Judgment;Summary — ECLI:EU:C:2023:2
Date: 2023-01-12
Language of the case: Hungarian
Court formation: First Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Fundamental rights;Data protection;Charter of Fundamental Rights
Procedure: Reference for a preliminary ruling
Origin: Hungary

Anonymised version 
Translation C-132/21 – 1 
Case C-132/21 
Request for a preliminary ruling 
Date lodged: 
3 March 2021 
Referring court: 
Fővárosi Törvényszék (Budapest High Court, Hungary) 
Date of the decision to refer: 
2 March 2021 
Applicant: 
BE 
Defendant: 
Nemzeti Adatvédelmi és Információszabadság Hatóság (National 
Authority for Data Protection and Freedom of Information, 
Hungary) 
  
Fővárosi Törvényszék (Budapest High Court, Hungary) 
Other party intervening in support of the defendant: Budapesti Elektromos 
Művek Zártkörűen Működő Részvénytársaság ([…] Budapest […]) 
[…] [matters of domestic procedural law] 
Subject matter of the dispute: Administrative-law action brought against [an] 
administrative decision […] relating to data protection 
Order: 
The referring court hereby makes a reference to the Court of Justice of the 
European Union for a preliminary ruling on the interpretation of Articles 51(1), 
52(1), 77(1) and 79(1) of Regulation (EU) 2016/679 of the European Parliament 
EN 
REQUEST FOR A PRELIMINARY RULING OF 2.3.2021 – CASE C-132/21 
 
2  
Anonymised version 
and of the Council of 27 April 2016 on the protection of natural persons with 
regard to the processing of personal data and on the free movement of such data, 
and repealing Directive 95/46/EC, and of Article 47 of the Charter of 
Fundamental Rights in conjunction with the aforementioned provisions. 
The referring court submits the following questions to the Court of Justice of the 
European Union for a preliminary ruling: 
1. Must Articles 77(1) and 79(1) of [Regulation 2016/679] be interpreted as 
meaning that the administrative appeal provided for in Article 77 
constitutes an instrument for the exercise of public rights, whereas the 
legal action provided for in Article 79 constitutes an instrument for the 
exercise of private rights? If so, does this support the inference that the 
supervisory authority, which is responsible for hearing and determining 
administrative appeals, has priority competence to determine the 
existence of an infringement? 
2. In the event that the data subject ― in whose opinion the processing of 
personal data relating to him has infringed Regulation 2016/679 ― 
simultaneously exercises his right to lodge a complaint under 
Article 77(1) of that regulation and his right to bring a legal action 
under Article 79(1) of the same regulation, may an interpretation in 
accordance with Article 47 of the Charter of Fundamental Rights be 
regarded as meaning: 
(a) that the supervisory authority and the court have an obligation to 
examine the existence of an infringement independently and may 
therefore even arrive at different outcomes; or 
(b) that the supervisory authority’s decision takes priority when it 
comes to the assessment as to whether an infringement has been 
committed, regard being had to the powers provided for in 
Article 51(1) of Regulation 2016/679 and those conferred by 
Article 58(2)(b) and (d) of that regulation? 
3. Must the independence of the supervisory authority, ensured by 
Articles 51(1) and 52(1) of Regulation 2016/679, be interpreted as 
meaning that that authority, when conducting and adjudicating upon 
complaint proceedings under Article 77, is independent of whatever 
ruling may be given by final judgment by the court having jurisdiction 
under Article 79, with the result that it may even adopt a different 
decision in respect of the same alleged infringement? 
[…] [matters of domestic procedural law] 
Grounds 
BUDAPESTI ELEKTROMOS MŰVEK 
 
