Case C-33/22, Österreichische Datenschutzbehörde: Judgment of the Court (Grand Chamber) of 16 January 2024 (request for a preliminary ruling from the Verwaltungsgerichtshof — Austria) — Österreichische Datenschutzbehörde v WK (Reference for a preliminary ruling — Protection of natural persons with regard to the processing of personal data — Article 16 TFEU — Regulation (EU) 2016/679 — Article 2(2)(a) — Scope — Exclusions — Activities which fall outside the scope of Union law — Article 4(2) TEU — Activities concerning national security — Committee of inquiry set up by the parliament of a Member State — Article 23(1)(a) and (h), Articles 51 and 55 of Regulation (EU) 2016/679 — Competence of the supervisory authority responsible for data protection — Article 77 — Right to lodge a complaint with a supervisory authority — Direct effect)
Date: 2024-01-16
Institutions: Court of Justice
Subjects: committee of inquiry, competence of the institution, data protection, data-processing law, personal data, supervisory body








C_202401653EN.000101.fmx.xml












Official Journal of the European Union


EN
Series C













C/2024/1653


4.3.2024





Judgment of the Court (Grand Chamber) of 16 January 2024 (request for a preliminary ruling from the Verwaltungsgerichtshof — Austria) — Österreichische Datenschutzbehörde v WK
(Case C-33/22, (1) Österreichische Datenschutzbehörde)
(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Article 16 TFEU - Regulation (EU) 2016/679 - Article 2(2)(a) - Scope - Exclusions - Activities which fall outside the scope of Union law - Article 4(2) TEU - Activities concerning national security - Committee of inquiry set up by the parliament of a Member State - Article 23(1)(a) and (h), Articles 51 and 55 of Regulation (EU) 2016/679 - Competence of the supervisory authority responsible for data protection - Article 77 - Right to lodge a complaint with a supervisory authority - Direct effect)
(C/2024/1653)
Language of the case: German

Referring court

Verwaltungsgerichtshof

Parties to the main proceedings


Appellant on a point of law: Österreichische Datenschutzbehörde

Respondent on a point of law: WK

Interested party: Präsident des Nationalrates

Operative part of the judgment







1.


The first sentence of Article 16(2) TFEU and Article 2(2)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
must be interpreted as meaning that an activity cannot be regarded as being outside the scope of Union law and therefore falling outside the scope of that regulation for the sole reason that it is carried out by a committee of inquiry set up by the parliament of a Member State in the exercise of its power of scrutiny over the executive.










2.


Article 2(2)(a) of Regulation 2016/679, read in the light of recital 16 of that regulation,
must be interpreted as meaning that the activities of a committee of inquiry set up by the parliament of a Member State in the exercise of its power of scrutiny over the executive, the purpose of which is to investigate the activities of a police State-protection authority on account of a suspicion of political influence over that authority, cannot, as such, be regarded as activities concerning national security which fall outside the scope of Union law, within the meaning of that provision.










3.


Article 77(1) and Article 55(1) of Regulation 2016/679
must be interpreted as meaning that, where a Member State has chosen, in accordance with Article 51(1) of that regulation, to establish a single supervisory authority, without, however, conferring on it the competence to monitor the application of that regulation by a committee of inquiry set up by that Member State’s parliament in the exercise of its power of scrutiny over the executive, those provisions directly confer on that authority the competence to hear complaints relating to the processing of personal data by that committee of inquiry.






(1)  
            OJ C 138, 28.3.2022.


ELI: http://data.europa.eu/eli/C/2024/1653/oj
ISSN 1977-091X (electronic edition)