Contents
Judgment of the Court (First Chamber)10 December 2020note(Reference for a preliminary ruling — Personal data — Regulation (EU) 2016/679 — Article 23 — Restriction of the rights of data subjects — Important financial interest — Enforcement of civil law claims — National legislation referring to provisions of EU law — Tax data concerning a legal person — Lack of jurisdiction of the Court of Justice)In Case C‑620/19,REQUEST for a preliminary ruling under Article 267 TFEU from the Bundesverwaltungsgericht (Federal Administrative Court, Germany), made by decision of 4 July 2019, received at the Court on 20 August 2019, in the proceedingsLand Nordrhein-WestfalenvD.-H. T., acting as insolvency administrator of J & S Service UG,intervener:Vertreter des Bundesinteresses beim Bundesverwaltungsgericht,THE COURT (First Chamber),composed of J.‑C. Bonichot, President of the Chamber, L. Bay Larsen, C. Toader (Rapporteur), M. Safjan and N. Jääskinen, Judges,Advocate General: M. Bobek,Registrar: A. Calot Escobar,having regard to the written procedure,after considering the observations submitted on behalf of:– Land Nordrhein-Westfalen, by M. Kottmann and C. Mensching, Rechtsanwälte,– the German Government, by J. Möller and D. Klebs, acting as Agents,– the Czech Government, by M. Smolek, O. Serdula and J. Vláčil, acting as Agents,– the Polish Government, by B. Majczyna, acting as Agent,– the European Commission, initially by H. Kranenborg, D. Nardi and K. Kaiser and then by H. Kranenborg, D. Nardi and F. Erlbacher, acting as Agents,after hearing the Opinion of the Advocate General at the sitting on 3 September 2020,gives the following
Judgment
1This request for a preliminary ruling concerns the interpretation of Article 23(1)(e) and (j) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).
2The request has been made in proceedings between Land Nordrhein-Westfalen and D.-H. T., acting as insolvency administrator of J & S Service UG, concerning a request for tax data about that company.
Legal context
European Union law
3Recitals 2, 4, 14 and 73 of the GDPR state as follows:(2) The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data. ……(4) The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter [of Fundamental Rights of the European Union] as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.…(14) …This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.…(73) Restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, the right to object, decisions based on profiling, as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers may be imposed by Union or Member State law, as far as necessary and proportionate in a democratic society to safeguard public security, including the protection of human life especially in response to natural or manmade disasters, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, or of breaches of ethics for regulated professions, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest, further processing of archived personal data to provide specific information related to the political behaviour under former totalitarian state regimes or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes. Those restrictions should be in accordance with the requirements set out in the Charter [of Fundamental Rights of the European Union] and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.’
4Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides:1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.’
5Article 4 of that regulation, entitled ‘Definitions’, provides in paragraph 1 that the concept of ‘personal data’ is to be understood as meaning ‘any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’.
6According to paragraph 1 of Article 15 of that regulation, entitled ‘Right of access by the data subject’, a data subject is to have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to those personal data and certain information listed in that paragraph.
7Article 23 of the GDPR, entitled ‘Restrictions’, provides as follows in paragraph 1:‘Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:…(e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security;…(j) the enforcement of civil law claims.’
German law
The German Tax Code
8The Abgabenordnung (Tax Code) (BGBl. I 2002, p. 3866), in the version applicable to the dispute in the main proceedings (‘the Tax Code’) provides, in Paragraph 2a, entitled ‘Scope of the provisions relating to the processing of personal data’:‘…(3) The provisions of this Law and the tax laws relating to the processing of personal data do not apply where European Union law, in particular [the GDPR] applies directly in the version valid in each case or in accordance with subparagraph (5).…(5)Unless stated otherwise, the provisions of [the GDPR], of this Law and of the tax laws relating to the processing of personal data of natural persons apply correspondingly to information relating to identified or identifiable(1) deceased natural persons or(2) legal persons and associations of persons, with or without legal personality, or special-purpose bodies.’