3 
Anonymised version 
1 This administrative court, which is hearing a dispute relating to data protection, 
seeks from the Court of Justice of the European Union (‘the Court of Justice’) 
under Article 267 TFEU an interpretation of certain provisions of EU law which it 
needs in order to be able to dispose of the dispute in the main proceedings. 
Subject matter of the dispute and relevant facts 
2 The applicant, acting in his capacity as a shareholder in the limited liability 
company concerned (‘the controller’), attended the general meeting of 
shareholders of that company that was held on 26 April 2019, at various points 
during which he put questions to the members of the board of directors and to 
other persons attending the meeting. Afterwards, the applicant asked the controller 
to hand over to him, as his own personal data, the phonogram which had been 
recorded during the general meeting. The controller complied with that request but 
provided to the applicant only those segments of the recording that contained his 
own voice, not those containing what other persons had said. The applicant lodged 
a complaint with the defendant, in its capacity as the supervisory authority, and 
asked it, first, to declare that the controller had acted unlawfully, in breach of 
Regulation 2016/679, in not providing him with the phonogram of the general 
meeting of shareholders ― including, in particular, the answers to his questions 
― and, secondly, to compel the controller to provide him with the phonogram. 
The defendant stated that there had been no infringement and, by decision of 
29 November 2019 […], dismissed the applicant’s appeal. 
3 The applicant brought against the defendant’s decision an administrative-law 
action ― claiming, principally, that that decision should be amended or, in the 
alternative, annulled ― which gave rise to the dispute in the main proceedings 
that is currently pending before the referring court. The defendant has maintained 
the position which it took in its decision and contends that the administrative-law 
action should be dismissed. 
4 At the same time, the applicant brought an action before the civil courts in 
exercise of his rights under Article 79 of Regulation 2016/679. The civil court that 
heard that case at second instance held, by final judgment, that the controller had 
infringed the applicant’s right to access his personal data, given that the former 
had not made available to the latter, notwithstanding his request to that effect, 
those segments of the phonogram recorded during the general meeting of 
shareholders which contained the answers to his questions. Consequently, that 
court ordered the controller to provide the applicant with the aforementioned 
segments. In the administrative-law proceedings, the applicant has requested that 
account be taken of the findings contained in the civil court’s judgment. 
REQUEST FOR A PRELIMINARY RULING OF 2.3.2021 – CASE C-132/21 
 
4  
Anonymised version 
Reasons for making the request for a preliminary ruling and arguments of 
the parties 
5 Following the final judgment given by the civil court, the defendant proposed, in 
the course of the administrative-law proceedings, that a reference for a 
preliminary ruling be made, on the ground that, in its view, the supervisory 
authority and the civil courts share parallel competences. The referring court 
concurs with the raising of this point of uncertainty and considers it necessary, in 
order to dispose of the dispute, to arrive at a definition of those parallel 
competences, that definition being contingent upon a legal interpretation by the 
Court of Justice. 
6 In the view of the defendant, Article 57(1)(a) of Regulation 2016/679 supports the 
inference that the supervisory authority has priority competence to monitor the 
correct application of that regulation and is the primary guarantor of the protection 
of personal data in the context of public law. However, neither Regulation 
2016/679 nor the national procedural legislation define how that administrative 
competence interacts with the jurisdiction of the civil courts, which represent a 
secondary level of legal protection, and this raises a fundamental issue of legal 
certainty. The defendant submits that, owing to the particular features of national 
procedural law, the supervisory authority could not participate in the civil 
proceedings relating to the present case, even as an intervener, and was therefore 
unable to express its point of view in those proceedings. It states that this is not an 
isolated instance and it knows of several such cases in which, as a result of a 
single infringement, the data subject brought administrative proceedings and a 
civil case in parallel.  
7 The applicant considers that both the national legislation and Regulation 2016/679 
enable holders of data to exercise their civil rights as against controllers before the 
civil courts too. The civil courts clearly have jurisdiction to examine 
infringements relating to data protection and to award damages for non-material 
harm. According to the applicant, a court hearing data protection proceedings is in 
no way bound by the decision of the supervisory authority. 
Relevant legal provisions 
8 EU legislation 
Regulation 2016/679: 
Article 51(1) 
Article 52(1)  
Article 57(1)(a) and (f) 
Article 58(2)(b) and (d) 
BUDAPESTI ELEKTROMOS MŰVEK 
 
