CELEX: 62006CC0524
Language: en
Date: 2008-04-03
Title: Opinion of Mr Advocate General Poiares Maduro delivered on 3 April 2008. # Heinz Huber v Bundesrepublik Deutschland. # Reference for a preliminary ruling: Oberverwaltungsgericht für das Land Nordrhein-Westfalen - Germany. # Protection of personal data - European citizenship - Principle of non-discrimination on grounds of nationality - Directive 95/46/EC - Concept of necessity - General processing of personal data relating to citizens of the Union who are nationals of another Member State - Central register of foreign nationals. # Case C-524/06.

OPINION OF ADVOCATE GENERAL
      POIARES MADURO
      delivered on 3 April 2008 (1)
      
      Case C‑524/06
      Heinz Huber
      v
      Bundesrepublik Deutschland
      (Reference for a preliminary ruling from the Oberverwaltungsgericht für das Land Nordrhein-Westfalen (Germany))
      1.        The present case concerns the processing of the personal data of foreign EU citizens who reside in Germany. The referring
         court asks whether the processing of data in a central register operated by the Bundesamt für Migration und Flüchtlinge (Federal
         Office of Migration and Refugees), to which other public authorities also have access, is compatible with the prohibition
         of discrimination on the basis of nationality, the right of establishment and Directive 95/46, (2) given that no such register exists for German citizens.
      
      I –  Factual background
      2.        The claimant in the main proceedings, Mr Heinz Hubert, is an Austrian citizen. Since 1996, he has been living and working
         in Germany. The personal data of foreign citizens living in Germany, including those of citizens of other Member States, are
         stored in a central register operated by the Federal Office for Migration and Refugees. Information on Mr Huber stored in
         the register includes his personal details and marital status, passport details, the date of his first entry into Germany,
         his residence status, his various changes of domicile within the country as well as the details of the registration authorities
         and the names of the administrative offices that have communicated his data. Personal data of German citizens are stored only
         in local, municipal registers, as no central register at the federal level exists for them.
      
      3.        In 2002 Mr Huber, relying on Articles 12 and 49 EC and on Directive 95/46, requested the deletion from the central register
         of any data relating to him. His request was rejected by the Bundesverwaltungsamt (Federal Administrative Office), which was
         responsible at the time, while an administrative appeal within the same Office was also rejected. Then, Mr Huber brought an
         action before the Verwaltungsgericht (Administrative Court) with the same request. It upheld the action, finding that the
         storage of the claimant’s data was incompatible with Community law. The Federal Office for Migration and Refugees appealed
         against the judgment of the Administrative Court, so the Oberverwaltungsgericht für das Land Nordrhein-Westfalen (Higher Administrative
         Court of North-Rhine Westphalia) stayed the proceedings and referred three questions to the Court of Justice: 
      
      ‘Is the general processing of personal data of foreign citizens of the Union in a central register of foreign nationals compatible
         with:
      
      (a)      the prohibition of discrimination on grounds of nationality against citizens of the Union who exercise their right to move
         and reside freely within the territory of the Member States (first paragraph of Article 12 EC in conjunction with Articles
         17 EC and 18(1) EC),
      
      (b)       the prohibition of restrictions on the freedom of establishment of nationals of a Member State in the territory of another
         Member State (first paragraph of Article 43 EC),
      
      (c)       the requirement of necessity under Article 7(e) of [Directive 95/46]?’ 
      II –  Analysis
      4.        The first two questions referred to the Court of Justice by the national court concern the compatibility of the German system
         of processing the data of foreign Union nationals with, first, the general principle of non-discrimination enshrined in Article
         12 EC (read in conjunction with Articles 17 EC and 18(1) EC on Union citizenship and the right to move and reside freely within
         the European Union respectively) and, second, the right to establishment guaranteed by Article 43 EC. I share the Commission’s
         view that Article 12 EC is the most appropriate legal basis for analysing the issue, given that the claimant has clearly exercised
         his right under Community law, guaranteed by Article 18(1) EC, to move to another Member State. Indeed, I think that the question
         of discrimination is at the core of the present case. If the German system is considered to be incompatible with the prohibition
         laid down by Article 12 EC of discrimination on grounds of nationality in relation to the right to move and reside freely
         within a Member State, then it cannot be upheld regardless of whether it affects, or has the potential to affect, the claimant’s
         rights of establishment. Therefore, I will first discuss the question of discrimination and then turn to the requirement of
         necessity under Directive 95/46, which is the subject of the third question referred to the Court. (3)
      
      A –    Does the German system discriminate against foreign EU nationals?
      