9Paragraph 32b of the Tax Code, entitled ‘Duty of the financial authority to provide information where personal data have not been obtained from the data subject’, states as follows:(1)The duty on the part of the financial authority to provide information relating to the data subject in accordance with Article 14(1), (2) and (4) of [the GDPR], in addition to the exceptions laid down in Article 14(5) of [the GDPR] and Paragraph 31c(2) [of this code], does not exist1. where the provision of the information(a) would be prejudicial to the proper performance of the tasks within the competence of the financial authority or other public bodies within the meaning of Article 23(1)(d) to(h) of [the GDPR], or…and therefore the interest of the data subject with respect to the provision of information has to be of secondary importance. Paragraph 32a(2) [of this code] applies correspondingly.…’
10According to Paragraph 32c of that code, entitled ‘Right of access by the data subject’:1.The right of access by the data subject vis-à-vis a financial authority in accordance with Article 15 of [the GDPR] does not exist where(1) the data subject does not have to be informed pursuant to Paragraph 32b(1) or (2) [of this code];(2) the provision of information would adversely affect the legal entity of the financial authority in the establishment, exercise or defence of civil law claims or in the defence of civil law claims established against it within the meaning of Article 23(1)(j) of [the GDPR]; duties on the part of the financial authority to provide information under civil law remain unaffected;…’
11Paragraph 32e of the code, entitled ‘Relationship to other rights to access and provision of information’, states as follows:‘If the data subject or a third party has a right of access to information vis-à-vis the financial authority in accordance with the [Gesetz zur Regelung des Zugangs zu Informationen des Bundes (Law on access to federal state information)] of 5 September 2005 (BGBl. 2005 I, p. 2722), in the applicable version, or in accordance with corresponding legislation of the Länder, Articles 12 to 15 of [the GDPR] shall apply correspondingly in conjunction with Paragraphs 32a to 32d [of this code]. More extensive rights to information relating to tax data are excluded in that respect. Paragraph 30(4)(2) [of this code] shall not apply in that respect.’
The Law on insolvency
12Pursuant to Paragraph 129(1) of the Insolvenzordnung (Law on insolvency) of 5 October 1994 (BGBl. 1994 I, p. 2866), in the version applicable to the dispute in the main proceedings:‘In accordance with Paragraphs 130 to 146, the liquidator (Insolvenzverwalter) may challenge legal acts that were performed prior to the commencement of insolvency proceedings and that are detrimental to creditors.’
Law on freedom of information
13Paragraph 2, entitled ‘Scope’, of the Gesetz über die Freiheit des Zugangs zu Informationen für das Land Nordrhein-Westfalen (Law on freedom of information of the Land of North Rhine-Westphalia) of 27 November 2001, in the version applicable to the dispute in the main proceedings, (‘the Law on freedom of information’) provides as follows:(1) This Law shall apply to the administrative activity of public authorities …. For the purposes of this Law, a public authority is any body which performs public administration tasks.…’
14Under Paragraph 4 of the Law on freedom of information, entitled ‘Right to information’,(1) Any natural person may claim, against the bodies referred to in Paragraph 2, in accordance with this Law, a right of access to official information held by the body.(2) Any special legal provisions concerning access to administrative information, the provision of information or the granting of access to the file shall take precedence over the provisions of this Law. The duty to act with discretion shall not apply in the context of this Law.’
The main proceedings and the questions referred for a preliminary ruling
15D.-H. T., acting in the capacity of insolvency administrator of J & S Service, a German company, requested tax data about that company from the tax authorities, under Paragraph 4(1) of the Law on freedom of information, in order to examine the possibility of bringing insolvency avoidance claims in the context of the insolvency procedure.
16Those data concerned the potential enforcement measures to which J & S Service was subject and those already taken, the payments received and the date on which the tax authorities became aware that the company was insolvent. D.-H.T. also requested statements in relation to all the taxes administered by the tax authorities for the period between March 2014 and June 2015.
17As a result of the tax authorities rejecting that request, D.-H.T. brought proceedings before the appropriate Verwaltungsgericht (Administrative Court, Germany), which, in essence, upheld its action.
