Judgment;Abstract — ECLI:EU:C:2024:46
Date: 2024-01-16
Language of the case: German
Court formation: Grand Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling
Origin: Austria

Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
14 January 2022 
Referring court: 
Verwaltungsgerichtshof (Austria) 
Date of the decision to refer: 
14 December 2021 
Appellant on a point of law: 
Datenschutzbehörde (Austria) 
Other parties to the proceedings: 
1. W K; 2. President of the Nationalrat (National Council, Austria) 
  
Subject matter of the main proceedings 
Committee of inquiry – Data protection – Parliamentary activity – Separation of 
powers – Applicability of the General Data Protection Regulation (GDPR) – 
Supervisory authority – Data protection complaint 
Subject matter and legal basis of the request 
Interpretation of EU law, Article 267 TFEU 
Questions referred for a preliminary ruling 
1. Do activities of a committee of inquiry set up by a Parliament of a Member 
State in the exercise of its right to scrutinise the executive fall within the scope of 
EU law within the meaning of the first sentence of Article 16(2) TFEU, 
irrespective of the subject matter of the inquiry, with the result that Regulation 
(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on 
the protection of natural persons with regard to the processing of personal data 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-33/22 
 
2  
and on the free movement of such data, and repealing Directive 95/46/EC, 
(General Data Protection Regulation; ‘the GDPR’) is applicable to the processing 
of personal data by a parliamentary committee of inquiry of a Member State? 
If Question 1 is answered in the affirmative: 
2. Do activities of a committee of inquiry which has been set up by a 
Parliament of a Member State in the exercise of its right to scrutinise the executive 
and which has as the subject matter of its inquiry the activities of a police State-
protection authority, that is to say, activities concerning the protection of national 
security within the meaning of recital 16 of the GDPR, come within the scope of 
the exception set out in Article 2(2)(a) of the GDPR? 
If Question 2 is answered in the negative: 
3. If – as in the present case – a Member State has established only one single 
supervisory authority in accordance with Article 51(1) of the GDPR, does the 
competence of that authority in respect of complaints within the meaning of 
Article 77(1) of the GDPR, in conjunction with Article 55(1) thereof, already arise 
directly from the GDPR? 
Provisions of EU law cited 
Treaty on the Functioning of the European Union 
Directive 95/46/EC of the European Parliament and of the Council of 24 October 
1995 on the protection of individuals with regard to the processing of personal 
data and on the free movement of such data (repealed by Regulation [EU] 
2016/679) 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation, GDPR) 
Provisions of national law cited 
Bundes-Verfassungsgesetz (Federal Constitutional Law; ‘the B-VG’), Article 24, 
Article 53(1), Article 56(1), point 7 of Article 138(1) 
Bundesgesetz zum Schutz natürlicher Personen bei der Verarbeitung 
personenbezogener Daten (Federal Law on the protection of natural persons with 
regard to the processing of personal data; ‘the DSG’), Paragraph 1(1), 
Paragraph 4(1), Paragraph 18(1), Paragraph 24(1) 
ÖSTERREICHISCHE DATENSCHUTZBEHÖRDE 
 
3 
Succinct presentation of the facts and procedure in the main proceedings 
1 On 20 April 2018, the Nationalrat (National Council) set up the 
Untersuchungsausschuss über die politische Einflussnahme auf das Bundesamt für 
Verfassungsschutz und Terrorismusbekämpfung (Committee of Inquiry into 
political influence on the Federal Office for the Protection of the Constitution and 
for Counterterrorism; ‘the BVT Committee of Inquiry’) in accordance with 
Article 53(1) of the B-VG. 
2 On 19 September 2018, the first of the other parties to the proceedings was 
questioned as an information source by the BVT Committee of Inquiry in a 
manner open only to media representatives. The verbatim record of the 
questioning, which was published on the website of the Austrian Parliament, 
contained his full forename and surname. By complaint lodged with the Austrian 
Datenschutzbehörde (‘Data Protection Authority’) on 2 April 2019, the first of the 
other parties to the proceedings requested a declaration that the publication of the 
record containing his full name infringed the GDPR and Paragraph 1 of the DSG. 
He asserted that he worked as an undercover investigator and that the publication 
of his name, contrary to his request, infringed his fundamental right to data 
protection and his right to erasure of impermissibly processed data. 
3 The Data Protection Authority rejected the complaint by administrative decision 
of 18 September 2019. As grounds, it was stated that, although the GDPR does 
not prevent data protection supervisory authorities from supervising legislative 
bodies, the separation of powers is inherent in the European legal order, and, 
therefore, the executive is precluded from scrutinising the legislature. The BVT 
Committee of Inquiry is to be regarded as a body attributable to the legislature, 
with the result that the Data Protection Authority does not have competence. 
4 The first of the other parties to the proceedings brought an appeal against that 
administrative decision before the Bundesverwaltungsgericht (Federal 
Administrative Court). The latter annulled the administrative decision of the Data 
Protection Authority and stated, in summary, that neither the GDPR nor the DSG 
provides for an exception to the competence of the Data Protection Authority to 
scrutinise the conformity of the processing of personal data within the framework 
of the legislature. The exception in Article 55 of the GDPR in respect of activities 
of courts acting in their judicial capacity cannot be generalised, with the result that 
it must be assumed that data protection supervisory authorities have unlimited 
competence in respect of all other independent bodies, including parliamentary 
committees of inquiry. Article 77 of the GDPR provides for effective judicial 
protection for matters coming within the scope of application of the regulation, 
whereby that protection is intended to enable every data subject to defend himself 
or herself against infringements of rights guaranteed by the regulation. 
5 The Data Protection Authority brought an appeal on a point of law before the 
Verwaltungsgerichtshof (Supreme Administrative Court) against the judgment of 
the Federal Administrative Court. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-33/22 
 
