CELEX: 62009CJ0092
Language: en
Date: 2010-11-09
Title: Judgment of the Court (Grand Chamber) of 9 November 2010.#Volker und Markus Schecke GbR (C-92/09) and Hartmut Eifert (C-93/09) v Land Hessen.#References for a preliminary ruling: Verwaltungsgericht Wiesbaden - Germany.#Protection of natural persons with regard to the processing of personal data - Publication of information on beneficiaries of agricultural aid - Validity of the provisions of European Union law providing for that publication and laying down detailed rules for such publication - Charter of Fundamental Rights of the European Union - Articles 7 and 8 - Directive 95/46/EC - Interpretation of Articles 18 and 20.#Joined cases C-92/09 and C-93/09.

Joined Cases C-92/09 and C-93/09
      Volker und Markus Schecke GbR 
      and 
      Hartmut Eifert 
      v
      Land Hessen
      (References for preliminary rulings 
      from the Verwaltungsgericht Wiesbaden)
      (Protection of natural persons with regard to the processing of personal data – Publication of information on beneficiaries of agricultural aid – Validity of the provisions of European Union law providing for that publication and laying down detailed rules for such publication
         – Charter of Fundamental Rights of the European Union – Articles 7 and 8 – Directive 95/46/EC – Interpretation of Articles 18 and 20)
      
      Summary of the Judgment
      1.        Fundamental rights – Right to respect for private life – Protection of personal data – Articles 7 and 8 of the Charter of
            Fundamental Rights of the European Union – Scope
      (Charter of Fundamental Rights of the European Union, Arts 7 and 8)
      2.        Fundamental rights – Right to respect for private life – Protection of personal data – Limitations – Conditions
      (Charter of Fundamental Rights of the European Union, Arts 7, 8 and 52(1))
      3.        Agriculture – Common agricultural policy – Financing by the EAGF and the EAFRD – Regulations Nos 1290/2005 and 259/2008 –
            Mandatory publication of personal data relating to natural persons receiving aid from the EAGF and the EAFRD
      (Charter of Fundamental Rights of the European Union, Arts 7 and 8; Council Regulation No 1290/2005, Arts 42(8b) and 44a;
            Commission Regulation No 259/2008)
      4.        Preliminary rulings – Assessment of validity – Declaration of invalidity of provisions requiring the publication of personal
            data relating to beneficiaries of aid from the EAGF and the EAFRD – Effects – Temporal limitation
      (Arts 264, second para., TFEU and 267 TFEU)
      5.        Approximation of laws – Protection of natural persons with regard to the processing of personal data – Directive 95/46 – Obligation
            to notify the supervisory authority – Derogation
      (European Parliament and Council Directive 95/46, Art. 18(2), second indent)
      6.        Approximation of laws – Protection of natural persons with regard to the processing of personal data – Directive 95/46 – Prior
            checks
      (European Parliament and Council Directive 95/46, Art. 20)
      1.        The right to respect for private life with regard to the processing of personal data, recognised by Articles 7 and 8 of the
         Charter of Fundamental Rights of the European Union, concerns any information relating to an identified or identifiable individual.
         Legal persons can thus claim the protection of Articles 7 and 8 of the Charter only in so far as the official title of the
         legal person identifies one or more natural persons. That is the case where the official title of a partnership directly identifies
         natural persons who are its partners.
      
      (see paras 52-54)
      2.        Article 52(1) of the Charter of Fundamental Rights of the European Union accepts that limitations may be imposed on the exercise
         of rights such as those set forth in Articles 7 and 8 of the Charter, as long as the limitations are provided for by law,
         respect the essence of those rights and freedoms, and, subject to the principle of proportionality, are necessary and genuinely
         meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.
         The limitations which may lawfully be imposed on the right to the protection of personal data correspond to those tolerated
         in relation to Article 8 of the European Convention on Human Rights.
      
      (see paras 52, 65)
      3.        Articles 42(8b) and 44a of Regulation No 1290/2005 on the financing of the common agricultural policy, as amended by Regulation
         No 1437/2007, and Regulation No 259/2008 laying down detailed rules for the application of Regulation No 1290/2005 as regards
         the publication of information on the beneficiaries of funds deriving from the European Agricultural Guarantee Fund (EAGF)
         and the European Agricultural Fund for Rural Development (EAFRD) are invalid in so far as, with regard to natural persons
         who are beneficiaries of EAGF and EAFRD aid, those provisions impose an obligation to publish personal data relating to each
         beneficiary without drawing a distinction based on relevant criteria such as the periods during which those persons have received
         such aid, the frequency of such aid or the nature and amount thereof.
      
      The amounts which the beneficiaries receive from the EAGF and the EAFRD represent part of their income, often a considerable
         part, and because the information becomes available to third parties, publication on a website of data naming those beneficiaries
         and indicating the precise amounts received by them constitutes an interference with their private life within the meaning
         of Article 7 of the Charter of Fundamental Rights of the European Union. It is of no relevance in this respect that the data
         published concerns activities of a professional nature. Moreover, the publication required by Article 44a of Regulation No
         1290/2005 and Regulation No 259/2008 constitutes the processing of personal data falling under Article 8(2) of the Charter.
         Furthermore, the fact that the beneficiaries have been informed of the mandatory publication of the data relating to them
         does not call in question the very existence of an interference with their private life, since Article 42(8b) of Regulation
         No 1290/2005 and Article 4(1) of Regulation No 259/2008, which merely provide that beneficiaries of aid are to be informed
         in advance that the data concerning them will be published, do not seek to base the personal data processing for which they
         provide on the consent of the beneficiaries concerned.
      
      Such an interference is not justified having regard to Article 52(1) of the Charter of Fundamental Rights of the European
         Union. While it is true that in a democratic society taxpayers have a right to be kept informed of the use of public funds,
         the fact remains that striking a proper balance between the various interests involved made it necessary for the institutions
         concerned, before adopting the provisions in question, to ascertain whether publication via a single freely consultable website
         in each Member State of data by name relating to all the beneficiaries concerned and the precise amounts received by each
         of them from the EAGF and the EAFRD – with no distinction being drawn according to the duration, frequency or nature and amount
         of the aid received – did not go beyond what was necessary for achieving the legitimate aims pursued, having regard in particular
         to the interference with the rights guaranteed by Articles 7 and 8 of the Charter resulting from such publication. In this
         respect, no automatic priority can be conferred on the objective of transparency over the right to protection of personal
         data, even if important economic interests are at stake. Since it does not appear that the institutions properly balanced,
         on the one hand, the objectives of Article 44a of Regulation No 1290/2005 and of Regulation No 259/2008 against, on the other,
         the rights which natural persons are recognised as having under Articles 7 and 8 of the Charter, having regard to the fact
         that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary
         and that it is possible to envisage measures which affect less adversely that fundamental right of natural persons and which
         still contribute effectively to the objectives of the European Union rules in question, the Council and Commission, by requiring
         the publication of the names of all natural persons who were beneficiaries of EAGF and EAFRD aid and of the exact amounts
         received by those persons, exceeded the limits which compliance with the principle of proportionality imposes.
      
