Judgment;Abstract — ECLI:EU:C:2023:874
Date: 2023-11-16
Language of the case: French
Court formation: Fifth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Fundamental rights;Data protection;Charter of Fundamental Rights
Procedure: Reference for a preliminary ruling
Origin: Belgium

Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged:  
20 May 2022 
Referring court:  
Cour d’appel de Bruxelles (Belgium) 
Date of the decision to refer:  
9 May 2022 
Appellants:  
Ligue des droits humains ASBL 
BA 
Respondent:  
L’organe de contrôle de l’information policière 
  
1. Subject matter and facts of the dispute:  
1 In 2016, BA wished to participate in the assembly and disassembly of the 
installations for the tenth ‘European Development Days’ event in Brussels. In 
order to do so, he had to obtain a ‘security clearance certificate’.  
2 By letter of 22 June 2016, the Autorité nationale de sécurité (National Security 
Authority) refused to issue the necessary security clearance certificate, stating as 
follows:  
‘It is apparent from the information … made available to the National Security 
Authority that the person concerned is known for participation in various 
demonstrations (10) between 2007 and 2016. 
That information prevents the issuance of a security clearance certificate under the 
aforesaid decree, which was adopted inter alia for reasons of State security and 
preservation of the constitutional democratic order.’ 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-333/22 
 
2  
3 The loi du 30 juillet 2018 (Law of 30 July 2018), which entered into force on 
5 September 2018, created an authority for the supervision of police information 
under the name ‘Organe de contrôle de l’information policière’ (Supervisory Body 
for Police Information).  
4 On 4 February 2020, BA’s legal adviser asked the Supervisory Body for Police 
Information to identify the controllers responsible for the processing at issue and 
order them to provide BA with access to all the information concerning him. 
5 By email of 6 February 2020, the Supervisory Body for Police Information replied 
indicating that BA had only an indirect right of access, while also stating that it 
was going to verify the personal data relating to BA with a view to ensuring the 
lawfulness of any processing in the Banque de données nationale générale 
(general national data bank). It stated that it had power to order the police to erase 
or amend data, if necessary, and that once the checks had been completed, BA 
would be informed that ‘the necessary verifications have been carried out’. 
6 On 22 June 2020, the Supervisory Body for Police Information wrote: 
‘… I inform you, in accordance with Article 42 of the loi du 30 juillet 2018 
relative à la protection des personnes physiques à l’égard des traitements de 
données à caractère personnel (Law of 30 July 2018 on the protection of natural 
persons with regard to the processing of personal data; ‘the LPD’), that the 
Supervisory Body has carried out the necessary verifications. 
This means that your client’s personal data have been checked in the police data 
banks with a view to ensuring the legality of any processing. 
If necessary, the personal data have been amended or erased. 
As I informed you in my email of 2 June, Article 42 of the LPD does not permit 
the Supervisory Body to provide any further information.’  
7 On 2 September 2020, BA and the Ligue des droits humains brought the 
Supervisory Body for Police Information before the President of the tribunal de 
première instance du tribunal francophone de Bruxelles (Brussels Court of First 
Instance (French-speaking) Belgium), pursuant to Article 209 of the Law of 
30 July 2018, essentially seeking access to all the personal data concerning BA, 
and therefore an order requiring the Supervisory Body for Police Information to 
identify the controllers and any persons who might have received those data.  
8 By order of 17 May 2021, the President declared himself not to have jurisdiction. 
9 By application of 15 June 2021, the present proceedings were brought before the 
cour d’appel de Bruxelles (Court of Appeal, Brussels; ‘the Court of Appeal’). 
LIGUE DES DROITS HUMAINS 
 
3 
2. Provisions at issue:  
EU Law 
Charter of Fundamental Rights of the European Union 
10 Article 8, which is headed ‘Protection of personal data’, provides: 
‘1. Everyone has the right to the protection of personal data concerning him or 
her. 
2. Such data must be processed fairly for specified purposes and on the basis of 
the consent of the person concerned or some other legitimate basis laid down by 
law. Everyone has the right of access to data which has been collected concerning 
him or her, and the right to have it rectified. 
3. Compliance with these rules shall be subject to control by an independent 
authority.’  
11 Article 47, which is headed ‘Right to an effective remedy and to a fair trial’, 
provides: 
‘Everyone whose rights and freedoms guaranteed by the law of the Union are 
violated has the right to an effective remedy before a tribunal in compliance with 
the conditions laid down in this Article. 
Everyone is entitled to a fair and public hearing within a reasonable time by an 
independent and impartial tribunal previously established by law. Everyone shall 
have the possibility of being advised, defended and represented. 
Legal aid shall be made available to those who lack sufficient resources in so far 
as such aid is necessary to ensure effective access to justice.’  
Directive (EU) 2016/680 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing 
of personal data by competent authorities for the purposes of the prevention, 
investigation, detection or prosecution of criminal offences or the execution of 
criminal penalties, and on the free movement of such data, and repealing Council 
Framework Decision 2008/977/JHA 
12 Article 17, which is headed ‘Exercise of rights by the data subject and verification 
by the supervisory authority’, provides: 
‘1. In the cases referred to in Article 13(3), Article 15(3) and Article 16(4) 
Member States shall adopt measures providing that the rights of the data subject 
may also be exercised through the competent supervisory authority. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-333/22 
 