5 
Anonymised version 
Article 77(1)  
Article 78(1)  
Article 79(1)  
Article 82(6)  
Charter of Fundamental Rights: Article 47 
9 National legislation 
Az információs önrendelkezési jogról és az információszabadságról szóló 2011. 
évi CXII. törvény (Law CXII of 2011 on the right to self-determination as regards 
information and freedom of information; ‘the Law on information’) 
Article 22 
In the exercise of his rights, the data subject may, in accordance with the 
provisions of Chapter VI: 
(a) ask the [Nemzeti Adatvédelmi és Információszabadság Hatóság (National 
Authority for the Protection of Data and Freedom of Information; ‘the 
Authority’)] to launch an investigation into the lawfulness of a measure 
adopted by the controller, in the case where the latter has limited the 
exercise of the rights enjoyed by the data subject under Article 14 or has 
refused a request by which that person has sought to exercise his rights, and 
(b) ask the Authority to conduct administrative data protection proceedings, in 
the case where the data subject considers that, in processing his personal 
data, the controller, or, where appropriate, his agent or the processor acting 
under his orders, has infringed provisions on the processing of personal data 
which are laid down in legislation or in a binding legal act of the European 
Union. 
Article 23 
1. The data subject may bring a legal action against the controller or the 
processor ― in connection with processing operations falling within the latter’s 
sphere of activity ― in the case where he considers that, in processing his 
personal data, the controller, or, where appropriate his agent or the processor 
acting under his orders, has infringed provisions on the processing of personal 
data which are laid down in legislation or in a binding legal act of the European 
Union. 
[…] 
REQUEST FOR A PRELIMINARY RULING OF 2.3.2021 – CASE C-132/21 
 
6  
Anonymised version 
4. Court proceedings shall also be open to participation by persons who 
otherwise lack locus standi. The Authority may intervene in those proceedings in 
support of the claims pursued by the data subject. 
5. If the court upholds the action, it shall find that an infringement has been 
committed and order the controller, or, where appropriate, the processor, to: 
(a) cease the unlawful processing operation; 
(b) restore the lawfulness of data processing; and/or 
(c) adopt precisely defined conduct in order to ensure that the data subject can 
exercise his rights, 
and at the same time give judgment on any claims for damages for material and 
non-material harm. 
[…] [circumstances in which the judgment mentioned in the foregoing paragraph 
must be published] 
Article 38 
1. The Authority shall be an independent body of the State Administration. 
2. The Authority shall have the task of monitoring and promoting the 
application of the right to the protection of personal data and to access data in the 
public interest and data disclosed on public interest grounds, and of promoting the 
free movement of personal data within the European Union. 
2a. The Authority shall perform the tasks and exercise the powers which 
Regulation 2016/679 entrusts to the supervisory authority in relation to individuals 
subject to Hungarian competence and in accordance with the provisions of the 
aforementioned regulation and of this Law.  
3. As part of the tasks referred to in paragraphs 2 and 2a and in accordance 
with the provisions of this Law, the Authority shall in particular be responsible 
for: 
(a) conducting investigations, both in response to a complaint and of its own 
motion; 
(b) conducting administrative proceedings in relation to data protection, both at 
the request of the data subject and of its own motion; 
[…] [tasks not relevant to this case] 
(e) intervening in any court proceedings instituted at the request of a third party; 
[…] [tasks not relevant to this case] 
BUDAPESTI ELEKTROMOS MŰVEK 
 
