Judgment;Summary — ECLI:EU:C:2024:239
Date: 2024-03-14
Language of the case: Hungarian
Court formation: Fifth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Hungary

Translation C-46/23 – 1 
Case C-46/23 
Request for a preliminary ruling 
Date lodged: 
31 January 2023 
Referring court: 
Fővárosi Törvényszék (Budapest High Court, Hungary) 
Date of the decision to refer: 
8 December 2022 
Applicant: 
Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri 
Hivatala (Council of the municipality of Újpest, District IV, 
Budapest) 
Defendant: 
Nemzeti Adatvédelmi és Információszabadság Hatóság (National 
Data Protection and Freedom of Information Authority, Hungary) 
  
[…] [administrative information] 
Decision 
This court hereby stays the proceedings and refers the following questions to the 
Court of Justice of the European Union for a preliminary ruling: 
‘1. Must Article 58(2), in particular subparagraphs (c), (d) and (g), of 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation) (‘GDPR’) be interpreted as 
meaning that the national supervisory authority, in exercise of its corrective 
powers, may order the data controller or processor to erase unlawfully processed 
personal data even in the absence of an express request by the data subject under 
Article 17(1) of the GDPR? 
EN 
REQUEST FOR A PRELIMINARY RULING OF 8. 12. 2022 – CASE C-46/23 
 
2  
2. In the event that the answer to the first question is that the supervisory 
authority may order the data controller or processor to erase unlawfully processed 
personal data even in the absence of a request by the data subject, is that so 
irrespective of whether or not the personal data were obtained from the data 
subject?’ 
[…] [matters of national procedural law] 
Grounds 
Factual background 
1 In February 2020, the applicant decided to grant financial aid (‘aid’) to residents 
belonging to groups that were vulnerable in the COVID-19 pandemic and meeting 
certain requirements (such as having reached retirement age or being entitled to 
certain social benefits); consequently, it approached the Magyar Államkincstár 
(Hungarian State Treasury) (‘State Treasury’) and the Budapest Főváros 
Kormányhivatala IV. Kerületi Hivatala (Budapest Metropolitan Government 
Office, District Office IV, Hungary) (‘district office’) in order to obtain the 
personal data needed to determine the eligibility requirements, in particular, the 
basic identity data of the natural persons and their social security numbers. The 
State Treasury and the district office satisfied those requests for data. 
2 In order to pay the aid, the applicant adopted Újpest+ Megbecsülés Program 
bevezetéséről szóló 16/2020. (IV. 30.) önkormányzati rendelet (Municipal Decree 
16 of 30 April 2020 on the introduction of the ‘Újpest+ Megbecsülés’ scheme), 
which was amended and supplemented by Municipal Decree 30 of 15 July 2020. 
Those decrees contained the eligibility requirements for applying for the aid. 
3 The applicant collated the data received from the State Treasury and the district 
office in a database created to implement its scheme and created a unique 
identifier and a barcode for each set of data. 
4 Pursuant to a public interest report, the defendant investigated the data processing 
referred to above, in the course of official controls that commenced on 
2 September 2020 and in the subsequent administrative data protection procedure. 
5 In its decision […] of 22 April 2021, the defendant found that the applicant had 
infringed various provisions of Articles 5 and 14 and Article 12(1) of the GDPR. 
It stated, inter alia, that the applicant had infringed a number of provisions of 
Article 14 of the GDPR because it had not informed the data subjects, within one 
month, of the extent of their personal data processed in relation to the ‘Újpest+ 
Megbecsülés’ scheme, the purpose of the data processing or the rights they could 
exercise. The defendant ordered the applicant, under Article 58(2)(d) of the 
GDPR, to erase the personal data of data subjects who, on the basis of the 
information provided by the district office and the State Treasury, were entitled to 
the aid but did not apply for it. The defendant found that the State Treasury and 
ÚJPESTI POLGÁRMESTERI HIVATAL 
 