      By contrast, with regard to the legal persons which received EAGF and EAFRD aid, and in so far as they may invoke the rights
         conferred by Articles 7 and 8 of the Charter, the view must be taken that the obligation to publish which follows from Articles
         42(8b) and 44a of Regulation No 1290/2005 and Regulation No 259/2008 does not go beyond the limits imposed by compliance with
         the principle of proportionality. The seriousness of the breach of the right to protection of personal data manifests itself
         in different ways for legal persons and natural persons. Legal persons are already subject to a more onerous obligation in
         respect of the publication of data relating to them. Furthermore, the obligation on the competent national authorities to
         examine, before the data in question are published and for each legal person which is a beneficiary of EAGF or EAFRD aid,
         whether the name of that person identifies natural persons would impose on those authorities an unreasonable administrative
         burden.
      
      (see paras 58-61, 63, 65, 79, 85-87, 89, 92, operative part 1)
      4.        Where it is justified by overriding considerations of legal certainty, the second paragraph of Article 264 TFEU, which is
         also applicable by analogy to a reference under Article 267 TFEU for a preliminary ruling on the validity of acts of the European
         Union, confers on the Court a discretion to decide, in each particular case, which specific effects of the act in question
         must be regarded as definitive.
      
      In the context of a judgment declaring invalid Articles 42(8b) and 44a of Regulation No 1290/2005 on the financing of the
         common agricultural policy, as amended by Regulation No 1437/2007, and Regulation No 259/2008 laying down detailed rules for
         the application of Regulation No 1290/2005 as regards the publication of information on the beneficiaries of funds deriving
         from the European Agricultural Guarantee Fund (EAGF) and the European Agricultural Fund for Rural Development (EAFRD), and
         in view of the large number of publications which have taken place in the Member States on the basis of rules which were regarded
         as being valid, the invalidity of the provisions concerned does not allow any action to be brought to challenge the effects
         of the publication of the lists of beneficiaries of EAGF and EAFRD aid carried out by the national authorities on the basis
         of those provisions during the period prior to the date on which the judgment is delivered.
      
       (see paras 93-94, operative part 2)
      5.        The second indent of Article 18(2) of Directive 95/46 on the protection of individuals with regard to the processing of personal
         data and on the free movement of such data must be interpreted as not placing the personal data protection official under
         an obligation to keep the register provided for by that provision before an operation for the processing of personal data,
         such as that resulting from Articles 42(8b) and 44a of Regulation No 1290/2005 on the financing of the common agricultural
         policy, as amended by Regulation No 1437/2007, and Regulation No 259/2008 laying down detailed rules for the application of
         Regulation No 1290/2005 as regards the publication of information on the beneficiaries of funds deriving from the European
         Agricultural Guarantee Fund (EAGF) and the European Agricultural Fund for Rural Development (EAFRD), is carried out.
      
      (see para. 101, operative part 3)
      6.        Article 20 of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free
         movement of such data must be interpreted as not imposing an obligation on the Member States to make the publication of information
         resulting from Articles 42(8b) and 44a of Regulation No 1290/2005 on the financing of the common agricultural policy, as amended
         by Regulation No 1437/2007, and from Regulation No 259/2008 laying down detailed rules for the application of Regulation No
         1290/2005 as regards the publication of information on the beneficiaries of funds deriving from the European Agricultural
         Guarantee Fund (EAGF) and the European Agricultural Fund for Rural Development (EAFRD) subject to the prior checks for which
         that Article 20 provides.
      
      (see para. 108, operative part 4)
JUDGMENT OF THE COURT (Grand Chamber)
      9 November 2010 (*)
      
      (Protection of natural persons with regard to the processing of personal data – Publication of information on beneficiaries of agricultural aid – Validity of the provisions of European Union law providing for that publication and laying down detailed rules for such publication
         – Charter of Fundamental Rights of the European Union – Articles 7 and 8 – Directive 95/46/EC – Interpretation of Articles 18 and 20)
      
      In Joined Cases C‑92/09 and C‑93/09,
      REFERENCES for preliminary rulings under Article 234 EC from the Verwaltungsgericht Wiesbaden (Germany), made by decisions
         of 27 February 2009, received at the Court on 6 March 2009, in the proceedings
      
      Volker und Markus Schecke GbR (C-92/09),
      
      Hartmut Eifert (C-93/09)
      
      v
      Land Hessen,
      joined party:
      Bundesanstalt für Landwirtschaft und Ernährung,
      THE COURT (Grand Chamber),
      composed of V. Skouris, President, A. Tizzano, J.N. Cunha Rodrigues, K. Lenaerts (Rapporteur), J.‑C. Bonichot, K. Schiemann,
         A. Arabadjiev and J.‑J. Kasel, Presidents of Chambers, E. Juhász, C. Toader and M. Safjan, Judges,
      
      Advocate General: E. Sharpston,
      Registrar: B. Fülöp, Administrator,
      having regard to the written procedure and further to the hearing on 2 February 2010,
      after considering the observations submitted on behalf of:
      –        Volker und Markus Schecke GbR, by R. Seimetz and P. Breyer, Rechtsanwälte, and by Mr Schecke,
      –        Mr Eifert, by R. Seimetz and P. Breyer, Rechtsanwälte,
      –        Land Hessen, by H.‑G. Kamann, Rechtsanwalt,
      –        the Greek Government, by V. Kontolaimos, I. Chalkias, K. Marinou and V. Karra, acting as Agents,
      –        the Netherlands Government, by C. Wissels and Y. de Vries, acting as Agents,
      –        the Swedish Government, by A. Falk and C. Meyer-Seitz, acting as Agents,
      –        the Council of the European Union, by E. Sitbon and Z. Kupčová, acting as Agents,
      –        the European Commission, by B. Smulders, F. Erlbacher and P. Costa de Oliveira, acting as Agents,
      after hearing the Opinion of the Advocate General at the sitting on 17 June 2010,
      gives the following
      Judgment
      1        These references for preliminary rulings concern the validity, first, of Articles 42(8b) and 44a of Council Regulation (EC)
         No 1290/2005 of 21 June 2005 on the financing of the common agricultural policy (OJ 2005 L 209, p. 1), as amended by Council
         Regulation (EC) No 1437/2007 of 26 November 2007 (OJ 2007 L 322, p. 1) (‘Regulation No 1290/2005’), and, second, of Commission
         Regulation (EC) No 259/2008 of 18 March 2008 laying down detailed rules for the application of Regulation No 1290/2005 as
         regards the publication of information on the beneficiaries of funds deriving from the European Agricultural Guarantee Fund
         (EAGF) and the European Agricultural Fund for Rural Development (EAFRD) (OJ 2008 L 76, p. 28) and Directive 2006/24/EC of
         the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection
         with the provision of publicly available electronic communications services or of public communications networks and amending
         Directive 2002/58/EC (OJ 2006 L 105, p. 54). Should the Court find that the European Union legislation referred to above is
         not invalid, the references for preliminary rulings also concern the interpretation of Article 7, the second indent of Article
         18(2) and Article 20 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection
         of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
      
      2        Those questions have been raised in the course of proceedings between Volker und Markus Schecke GbR and Mr Eifert (‘the applicants
         in the main proceedings’) and Land Hessen (the Land of Hesse) concerning the publication on the internet site of the Bundesanstalt für Landwirtschaft und Ernährung (Federal
         Office for Agriculture and Food; ‘the Bundesanstalt’) of personal data relating to them as recipients of funds from the EAGF
         or the EAFRD.
      