       Comparable situations
      5.        It is common ground among all the parties that there are significant differences between the processing of the personal data
         of German citizens and the data of nationals of other EU Member States. Germany does not have a centralised system for recording,
         storing and processing the personal data of its nationals. There are, however, around 7 700 municipal population registers,
         which record the basic personal details of citizens but which are not linked to each other and cannot be searched centrally
         and simultaneously. By contrast, the personal data of foreign nationals, including those of nationals of EU Member States,
         are stored not only in the municipal registers but also in a central register of foreign nationals operated by the Federal
         Office for Migration and Refugees. Moreover, the central register is considerably more extensive in scope and contains additional
         information which is not recorded in the municipal registers such as passport details, dates of entry to and exit from the
         country, residence status, details of any application for refugee status and its outcome, particulars of deportation orders
         and measures to execute them, information about suspected criminal activities of the data subject and information on criminal
         convictions. Thus, there is a difference in treatment between German nationals and foreign Union nationals in three respects:
         first, the personal data of foreign nationals are recorded not only in the municipal registers, where the data of German nationals
         are recorded as well, but also in the central register of foreign nationals; second, the central register contains more information
         on data subjects than the local registers do; and third, the data of foreign nationals are readily available to various governmental
         authorities through the central register while no such possibility exists in relation to German nationals. The question is
         whether such a difference in treatment constitutes prohibited discrimination 
      
      6.        The German Government reminds us that a finding of discrimination requires that there be two comparable situations which are
         treated differently. So, the obligation of Member States not to discriminate on the basis of national origin means that only
         similar cases should be treated alike. Since the residence status of German nationals is different from that of foreign nationals,
         these two categories of people are not in a similar position and, accordingly, no issue of discrimination arises. The same
         view is taken by the Danish Government, which notes that nationals of a particular State always have the right to enter and
         reside in their country, which, according to Article 3 of the Fourth Additional Protocol to the European Convention on Human
         Rights, can never deport them or refuse them entry, while foreign Union nationals are granted entry and residence rights only
         by virtue of Community law. According to the Dutch Government, the most pertinent criterion for deciding whether the two situations
         are comparable is the processing of data in relation to the right of residence. Since a German national living in Germany
         and a citizen of another Member State living in Germany have different residence rights – the former has an unlimited right
         based on his nationality, the latter a limited one granted by Community law – it is possible to treat their personal data
         differently without infringing the foreign citizens’ right to be free from discrimination on grounds of nationality. Essentially,
         what is being argued is that although there are two different systems of data processing in Germany, which apply according
         to the nationality of the data subject, no issue of discrimination on the basis of nationality can arise because German citizens
         are not comparable to EU citizens. The former have an unlimited right to reside in the country while the latter have no such
         right. 
      
      7.        I am not convinced by this line of reasoning. The starting point of our inquiry should be that there are two systems of data
         processing, one for Germans and another one for Union nationals. It is, of course, descriptively accurate to state that the
         residence rights of German citizens and foreign nationals are not the same. But this is no more than stating the obvious;
         it says nothing about how this difference in residence status should relate to the collection and processing of the personal
         data of German citizens and citizens of other Member States. Put differently, the Governments of Germany, Denmark and the
         Netherlands would have us believe that the fact that foreign EU citizens have limited residence rights compared to indigenous
         citizens is the last word of the story, while the opposite is true: it is only the beginning. For a finding of non-discrimination,
         it is not sufficient to point out that German citizens and foreign nationals are not in the same situation. It is also necessary
         to demonstrate that the difference in their respective situations is capable of justifying the difference in treatment. In
         other words, the difference in treatment must relate and be proportionate to the difference in their respective situations.
         Therefore, I agree with the Commission that, in order to decide whether a German national is in a comparable situation to
         an EU national in relation to the collection and processing of personal data by the German authorities, we need to examine
         the purposes for which this collection and processing takes place. The German Government submits that a systematic processing
         of personal data in a central register is necessary for immigration law and residence status purposes, for effective general
         law enforcement and for the collection of statistical data. I will discuss each of them in turn. 
      