7 
Anonymised version 
(h) performing the other tasks entrusted to the supervisory authorities of the 
Member States by a binding legal act of the European Union, in particular 
by Regulation 2016/679 and Directive (EU) 2016/680, as well as those tasks 
established by law. 
[…] 
5. The Authority shall be independent and subject only to law, being 
unamenable to instructions in relation to its tasks, and shall perform these 
separately from other bodies and in a manner free from influence. The Authority’s 
tasks may be established only by law. 
A bíróságok szervezetéről és igazgatásáról szóló 2011. évi CLXI. törvény (Law 
CLXI of 2011 on the organisation and administration of the courts; ‘the Law on 
the organisation of the courts’) 
Article 6 
Decisions of the courts shall be binding on everyone, even where the court 
declares itself to have or to lack jurisdiction in a case. 
Statement of the grounds on which the reference for a preliminary ruling was 
made  
10 The Court of Justice has not yet interpreted Articles 77 and 79 of Regulation 
2016/679 from the point of view of the definition of the competences established 
in those provisions. The aforementioned articles confer on individuals rights 
enforceable in parallel, but the parallel exercise of those rights may give rise to 
uncertainty in relation to legal certainty, as is the case in the dispute in the main 
proceedings. Since, in accordance with national procedural legislation, decisions 
of the supervisory authority are not binding on the civil courts, it is not 
inconceivable that a civil court may adopt a decision contrary to that of the 
supervisory authority in relation to the same facts. 
11 The referring court is an administrative court the role of which, pursuant to the 
powers conferred by Article 78 of Regulation 2016/679, is to review the decisions 
of the supervisory authority. The competences of the supervisory authority also 
define the competences of the administrative court, given that the latter may carry 
out an examination of lawfulness in respect of points of law falling within the 
scope of the supervisory authority’s sphere of competence. In the dispute in the 
main proceedings, the referring court has an obligation to review the findings 
contained in the supervisory authority’s decision on the infringement of 
Regulation 2016/679, given that the civil courts, acting pursuant to the powers 
provided for in Article 79 of that regulation, have already given final judgment on 
the same point of law. The judgment of the civil court lacks the authority of res 
judicata in the dispute in the main proceedings because the parties to the 
proceedings are not identical. Although, in both the civil proceedings and the 
REQUEST FOR A PRELIMINARY RULING OF 2.3.2021 – CASE C-132/21 
 
8  
Anonymised version 
dispute in the main proceedings, the applicant is the individual affected by the 
data processing, in the civil case, the defendant was the controller, whereas, in the 
dispute in the main proceedings, the defendant is the supervisory authority, in 
support of whose claims the controller has intervened as a interested party. In 
accordance with Article 23(4) of the Law on information, the supervisory 
authority may intervene in civil proceedings only in support of the claims pursued 
by the individual concerned. In this case, however, since the supervisory authority 
shares the view not of the applicant but of the controller, it did not meet the 
conditions governing intervention in civil proceedings. 
12 It is indisputable that the referring court has to examine the same facts and the 
commission of the same infringement ― and interpret the same EU and national 
legislation ― as those/that in respect of which the civil court has already given 
final judgment. In accordance with national procedural law, even though the 
judgment of the civil court is not binding on the administrative court, [the latter 
court] cannot disregard the general principle of legal certainty, whereby court 
decisions are binding on everyone (Article 6 of the Law on the organisation of the 
courts). 
13 In the opinion of the referring court, since the remedies provided for in Articles 77 
and 79 of Regulation 2016/679 cannot be intended to permit the coexistence of 
parallel heads of competence to examine the same facts and the same 
infringement, it is necessary for the Court of Justice to define those competences. 
The absence of such a definition might lead to substantively contradictory 
judgments, thus seriously undermining legal certainty both for the controller and 
for the individual affected by the data processing.  
14 The referring court puts forward a possible interpretation, similar to the regime 
developed in the context of competition law, according to which it is perfectly 
possible to separate the exercise of public rights and the exercise of private rights 
without infringing the competences or the rights of the persons concerned. 
Article 9(1) of Directive 2014/104/EU of the European Parliament and of the 
Council of 26 November 2014 on certain rules governing actions for damages 
under national law for infringements of the competition law provisions of the 
Member States and of the European Union provides that Member States must 
ensure that an infringement of competition law found by a final decision of the 
competition authority is deemed to be irrefutably established for the purposes of 
an action for damages. The referring court sees a parallel between these two 
legislative regimes, given that Article 82(6) of Regulation 2016/679, which deals 
with the exercise of the right to compensation, expressly refers to the judicial 
remedy provided for in Article 79 ― which, in the Hungarian legal system, falls 
within the jurisdiction of the civil courts ―, whereas competence in respect of 
compliance with the obligations laid down in that same regulation lies principally 
with the supervisory authority. 
15 In the view of the referring court, the remedy provided for in Article 77 of 
Regulation 2016/679 constitutes an instrument for the exercise of public rights ― 
BUDAPESTI ELEKTROMOS MŰVEK 
 