      I –  Legal context
      A –  European Convention for the Protection of Human Rights and Fundamental Freedoms
      3        Under the heading ‘Right to respect for private and family life’, Article 8 of the European Convention for the Protection
         of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950, (‘the Convention’) provides:
      
      ‘1.      Everyone has the right to respect for his private and family life, his home and his correspondence.
      2.      There shall be no interference by a public authority with the exercise of this right except such as is in accordance with
         the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being
         of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of
         the rights and freedoms of others.’
      
      B –  European Union law
      1.     Directive 95/46
      4        In accordance with Article 1(1) of Directive 95/46, the aim of the directive is to protect the fundamental rights and freedoms
         of natural persons, and in particular their right to privacy with respect to the processing of personal data. Under Article
         2(a) of the directive, ‘personal data’ means ‘any information relating to an identified or identifiable natural person’.
      
      5        Under Article 7 of that directive, ‘Member States shall provide that personal data may be processed only if:
      
      (a)      the data subject has unambiguously given his consent; or
      …
      (c)      processing is necessary for compliance with a legal obligation to which the controller is subject; or
      …
      (e)      processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority
         vested in the controller or in a third party to whom the data are disclosed; …
      
      …’
      6        Under Article 18(1) of the directive, ‘Member States shall provide that the controller or his representative, if any, must
         notify the supervisory authority referred to in Article 28 before carrying out any wholly or partly automatic processing operation’.
      
      7        Under the second indent of Article 18(2) of the directive, Member States may provide for the simplification of or exemption
         from notification inter alia in the following case:
      
      ‘where the controller, in compliance with the national law which governs him, appoints a personal data protection official,
         responsible in particular:
      
      –        for ensuring in an independent manner the internal application of the national provisions taken pursuant to this Directive;
      –        for keeping the register of processing operations carried out by the controller, containing the items of information referred
         to in Article 21(2),
      
      thereby ensuring that the rights and freedoms of the data subjects are unlikely to be adversely affected by the processing
         operations’.
      
      8        Article 19(1) of Directive 95/46 provides:
      
      ‘Member States shall specify the information to be given in the notification. It shall include at least:
      (a)      the name and address of the controller and of his representative, if any;
      (b)      the purpose or purposes of the processing;
      (c)      a description of the category or categories of data subject and of the data or categories of data relating to them;
      (d)      the recipients or categories of recipient to whom the data might be disclosed;
      (e)      proposed transfers of data to third countries;
      …’
      9        Article 20 of the directive, ‘Prior checking’, provides in paragraphs 1 and 2:
      
      ‘1.      Member States shall determine the processing operations likely to present specific risks to the rights and freedoms of data
         subjects and shall check that these processing operations are examined prior to the start thereof.
      
      2.      Such prior checks shall be carried out by the supervisory authority following receipt of a notification from the controller
         or by the data protection official, who, in cases of doubt, must consult the supervisory authority.’
      
      10      In accordance with the first and second subparagraphs of Article 21(2) of Directive 95/46, ‘Member States shall provide that
         a register of processing operations notified in accordance with Article 18 shall be kept by the supervisory authority’, and
         ‘[t]he register shall contain at least the information listed in Article 19(1)(a) to (e)’.
      
      11      Under Article 28 of the directive, each Member State is to designate one or more public authorities (‘supervisory authority’)
         to be responsible for monitoring, acting with complete independence, the application within that State’s territory of the
         national provisions adopted pursuant to that directive.
      
      2.     Regulation (EC) No 45/2001
      12      Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals
         with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data
         (OJ 2001 L 8, p. 1) provides in Article 27(1) and (2):
      
      ‘1.      Processing operations likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature,
         their scope or their purposes shall be subject to prior checking by the European Data Protection Supervisor.
      
      2.      The following processing operations are likely to present such risks:
      (a)      processing of data relating to health and to suspected offences, offences, criminal convictions or security measures;
      (b)      processing operations intended to evaluate personal aspects relating to the data subject, including his or her ability, efficiency
         and conduct;
      
      (c)      processing operations allowing linkages not provided for pursuant to national or Community legislation between data processed
         for different purposes;
      
      (d)      processing operations for the purpose of excluding individuals from a right, benefit or contract.’
      3.     Directive 2006/24
      13      Directive 2006/24 requires the Member States to retain for a certain time data generated or processed in connection with the
         provision of publicly available electronic communications services or of public communications networks.
      
      4.     Regulation No 1290/2005
      14      Regulation No 1290/2005 sets the specific requirements and rules on the financing of expenditure falling under the common
         agricultural policy (‘the CAP’).
      
      15      Article 42 of Regulation No 1290/2005 provides that the detailed rules for the application of that regulation are to be adopted
         by the European Commission. Under Article 42(8b) of the regulation, the Commission is to determine inter alia:
      
      ‘the detailed rules on the publication of information concerning beneficiaries referred to in Article 44a and on the practical
         aspects related to the protection of individuals with regard to the processing of their personal data in accordance with the
         principles laid down in Community legislation on data protection. These rules shall ensure, in particular, that the beneficiaries
         of funds are informed that these data may be made public and may be processed by auditing and investigating bodies for the
         purpose of safeguarding the financial interests of the Communities, including the time that this information shall take place’.
      
      16      Article 44a of Regulation No 1290/2005, ‘Publication of the beneficiaries’, states:
      
      ‘… Member States shall ensure annual ex-post publication of the beneficiaries of the EAGF and the EAFRD and the amounts received per beneficiary under each of these Funds.
      
      The publication shall contain at least:
      (a)      for the EAGF, the amount subdivided in direct payments within the meaning of Article 2(d) of Regulation (EC) No 1782/2003
         and other expenditure;
      
      (b)      for the EAFRD, the total amount of public funding per beneficiary.’
      17      Recitals 13 and 14 in the preamble to Regulation No 1437/2007 amending Regulation No 1290/2005 read as follows:
      
      ‘(13) In the context of the revision of Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation
         applicable to the general budget of the European Communities [OJ 2002 L 248, p. 1], the provisions on the annual ex-post publication of beneficiaries of funds deriving from the budget were inserted into that Regulation in order to implement the
         European Transparency Initiative. Sector-specific Regulations are to provide the means for such a publication. Both the EAGF
         and the EAFRD form part of the general budget of the European Communities and finance expenditure in a context of shared management
         between the Member States and the Community. Rules should therefore be laid down for the publication of information on the
         beneficiaries of these Funds. To that end, Member States should ensure annual ex-post publication of the beneficiaries and the amounts received per beneficiary under each of these Funds.
      
