Judgment;Summary — ECLI:EU:C:2022:124
Date: 2022-02-24
Language of the case: Latvian
Court formation: Fifth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Latvia

Summary C-175/20 — 1 
Case C-175/20 
Summary of the request for a preliminary ruling under Article 98(1) of the 
Rules of Procedure of the Court of Justice 
Date lodged: 
14 April 2020 
Referring court: 
Administratīvā apgabaltiesa (Regional Administrative Court, 
Latvia) 
Date of the decision to refer: 
11 March 2020 
Applicant and appellant: 
SIA SS  
Defendant and other party to the appeal proceedings: 
Valsts ieņēmumu dienests (State Tax Administration, Latvia) 
  
Subject matter of the main proceedings 
Action for the annulment of a decision adopted by the defendant (the Tax 
Administration) — dismissing the complaint lodged by the applicant and 
confirming the request for information sent to the applicant — on the ground that 
that decision is contrary to the provisions of Regulation (EU) 2016/679 (General 
Data Protection Regulation; ‘GDPR’ or ‘the Regulation’). 
Subject matter and legal basis of the request for a preliminary ruling 
On the basis of Article 267 TFEU, the referring court seeks an interpretation of 
several provisions of the GDPR and asks, first, whether the requirements laid 
down in that regulation, in particular in Article 5(1) thereof, can be applied to a 
request for information issued by a tax authority; secondly, whether there is a 
legitimate objective capable of justifying a request for data in an undefined 
amount and for an undefined period of time, in the case where that request does 
not indicate the purpose of the processing of the data and relates to an unspecified 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING — CASE C-175/20 
 
2  
group of data subjects; and, thirdly, what the criteria are for determining whether 
the tax authority, acting as controller, ensures that the processing of those data 
complies with the requirements laid down in that regulation, in particular as 
regards the legitimacy of the data processing, its occasional nature, its objectives, 
its scope and its form. 
Questions referred for a preliminary ruling 
1. Must the requirements laid down in the General Data Protection Regulation 
be interpreted as meaning that a request for information issued by a tax 
authority, such as the request at issue in this case, which seeks the disclosure 
of information containing a considerable amount of personal data, must 
comply with the requirements laid down in the General Data Protection 
Regulation (in particular Article 5(1) thereof)?  
2. Must the requirements laid down in the General Data Protection Regulation 
be interpreted as meaning that the [Latvian] Tax Administration may depart 
from the provisions of Article 5(1) of that regulation even though the 
legislation in force in the Republic of Latvia does not empower it to do so? 
3. For the purposes of interpreting the requirements laid down in the General 
Data Protection Regulation, can there be considered to be a legitimate 
objective justifying the obligation, imposed by a request for information 
such as that at issue in this case, to provide all of the data requested in an 
undefined amount and for an undefined period of time, in the case where 
there is no prescribed expiry date for the fulfilment of that request for 
information? 
4. For the purposes of interpreting the requirements laid down in the General 
Data Protection Regulation, can there be considered to be a legitimate 
objective justifying the obligation, imposed by a request for information 
such as that at issue in this case, to provide all of the data requested even if 
the request for information does not (or does not fully) specify the purpose 
of disclosing that information? 
5. For the purposes of interpreting the requirements laid down in the General 
Data Protection Regulation, can there be considered to be a legitimate 
objective justifying the obligation, imposed by a request for information 
such as that at issue in this case, to provide all of the data requested even if 
that request relates in practice to absolutely all data subjects who have 
published advertisements in the ‘Motor Vehicles’ section of a portal? 
6. What criteria must be used to verify that a tax authority, acting as controller, 
is duly ensuring that the processing of data (including the collection of 
information) is compliant with the requirements laid down in the General 
Data Protection Regulation? 
VALSTS IEŅĒMUMU DIENESTS 
 