9 
Anonymised version 
notwithstanding that it is initiated by way of a complaint from, or at the request of, 
the data subject ―, whereas the legal action provided for in Article 79 is pursued 
in the exercise of private rights. The referring court takes the view that a natural 
person so affected may, at his own discretion, pursue either remedy, neither one 
being a prerequisite for, or a ground for the exclusion of, the other. The Court of 
Justice held in its judgment of 27 September 2017, Puškár (C-73/16, 
EU:C:2017:725) (‘the judgment in Puškár’) that ‘Article 47 of the Charter of 
Fundamental Rights of the European Union must be interpreted as meaning that it 
does not preclude national legislation which makes the exercise of a judicial 
remedy by a person stating that his right to protection of personal data guaranteed 
by Directive 95/46/EC of the European Parliament and of the Council of 
24 October 1995 on the protection of individuals with regard to the processing of 
personal data and on the free movement of such data, has been infringed, subject 
to the prior exhaustion of the remedies available to him before the national 
administrative authorities, provided that the practical arrangements for the 
exercise of such remedies do not disproportionately affect the right to an effective 
remedy before a court referred to in that article’ (judgment in Puškár, point 1 of 
the operative part). In that judgment, the Court of Justice recognised that the prior 
processing of the administrative appeal is a method for achieving legitimate 
general interest objectives, such as relieving the courts of disputes which can be 
decided directly before the administrative authority concerned and increasing the 
efficiency of judicial proceedings as regards disputes in which a legal action is 
brought despite the fact that a complaint has already been lodged (judgment in 
Puškár, paragraph 67). 
16 In the dispute in the main proceedings, unlike in the case of the facts in the 
judgment in Puškár, the national legislation does not make legal action subject to 
the condition of prior exhaustion of the administrative remedies available. On the 
contrary, the question of legal interpretation which has arisen in the dispute in the 
main proceedings stems from the fact that the parallel pursuit of remedies may 
give rise to different outcomes. In the case where a single natural person pursues 
both remedies in parallel in order to resolve a single infringement, it is necessary, 
for the purposes of establishing which forum has priority competence to determine 
the existence of an infringement, to define both the competences of the 
supervisory authority ― together with those of the administrative courts, to 
which, in accordance with Article 78 of Regulation 2016/679, it falls to dispose of 
legal actions brought against administrative decisions ― and the competences of 
the civil courts, to which, in accordance with Article 79, it falls to hear and 
determine actions under private law. As the Court of Justice held in the judgment 
in Puškár, increasing the efficiency of judicial proceedings is a legitimate general 
interest objective which, in the opinion of the referring court, must be achieved in 
all Member States irrespective of the differences established in national 
procedural rules. 
17 The parallel between competences at the vertical level is also problematic, given 
that the objective set out in recital 117 of Regulation 2016/679 ― according to 
which the establishment of supervisory authorities in Member States, empowered 
REQUEST FOR A PRELIMINARY RULING OF 2.3.2021 – CASE C-132/21 
 
