Judgment_paragraph 37 · Österreichische Datenschutzbehörde v WK (C-33/22)

37It is apparent from the Court’s case-law that the exception provided for in Article 2(2) of the GDPR must be interpreted strictly (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 62 and the case-law cited). In that context, the Court has previously had occasion to state that Article 2(2)(a) of that regulation, read in the light of recital 16 thereof, is designed solely to exclude from the scope of that regulation the processing of personal data carried out by State authorities in the course of an activity which is intended to safeguard national security or of an activity which can be classified in the same category, with the result that the mere fact that an activity is an activity characteristic of the State or of a public authority is not sufficient ground for that exception to be automatically applicable to such an activity (judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 66, and of 20 October 2022, Koalitsia ‘Demokratichna Bulgaria – Obedinenie’, C‑306/21, EU:C:2022:813, paragraph 39).