       Residence status and immigration rules
      8.        The primary argument of the German Government is that Community law allows Member States to impose limitations on the entry
         and residence, within their territory, of citizens of other Member States, who may even be deported. In order to be able to
         exercise this power, the German authorities need an effective mechanism for collecting the personal data and monitoring the
         movements of foreigners who take up residence in the country; such a mechanism is not necessary for Germans as they have an
         unlimited right to reside in the country and can never be deported. The German Government makes two points in support of this
         position. First, it argues that Directive 2004/38/EC, by giving the Member States the power to require resident foreign EU
         citizens to register with the relevant authorities, has implicitly authorised the collection and processing of their data. (4) Second, the German Government relies heavily on the Court’s judgment in Watson and Belmann. (5) That case concerned an Italian law requiring all foreigners, including Community nationals, to register with the local police
         within three days of their entry to Italy, and provided for a fine or imprisonment and possible deportation in cases where
         an individual failed to comply. The Court held that deportation was ‘certainly incompatible’ (6) with the provisions of the Treaty, while any other penalty had to be proportionate to the gravity of the offence and not
         function as an obstacle to freedom of movement for persons. However, the Court explained: ‘by creating the principle of freedom
         of movement for persons and by conferring on any person falling within its ambit the right of access to the territory of the
         Member States, for the purposes intended by the Treaty, Community law has not excluded the power of Member States to adopt
         measures enabling the national authorities to have an exact knowledge of population movements affecting their territory’. (7) The German Government argues that, since Member States have the power to adopt measures in order to have exact knowledge
         of population movements, it is clear that they have the power to establish a register containing information about who enters
         or leaves the country even when they do so only in relation to EU citizens.
      
      9.        Yet, neither Directive 2004/38 nor Watson and Belmann confer on Member States an unlimited power to adopt registration and monitoring systems for citizens of other Member States.
         Obviously, a registration requirement necessarily means that some personal data of EU citizens will be collected, stored and
         processed. Directive 2004/38, though, does not include any provisions about how this is to be done. That is a matter for each
         Member State, which, however, must exercise that power in a way which is compatible with its Community law obligations, including
         the obligation not to discriminate on the basis of national origin. Therefore, the fact that the Community legislature has
         implicitly accepted the possibility of some data collection taking place does not mean that it has authorised Member States
         to establish any system of data collection and processing they think appropriate.
      
      10.      Similarly, I think that the German Government reads too much into the excerpt from Watson and Belmann cited above. This case is authority only for the proposition that Member States may monitor population movements. It does
         not establish a general right for national authorities to carry out this monitoring in any way they think appropriate or convenient,
         and it certainly does not excuse Member States from complying with their obligations under Community law, and, in particular,
         the prohibition of discrimination on the basis of nationality. The German authorities may adopt measures to monitor population
         movements, but such measures must be compatible with the Treaty and any other relevant provisions of Community law. 
      
      11.      Therefore, we need to examine those three features of the German system which lead to differential treatment between nationals
         and Union citizens and to assess whether they are justified as a means of enforcing residence and immigration rules.
      