3 
7. What criteria must be used to verify that a request for information such as 
that at issue in this case is duly reasoned and occasional? 
8. What criteria must be used to verify that personal data are being processed 
to the extent necessary and in a manner compatible with the requirements 
laid down in the General Data Protection Regulation? 
9. What criteria must be used to verify that a tax authority, acting as controller, 
ensures that data are processed in accordance with the requirements laid 
down in Article 5(1) of the General Data Protection Regulation 
(accountability)? 
Provisions of EU law relied on 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC: recitals 1 and 31, Article 5 (principles relating to processing of personal 
data), Article 6 (lawfulness of processing) and paragraph 1(e) of Article 23 
(restrictions).  
Provisions of national law relied on  
Likums ‘Par nodokļiem un nodevām’ (Law on taxes and duties): Article 15(6) (in 
the version in force at the time when the request for information was issued). 
Fizisko personu datu apstrādes likums (Law on the processing of personal data): 
Article 25(1). 
Case-law of the Court of Justice 
Judgment of the Court of Justice of the European Union of 16 January 2019, 
Deutsche Post (C-496/17, EU:C:2019:26, paragraph 53). 
Brief presentation of the facts and the main proceedings 
1 On 28 August 2018, the director of the Nodokļu kontroles pārvalde (Tax 
Inspection Office) of the Valsts ieņēmumu dienests (State Tax Administration; 
‘the VID’) sent the applicant a request for information in which, acting on the 
basis of Article 15(6) of the Law on taxes and duties, it urged the applicant to 
renew the VID’s access to information on advertisers’ telephone numbers and the 
chassis numbers of vehicles featured in advertisements published on the 
www.ss.com portal maintained by the applicant, and, by 3 September 2018 at the 
latest, to provide information on advertisements published in the ‘Motor Vehicles’ 
section of the aforementioned portal during the period from 14 July to 31 August 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING — CASE C-175/20 
 
4  
2018. The applicant was asked to send the information electronically, in a format 
allowing the data to be filtered and selected. It was also asked to include the 
following information in the data file: link to the advertisement, advertisement 
text, make of vehicle, model, chassis number, price, vendor’s telephone numbers. 
Should it not be possible to renew access, the applicant was asked to give the 
reason for this and to provide the aforementioned information on advertisements 
published in the preceding month no later than on the third of each month. 
2 The applicant lodged a complaint challenging the aforementioned request for 
information with the acting director-general of the VID. According to the 
applicant, the scope of the request for information is not justified by the law 
(which does not specify the amount of information that must be provided) and is 
not in accordance with the principle of proportionality or the principle of 
minimising the processing of personal data as laid down in the GDPR, which the 
VID, in its capacity as controller, must observe, since the information requested is 
personal data. The request for information does not specify a particular group of 
data subjects and does not indicate the purpose or scope of the scheduled 
processing or for how long the obligation [to provide the information] will last. 
3 By decision of 30 October 2018 (‘the decision’), the VID dismissed the 
aforementioned complaint and confirmed the request for information. 
4 In the grounds of that decision, the VID states, in essence, that, in processing the 
abovementioned data, the Tax Administration performs the functions and 
exercises the powers conferred on it by law. In particular, the Tax Administration 
is responsible for collecting and auditing taxes, duties and other levies, and has a 
statutory duty, in the context of those functions, to monitor the economic and 
financial activities of natural and legal persons in order to ensure that such dues 
are paid to the State coffers and to the EU budget. The timely collection of taxes is 
a matter of public interest. In order to enable them to discharge those functions, 
the law confers on VID officials the power to gather the documents and 
information necessary to account for and record taxable events and to audit taxes 
and duties. In particular, providers of internet advertising services have an 
obligation under Article 15(6) of the Law on taxes and duties (in the version in 
force at the time when the request for information was issued) to provide, when 
requested to do so by the State Tax Administration, any information they may 
have on taxable persons who have used those services to publish advertisements 
and on the advertisements published by them. Article 25(1) of the Law on the 
processing of personal data provides that the processing of such data is to be 
permitted where at least one of the grounds specified in Article 6(1) of the GDPR 
is present. The provisions of Article 6(2) and (3) of the Regulation, concerning the 
processing of data for the purposes of compliance with a legal obligation to which 
the controller is subject, to perform a task carried out by the controller in the 
public interest and to enable the controller to exercise the official authority vested 
in it by law, are set out in the legislative measures relating to the field in question. 
In addition, confidential information held by the defendant is protected by law, in 
VALSTS IEŅĒMUMU DIENESTS 
 
