79Furthermore, in the light of the principle that exceptions to the application of the GDPR must be interpreted strictly, that processing of personal data cannot be regarded as being carried out ‘in an activity which falls outside the scope of Union law’, within the meaning of Article 2(2)(a) of the GDPR and Article 9(1) and (2) of Directive 2016/680. In that regard, it follows from the case-law that the sole purpose of that expression is to exclude from the scope of the GDPR the processing of personal data carried out by the State authorities in the course of an activity which is intended to safeguard national security or of an activity which can be classified in the same category. The participation of a public authority in civil proceedings as a defendant in an action for damages against the State does not seek to safeguard national security; nor can it be classified in the same category of activities (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraphs 66 to 68 and the case-law cited).
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.