      12.      Clearly, making the data of Union citizens available not only to immigration authorities but to the administration in general
         is not justified by any need to enforce residence rules. Even if the system under consideration is necessary so that the immigration
         authorities can perform their functions, it does not follow that the data stored therein should be made available to other
         administrative and criminal authorities and agencies. It is stated in the order for reference that the information stored
         in the register of foreign nationals can be used not only by the Federal Office for Migration and Refugees but by many other
         public authorities and agencies such as the police, the security services, the public prosecutor’s office and the courts.
         Certain of these authorities may retrieve data by means of an automated procedure. Access to this information can also be
         given to non-public, charitable organisations, public authorities from other States and international organisations. It is
         obvious that the scope of the data collection and processing through the central register for foreigners is very extensive
         and goes beyond immigration purposes to encompass all kinds of relationships between an individual and the State. Through
         the central register, the various authorities in Germany are in a position to retrieve data about the personal status of EU
         nationals living in the country, to monitor systematically and without difficulty their whereabouts and to share among themselves
         all the information they need for such monitoring. The register of the Federal Office for Migration and Refugees is, thus,
         much more than an immigration register; it is a comprehensive database through which State authorities have the personal data
         of EU citizens at their fingertips. The treatment of German citizens is completely different, as no similar data collection
         mechanism exists for them. An administrative agency which needs information on a German national would have to carry out a
         much more cumbersome and complicated search based on the municipal registers which are not centrally managed, cannot be searched
         simultaneously and contain less information than the register for foreign citizens. 
      
      13.      For the same reason, I do not consider that the amount of data stored in the central register for foreigners can be justified.
         Registration of Union citizens is authorised by Directive 2004/38 exclusively for the purposes of ascertaining one’s residence
         status and rights. It follows that the only pieces of data that Member States can legitimately collect and process are those
         that relate to residence rights of Union citizens. Article 8 of Directive 2004/38, paragraph 1 of which provides for the possibility
         of a registration requirement, states, in paragraph 3, which information and documentation national authorities may require
         in order to issue a registration certificate. Union citizens may be asked to prove their identity by showing their passport
         or identity card and provide documentation concerning employment or study in the host country (if they are coming as students
         or workers) or evidence of their financial resources; this list is restrictive and not indicative. By enacting Article 8(3),
         the European Parliament and the Council have made an assessment that the information referred to therein is enough to enable
         Member States to exercise their right to monitor who enters the country and takes up residence there. Accordingly, collecting,
         storing and processing more data than Article 8(3) of Directive 2004/38 allows, as Germany currently does, cannot be justified
         by the need to enforce residence and immigration rules. 
      
      14.      The third element of the German system which leads to differential treatment between Germans and Union nationals, namely the
         existence of a central register for the latter as opposed to local ones for the former, gives rise to a more difficult question:
         is the systematic and centralised processing of the personal data of Union citizens necessary for the enforcement of Community law provisions on entry and residence?
         
      
      15.      I have to say from the outset that the existence of two separate data processing systems casts an unpleasant shadow over Union
         citizens, whom the German Government monitors much more strictly and systematically than German citizens. While the idea underlying
         the EU law provisions on citizenship and the right of entry and residence is that individuals should be able to integrate
         into the society of the host Member State and enjoy the same treatment as nationals, the system in question perpetuates the
         distinction between ‘us’ – the natives – and ‘them’ – the foreigners. Such a system can reinforce the prejudice of individuals
         or certain segments of society against foreigners and is likely to stigmatise Union citizens merely on account of their national
         origin. It must be also noted that the systematic monitoring of individuals is, in some European States, associated, for historical
         reasons, with undemocratic and totalitarian regimes, which explains, in part, why so many people in Europe find those systems
         particularly objectionable. On the other hand, there are European States where centralised systems of data processing do exist
         without raising any particular social controversy. In the present case, the sensitivity of the issue is enhanced by the fact
         that only the data of citizens of other Member States are subject to such a centralised processing. At the same time, this
         could be seen as a consequence of the different residential status of nationals of other Member States in Germany. 
      
      16.      I think that the proper test here is one of effectiveness, and it is for the national court to apply it. The question it must ask is whether there are other ways of data processing
         by which the immigration authorities could enforce the rules on residence status. If it answers that question in the affirmative,
         the centralised data storage and processing for Union citizens should be declared unlawful. It is not necessary for the alternative
         system to be the most effective or appropriate; it is enough for it to be able to perform adequately. Put differently, even if the central register
         is more effective or convenient or user-friendly than its alternatives (such as the decentralised, local registers), the latter
         are clearly to be preferred if they can be used to indicate the residence status of Union citizens. 
      