10  
Anonymised version 
to perform their tasks and exercise their powers with complete independence, is an 
essential component of the protection of natural persons with regard to the 
processing of their personal data ―, the achievement of which is an obligation 
incumbent on the Member States under Article 51(1), would be partially restricted 
if the legal action preceded the administrative appeal. In so far as it is permitted to 
bring the administrative appeal and the legal action in parallel, any final court 
order made first would be binding on the supervisory authority at the time of 
adjudicating on a complaint lodged on account of the same facts. In that situation, 
therefore, the competences of the supervisory authority as provided for in 
Article 58 of Regulation 2016/679 would be restricted. 
18 In the pending case of Facebook Ireland and Others (C-645/19), Advocate 
General Bobek expressed the view in points 95 to 97 of his Opinion, delivered on 
13 January 2021 (‘the Advocate General’s Opinion in Facebook’), that a high 
level of protection of natural persons is contingent upon the assurance of 
consistency. In the view of the referring court, the application of Article 47 of the 
Charter of Fundamental Rights requires consistency not only at the horizontal 
level ― through the operation of the mechanism for consistency between 
supervisory authorities ― but also at the vertical level, in the relationship between 
administrative appeals and legal actions. The right to effective judicial protection 
enshrined in Article 47 of the Charter of Fundamental Rights can be guaranteed 
only through the assurance of legal certainty, that is to say through the consistent 
application of the law by independent bodies competent to conduct appeal 
proceedings. In the interests of consistency, it is necessary to define a precedence 
between the remedies which natural persons can pursue in parallel. This is only 
possible by way of an interpretation of Regulation 2016/679, given that both the 
supervisory authority and the courts enjoy independence, within the limits of their 
respective competences, in the adoption of their decisions.  
19 In the proceedings pending before the referring court, concerning an 
administrative-law action brought against a decision adopted by the supervisory 
authority under Article 78 of Regulation 2016/679, the question of parallel 
competences has arisen at the horizontal level, between the administrative court 
and the civil court. In so far as it is not possible to define those competences and a 
single person, acting on account of a single alleged infringement, institutes in 
parallel administrative proceedings under Article 77 of Regulation 2016/679 and 
legal proceedings under Article 79, the issue identified in point 171 of the 
Advocate General’s Opinion in Facebook will arise in connection with the 
respective competences of the administrative court and the civil court too. The 
reason for this is that the administrative court, which oversees the supervisory 
authority ― pursuant to its powers under Article 78 ―, and the civil court, which 
operates under Article 79, might find themselves engaged in a ‘parallel race to the 
first judgment’. In this way, true competence to determine whether, in the 
particular case, data was processed lawfully or unlawfully would lie with the 
forum finally disposing of the legal proceedings first.  
BUDAPESTI ELEKTROMOS MŰVEK 
 
11 
Anonymised version 
20 The referring court concurs with the supervisory authority’s submission that the 
power granted by Article 51(1) of Regulation 2016/679 and the tasks and powers 
provided for in Article 57(1)(a) and (f) and Article 58(2)(b) and (c) confer on the 
supervisory authority priority competence for the purposes of investigating and 
overseeing compliance with the obligations laid down in that regulation. The 
referring court therefore proposes that the Court of Justice confirm the 
interpretation to the effect that, in the case where the supervisory authority 
conducts or has conducted proceedings in respect of one and the same 
infringement, the decision of that authority in that case ― along with that of the 
administrative court overseeing it ― will take precedence when it comes to 
determining the existence of an infringement, and, in the aforementioned 
administrative and administrative-law proceedings, no binding force will attach to 
any rulings given by the civil courts acting under Article 79 of Regulation 
2016/679. 
21 In order to settle the present dispute, it is necessary, for the purposes of 
determining the existence of an infringement, to define the competences of the 
supervisory authority, the administrative court reviewing the decisions of that 
authority and the civil court acting under Article 79 of Regulation 2016/679 
respectively. It should be taken into account in this regard that, if the supervisory 
authority’s competence is not recognised as taking priority, the referring court will 
be compelled, in accordance with the principle of legal certainty, to regard as 
binding the ruling given by the civil court in its final judgment, and will not be 
able to assess for itself the lawfulness of the ruling given in the administrative 
decision with respect to the existence of an infringement, and, in that event, the 
competence provided for in Article 78 of Regulation 2016/679 will in practice be 
divested of substance. 
22 On the other hand, maintaining the current situation would create widespread legal 
uncertainty, given that chronology would determine which of the judgments 
delivered by the administrative courts and the civil courts respectively has binding 
force in respect of the other proceedings which are still pending.  
[…] [matters of domestic procedural law] 
Budapest, 2 March 2021. 
[…] [signatures]