5 
particular by the prohibition on disclosure which is imposed on the Tax 
Administration’s employees.  
5 The applicant brought an action for the annulment of that decision before the 
Administratīvā rajona tiesa (District Administrative Court), claiming that the 
statement of grounds in that decision did not indicate either the specific purpose of 
the data processing or the amount of data necessary for that purpose. The 
applicant therefore takes the view that that decision infringes the principles of 
personal data processing that are laid down in Article 5 of the GDPR, which the 
defendant, in its capacity as controller, had a duty to observe, namely by setting 
out clearly defined criteria for selecting the information requested in connection 
with a particular group of identifiable persons. 
6 By judgment of 21 May 2019, the Administratīvā rajona tiesa dismissed that 
action on the ground that it considered to be essentially well founded the argument 
put forward by the defendant to the effect that no restriction can be placed on the 
amount of information to which the Tax Administration may have access in 
connection with any person, unless the information in question is considered to be 
inconsistent with the objectives of the administration of tax matters. That court 
held that this is not in any doubt, since the information requested is necessary in 
order to identify undeclared economic activities, and the provisions of the GDPR 
apply only to the applicant in its capacity as a service provider, but not to the VID. 
7 The applicant appealed that judgment to the referring court. In its appeal, it 
reiterated the arguments it had set out both in its original complaint and in the 
action it had brought at first instance with respect to the defendant’s obligation to 
make known its views on the usefulness of the amount of information requested 
and to observe the principle of proportionality, since, in its opinion, in the context 
of that request for information, the defendant must also be regarded as the 
controller of the data and must therefore comply with the requirements laid down 
in the Regulation. According to the applicant, the GDPR does not provide for any 
exceptions whereby a national authority is exempt from the obligation to comply 
with the requirements it lays down and may process personal data at its own 
discretion.  
8 The applicant asked the referring court to make a reference to the Court of Justice 
of the European Union for a preliminary ruling on the interpretation of the 
provisions of the GDPR. 
Essential arguments of the parties to the main proceedings 
9 The applicant submits that the GDPR is applicable to the case at issue, given that, 
for the purposes of the personal data collected by means of the request for 
information, the defendant must be regarded as the controller within the meaning 
of that regulation, and must therefore comply with the requirements laid down 
there. By issuing the request for information, however, the applicant argues, the 
defendant infringed the principle of proportionality by requiring that it be 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING — CASE C-175/20 
 
6  
provided every month with a considerable amount of data relating to an undefined 
number of advertisements without indicating the specific taxable persons against 
whom tax inspections have been initiated. The applicant states that the request for 
information does not indicate for how long the applicant will be subject to the 
obligation to provide the defendant with the information identified in that request. 
It therefore takes the view that the defendant infringed the principles governing 
the processing of personal data which are laid down in Article 5 of the GDPR 
(lawfulness, fairness and transparency). It contends that neither the request for 
information nor the statement of grounds for the contested decision specifies the 
particular framework (purpose) within which the processing of the information 
prescribed by the defendant takes place, or the volume of information necessary 
(data minimisation). It submits that, in the request for information, the 
administrative authority must include clearly defined criteria for selecting the 
information required by that authority in connection with a particular group of 
identifiable persons. 
10 The defendant states, on the basis of the reasoning set out in paragraph 4 of this 
summary, that the requirements laid down in the EU legislation can have no 
bearing on the content of the contested decision. 
Brief presentation of the grounds for the request for a preliminary ruling 
11 The dispute is concerned with the provisions applicable and the interpretation 
thereof, as well as with whether the legal reasoning set out in the request for 
information from the VID and in the statement of grounds for the contested 
decision justify the obligation imposed on the applicant by the administrative 
measure at issue. 
12 On 23 November 2016, amendments were made to Article 15 of the Law on taxes 
and duties which entered into force on 1 January 2017 and added a paragraph 6 to 
that article. 
13 The administrative measure at issue is based on Article 15(6) of the Law on taxes 
and duties (in the version in force at the time when the request for information 
was issued), which provided that providers of internet advertising services had an 
obligation to provide, when requested to do so by the State Tax Administration, 
any information they might have on taxable persons who had used those services 
to publish advertisements and on the advertisements published by them. 
14 The explanatory memorandum to the legislative amendment supports the 
inference that considerations of proportionality were taken into account in the 
context of, inter alia, the rules on data protection. The explanatory memorandum 
states that, in order for the VID to be able to identify undeclared economic 
activities on the internet, it is necessary to require providers of advertising 
services, among others, to provide the Tax Administration with any data they may 
have or keep on the economic activities of other taxable persons. The legislation 
which empowers the VID to request such information is also proportionate from 
VALSTS IEŅĒMUMU DIENESTS 
 