      17.      In assessing the effectiveness of the various registration systems, the national court should take into account the case-law
         of the Court of Justice on the right of entry to and residence in a Member State, as it is in those judgments that the powers
         of the national authorities in this field and their limits are defined. For example, it has been clear for many years now
         that a Member State can neither prevent a citizen of another Member State from entering its territory nor deport him at will;
         only an individual’s personal conduct which poses a real and serious threat to society may justify a prohibition of entry
         or a deportation order. (8) Moreover, this power must be narrowly construed, as it constitutes a derogation from the fundamental principle of freedom
         of movement within the Union. (9) These principles have been affirmed recently by the Court in Commission v Spain (10) and Commission v Germany (11) and given legislative recognition by the Community legislature in Directive 2004/38. (12)
      
      18.      Of course, any discussion of the right to reside in a Member State and its limits should take place against the concept of
         Union citizenship. Following the Treaty on European Union it is no longer possible to think about the status of EU nationals
         and the rights they have to enter a Member State and reside there in the same way as we did before it. The Court explained
         the rule in Baumbast as follows: ‘… Union citizenship has been introduced into the EC Treaty and Article 18(1) EC has conferred a right, for every
         citizen, to move and reside freely within the territory of the member States. Under Article 17(1) EC, every person holding
         the nationality of a Member State is to be a citizen of the Union. Union citizenship is destined to be the fundamental status of nationals of the Member States’ (my emphasis). (13) As the Court held in Grzelczyk, the starting point in discrimination cases should be that Union citizens are entitled to the same treatment as nationals
         subject to express exceptions. (14) The prohibition of discrimination on the basis of nationality is no longer merely an instrument at the service of freedom
         of movement; it is at the heart of the concept of European citizenship and of the extent to which the latter imposes on Member
         States the obligation to treat Union citizens as national citizens. Though the Union does not aim to substitute a ‘European
         people’ for the national peoples, it does require its Member States no longer to think and act only in terms of the best interests
         of their nationals but also, in so far as possible, in terms of the interests of all EU citizens. 
      
      19.      When the Court describes Union citizenship as the ‘fundamental status’ of nationals it is not making a political statement;
         it refers to Union citizenship as a legal concept which goes hand in hand with specific rights for Union citizens. Principal among them is the right to enter and live
         in another Member State. Directive 2004/38 reflects this new rule in recital 11, which states that ‘the fundamental and personal
         right of residence in another Member State is conferred directly on Union citizens by the Treaty and is not dependent upon
         their having fulfilled administrative procedures’. 
      
      20.      In the light of the foregoing analysis, I think that two of the elements of the data processing system under consideration,
         namely that it is accessible by authorities other than the Federal Office for Migration and Refugees and that it includes
         various pieces of personal information beyond those allowed by Article 8(3) of Directive 2004/38, cannot be justified by the
         need to enforce immigration law and residence status provisions. The centralised nature of the system can be justified only
         if the national court concludes, after considering the case-law of the Court of Justice on the right to enter and reside in
         a Member State, that a central register is the only effective way for enforcing immigration law and residence status provisions.
         
      
       General law enforcement and statistical data
      21.      The German Government claims that in addition to issues relating to residence status and immigration rules, there are also
         general law-enforcement considerations, namely the combating of crime and threats to security, which justify the difference
         in treatment between Germans and citizens of other Member States. Indeed, law enforcement and the combating of crime could,
         in principle, be a legitimate public policy reason qualifying rights granted by Community law. What Member States cannot do,
         though, is to invoke it selectively, that is, against EU nationals living in their territory, but not against their own citizens.
         If a central register is so important for effective general policing, it should obviously include everyone living within a
         particular country regardless of his nationality. It is not open to national authorities to say that fighting crime requires
         the systematic processing of personal data of EU citizens but not of that relating to nationals. This would be tantamount
         to saying that EU nationals pose a greater security threat and are more likely to commit crimes than citizens, which, as the
         Commission points out, is completely unacceptable.
      