      (14)      Making this information accessible to the public enhances transparency regarding the use of Community funds in the [CAP] and
         improves the sound financial management of these funds, in particular by reinforcing public control of the money used. Given
         the overriding weight of the objectives pursued, it is justified with regard to the principle of proportionality and the requirement
         of the protection of personal data to provide for the general publication of the relevant information as it does not go beyond
         what is necessary in a democratic society and for the prevention of irregularities. Taking into account the opinion of the
         European Data Protection Supervisor of 10 April 2007 [OJ 2007 C 134, p. 1], it is appropriate to make provision for the beneficiaries
         of funds to be informed that those data may be made public and that they may be processed by auditing and investigating bodies.’
      
      5.     Regulation No 259/2008
      18      On the basis of Article 42(8b) of Regulation No 1290/2005, the Commission adopted Regulation No 259/2008.
      
      19      Recital 6 in the preamble to Regulation No 259/2008 reads as follows:
      
      ‘(6)      Making … information [concerning beneficiaries of funds from the EAGF and EAFRD] accessible to the public enhances transparency
         regarding the use of Community funds in the [CAP] and improves the sound financial management of these funds, in particular
         by reinforcing public control of the money used. Given the overriding weight of the objectives pursued, it is justified with
         regard to the principle of proportionality and the requirement of the protection of personal data to provide for the general
         publication of the relevant information as it does not go beyond what is necessary in a democratic society and for the prevention
         of irregularities.’
      
      20      Recital 7 in the preamble states that ‘[t]o comply with the data protection requirements beneficiaries of the Funds should
         be informed of the publication of their data before the publication takes place’.
      
      21      Article 1(1) of Regulation No 259/2008 specifies the content of the publication referred to in Article 44a of Regulation No 1290/2005
         and provides that it is to include the following information:
      
      ‘(a)      the first name and the surname where the beneficiaries are natural persons;
      (b)      the full legal name as registered where the beneficiaries are legal persons;
      (c)      the full name of the association as registered or otherwise officially recognised where the beneficiaries are associations
         of natural or legal persons without an own legal personality;
      
      (d)      the municipality where the beneficiary resides or is registered and, where available, the postal code or the part thereof
         identifying the municipality;
      
      (e)      for the … EAGF, the amount of direct payments within the meaning of Article 2(d) of Regulation (EC) No 1782/2003 received
         by each beneficiary in the financial year concerned;
      
      (f)      for the EAGF, the amount of payments other than those referred to in point (e) received by each beneficiary in the financial
         year concerned;
      
      (g)      for the … EAFRD, the total amount of public funding received by each beneficiary in the financial year concerned, which includes
         both the Community and the national contribution;
      
      (h)      the sum of the amounts referred to in points (e), (f) and (g) received by each beneficiary in the financial year concerned;
      (i)      the currency of these amounts.’
      22      In accordance with Article 2 of Regulation No 259/2008, ‘[the] information referred to in Article 1 shall be made available
         on a single website per Member State through a search tool allowing the users to search for beneficiaries by name, municipality,
         amounts received as referred to in (e), (f), (g) and (h) of Article 1 or a combination thereof and to extract all the corresponding
         information as a single set of data.’
      
      23      Article 3(3) of that regulation provides that ‘[t]he information shall remain available on the website for two years from
         the date of [its] initial publication’.
      
      24      Article 4 of Regulation No 259/2008 provides:
      
      ‘1.      Member States shall inform the beneficiaries that their data will be made public in accordance with Regulation … No 1290/2005
         and this Regulation and that they may be processed by auditing and investigating bodies of the Communities and the Member
         States for the purpose of safeguarding the Communities’ financial interests.
      
      2.      In case of personal data, the information referred to in paragraph 1 shall be provided in accordance with the requirements
         of Directive 95/46 … and the beneficiaries shall be informed of their rights as data subjects under this Directive and of
         the procedures applicable for exercising these rights.
      
      3.      The information referred to in paragraphs 1 and 2 shall be provided to the beneficiaries by including it in the application
         forms for receiving funds deriving from the EAGF and EAFRD, or otherwise at the time when the data are collected.
      
      …’
      II –  The actions in the main proceedings and the questions referred for preliminary rulings
      25      The applicants in the main proceedings, one established and the other resident in the Land of Hesse, are an agricultural undertaking in the legal form of a partnership (Case C‑92/09) and a full-time farmer (Case
         C‑93/09). For the financial year 2008 they made applications to the competent local authorities for funds from the EAGF or
         the EAFRD, which were approved by decisions of 5 December 2008 (Case C‑93/09) and 31 December 2008 (Case C‑92/09).
      
      26      In each case the application form contained the following statement:
      
      ‘I am aware that Article 44a of Regulation … No 1290/2005 requires publication of information on the beneficiaries of [funds
         from] the EAGF and the EAFRD and the amounts received per beneficiary. The publication relates to all measures applied for
         in connection with the Common Application, which constitutes the single application for the purposes of Article 11 of Regulation
         (EC) No 796/2004, and is effected annually at the latest by 31 March of the following year.’
      
      27      The referring court explains that the Bundesanstalt’s website makes available to the public the names of beneficiaries of
         aid from the EAGF and the EAFRD, the place in which they are established or reside and the postcode of that place, and the
         annual amounts received. The site is provided with a search tool.
      
      28      On 26 September 2008 (Case C‑92/09) and 18 December 2008 (Case C‑93/09) the applicants in the main proceedings brought proceedings
         to prevent publication of the data relating to them. In their view, publication of the amounts received from the EAGF or the
         EAFRD is not justified by overriding public interests. Moreover, the rules governing the European Social Fund do not provide
         for beneficiaries to be identified by name. In their applications, they ask for the Land of Hesse to be ordered to refrain from, or to be prohibited from, transmitting or publishing those data for the purposes
         of the general publication of information on the financial amounts granted to them from the EAGF and the EAFRD.
      
      29      The Land of Hesse, which takes the view that the obligation to publish data relating to the applicants in the main proceedings follows
         from Regulations No 1290/2005 and No 259/2008, nevertheless undertook not to publish the amounts received by them as beneficiaries
         of aid from the EAGF and the EAFRD pending final decisions in the main proceedings.
      
      30      The referring court believes that the obligation to publish under Article 44a of Regulation No 1290/2005 constitutes an unjustified
         interference with the fundamental right to the protection of personal data. It considers that that provision, which pursues
         the aim of increasing the transparency of the use of European funds, does not improve the prevention of irregularities, since
         extensive control mechanisms exist at present for that purpose. On the basis of the judgment in Joined Cases C‑465/00, C‑138/01
         and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I‑4989, it takes the view that, in any event, that obligation to publish is not proportionate to the aim pursued.
         Moreover, in its view, Article 42(8b) of Regulation No 1290/2005 gives the Commission too broad a discretion with respect
         to determining both the data to be published and the means of publication and is therefore incompatible with the third indent
         of Article 202 EC and with the fourth indent of Article 211 EC.
      