7 
the point of view of the legislative provisions on data protection. The fundamental 
rights and freedoms of natural persons, in particular the right to respect for 
privacy, are protected, in the context of the processing of personal data, by the 
Fizisko personu datu aizsardzības likums (Law on the protection of personal data 
of natural persons). That right derives from Article 96 of the Latvijas Republikas 
Satversme (Constitution of the Republic of Latvia), which provides that every 
person is to have the right to respect for his or her private life, home and 
correspondence. Article 116 of the Constitution provides for its part that that right 
may be limited in all cases provided for by law in order to protect the rights of 
third parties, the democratic structure of the State and public safety, and public 
welfare and morality. The legislation contained in the draft law pursues a 
legitimate objective, which is to promote social welfare. The fight against tax 
evasion increases revenue to the public exchequer and improves the business 
environment. Moreover, in requesting information from the entities specified in 
the draft law, the VID may obtain information which, in general, account being 
taken of the principles of the digital economy (for example, some entities store 
information in digital form on the internet trading activities of other taxable 
persons and on the amounts received from the sale of goods or provision of 
services in the digital environment), cannot be obtained via other less restrictive 
means. Furthermore, the amount of information collected by the VID must not be 
greater than that necessary in order to attain a legitimate objective. The 
information collected from … providers of internet advertising services must be 
confined to that which is necessary to identify the economic operator and … must 
contain data relating to the economic activities of taxable persons, but not to their 
private lives. In the light of the foregoing, the benefit to society will outweigh any 
restriction of the rights of individuals, and the rules contained in the draft law are 
therefore proportionate.  
15 [In its current version, applicable] at the time when the order for reference was 
made, Article 15(6) of the aforementioned Law provides that providers of internet 
advertising services have an obligation to provide, when requested to do so by the 
State Tax Administration, any information they may have on the advertisements 
published and on the persons who have published them (advertisers). Any 
challenge to, or action brought against, the request for information from the State 
Tax Administration is not to have suspensive effect. 
16 At present, therefore, that provision no longer identifies a particular group of 
persons, which is to say that it does not provide that providers of internet 
advertising services must provide information on taxable persons who have used 
those services to publish advertisements and on the advertisements published by 
them. 
17 In this case, it is common ground that implementation of the request for 
information from the VID is inextricably linked to the processing of personal data.  
18 It is also common ground that the VID has the power to collect data in the 
possession of internet advertising services which are necessary in order to carry 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING — CASE C-175/20 
 