4  
2. Member States shall provide for the controller to inform the data subject of 
the possibility of exercising his or her rights through the supervisory authority 
pursuant to paragraph 1. 
3. Where the right referred to in paragraph 1 is exercised, the supervisory 
authority shall inform the data subject at least that all necessary verifications or a 
review by the supervisory authority have taken place. The supervisory authority 
shall also inform the data subject of his or her right to seek a judicial remedy.’  
Belgian law 
Law of 30 July 2018 on the protection of natural persons with regard to the 
processing of personal data 
13 Title 2, which addresses the criminal context and public security, transposes 
Directive 2016/680/EU.  
14 Chapter III of Title 2 lays down the rights of the data subject, consisting 
essentially of the right to information (Article 37, paragraph 2 of which provides 
for the provision of information to be delayed or refused, or its content restricted), 
the right of access to data (Article 38, paragraph 2 of which provides for such 
access to be restricted or refused) and the right to have the data rectified 
(Article 39, paragraph 4 of which provides for the statement of reasons for a 
refusal to rectify or erase the data, or to limit or prohibit processing, to be 
restricted).  
15 Article 42 then provides: 
‘Any request to exercise the rights set out in this chapter with respect to the police 
services … or to the Inspection générale de la police fédérale et de la police locale 
(General Inspectorate of the Federal and Local Police) shall be made to the 
supervisory authority referred to in Article 71. 
In the cases referred to in Articles 37(2), 38(2), 39(4) and 62(1), the supervisory 
authority referred to in Article 71 shall inform the data subject only that the 
necessary verifications have been carried out. 
…’ 
16 Chapter VI of Title 2 is entitled ‘Independent supervisory authorities’. 
17 Article 71, which is contained in that chapter, provides:  
‘1. An independent supervisory authority for police information is hereby 
created at the Chamber of Representatives, under the name ‘the Supervisory Body 
for Police Information’. 
… 
LIGUE DES DROITS HUMAINS 
 
5 
[It shall be] responsible for: 1. supervising the application of this Title … .’ 
18 Within Title 5, which is entitled ‘Remedies and representation of data subjects’, 
Chapter 1 is entitled ‘Action for an injunction’. 
19 Article 209, which is contained in that chapter, reads as follows: 
‘Without prejudice to any other judicial, administrative or extra-judicial remedy, 
the president of the court of first instance, sitting as if hearing interim 
proceedings, may determine that processing has been carried out which constitutes 
a breach of the statutory or regulatory provisions on the protection of natural 
persons with regard to the processing of their personal data, and grant an 
injunction prohibiting such processing. 
The president of the court of first instance, sitting as if hearing interim 
proceedings, shall hear any application relating to the right granted by or by virtue 
of the law to obtain access to personal data, as well as any application seeking 
rectification, erasure or prevention of the use of any personal data which are 
inaccurate or, having regard to the purpose of the processing, incomplete or 
irrelevant, or of which the recording, disclosure or storage is prohibited, to the 
processing of which the data subject has objected or which have been retained for 
longer than is permitted.’  
3. The parties’ positions:  
BA and the Ligue des droits humains (‘the appellants’)  
20 The appellants complain that there is a general and systematic derogation from the 
right of access to personal data in that the right of access can only be exercised 
indirectly via the Supervisory Body for Police Information and, more specifically, 
they criticise the lack of any remedy against a decision of the Supervisory Body 
for Police Information. 
21 They reiterate their request for access to the personal data relating to BA and his 
participation in 10 demonstrations between 2007 and 2016, and request in the 
alternative that a reference be made to the Court of Justice for a preliminary ruling 
on Articles 14, 15 and 17 of Directive 2016/680, read in conjunction with 
Articles 8, 47 and 52(1) of the Charter. 
The Supervisory Body for Police Information 
22 The Supervisory Body for Police Information submits that the appeal should be 
dismissed and the order under appeal confirmed inasmuch as the judge below 
declared himself not to have jurisdiction to hear the application and dismissed it 
on that basis. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-333/22 
 