      31      Regardless of the validity of Articles 42(8b) and 44a of Regulation No 1290/2005, the referring court considers that Regulation
         No 259/2008, which prescribes that the information relating to the beneficiaries of aid from the EAGF and the EAFRD is to
         be published exclusively on the internet, breaches the fundamental right to the protection of personal data. It points out
         that the latter regulation does not limit access to the internet site concerned to ‘internet protocol’ (IP) addresses situated
         in the European Union. Furthermore, it is not possible to withdraw the data from the internet after the expiry of the two-year
         period laid down in Article 3(3) of Regulation No 259/2008. It its view, publication of the data exclusively on the internet
         also has a deterrent effect. First, citizens wishing to obtain information must have access to the internet. Second, those
         citizens run the risk of having their data stored under Directive 2006/24. It is paradoxical to strengthen the supervision
         of telecommunications on the one hand and to provide on the other hand that information which is intended to enable citizens
         to participate in public affairs is available only electronically.
      
      32      In case the Court should find that the provisions referred to in paragraphs 30 and 31 above are not invalid, the referring
         court further seeks an interpretation of a number of provisions of Directive 95/46. It considers that the publication of personal
         data may take place only if the measures provided for in the second indent of Article 18(2) of that directive have been taken.
         According to the information provided by the referring court, the German legislature, in particular that of the Land of Hesse, has made use of the possibility under that provision. However, according to that court, the notification by the
         Ministry of the Environment, Rural Affairs and Consumer Protection of the Land of Hesse to the personal data protection official was incomplete. Some information was not communicated to that official,
         such as the fact that the data are processed by the Bundesanstalt on behalf of the Land, in some cases with the assistance of a private third party, specific details of the deletion period and the access provider,
         and information on the registration of IP addresses.
      
      33      Moreover, according to the national court, the publication of the data relating to the beneficiaries of agricultural aid ought
         to have been preceded by a prior check as provided for in Article 20 of Directive 95/46. In the present case, however, a prior
         check was carried out, not by a central supervisory authority, but by the data protection official of the undertaking or office
         responsible, on the basis of incomplete notifications.
      
      34      Finally, the referring court is uncertain as to the lawfulness, from the point of view of Article 7(e) of Directive 95/46,
         of the registration of the IP addresses of users who consult the information relating to beneficiaries of aid from the EAGF
         and the EAFRD on the Bundesanstalt’s website.
      
      35      In those circumstances, the Verwaltungsgericht (Administrative Court) Wiesbaden decided to stay the proceedings and to refer
         the following questions, which are worded identically in Case C‑92/09 and Case C‑93/09, to the Court for preliminary rulings:
      
      ‘1.      Are Article [42](8b) and Article 44a of … Regulation … No 1290/2005 …, inserted by … Regulation … No 1437/2007 …, invalid?
      2.      Is … Regulation … No 259/2008 …
      (a)      invalid, or
      (b)      valid by reason only of the fact that Directive 2006/24 … is invalid?
      If the provisions mentioned in the first and second questions are valid:
      3.      Must the second indent of Article 18(2) of Directive 95/46 … be interpreted as meaning that publication in accordance with
         … Regulation … No 259/2008 … may be effected only following implementation of the procedure – in lieu of notification to a
         supervisory authority – established by that article?
      
      4.      Must Article 20 of Directive 95/46 … be interpreted as meaning that publication in accordance with … Regulation … No 259/2008
         … may be effected only following exercise of the prior check required by national law in that case?
      
      5.      If the fourth question is answered in the affirmative: Must Article 20 of Directive 95/46 … be interpreted as meaning that
         no effective prior check has been performed, if it was effected on the basis of a register established in accordance with
         the second indent of Article 18(2) of that directive which lacks an item of information prescribed?
      
      6.      Must Article 7 – and in this case, in particular, subparagraph (e) – of Directive 95/46 … be interpreted as precluding a practice
         of storing the IP addresses of the users of a homepage without their express consent?’
      
      36      By order of the President of the Court of 4 May 2009, Cases C‑92/09 and C‑93/09 were joined for the purposes of the written
         and oral procedure and the judgment.
      
      III –  Consideration of the questions referred
      37      The decisions for reference contain questions on the validity of Regulations No 1290/2005 and No 259/2008 (Questions 1 and
         2) and questions on the interpretation of Directive 95/46 (Questions 3 to 6). Before examining the substance of the case,
         the admissibility of the second part of Question 2 and of Question 6 should be considered.
      
      A –  Admissibility
      38      By the second part of Question 2 and by Question 6 respectively, the referring court asks the Court to rule on the validity
         of Directive 2006/24 and on the interpretation of Article 7(e) of Directive 95/46, so as to enable it to assess whether the
         retention of certain data relating to the users of the internet sites, laid down by European Union and German legislation,
         is lawful.
      
      39      It should be recalled at the outset that although, in view of the division of responsibilities in the preliminary-ruling procedure,
         it is for the referring court alone to determine the subject-matter of the questions which it proposes to refer to the Court,
         the Court has held that, in exceptional circumstances, it will examine the conditions in which the case was referred to it
         by the national court, in order to assess whether it has jurisdiction (Case C‑567/07 Woningstichting Sint Servatius [2009] ECR I‑9021, paragraph 42).
      
      40      That is the case in particular where the problem referred to the Court is purely hypothetical or where the interpretation
         or consideration of the validity of a rule of European Union law which is sought by the national court has no relation to
         the actual facts of the main action or to its purpose (see, to that effect, Case C‑415/93 Bosman [1995] ECR I‑4921, paragraph 61; Case C‑466/04 Acereda Herrera [2006] ECR I‑5341, paragraph 48; Case C‑380/05 Centro Europa 7 [2008] ECR I‑349, paragraph 53; and Woningstichting Sint Servatius, paragraph 43).
      
      41      According to the decisions for reference, the applicants in the main proceedings each brought proceedings before the referring
         court against the publication under Regulations No 1290/2005 and No 259/2008 of data relating to them. Their applications
         seek for the Land of Hesse to refrain from transmitting or publishing, or to refuse to transmit or publish, the information concerning the
         aid which they have received from the EAGF and the EAFRD.
      
      42      The second part of Question 2 and Question 6 have no relation to the subject-matter of the disputes in the main proceedings.
         They relate, not to the publication of data relating to the beneficiaries of aid under those Funds, such as the applicants
         in the main proceedings, but to the retention of data relating to persons consulting websites. Since consideration of the
         second part of Question 2 and Question 6 is therefore of no relevance for the outcome of the main proceedings, there is no
         need to answer them.
      
      B –  Substance
      1.     Question 1 and the first part of Question 2
      a)     Preliminary observations
      43      By Question 1 and the first part of Question 2, the national court asks the Court to examine the validity, first, of Article
         44a of Regulation No 1290/2005 and of Regulation No 259/2008 containing the detailed rules for the application of the publication
         obligation laid down by Article 44a and, second, of Article 42(8b) of Regulation No 1290/2005, the provision which is the
         legal basis of Regulation No 259/2008.
      
      44      The referring court considers that the obligation to publish data relating to the beneficiaries of aid from the EAGF and the
         EAFRD, which follows from the provisions cited in the previous paragraph, constitutes an unjustified interference with the
         fundamental right to the protection of personal data. It refers essentially to Article 8 of the Convention.
      