3 
the district office had also infringed the data protection provisions. It therefore 
imposed a data protection fine on both the applicant and the State Treasury. 
6 In the statement of reasons of the decision, in addition to the articles of the GDPR 
referred to above, the defendant also relied on certain provisions of Articles 2, 4, 6 
and 83 and Article 58(2)(b) and (j) of that regulation, the információszabadságról 
és információs önrendelkezési jogról szóló 2011. évi CXII. törvény (Law CXII of 
2011 on the right to informational self-determination and on the freedom of 
information), the szociális igazgatásról és szociális ellátásokról szóló 1993. évi III. 
törvény (Law III of 1993 on social services and benefits) and the aforementioned 
municipal decrees adopted by the applicant. Lastly, the defendant ordered the 
applicant, under Article 58(2)(d) of the GDPR, to erase the personal data of data 
subjects who, according to the information provided by the district office and the 
State Treasury, were entitled to the aid but did not apply for it. 
The dispute between the parties 
7 The applicant has contested the defendant’s […] decision in these administrative 
review proceedings. 
8 As regards the part of the decision ordering the erasure of personal data, the 
applicant submits that Article 58(2)(d) of the GDPR does not give the defendant 
power to issue such an order. In support of that argument it adduces judgment 
No 105. K. 706.125/2020/12 of the Fővárosi Törvényszék (Budapest High Court, 
Hungary) (‘the final judgment’), which was confirmed by the Kúria (Supreme 
Court, Hungary) in judgment No Kfv.II.37.001/2021/6 (‘the Supreme Court 
judgment’). 
9 According to the applicant, the defendant’s practice infringes the principles of 
legal certainty and that public authorities must act lawfully, which form part of the 
rule of law, because in a different decision – which was the subject matter of the 
case disposed of by the final judgment – the defendant found only that there had 
been a breach but did not mention any provision of Article 58 of the GDPR as the 
legal basis for ordering erasure, whereas, in the decision that constitutes the 
subject matter of the present proceedings, that authority mentions Article 58(2)(d) 
of the GDPR. After examining other decisions of the defendant, the applicant 
draws attention to the fact that in each of them the authority has relied on a 
different legal provision when ordering the data controller to erase data, including, 
for example, Article 58(2) of the GDPR – without further specification – […], 
Article 58(2)(c) of the GDPR […], Article 58(2)(d) of the GDPR […] and 
Article 58(2)(g) of the GDPR […]. The applicant argues that the obligation on the 
data controller to erase data irrespective of whether the data subject has so 
requested flows from Article 5 of the GDPR rather than from Article 17(1) of that 
regulation, because the erasure under Article 17 of the GDPR can only be 
interpreted as a right of the data subject and the second part of the sentence in 
REQUEST FOR A PRELIMINARY RULING OF 8. 12. 2022 – CASE C-46/23 
 
4  
Article 17(1) can only be interpreted in the context of the exercise of that right, 
not independently but subject to the exercise of that right by the person concerned. 
10 In these administrative review proceedings the defendant has proposed making a 
reference for a preliminary ruling on a question identical in essence to the 
operative part of this decision. Alongside these proceedings, the defendant 
brought an action for a declaration of unconstitutionality before the 
Alkotmánybíróság (Constitutional Court, Hungary) against the judgment of the 
Supreme Court. 
11 By decision No 3110 of 23 March 2022 (‘the decision of the Constitutional 
Court’), the Constitutional Court found the judgment of the Supreme Court and 
the final judgment to be contrary to the Alaptörvény (Hungarian Basic Law) and 
accordingly set them aside. The Constitutional Court referred to Opinion 39/2021 
of the European Data Protection Board (‘the Board’), which issued conclusions on 
whether Article 58(2)(g) of the GDPR could serve as a legal basis for a 
supervisory authority to order ex officio the erasure of personal data, in a situation 
where such a request was not submitted by the data subject. The Board found that 
Article 17 of the GDPR provides for two separate cases for erasure that are 
independent from each other: one, the erasure at the request of the data subject, 
and the other the erasure as a standalone obligation of the controller. It therefore 
found that Article 58(2)(g) of the GDPR is a valid legal basis for a supervisory 
authority to order ex officio the erasure of unlawfully processed personal data. The 
Constitutional Court stated in its decision that, under Paragraphs E(2) and (3) and 
VI(4) of the Hungarian Basic Law and in accordance with the GDPR — as EU 
legislation guaranteeing the uniform application of data protection and the 
freedom of information — the defendant has power to order ex officio the erasure 
of unlawfully processed personal data, including where there is no request by the 
data subject. 
12 The defendant has withdrawn its proposal to request a preliminary ruling in the 
light of the decision of the Constitutional Court. 
Relevant EU law 
13 According to Article 17(1)(d) of the GDPR, the data subject is to have the right to 
obtain from the controller the erasure of personal data concerning him or her 
without undue delay and the controller is to have the obligation to erase personal 
data without undue delay where they have been processed unlawfully. 
Under Article 58(2)(c), (d) and (g) of the GDPR, each supervisory authority shall 
have the following corrective powers: 
(c) to order the controller or the processor to comply with the data subject’s 
requests to exercise his or her rights pursuant to this Regulation; 
ÚJPESTI POLGÁRMESTERI HIVATAL 
 