6  
4. Assessment of the Court of Appeal:  
23 Data processed by the police services, such as the data at issue, are subject in 
Belgian law to a specific body of rules. As permitted by Article 17 of Directive 
2016/680, Article 42 of the Law of 30 July 2018 provides that requests based on 
rights relating to personal data are to be made to the Supervisory Body for Police 
Information, which will simply inform the data subject that ‘the necessary 
verifications have been carried out’. The ‘contextual information’ that the 
Supervisory Body for Police Information can disclose to the data subject have not 
yet been specified in a royal decree provided for by law. 
24 Under Article 71 of the Law of 30 July 2018, the Supervisory Body for Police 
Information is the supervisory authority designated to exercise, vis-à-vis the 
controller, BA’s individual rights over the data at issue.  
25 Although Article 17(3) of the directive so requires, Article 42 of the Law of 
30 July 2018 does not call on the supervisory authority to inform the data subject 
of his or her right to seek a judicial remedy. Article 17(3) of the directive thus has 
not been transposed into domestic law.  
26 Article 47 of the Charter guarantees the right to an effective remedy before an 
impartial tribunal.  
27 The Court of Appeal observes that: 
– Article 240 of the Law of 30 July 2018 provides that the Supervisory Body for 
Police Information: 
‘4. shall deal with complaints, investigate the subject matter of the complaint 
so far as necessary, and inform the complainant of the progress and the 
outcome of the investigation within a reasonable time, particularly where 
further investigation or co-operation with another supervisory authority is 
necessary … .’  
However, that remedy before the Supervisory Body for Police Information 
must be exercised against the controller. Consequently it is not open to a 
data subject who cannot personally exercise the rights provided for by the 
directive and by the Law of 30 July 2018 and to whom the controller has not 
disclosed its identity, as in the present case.  
– equally, the action for an injunction provided for by Article 209 et seq. of the 
Law of 30 July 2018 does not provide BA with an effective remedy against the 
Supervisory Body for Police Information. It can be seen from those provisions 
that: 
• the action may be brought either by the data subject him or herself or by the 
Supervisory Body for Police Information but must be brought against the 
LIGUE DES DROITS HUMAINS 
 
7 
controller; it cannot therefore be brought by BA against the Supervisory 
Body for Police Information; 
• Article 42 of the Law of 30 July 2018, enacted in accordance with 
Article 13(3), Article 15(4), Article 16(4), and Article 17 of Directive 
2016/680, does not enable BA to bring such an action against the controller, 
because the exercise of his rights is entrusted to the Supervisory Body for 
Police Information; 
• the very succinct information provided by the Supervisory Body for Police 
Information, while admittedly compliant with Article 42 of the Law of 
30 July 2018 and – except in not mentioning the existence of a remedy – 
with Article 17 of the directive, does not enable either BA or a court, in an a 
posteriori review, to determine whether the Supervisory Body for Police 
Information exercised BA’s rights correctly; 
– Lastly, although the action for an injunction is provided for by the Law of 
30 July 2018 ‘without prejudice to any other judicial, administrative or extra-
judicial remedy’ and without limiting ‘the jurisdiction of the court of first 
instance and of the president of the court of first instance hearing interim 
proceedings’ (Articles 209 and 219 of the Law), any other remedy which BA 
might seek to exercise would encounter the same obstacles, given that BA 
cannot personally exercise his rights against the controller, nor obtain an a 
posteriori review of the exercise of his rights through the Supervisory Body for 
Police Information and have the action taken by that body reviewed in the light 
of its initial response, which nevertheless was permitted by Article 17 of the 
directive and the Law of 30 July 2018. 
5. Questions referred:  
28 On those grounds the Court of Appeal refers the following questions to the Court 
of Justice for a preliminary ruling: 
1. ‘Do Articles 47 and 8(3) of the Charter of Fundamental Rights of the 
European Union require provision to be made for a judicial remedy against 
an independent supervisory authority such as the Supervisory Body for 
Police Information where it exercises the rights of the data subject vis-à-vis 
the controller?’  
2. ‘Does Article 17 of Directive 2016/680 comply with Articles 47 and 8(3) of 
the Charter of Fundamental Rights of the European Union, as interpreted by 
the Court of Justice, in that it obliges the supervisory authority – which 
exercises the rights of the data subject vis-à-vis the controller – only to 
inform the data subject “that all necessary verifications or a review by the 
supervisory authority have taken place” and “of his or her right to seek a 
judicial remedy”, when such information does not enable any a posteriori 
review to be conducted as regards the action taken and assessment made by 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-333/22 
 
8  
the supervisory authority in the light of the data of the data subject and the 
obligations of the controller?’