18The appropriate Oberverwaltungsgericht (Higher Administrative Court, Germany) dismissed the appeal brought by Land Nordrhein-Westfalen against the first instance decision. That court found inter alia that the right of access to information exercised under the Law on freedom of information was not precluded by any specific tax rules and was not subject to any grounds of exclusion.
19According to that court, entitlement to access to tax information had been transferred to the insolvency administrator in the context of the insolvency proceedings, and that transfer also included business secrets and tax information to the extent necessary for proper management of the assets of the insolvent debtor. Accordingly, even if the information requested was covered by tax secrecy, D.-H.T. was entitled, as the insolvency administrator, to request all information connected with the insolvency procedure from J & S Service. The insolvent debtor’s duty to participate also encompassed an obligation to release the tax authorities from tax secrecy.
20Land Nordrhein-Westfalen brought an appeal on a point of law before the Bundesverwaltungsgericht (Federal Administrative Court, Germany) against the decision of the relevant Oberverwaltungsgericht (Higher Administrative Court).
21That court notes at the outset that the GDPR does not apply directly in the present case because the case in the main proceedings does not concern personal data relating to a natural person within the meaning of Article 1(1) and Article 4(1) thereof, or the data subject’s right of access within the meaning of Article 15 of that regulation. According to the referring court, the right of access under Article 15 of that regulation is a right attaching to the data subject to whom the processing of personal data relates that does not form part of the assets of the insolvency and therefore is not covered by the transfer of powers of management and disposal to the insolvency administrator.
22That court nevertheless recalls that, in order to ensure the uniform interpretation of EU law, the Court has already declared that it has jurisdiction to make preliminary rulings relating to provisions of EU law in purely internal situations, where those provisions had been rendered directly and unconditionally applicable by national law.
23It considers that requirement to be satisfied in the present case, because Paragraph 2a(5) of the Tax Code makes reference, in so far as concerns the processing of the personal data of legal persons, to the provisions of the GDPR.
24In that connection, the referring court asks essentially, by its first question, whether the tax authorities may restrict access to the tax data of a tax debtor under Article 23(1)(j) of the GDPR, to which Paragraph 32c(1)(2) of the Tax Code makes express reference.
25Should it be found that the tax authorities may rely on Article 23(1)(j) of the GDPR, the referring court is uncertain whether the concept of ‘enforcement of civil law claims’, which appears in that article, also encompasses the defence against civil law claims.
26The referring court states that, in national law, Paragraph 32c(1)(2) of the Tax Code expressly includes the defence of civil law claims as a ground on which a data subject’s right of access can be restricted. That provision is intended to ensure that the tax authorities are not treated differently from other creditors or debtors. The obligations of those authorities to provide information should therefore be governed only by civil law and be subject only to the condition that an insolvency avoidance claim is established on its merits and that only the nature and extent of the claim remain to be determined.
27Lastly, the referring court wonders whether a national provision that introduces a restriction on the right of access conferred by Article 15 of the GDPR in the interests of defending insolvency avoidance claims against the tax authorities can have its basis in Article 23(1)(e) thereof.
28The referring court states that Paragraph 32c(1)(2) of the Tax Code is geared towards treating the tax authorities in the same way as other creditors and debtors in relation to civil law claims and ensuring that taxation is due and lawful and therefore safeguarding tax revenue. Those objectives can amount to important objectives of general public interest in budgetary and taxation matters within the meaning of Article 23(1)(e) of the GDPR.
29Nevertheless, according to the referring court, by means of Paragraph 32c(1)(2) of the Tax Code, the national legislature availed itself instead of the restriction under Article 23(1)(j) of the GDPR. The tax data requested are in fact of interest not for the purpose of the tax claims themselves, but for the payment operations which are a matter of insolvency law, as acts which can, where applicable, be avoided under the Law on insolvency of 5 October 1994, in the version applicable to the dispute in the main proceedings.
