Judgment of the court of 10 December 2020 in Joined Cases E-11/19 and E-12/19 Adpublisher AG v J and K (Regulation (EU) 2016/679 – Data protection – Right to lodge a complaint with a supervisory authority – Right to an effective judicial remedy against a supervisory authority – Anonymity – Costs incurred in appeal proceedings) 2021/C 113/04
Date: 2020-12-10
Institutions: EFTA Court
Subjects: Liechtenstein, appeal to an administrative authority, data protection, data-processing law, disclosure of information, legal expenses, natural person, personal data, protection of privacy, supervisory body








C_2021113EN.01000901.xml










31.3.2021   


EN


Official Journal of the European Union


C 113/9






JUDGMENT OF THE COURT
of 10 December 2020
in Joined Cases E-11/19 and E-12/19
Adpublisher AG v J and K


(Regulation (EU) 2016/679 – Data protection – Right to lodge a complaint with a supervisory authority – Right to an effective judicial remedy against a supervisory authority – Anonymity – Costs incurred in appeal proceedings)


(2021/C 113/04)
In Joined Cases E-11/19 and E-12/19, Adpublisher AG v J and K – REQUESTS to the Court under Article 34 of the Agreement between the EFTA States on the Establishment of a Surveillance Authority and a Court of Justice by the Liechtenstein Board of Appeal for Administrative Matters (Beschwerdekommission für Verwaltungsangelegenheiten) concerning the interpretation of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Court, composed of Páll Hreinsson, President (Judge-Rapporteur), Per Christiansen, and Bernd Hammermann, Judges, gave judgment on 10 December 2020, the operative part of which is as follows:






1.


Disclosure of a complainant’s personal data during proceedings based on a complaint lodged under Article 77 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, or proceedings based on Article 78(1) of that regulation, is not precluded by that regulation or any other provision of EEA law. The question of non-disclosure of a complainant’s personal data must be examined in the light of the principles for processing personal data under Articles 5 and 6 of Regulation (EU) 2016/679. Non-disclosure should not be granted if it would inhibit the performance of the obligations provided in Regulation (EU) 2016/679, or the exercise of the right to effective judicial remedy and due process as set out in Article 58(4) and under the fundamental right to an effective judicial remedy.










2.


It follows from Articles 77(1) and 57(3) of Regulation (EU) 2016/679 that where a data subject becomes a party to proceedings under Article 78(1) as a result of a data controller appealing against a supervisory authority’s decision, and where national law imposes this status on a data subject automatically, the data subject may not be made responsible for any costs incurred in relation to those proceedings.