      45      In accordance with Article 6(1) TEU, the European Union recognises the rights, freedoms and principles set out in the Charter
         of Fundamental Rights of the European Union (‘the Charter’), ‘which shall have the same legal value as the Treaties’.
      
      46      In those circumstances, the validity of Articles 42(8b) and 44a of Regulation No 1290/2005 and of Regulation No 259/2008 must
         be assessed in the light of the provisions of the Charter.
      
      47      In this regard, Article 8(1) of the Charter states that ‘[e]veryone has the right to the protection of personal data concerning
         him or her’. That fundamental right is closely connected with the right to respect of private life expressed in Article 7
         of the Charter.
      
      48      The right to the protection of personal data is not, however, an absolute right, but must be considered in relation to its
         function in society (see, to that effect, Case C‑112/00 Schmidberger [2003] ECR I‑5659, paragraph 80 and the case-law cited).
      
      49      Article 8(2) of the Charter thus authorises the processing of personal data if certain conditions are satisfied. It provides
         that personal data ‘must be processed fairly for specified purposes and on the basis of the consent of the person concerned
         or some other legitimate basis laid down by law’.
      
      50      Moreover, Article 52(1) of the Charter accepts that limitations may be imposed on the exercise of rights such as those set
         forth in Articles 7 and 8 of the Charter, as long as the limitations are provided for by law, respect the essence of those
         rights and freedoms and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general
         interest recognised by the European Union or the need to protect the rights and freedoms of others.
      
      51      Finally, according to Article 52(3) of the Charter, in so far as it contains rights which correspond to rights guaranteed
         by the Convention, the meaning and scope of those rights are to be the same as those laid down by the Convention. Article
         53 of the Charter further states that nothing in the Charter is to be interpreted as restricting or adversely affecting the
         rights recognised inter alia by the Convention.
      
      52      In those circumstances, it must be considered that the right to respect for private life with regard to the processing of
         personal data, recognised by Articles 7 and 8 of the Charter, concerns any information relating to an identified or identifiable
         individual (see, in particular, European Court of Human Rights, Amann v. Switzerland [GC], no. 27798/95, § 65, ECHR 2000‑II, and Rotaru v. Romania [GC], no. 28341/95, § 43, ECHR 2000‑V) and the limitations which may lawfully be imposed on the right to the protection of
         personal data correspond to those tolerated in relation to Article 8 of the Convention.
      
      b)     The validity of Article 44a of Regulation No 1290/2005 and of Regulation No 259/2008
      53      It must be recalled, in the first place, that the publication required by Article 44a of Regulation No 1290/2005 and Regulation
         No 259/2008 implementing that article identifies by name all beneficiaries of aid from the EAGF and the EAFRD, among whom
         are both natural and legal persons. Having regard to the observations in paragraph 52 above, legal persons can claim the protection
         of Articles 7 and 8 of the Charter in relation to such identification only in so far as the official title of the legal person
         identifies one or more natural persons.
      
      54      That is the case with the applicant in the main proceedings in Case C‑92/09. The official title of the partnership in question
         directly identifies natural persons who are its partners.
      
      55      In the second place, it must be ascertained whether Article 44a of Regulation No 1290/2005 and Regulation No 259/2008 interfere
         with the rights guaranteed by Articles 7 and 8 of the Charter to beneficiaries of aid from the EAGF or the EAFRD who are identified
         or identifiable natural persons (‘the beneficiaries concerned’), and, if so, whether such an interference is justified having
         regard to Article 52 of the Charter.
      
      i)     Existence of an interference with the rights recognised by Articles 7 and 8 of the Charter
      56      Article 44a of Regulation No 1290/2005 requires the Member States to ensure the annual ex-post publication of the names of the beneficiaries of aid from the EAGF and the EAFRD and the amounts received by each beneficiary
         from each of those Funds. It follows from recital 14 in the preamble to Regulation No 1437/2007 amending Regulation No 1290/2005
         that that information must be the subject of ‘general publication’.
      
      57      Article 1(1)(d) of Regulation No 259/2008 lays down the content of the publication and prescribes that, in addition to the
         matters mentioned in the preceding paragraph and other information regarding the aid received, ‘the municipality where the
         beneficiary resides or is registered and, where available, the postal code or the part thereof identifying the municipality’
         must be published. Article 2 of that regulation prescribes that the information is to be made available on a single website
         per Member State and may be consulted by means of a search tool.
      
      58      It is not disputed that the amounts which the beneficiaries concerned receive from the EAGF and the EAFRD represent part of
         their income, often a considerable part. Because the information becomes available to third parties, publication on a website
         of data naming those beneficiaries and indicating the precise amounts received by them thus constitutes an interference with
         their private life within the meaning of Article 7 of the Charter (see, to that effect, Österreichischer Rundfunk and Others, paragraphs 73 and 74).
      
      59      It is of no relevance in this respect that the data published concerns activities of a professional nature (see Österreichischer Rundfunk and Others, paragraphs 73 and 74). The European Court of Human Rights has held on this point, with reference to the interpretation of
         Article 8 of the Convention, that the term ‘private life’ must not be interpreted restrictively and that ‘there is no reason
         of principle to justify excluding activities of a professional … nature from the notion of “private life”’ (see, inter alia,
         Amann v. Switzerland, § 65, and Rotaru v. Romania, § 43).
      
      60      Moreover, the publication required by Article 44a of Regulation No 1290/2005 and Regulation No 259/2008 constitutes the processing
         of personal data falling under Article 8(2) of the Charter.
      
      61      The Land of Hesse casts doubt, however, on the very existence of an interference with the private life of the applicants in the main
         proceedings, as they were informed in the aid application form of the mandatory publication of the data relating to them and,
         in accordance with Article 8(2) of the Charter, gave their consent to that publication by submitting their applications.
      
      62      On this point, it should be noted that Article 42(8b) of Regulation No 1290/2005 provides only that ‘the beneficiaries of
         funds are informed that these data [concerning them, namely their names and the amounts received from each of the Funds] may
         be made public’. Article 4(1) of Regulation No 259/2008 contains a similar provision, stating that ‘Member States shall inform
         the beneficiaries that their data will be made public’.
      
      63      The European Union legislation in question, which merely provides that beneficiaries of aid are to be informed in advance
         that the data concerning them will be published, thus does not seek to base the personal data processing for which it provides
         on the consent of the beneficiaries concerned. Furthermore, it must be noted that in the main proceedings, in their aid application
         forms, the applicants stated only that they were ‘aware that Article 44a of Regulation … No 1290/2005 requires publication
         of information on the beneficiaries of [funds from] the EAGF and the EAFRD’.
      
      64      Since the publication of data by name relating to the beneficiaries concerned and the precise amounts received by them from
         the EAGF and the EAFRD constitutes an interference, as regards those beneficiaries, with the rights recognised by Articles
         7 and 8 of the Charter, and since such processing of personal data is not based on the consent of those beneficiaries, it
         is necessary to examine whether the interference is justified having regard to Article 52(1) of the Charter.
      
      ii)  Justification of the interference with the rights recognised by Articles 7 and 8 of the Charter
      65      Article 52(1) of the Charter accepts that limitations may be imposed on the exercise of rights such as those set forth in
         Articles 7 and 8 of the Charter, as long as the limitations are provided for by law, respect the essence of those rights and
         freedoms, and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest
         recognised by the European Union or the need to protect the rights and freedoms of others.
      