4  
Succinct presentation of the reasoning in the request for a preliminary ruling 
Question 1 
6 The first of the other parties to the proceedings considers that his fundamental 
right to the protection of personal data was infringed by the publication of the 
record – which contains his full name – of his questioning before the BVT 
Committee of Inquiry. Publication constitutes, in principle, ‘processing’ of 
personal data within the meaning of the GDPR. The question that arises is whether 
such processing is excluded from the scope of Article 2(1) of the GDPR in 
accordance with Article 2(2)(a) thereof. 
7 The Federal Administrative Court proceeds on the assumption that the GDPR 
applies to acts of the legislature (such as those of parliamentary committees of 
inquiry, for example), as the material scope is conceived in comprehensive terms 
and encompasses all data processing. According to the Federal Administrative 
Court, the legislature, as one of the functions of the State, is not excluded from the 
scope of the GDPR. The exception in Article 2(2)(a) of the GDPR must, in its 
view, be interpreted very restrictively and covers only national security. 
8 The Data Protection Authority refers to the judgment of the Court of Justice of 
9 July 2020, Land Hessen, C-272/19, EU:C:2020:535, but disputes its competence 
by pointing to the principle of the separation of powers, which precludes bodies of 
the executive and judiciary from scrutinising the legislature. 
9 In Case C-272/19, the Court of Justice held ‘that, in so far as a Petitions 
Committee of the Parliament of a Federated State of a Member State determines, 
alone or with others, the purposes and means of the processing of personal data, 
that committee must be categorised as a “controller”, within the meaning of 
[Article 4(7) of the GDPR], and consequently the processing of personal data 
carried out by that committee falls within the scope of that regulation’. 
10 The first of the other parties to the proceedings considers that the GDPR is 
applicable, whereas the second takes the view that it is not. 
11 Committees of inquiry set up by the National Council serve to exercise scrutiny 
and legislative functions, which, under the Austrian Constitution, are vested in the 
legislature. Parliamentary committees of inquiry act as supervisory bodies of the 
legislature and are organisationally and functionally attributable to the legislative 
branch. Each inquiry conducted by those committees concerns a specific, 
delineated process in the executive or judicial branch of the Federal Government, 
with the aim of clarifying processes for political purposes. 
12 Persons who have been questioned as an information source may bring an appeal 
before the Verfassungsgerichtshof (Constitutional Court) against the decision of a 
committee of inquiry to publish a record of their questioning, on the grounds of an 
alleged infringement of the DSG. Such appeals are confined to an assessment of 
ÖSTERREICHISCHE DATENSCHUTZBEHÖRDE 
 
5 
the question as to whether the conduct specifically challenged infringes the 
personality rights specifically asserted by the appellant. 
13 Proceeding on the basis of the judgment of the Court of Justice of 9 July 2020 
(Land Hessen, C-272/19, EU:C:2020:535) and the case-law on Directive 
95/46/EC cited in that judgment, the applicability of the data protection provisions 
does not require that the processing of personal data should take place specifically 
for purposes governed by EU law, is cross-border in nature or directly affects 
freedom of movement between Member States. The applicability of the GDPR 
can be excluded only if a specific exception in Article 2(2)(a) to (d) thereof 
applies. 
14 In accordance with the case-law of the Court of Justice, Article 2(2)(a) of the 
GDPR must be interpreted strictly. That provision, read in the light of recital 16 of 
the regulation, must be regarded as being designed to exclude solely the 
processing of personal data carried out by State authorities in the course of an 
activity which is intended to safeguard national security or of an activity which 
can be classified in the same category. Those activities encompass, in particular, 
those that are intended to protect essential State functions and the fundamental 
interests of society. 
15 However, by contrast to the judgment in Case C-272/19, which concerns a 
petitions committee of the Parliament of Land Hessen, committees of inquiry set 
up by the National Council do not merely contribute indirectly to parliamentary 
activity, but, as supervisory bodies, are involved in the core area of parliamentary 
activity. They serve to exercise political scrutiny and to obtain clarification for 
political purposes. The statements in the judgment in Case C-272/19 do not in 
themselves exclude the applicability of the exception to data processing in respect 
of the core area of parliamentary activity. Rather, it might be argued that, in 
principle, activities of parliamentary scrutiny also serve to protect essential State 
functions and the fundamental interests of society – a form of protection covered 
by Article 2(2)(a) of the GDPR. 
16 There do not appear to be any provisions of EU law that regulate parliamentary 
activity in the Member States. The bases for such activity arise from the national 
legislation of the respective Member States. The fact that, in accordance with the 
judgment in Case C-272/19, no general exception is provided for with respect to 
parliamentary activities does not mean that at least some parliamentary activities 
cannot be covered by the exception in Article 2(2)(a) of the GDPR. 
17 The principle of separation of powers is inherent in both EU law and national law. 
It is true that Article 55(3) of the GDPR excludes only the supervision of 
processing operations of courts acting in their judicial capacity from the 
competence of the supervisory authority. However, this might be understood as 
meaning that the core area of parliamentary activity is already excluded from the 
scope of application of the GDPR in accordance with Article 2(2)(a), as otherwise 
it would also have been taken into account in Article 55(3). 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-33/22 
 