8  
out certain tax administration measures. The applicant agrees to provide the 
information needed by the Tax Administration provided that the request is made 
in accordance with the requirements laid down by the GDPR. 
19 The issue, therefore, is to what extent the VID can request information and 
whether the amount of information requested can be unlimited. Moreover, the 
request for information at issue in this case makes it clear that all information 
must be provided no later than on the third of every month, but does not specify 
an end date for that obligation. 
20 The dispute is also concerned with the type of information that must be included 
in the request for information, given that any practice by the authorities that 
involves the processing of personal data within the meaning of Article 4(2) of the 
GDPR must respect the EU legislation on the protection of such data (see the 
judgment of the Court of Justice of 16 January 2019 Deutsche Post, C-496/17, 
EU:C:2019:26, paragraph 53). 
21 Article 15(6) of the Law on taxes and duties does not prescribe the content of a 
request for information. The VID argues that it needs all information relating to 
data subjects. In essence, the Tax Administration wishes to carry out ongoing and 
exhaustive checks in order to determine whether any covert transactions have 
been performed, whether any undeclared business activity has taken place and 
whether any specific tax administration measures need to be adopted. 
22 It may be concluded from the explanatory memorandum to the aforementioned 
legislative amendment that proportionality has already been taken into account in 
the context of the rules relating to data protection; there are, however, 
contradictions in evidence as regards the requirements imposed by the GDPR. 
23 The questions on how the provisions of the GDPR are to be interpreted in the 
context of this dispute have not been extensively analysed. There is no doubt that 
the processing of the information to which the request for information refers may 
affect the fundamental rights of a large group of persons (given that the request for 
information does not identify the persons in question), and the data in question 
cannot therefore be processed without complying with the requirements laid down 
in the GDPR. So far as concerns the request for information at issue in this case, it 
should be noted that the reasons given for it are inadequate, although this is to 
some extent offset by the statement of grounds in the contested decision. It cannot 
be unequivocally concluded that such a request for information is capable of being 
regarded as duly reasoned and occasional and that it does not relate to all of the 
information included under the ‘Motor Vehicle’ heading, given that the Tax 
Administration wishes in essence to carry out ongoing and exhaustive checks. 
24 The referring court has doubts about whether the processing of personal data 
prescribed by the VID can be regarded as compliant with the data-protection rules 
applicable depending on the purpose of the processing within the meaning of 
recital 31 of the GDPR. 
VALSTS IEŅĒMUMU DIENESTS 
 
9 
25 In the context of the examination of this administrative-law case, it is necessary to 
determine whether the personal data in question are processed in a manner that is 
transparent to the data subjects, whether the information contained in the request 
for information was requested for particular, explicit and legitimate purposes, and 
whether the personal data are processed only to the extent strictly necessary to 
enable the VID to perform its functions (data minimisation) within the meaning of 
Article 5(1) of the GDPR. 
26 In order to clarify the issues raised, it is necessary to adopt a correct interpretation 
of the requirements laid down in the GDPR in the light of the circumstances at 
issue. The legislative measures do not contain specific criteria for assessing 
whether the controller duly ensures compliance with the provisions of Article 5(1) 
of the GDPR (accountability). The Latvian legislation does not contain any more 
specific rules on the issue of the application of the provisions of the GDPR to a 
processing of personal data such as that at issue in this case. It is therefore 
necessary to determine the criteria for assessing whether the request for 
information made by the VID respects the essence of the fundamental rights and 
freedoms and whether the request for information in question may be considered 
necessary and proportionate in a democratic society in order to safeguard 
important objectives of public interest of the Union and of Latvia in the taxation 
and budgetary fields.  
27 It must be borne in mind that the request for information at issue does not make 
reference to any ‘particular inquiry’ carried out by the VID within the meaning of 
the provisions of the Regulation. 
28 The aforementioned request for information does not ask for information on 
specific persons, but on all data subjects who have published advertisements in the 
‘Motor Vehicles’ section of the portal; it also asks that that information be 
provided no later than on the third of each month (meaning that the applicant must 
provide the VID with all information on advertisements published in the previous 
month). 
29 In the light of the foregoing, the referring court is uncertain whether such a 
practice on the part of a national authority may be regarded as being consistent 
with the requirements laid down in the GDPR. 
30 In deciding whether to make a reference for a preliminary ruling to the Court of 
Justice of the European Union, the referring court took into account the following 
factors: 
1. the uncertainty as to the correct interpretation of the GDPR; 
2. the importance of a correct interpretation of European Union legislation to 
the uniform application of the rules in place in the Member States; 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING — CASE C-175/20 
 
10  
3. the lack of any specifically defined criteria for assessing whether the 
controller duly ensured that the processing of data (including the acquisition 
of information) complied with the requirements laid down in the Regulation; 
4. the decisive importance of the interpretation given by the Court of Justice of 
the European Union to the correct and fair resolution of the administrative-
law dispute pending before it.