30In those circumstances the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:(1) Does Article 23(1)(j) of [the GDPR] also serve to protect the interests of financial authorities?(2) If so, does the wording “the enforcement of civil law claims” also cover the defence of the financial authority against civil law claims and must such claims already have been submitted?(3) Does the provision of Article 23(1)(e) of [the GDPR] relating to the protection of an important financial interest of a Member State in taxation matters allow a restriction of the right of access under Article 15 of [that regulation] in relation to the defence of civil law insolvency avoidance claims against the financial authority?’
Jurisdiction of the Court
31In accordance with settled case-law, in the context of the cooperation between the Court and the national courts provided for in Article 267 TFEU, it is solely for the national court before which a dispute has been brought, and which must assume responsibility for the subsequent judicial decision, to determine in the light of the particular circumstances of the case both the need for a preliminary ruling in order to enable it to deliver judgment and the relevance of the questions which it submits to the Court. Consequently, where the questions submitted by the national court concern the interpretation of EU law, the Court is, in principle, bound to give a ruling (judgments of 18 October 1990, Dzodzi, C‑297/88 and C‑197/89, EU:C:1990:360, paragraphs 34 and 35, and of 14 February 2019, Milivojević, C‑630/17, EU:C:2019:123, paragraph 47 and the case-law cited).
32However, it is also settled case-law that it is for the Court to examine the conditions in which a case has been referred to it by the national court, in order to assess whether it has jurisdiction (judgment of 16 June 2016, Rodríguez Sánchez, C‑351/14, EU:C:2016:447, paragraph 55 and the case-law cited).
33The Court has repeatedly considered itself to have jurisdiction to give preliminary rulings on questions concerning provisions of European Union law in situations where the facts at issue in the main proceedings were outside the scope of European Union law and therefore fell within the competence of the Member States alone, but where those provisions of European Union law had been rendered applicable by domestic law due to a reference made by that law to the content of those provisions (judgment of 12 July 2012, SC Volksbank România, C‑602/10, EU:C:2012:443, paragraph 86 and the case-law cited).
34That jurisdiction is justified by the fact that it is manifestly in the interest of the EU legal order that, in order to forestall future differences of interpretation, the provisions taken from EU law should be interpreted uniformly (see to that effect, judgments of 18 October 1990, Dzodzi, C‑297/88 and C‑197/89, EU:C:1990:360, paragraph 37, and of 12 December 2019, G. S. and V. G. (Threat to public policy), C‑381/18 and C‑382/18, EU:C:2019:1072, paragraph 42 and the case-law cited).
35Nevertheless, the jurisdiction of the Court is confined to considering provisions of EU law only. In its reply to the national court, it cannot take account of the general scheme of the provisions of domestic law which, while referring to EU law, define the extent of that reference. Consideration of the limits which the national legislature may have placed on the application of EU law to purely internal situations, to which it is applicable only through the operation of the national legislation, is a matter for domestic law and hence falls within the exclusive jurisdiction of the courts of the Member State (see to that effect, judgment of 18 October 1990, Dzodzi, C‑297/88 and C‑197/89, EU:C:1990:360, paragraph 42).
36In the present case, it emerges from the information provided by the referring court that, as a result of the reference made by Paragraph 2a(5)(2) of the Tax Code, the provisions of the GDPR on the processing of the personal data of natural persons apply mutatis mutandis to legal persons.
37Specifically, Paragraph 32b of that code provides that the tax authorities do not have a duty to provide information where the personal data have not been obtained from the data subject, if that information could be prejudicial to the proper performance of the tasks within the competence of the financial authorities or other public bodies within the meaning of Article 23(1)(d) to (h) of the GDPR.
38According to Paragraph 32c(1)(2) of that code, data subjects cannot rely on their right of access vis-à-vis the tax authorities under Article 15 of the GDPR if provision of the information requested could adversely affect those authorities in the establishment, exercise or defence of civil law claims or in the defence by those authorities of civil law claims established against them, within the meaning of Article 23(1)(j) thereof.
39It is clear from the request for a preliminary ruling that the provisions of the Tax Code at issue in the main proceedings make a reference to Article 23 of the GDPR in order to regulate the tax authorities’ obligation to provide information and the data subject’s right of access vis-à-vis those authorities, with the aim of remedying the disadvantage at which those authorities would find themselves compared with private law creditors in insolvency procedures, thereby contributing to the safeguarding of tax revenue.