      22.      There is, of course, the issue of convenience. Having a comprehensive database containing the personal data of every foreigner
         in the country makes it easy for the police and security services to monitor an individual’s movements and conduct. It is
         far more complicated and time-consuming to have to search thousands of local registers to get the information they may want,
         as they need to do with German citizens. However, first, administrative convenience can never be a reason justifying discriminatory
         treatment on the basis of nationality or any other restriction on the rights granted by Community law; (15) second, if the police need a convenient surveillance method, it is clear that they must need the same one for both Germans
         and foreigners.
      
      23.      Finally, the German Government claims that the central register for EU nationals is necessary in order to collect statistical
         information on migration and population movement in Europe. It cites, to this effect, Regulation (EC) No 862/2007 of the European
         Parliament and of the Council of 11 July 2007 on Community statistics on migration and international protection. (16) Yet, the Regulation neither requires nor authorises the establishment of a database containing the personal data of EU nationals
         who have exercised their rights to freedom of movement. Statistics are, by definition, anonymous and impersonal. All that
         the German authorities have to do to comply with their obligations under the Regulation is to compile this anonymous information
         on migration. 
      
      24.      Therefore, I think that the Court should answer the question whether the German system constitutes discrimination on the basis
         of national origin as follows:
      
      ‘A system of data storage and processing such as the one at issue in the main proceedings is incompatible with the prohibition
         of discrimination on grounds of nationality in so far as it includes data beyond those specified in Article 8(3) of Directive
         2004/38 and is accessible by public authorities other than the immigration authority. The centralised processing of personal
         data applicable only to citizens of other Member States will also be incompatible with the prohibition of discrimination on
         grounds of nationality if there are other effective ways for enforcing immigration and residence status rules, that being
         for the national court to assess.’
      
      B –    The requirement of necessity under Directive 95/46 
      25.      For present purposes, the relevant provision is that of Article 7(e) of Directive 95/46, which states: ‘Member States shall
         provide that personal data may be processed only if … processing is necessary for the performance of a task carried out in
         the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data
         are disclosed’. Therefore, the question we have to ask is whether this particular form of centralised processing is necessary
         for the achievement of a legitimate public interest objective.
      
      26.      In its written submissions to the Court, the German Government takes the view that the public interest at play here is the
         exercise by Member States of their power to enforce Community law in relation to the entry and residence of Union citizens
         in their territory. The data processing system currently in force, the German Government submits, is necessary for the performance
         of this task, as there are no other, less intrusive measures which could allow national authorities to enforce immigration
         law.
      
      27.      The concept of necessity has a long history in Community law and is well established as part of the proportionality test.
         It means that the authority adopting a measure which interferes with a right protected by Community law in order to achieve
         a legitimate aim must demonstrate that the measure is the least restrictive for the achievement of this aim. (17) Moreover, when the processing of personal data may be liable to infringe the fundamental right of privacy, Article 8 of the
         European Convention on Human Rights, which guarantees the right to private and family life, also becomes relevant. As the
         Court held in Österreichischer Rundfunk and Others, when a national measure is incompatible with Article 8 of the Convention, it also fails to pass the threshold of Article
         7(e) of Directive 95/46. (18) The second paragraph of Article 8 stipulates that an interference with private life may be legitimate if it pursues one of
         the aims listed therein and is ‘necessary in a democratic society’. The European Court of Human Rights has held that the adjective
         ‘necessary’ implies that there exists ‘a pressing social need’ for the State to act in a particular way and that the measure
         taken is proportionate to the legitimate aim pursued. (19)
      