5 
(d) to order the controller or processor to bring processing operations into 
compliance with the provisions of this Regulation, where appropriate, in a 
specified manner and within a specified period; 
(g) to order the rectification or erasure of personal data or restriction of 
processing pursuant to Articles 16, 17 and 18 and the notification of such actions 
to recipients to whom the personal data have been disclosed pursuant to 
Article 17(2) and Article 19. 
Relevant Hungarian law 
14 The request for a preliminary ruling is made exclusively in the context of 
application of the GDPR, which is directly applicable at national level, and it is 
therefore not necessary to set out the relevant Hungarian legislation. 
Grounds on which the request for a preliminary ruling is necessary 
15 This court is asking the Court of Justice for guidance on how Article 17(1), in 
conjunction with Article 58(2), of the GDPR should be interpreted, in particular as 
regards the corrective powers of the supervisory authority under Article 58(2)(c), 
(d) and (g). 
16 The defendant’s administrative practice is not uniform as regards ordering the 
erasure of unlawfully processed personal data, since in its various decisions it has 
either referred to different provisions of the GDPR as the legal basis of the order 
for erasure or has not indicated any provision as the legal basis. 
17 In this court’s view, the right to erasure under Article 17 of the GDPR clearly 
must be interpreted as a right of the data subject and Article 17(1) does not 
establish two separate legal grounds for erasure. Instead, the second part of the 
sentence in that paragraph (‘the controller shall have the obligation to erase [the 
data subject’s] personal data without undue delay’) is a subsequent obligation on 
the data controller deriving from the first part of that sentence. In consequence, 
contrary to the Board’s Opinion 39/2021, this court is of the view that the right of 
erasure under Article 17 of the GDPR may only be interpreted as a right of the 
data subject. This is supported by the fact that the original text of the GDPR in 
English refers to the data controller’s obligation using the conjunction ‘and’ 
between the first and second parts of the sentence in Article 17(1). The Hungarian 
language version contains the conjunction ‘pedig’, which is more ambiguous. 
18 It should also be borne in mind that the data subject may want the personal data 
concerning him her to be processed even though the supervisory authority has 
ordered the data controller to erase the data, including on the ground that it has 
been processed unlawfully. In such a situation, the supervisory authority would be 
exercising the data subject’s right against that person’s wishes. 
REQUEST FOR A PRELIMINARY RULING OF 8. 12. 2022 – CASE C-46/23 
 
6  
19 The question to be determined is, therefore, whether, irrespective of any exercise 
of his or her right by the data subject, the national supervisory authority may 
oblige the data controller or processor to erase the unlawfully processed personal 
data and, if it may, on what legal basis; in answering that question, it must be 
borne in mind, in particular, that Article 58(2)(c) of the GDPR is expressly 
predicated on a request to exercise the rights of the data subject and that 
Article 58(2)(d) provides in general terms that processing operations must be in 
compliance with the GDPR, while Article 58(2)(g) refers directly to Article 17 
which, as explained above, likewise cannot be interpreted regardless of the need 
for an express request by the data subject to erase personal data. 
20 If the supervisory authority is entitled to order the data controller or processor to 
erase unlawfully processed personal data even where there is no request by the 
data subject, this court also enquires whether, when the order for erasure is issued, 
a distinction can be drawn depending on whether the personal data have been 
obtained from the data subject (having regard to the obligation on the data 
controller under Article 13(2)(b) of the GDPR) or whether they have not been 
obtained from the data subject (in respect of the obligation on the data controller 
under Article 14(2)(c) of the GDPR). 
21 […] [matters of national procedural law] 
22 […] [matters of national procedural law] 
Budapest, 8 December 2022 
[…] [signatures]