6  
18 Therefore, the question that arises for the referring court is whether the core area 
of parliamentary activities, such as legislative processes and parliamentary 
scrutiny processes, comes within the scope of Article 16(2) TFEU and is thus 
covered by the material scope of the GDPR pursuant to Article 2(1), in accordance 
with Article 2(2)(a) thereof. 
Question 2 
19 The subject matter of the inquiry conducted by the BVT Committee of Inquiry 
was ‘the suspicion of a concerted, politically motivated exertion of influence by 
natural persons acting as executive organs of legal persons, by other (senior) 
officials and by employees of political offices of the BMI [Bundesministerium für 
Inneres – Federal Ministry of the Interior] on the performance of the tasks of the 
BVT [Bundesamt für Verfassungsschutz und Terrorismusbekämpfung – Federal 
Office for the Protection of the Constitution and for Counterterrorism], as well as 
the alleged associated infringement of legal provisions in connection with the 
executive branch of the Federal Government …’. 
20 The BVT (since 1 December 2021: Direktion Staatsschutz und 
Nachrichtendienst – Directorate of State Protection and the Intelligence Service; 
‘the DSN’) acts as a police State protection authority and is responsible for, inter 
alia, protecting constitutional institutions and their ability to act. Thus, its remit 
includes ‘activities concerning national security’ within the meaning of recital 16 
of the GDPR. Therefore, the subject matter of the inquiry conducted by the BVT 
Committee of Inquiry encompasses activities concerning national security, which 
do not come within the scope of EU law and are thus excluded from the material 
scope of the GDPR in accordance with Article 2(2)(a) thereof. 
21 According to the judgment of the Court of Justice of 6 October 2020, La 
Quadrature du Net and Others (C-511/18, C-512/18 and C-520/18, 
EU:C:2020:791, paragraph 101), ‘processing operations concerning public 
security, defence, [and] State security’ are ‘excluded, in a general way, from the 
scope of [Directive 95/46/EC], without drawing any distinction according to who 
was carrying out the data processing operation concerned’. The approach taken to 
identifying the actions excluded was therefore purposive. 
22 In so far as the activities of parliamentary scrutiny carried out by a committee of 
inquiry come, in principle, within the scope of EU law, the question arises as to 
whether those activities are excluded from the scope of the GDPR at least where 
the subject matter of the inquiry concerns activities of the executive branch, which 
do not come within the scope of EU law. 
Question 3 
23 The Data Protection Authority is the only national supervisory authority, within 
the meaning of the GDPR, in Austria. If the GDPR is applicable to activities of 
ÖSTERREICHISCHE DATENSCHUTZBEHÖRDE 
 
7 
parliamentary scrutiny, its competence as the sole national supervisory authority 
in respect of acts of the legislature would require a constitutional basis due to the 
constitutional principle of separation of powers between the executive and the 
legislature. To date, there is no such basis. 
24 However, every national court has, as an organ of a Member State, the obligation 
fully to apply the directly applicable law of the European Union and to protect the 
rights which that law confers on individuals. 
25 If the first question is answered in the affirmative but the second in the negative, 
the question that arises for the referring court is whether, as Austria’s only 
supervisory authority established in accordance with the GDPR, the Data 
Protection Authority’s competence in respect of the right to lodge a complaint 
conferred on every person by Article 77 of the GDPR already arises directly from 
EU law. 
26 In the event that, as Austria’s only supervisory authority established in accordance 
with Article 51 of the GDPR, the Data Protection Authority’s competence in 
respect of complaints within the meaning of Article 77(1) of the GDPR already 
arises directly from the GDPR, the want of a constitutional basis for the Data 
Protection Authority’s competence in respect of data protection complaints 
concerning alleged infringements of the GDPR as a result of the processing of 
personal data within the framework of parliamentary scrutiny would not be 
relevant. This, however, presupposes that Articles 51 and 77 of the GDPR are 
applicable to activities of parliamentary scrutiny as such, and are specifically 
applicable in the present case of the BVT Committee of Inquiry. Those questions 
are therefore relevant to the decision to be given on the pending appeal on a point 
of law.