      28.      All this means that, in view of the facts of this case, the answer to the third question turns out to depend on a substantially
         similar analysis to that employed to answer the question on discrimination on grounds of nationality. I have already explained
         that there are three objectionable elements in the data processing system at issue. For the first two of them, the reply to
         the question whether they are necessary under Directive 95/46 is the same as the conclusion in relation to the principle of
         non-discrimination on the basis of nationality: they are not necessary, at least for the purpose of enforcing the rules on
         the right of entry and residence of foreign EU citizens which is the public interest being claimed by the German Government,
         on the basis of Article 7(e) of Directive 95/46. For this task to be achieved, all that is required is that the relevant authority,
         namely the Federal Office for Migration and Refugees, processes the personal data of Union citizens. The transmission (20) of the data to other public authorities does not meet the requirement of necessity laid down under the Directive. The same
         is true of the amount of data collected in the central register. The only information that can be legitimately stored and
         processed is that which is essential for the enforcement of immigration and residence status provisions. For Union citizens,
         this information is exhaustively listed in Article 8(3) of Directive 2004/38; anything which goes beyond this cannot be deemed
         to be necessary for immigration law purposes. Therefore, the fact that the central register for foreigners includes additional
         data also fails to meet the requirement of necessity under Directive 95/46. 
      
      29.      This leaves us with the third element of the German system, its centralised nature. Is such a manner of data processing compatible
         with the requirement of necessity under Directive 95/46? Again, the answer will not depart from the answer provided to the
         first question. I think it is for the national court to make a decision on this point on the basis of the elements put forward
         above. (21) While the German Government enjoys some leeway to decide how to pursue its legitimate objectives, the requirement of necessity
         under Directive 95/46 means that it has to demonstrate that it is impossible to enforce Community law provisions on entry
         and residence in Germany of citizens of other Member States unless their data are centrally processed. An argument that centralised
         processing is more convenient, easier or quicker than alternative forms of processing should not be enough for the Government
         to pass the test of necessity. 
      
      30.      The question would be different and substantially more complex and potentially difficult to answer if the national court were
         asking the Court of Justice to give a ruling on the compatibility of a centralised system of data processing applicable to
         all individuals resident in Germany with the requirement laid down in Article 7(e) of Directive 95/46; the necessity for such
         a system would need to be argued on the basis of public interests other than immigration policy. That would require balancing
         the public interests to be pursued by such a centralised system with the individual rights protected by that Directive. While
         the Directive aims to remove the obstacles to flows of personal data which could affect cross-border economic activities,
         it also provides for the attainment of a high level of data protection throughout the Community. This concern with data protection
         and privacy is not subordinate to the aim of facilitating the free flow of data; it runs in parallel with it, and functions
         as the basis upon which any legitimate processing of data takes effect. Put differently, in the context of Directive 95/46,
         data protection is not merely incidental to the economic activity that may be facilitated by data processing; it is on a par
         with it. This is expressed in the title of the Directive (‘on the protection of individuals with regard to the processing
         of personal data and on the free movement of such data’), in recitals 2, 10, 11 and 12 and, of course, in its numerous provisions
         imposing specific obligations on data controllers. Furthermore, the right to privacy, which, in essence, is at stake in data
         protection cases, is protected in Article 7 of the Charter of Fundamental Rights of the European Union. In any event, it is
         neither necessary nor appropriate to address this hypothetical question in the context of the current case.
      
      31.      Consequently, I think that the Court should answer the third question as follows: 
      
      A system of data storage and processing such as the one at issue in the main proceedings is incompatible with the requirement
         of necessity under Article 7(e) of Directive 95/46 in so far as it includes data beyond those specified in Article 8(3) of
         Directive 2004/38 and is accessible by public authorities other than the immigration authorities. The centralised processing
         of personal data applicable only to citizens of other Member States will also be incompatible with the requirement of necessity
         under Article 7(e) of Directive 95/46, unless it can be demonstrated that there is no other way of enforcing immigration and
         residence status rules, that being for the national court to assess.
      
