled that the Court has already had occasion to state, in relation to Article 3(2) of Directive 95/46, which is based on Article 100a of the EC Treaty (which became, after amendment, Article 95 EC), that recourse to that legal basis does not presuppose the existence of an actual link with free movement between Member States in every situation referred to by the measure founded on that legal base and that it is not appropriate to interpret the expression ‘activity which falls outside the scope of [Union] law’ as having a meaning which would require it to be determined in each individual case whether the specific activity at issue directly affected freedom of movement between Member States (judgment of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraphs 40 and 42).

67That applies a fortiori with respect to Regulation 2016/679, which is based on Article 16 TFEU, which states that the European Parliament and the Council of the European Union are to lay down the rules relating to the protection of individuals with regard to the processing of personal data by, in particular, Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data; Article 2(2) of that regulation corresponds, in essence, to Article 3(2) of Directive 95/46.

68Third, since Article 2(2)(a) of that regulation constitutes an exception to the very wide definition of the scope of that regulation set out in Article 2(1) of that regulation, Article 2(2)(a) must be interpreted restrictively.

69Admittedly, the Court has, in essence, stated that the activities mentioned by way of example in the first indent of Article 3(2) of Directive 95/46 (in other words, the activities provided for by Titles V and VI of the Treaty on European Union and data processing operations concerning public security, defence, State security and activities in areas of criminal law) are, in all circumstances, activities of the States or of State authorities, and those activities are intended to define the extent of the exception provided for therein, with the result that that exception applies only to the activities which are expressly listed there or which can be classified in the same category (ejusdem generis) (judgment of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraphs 43 and 44).

70However, that fact that an activity is an activity characteristic of the State or of a public authority is not sufficient ground for that exception to be automatically applicable to such an activity. It is necessary that that activity is one of the activities that are explicitly mentioned by that provision or that it can be classified in the same category as those activities.

71While the activities of the Petitions Committee of the Parliament of Land Hessen are incontestably public and are activities of that Land, that committee contributing indirectly to the parliamentary activity, the fact remains that not only are those activities political as much as administrative, but it is also not clear from the documents available to the Court that those activities correspond, in this instance, to the activities mentioned in Article 2(2)(b) and (d) of Regulation 2016/679 or that they can be classified in the same category as those activities.

72Fourth and last, no exception is provided for in Regulation 2016/679, including in recital 20 and in Article 23 of that regulation, with respect to parliamentary activities.

73Consequently, in so far as the Petitions Committee of the Parliament of Land Hessen determines, alone or with others, the purposes and means of the processing of personal data, that committee must be categorised as a ‘controller’, within the meaning of Article 4(7) of Regulation 2016/679 and consequently, Article 15 of that regulation is, in this instance, applicable.

74It follows from all the foregoing that Article 4(7) of Regulation 2016/679 must be interpreted as meaning that, in so far as a Petitions Committee of the parliament of a Federated State of a Member State determines, alone or with others, the purposes and means of the processing of personal data, that committee must be categorised as a ‘controller’, within the meaning of that provision, and consequently the processing of personal data carried out by that committee falls within the scope of that regulation and, in particular, of Article 15 thereof.

Costs

75Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

Operative part

On those grounds, the Court (Third Chamber) hereby rules: Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that, in so far as a Petitions Committee of the parliament of a Federated State of a Member State determines, alone or with others, the purposes and means of the processing of personal data, that committee must be categorised as a ‘controller’, within the meaning of that provision, and consequently the processing of personal data carried out by that committee falls within the scope of that regulation and, in particular, of Article 15 thereof.