      66      First, it is common ground that the interference arising from the publication on a website of data by name relating to the
         beneficiaries concerned must be regarded as ‘provided for by law’ within the meaning of Article 52(1) of the Charter. Articles
         1(1) and 2 of Regulation No 259/2008 expressly provide for such publication.
      
      67      Second, on the question whether that interference meets an objective of general interest recognised by the European Union
         within the meaning of Article 52(1) of the Charter, it follows from recital 14 in the preamble to Regulation No 1437/2007
         amending Regulation No 1290/2005 and from recital 6 in the preamble to Regulation No 259/2008 that publication of the names
         of the beneficiaries of aid from the EAGF and the EAFRD and of the amounts which they receive from those Funds is intended
         to ‘[enhance] transparency regarding the use of Community funds in the [CAP] and [improve] the sound financial management
         of these funds, in particular by reinforcing public control of the money used’.
      
      68      The principle of transparency is stated in Articles 1 TEU and 10 TEU and in Article 15 TFEU. It enables citizens to participate
         more closely in the decision-making process and guarantees that the administration enjoys greater legitimacy and is more effective
         and more accountable to the citizen in a democratic system (see Case C‑41/00 P Interporc v Commission [2003] ECR I‑2125, paragraph 39, and Case C‑28/08 P Commission v Bavarian Lager [2010] ECR I‑0000, paragraph 54).
      
      69      By reinforcing public control of the use of the money from the EAGF and the EAFRD, the publication required by the provisions
         whose validity is contested contributes to the appropriate use of public funds by the administration (see, to that effect,
         Österreichischer Rundfunk and Others, paragraph 81).
      
      70      Moreover, that publication relating to the use of money paid out by the agricultural Funds will enable citizens to participate
         more closely in the public debate surrounding decisions on the direction to be taken by the CAP.
      
      71      Consequently, by aiming to increase the transparency of the use of funds in the context of the CAP, Article 44a of Regulation
         No 1290/2005 and Regulation No 259/2008 pursue an objective of general interest recognised by the European Union.
      
      72      Third, it is also necessary to ascertain whether the limitation imposed on the rights conferred by Articles 7 and 8 of the
         Charter is proportionate to the legitimate aim pursued (see, inter alia, European Court of Human Rights, Gillow v. United Kingdom, 24 November 1986, § 55, Series A no. 109, and Österreichischer Rundfunk and Others, paragraph 83).
      
      73      The applicants in the main proceedings observe that the data whose publication is provided for in Article 44a of Regulation
         No 1290/2005 and in Regulation No 259/2008 allows third parties to draw conclusions as to their income. They explain that
         the aid represents between 30% and 70% of the total income of the beneficiaries concerned. The legitimate interests of the
         public would, they argue, be satisfied by the publication of anonymous statistics.
      
      74      It is settled case-law that the principle of proportionality, which is one of the general principles of European Union law,
         requires that measures implemented by acts of the European Union are appropriate for attaining the objective pursued and do
         not go beyond what is necessary to achieve it (Case C‑58/08 Vodafone and Others [2010] ECR I‑0000, paragraph 51 and the case-law cited).
      
      75      It is not disputed that the publication on the internet of data by name relating to the beneficiaries concerned and the precise
         amounts received by them from the EAGF and the EAFRD is liable to increase transparency with respect to the use of the agricultural
         aid concerned. Such information made available to citizens reinforces public control of the use to which that money is put
         and contributes to the best use of public funds.
      
      76      As to whether the measure is necessary, it must be recalled that the objective of the publication at issue may not be pursued
         without having regard to the fact that that objective must be reconciled with the fundamental rights set forth in Articles
         7 and 8 of the Charter (see, to that effect, Case C‑73/07 Satakunnan Markkinapörssi and Satamedia [2008] ECR I‑9831, paragraph 53).
      
      77      It is thus necessary to determine whether the Council of the European Union and the Commission balanced the European Union’s
         interest in guaranteeing the transparency of its acts and ensuring the best use of public funds against the interference with
         the right of the beneficiaries concerned to respect for their private life in general and to the protection of their personal
         data in particular. The Court has held in this respect that derogations and limitations in relation to the protection of personal
         data must apply only in so far as is strictly necessary (Satakunnan Markkinapörssi and Satamedia, paragraph 56).
      
      78      The Member States which have submitted written observations to the Court, the Council and the Commission argue that the objective
         pursued by the publication required by Article 44a of Regulation No 1290/2005 and by Regulation No 259/2008 could not be achieved
         by measures which interfere less with the right of the beneficiaries concerned to respect for their private life in general
         and the protection of their personal data in particular. Information limited to those of the beneficiaries concerned who receive
         aid exceeding a certain threshold would, it is submitted, not give taxpayers an accurate image of the CAP. Taxpayers would
         have the impression that there were only ‘big’ beneficiaries of aid from the agricultural Funds, whereas there are numerous
         ‘little’ ones. Limiting publication to legal persons only would not be satisfactory either. The Commission submits in this
         connection that the largest beneficiaries of agricultural aid include natural persons.
      
      79      While it is true that in a democratic society taxpayers have a right to be kept informed of the use of public funds (Österreichischer Rundfunk and Others, paragraph 85), the fact remains that striking a proper balance between the various interests involved made it necessary
         for the institutions, before adopting the provisions whose validity is contested, to ascertain whether publication via a single
         freely consultable website in each Member State of data by name relating to all the beneficiaries concerned and the precise
         amounts received by each of them from the EAGF and the EAFRD – with no distinction being drawn according to the duration,
         frequency or nature and amount of the aid received – did not go beyond what was necessary for achieving the legitimate aims
         pursued, having regard in particular to the interference with the rights guaranteed by Articles 7 and 8 of the Charter resulting
         from such publication.
      
      80      As far as natural persons benefiting from aid under the EAGF and the EAFRD are concerned, however, it does not appear that
         the Council and the Commission sought to strike such a balance between the European Union’s interest in guaranteeing the transparency
         of its acts and ensuring the best use of public funds, on the one hand, and the fundamental rights enshrined in Articles 7
         and 8 of the Charter, on the other.
      
      81      There is nothing to show that, when adopting Article 44a of Regulation No 1290/2005 and Regulation No 259/2008, the Council
         and the Commission took into consideration methods of publishing information on the beneficiaries concerned which would be
         consistent with the objective of such publication while at the same time causing less interference with those beneficiaries’
         right to respect for their private life in general and to protection of their personal data in particular, such as limiting
         the publication of data by name relating to those beneficiaries according to the periods for which they received aid, or the
         frequency or nature and amount of aid received.
      
      82      Such limited publication by name might be accompanied, if appropriate, by relevant information about other natural persons
         benefiting from aid under the EAGF and the EAFRD and the amounts received by them.
      