      III –  Conclusion
      32.      For these reasons I propose that the Court give the following answers to the questions referred by the Oberverwaltungsgericht
         für das Land Nordrhein-Westfalen:
      
      (1)      A system of data storage and processing such as the one at issue in the main proceedings is incompatible with the prohibition
         of discrimination on grounds of nationality in so far as it includes data beyond those specified in Article 8(3) of Directive
         2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their
         family members to move and reside freely within the territory of the Member States and is accessible by public authorities
         other than the immigration authority. The centralised processing of personal data applicable only to citizens of other Member
         States will also be incompatible with the prohibition of discrimination on grounds of nationality if there are other effective
         ways for enforcing immigration and residence status rules, that being for the national court to assess.
      
      (2)       A system of data storage and processing such as the one at issue in the main proceedings is incompatible with the requirement
         of necessity under Article 7(e) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on
         the protection of individuals with regard to the processing of personal data and on the free movement of such data in so far
         as it includes data beyond those specified in Article 8(3) of Directive 2004/38 and is accessible by public authorities other
         than the immigration authorities. The centralised processing of personal data applicable only to citizens of other Member
         States will also be incompatible with the requirement of necessity under Article 7(e) of Directive 95/46, unless it can be
         demonstrated that there is no other way of enforcing immigration and residence status rules, that being for the national court
         to assess.
      
      1 –	Original language: English.
      
      2 –	Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with
         regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) (‘the Directive’).
      
      3 –	A further reason to treat the first two questions together is that the order for reference does not provide sufficient
         information to enable the Court of Justice to examine whether this particular form of data processing has a negative impact
         on  the claimant’s right of establishment under Article 43 EC. The Greek Government also takes the view that the case must
         be examined under Article 12 EC and not 43 EC, as it raises no questions relating to the right of establishment.
      
      4 –	Article 8 of Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens
         of the Union and their family members to move and reside freely within the territory of the Member States (OJ 2004 L 158,
         p. 77) and corrigendum OJ 2004 L 229, p. 35.
      
      5 –	Case 118/75 [1976] ECR 1185.
      
      6 –	Ibid., paragraph 20.
      
      7 –	Ibid., paragraph 17.
      
      8 –	Case 41/74 Van Duyn [1974] ECR 1337; Case 67/74 Bonsignore [1975] ECR 297; Case 30/77 Bouchereau [1977] ECR 1999.
      
      9 –	Case 36/75 Rutili [1975] ECR 1219; Bouchereau.
      
      10 –	Case C‑503/03 [2006] ECR I‑1097.
      
      11 –	Case C‑441/02 [2006] ECR I‑3449.
      
      12 –	Article 27(2) of Directive 2004/38 provides that restrictions on the right of entry and residence are to comply with the
         principle of proportionality and are to be based exclusively on the personal conduct of the individual which must represent
         a genuine, present and sufficiently serious threat affecting one of the fundamental interests of society. Under Article 31,
         an individual who is subject to such measures is to have access to judicial and administrative redress, including interim
         relief.
      
      13 –	C‑413/99 Baumbast [2002] ECR I‑7091, paragraphs 81and 82. 
      
      14 –	Case C‑184/99 Grzelczyk [2001] ECR I‑6193, paragraph 31. 
      
      15 –	See Case C‑18/95 Terhoeve [1999] ECR I‑345, paragraph 45 (‘Considerations of an administrative nature cannot justify derogation by a Member State from
         the rules of Community law. That principle applies with even greater force where the derogation in question amounts to preventing
         or restricting the exercise of one of the fundamental freedoms of Community law’).
      
      16 –	OJ 2007 L 199, p. 23
      
      17 –	See inter alia Joined Cases 133/85, 134/85, 135/85 and 136/85 Rau and Others [1987] ECR 2289.
      
      18 –	Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I‑4989, paragraph 91.
      
      19 –	See, inter alia, Gillow v United Kingdom (1989) 11 EHRR 335; Z v Finland (1998) 25 EHRR 371.
      
      20 –	Disclosure by transmission and dissemination of personal data constitute a form of processing: Article 2(b) of Directive
         95/46. 
      
      21 –	The same approach to the assessment of necessity was taken by the Court of Justice in Österreichischer Rundfunk and Others, paragraph 88.