40In the dispute in the main proceedings, the data subject in respect of the information requested is a legal person, specifically an insolvent company.
41As can be seen from Article 1(1) of the GDPR, that regulation lays down rules relating to the protection of the data of natural persons and does not extend to data relating to legal persons.
42Article 23 of that regulation, of which the referring court seeks an interpretation, governs situations where EU law or the law of the Member State to which the data controller or processor is subject may restrict the scope of the rights conferred on data subjects, defined as identified or identifiable natural persons, and the corresponding obligations on data controllers.
43The questions referred concern specifically the interpretation of Article 23(1) of the GDPR in a situation in which that article has been rendered applicable to legal persons in order to regulate the obligations on public authorities to provide information under the Law on freedom of information.
44However, the provisions of the Tax Code at issue in the main proceedings do not merely render the provisions of the GDPR applicable outside the scope of that regulation; they also modify their subject matter and scope.
45Although the provisions of the Tax Code at issue in the main proceedings are derived from an almost literal reproduction of certain provisions of the GDPR, the purpose of that regulation and the context in which it was adopted are substantially different from the purpose and context of the domestic legislation at issue in the main proceedings, because the GDPR seeks among other matters to ensure respect for the fundamental rights of natural persons and, at the same time, to strike a balance between those rights and the need to safeguard other legitimate interests in a democratic society.
46It must be observed, first, that the concept of information concerning legal persons is radically different from the concept of the personal data of natural persons as defined in EU law. The right of any natural person to the protection of personal data concerning him or her is a fundamental right enshrined in Article 8(1) of the Charter of Fundamental Rights of the European Union. Any restrictions on that right must therefore, as Article 23(1) of the GDPR states, be provided for by law, respect the essence of the fundamental rights and freedoms and be a necessary and proportionate measure in a democratic society to safeguard certain public and private interests. Information concerning legal persons, in contrast, has no comparable protection in EU law.
47Therefore, in this case, the German law concerns, in reality, not the protection of the personal data of natural persons, governed by the GDPR in EU law, but rather the purely national law concept of the protection of the personal data of legal persons. That being so, the questions referred do not in fact concern the interpretation of a provision of EU law rendered applicable, beyond its scope of application, by a provision of national law, but instead to a national law concept that has no equivalent in EU law.
48Secondly, as the Advocate General has indicated, in essence, in points 86 and 88 of his Opinion, Article 23(1) of the GDPR seeks to strike a fair balance between respect for the fundamental rights of natural persons that are affected by data processing and the need to safeguard other legitimate interests in a democratic society. In order to interpret the restrictions for which it provides it is therefore necessary to weigh the fundamental rights conferred on natural persons against the interests that those restrictions are intended to preserve.
49Article 23 of the GDPR cannot therefore be construed without having regard to the fact that it specifically seeks to guarantee the fundamental rights of natural persons.
50This means that the provisions of that regulation cannot be interpreted in the same way in relation to natural persons and in relation to legal persons, whose right to the protection of data is not defined by the GDPR. Accordingly, in contrast to the position taken by the referring court, it cannot be held that there is a manifest interest in the present case in the Court interpreting those provisions with a view to ensuring that they are interpreted uniformly.
51Accordingly, the provisions of EU law which the Court is asked to interpret cannot be regarded as having been rendered applicable as such by the national law in cases out with the scope of that regulation (see, by analogy, judgment of 28 March 1995, Kleinwort Benson, C‑346/93, EU:C:1995:85, paragraph 19).
52In the light of the foregoing, it must be held that the Court does not have jurisdiction to answer the questions referred by the Bundesverwaltungsgericht (Federal Administrative Court).
Costs
53Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
Operative part
On those grounds, the Court (First Chamber) hereby rules: The Court does not have jurisdiction to answer the questions referred by the Bundesverwaltungsgericht (Federal Administrative Court, Germany) by decision of 4 July 2019.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.