      83      The institutions ought thus to have examined, in the course of striking a proper balance between the various interests involved,
         whether publication by name limited in the manner indicated in paragraph 81 above would have been sufficient to achieve the
         objectives of the European Union legislation at issue in the main proceedings. In particular, it does not appear that such
         a limitation, which would protect some of the beneficiaries concerned from interference with their private lives, would not
         provide citizens with a sufficiently accurate image of the aid granted by the EAGF and the EAFRD to achieve the objectives
         of that legislation.
      
      84      The Member States which submitted written observations to the Court and the Council and the Commission refer also to the significant
         role of the CAP in the European Union budget in order to justify the need for publication laid down by Article 44a of Regulation
         No 1290/2005 and by Regulation No 259/2008.
      
      85      That argument must be rejected. It is necessary to bear in mind that the institutions are obliged to balance, before disclosing
         information relating to a natural person, the European Union’s interest in guaranteeing the transparency of its actions and
         the infringement of the rights recognised by Articles 7 and 8 of the Charter. No automatic priority can be conferred on the
         objective of transparency over the right to protection of personal data (see, to that effect, Commission v Bavarian Lager, paragraphs 75 to 79), even if important economic interests are at stake.
      
      86      It follows from the foregoing that it does not appear that the institutions properly balanced, on the one hand, the objectives
         of Article 44a of Regulation No 1290/2005 and of Regulation No 259/2008 against, on the other, the rights which natural persons
         are recognised as having under Articles 7 and 8 of the Charter. Regard being had to the fact that derogations and limitations
         in relation to the protection of personal data must apply only in so far as is strictly necessary (Satakunnan Markkinapörssi and Satamedia, paragraph 56) and that it is possible to envisage measures which affect less adversely that fundamental right of natural
         persons and which still contribute effectively to the objectives of the European Union rules in question, it must be held
         that, by requiring the publication of the names of all natural persons who were beneficiaries of EAGF and EAFRD aid and of
         the exact amounts received by those persons, the Council and the Commission exceeded the limits which compliance with the
         principle of proportionality imposes.
      
      87      Finally, with regard to the legal persons which received EAGF and EAFRD aid, and in so far as they may invoke the rights conferred
         by Articles 7 and 8 of the Charter (see paragraph 53 of the present judgment), the view must be taken that the obligation
         to publish which follows from the provisions of the European Union rules the validity of which has here been brought into
         question does not go beyond the limits imposed by compliance with the principle of proportionality. The seriousness of the
         breach of the right to protection of personal data manifests itself in different ways for, on the one hand, legal persons
         and, on the other, natural persons. It is necessary to point out in this regard that legal persons are already subject to
         a more onerous obligation in respect of the publication of data relating to them. Furthermore, the obligation on the competent
         national authorities to examine, before the data in question are published and for each legal person which is a beneficiary
         of EAGF or EAFRD aid, whether the name of that person identifies natural persons would impose on those authorities an unreasonable
         administrative burden (see, to that effect, judgment of the European Court of Human Rights, K.U. v.Finland, 2 March 2009, application no 2872/02, § 48, not yet published).
      
      88      In those circumstances, it must be held that the provisions of European Union law, the validity of which is questioned by
         the referring court, observe, in so far as they concern the publication of data relating to legal persons, a fair balance
         in the consideration taken of the respective interests in issue.
      
      89      On the basis of all of the foregoing, Article 44a of Regulation No 1290/2005 and Regulation No 259/2008 must be declared invalid
         to the extent to which, with regard to natural persons who are beneficiaries of EAGF and EAFRD aid, those provisions impose
         an obligation to publish personal data relating to each beneficiary without drawing a distinction based on relevant criteria
         such as the periods during which those persons have received such aid, the frequency of such aid or the nature and amount
         thereof. 
      
      c)     The validity of Article 42(8b) of Regulation No 1290/2005
      90      Article 42(8b) of Regulation No 1290/2005 authorises the Commission to adopt the detailed rules for the implementation solely
         of Article 44a of that regulation.
      
      91      However, as Article 44a of Regulation No 1290/2005 has to be declared invalid for the reasons indicated above, Article 42(8b)
         of that regulation must be declared invalid in like manner.
      
      92      The answer to the first question and to the first part of the second question is therefore that Articles 42(8b) and 44a of
         Regulation No 1290/2005, and Regulation No 259/2008, are invalid in so far as, with regard to natural persons who are beneficiaries
         of EAGF and EAFRD aid, those provisions impose an obligation to publish personal data relating to each beneficiary without
         drawing a distinction based on relevant criteria such as the periods during which those persons have received such aid, the
         frequency of such aid or the nature and amount thereof. 
      
      d)     The effects in time of the invalidity which has been established
      93      Where it is justified by overriding considerations of legal certainty, the second paragraph of Article 264 TFEU, which is
         also applicable by analogy to a reference under Article 267 TFEU for a preliminary ruling on the validity of acts of the European
         Union, confers on the Court a discretion to decide, in each particular case, which specific effects of the act in question
         must be regarded as definitive (see, to that effect, Case C‑333/07 Regie Networks [2008] ECR I‑10807, paragraph 121 and the case‑law cited).
      
      94      In view of the large number of publications which have taken place in the Member States on the basis of rules which were regarded
         as being valid, it must be held that the invalidity of the provisions mentioned in paragraph 92 of the present judgment does
         not allow any action to be brought to challenge the effects of the publication of the lists of beneficiaries of EAGF and EAFRD
         aid carried out by the national authorities on the basis of those provisions during the period prior to the date on which
         the present judgment is delivered. 
      
      2.     The third question
      95      By its third question, the referring court seeks, essentially, to ascertain whether the second indent of Article 18(2) of
         Directive 95/46 is to be interpreted as meaning that the publication of the information resulting from Articles 42(8b) and
         44a of Regulation No 1290/2005 and from Regulation No 259/2008 may be effected only if the personal data protection official
         has, prior to such publication, kept a full register within the terms of the second indent of Article 18(2). 
      
      96      It must, in this regard, be borne in mind that Article 18(1) of Directive 95/46 establishes the principle that the supervisory
         authority must be notified before any wholly or partly automatic operation for the processing of personal data, or any set
         of such operations intended to serve a single purpose or several related purposes, is carried out. As recital 48 in the preamble
         to Directive 95/46 explains, ‘the procedures for notifying the supervisory authority are designed to ensure disclosure of
         the purposes and main features of any processing operation for the purpose of verification that the operation is in accordance
         with the national measures taken under this Directive’. 
      
      97      The second indent of Article 18(2) of Directive 95/46, however, provides that Member States may provide for the simplification
         of or exemption from that obligation in the case where, inter alia, the controller appoints a personal data protection official.
         It appears from the decisions for reference that such an appointment was made in the Land of Hesse so far as concerns the publication of data resulting from Articles 42(8b) and 44a of Regulation No 1290/2005 and
         from Regulation No 259/2008. 
      
      98      According to the second indent of Article 18(2) of Directive 95/46, a personal data protection official has a number of tasks
         which are designed to ensure that processing operations are unlikely to have an adverse effect on the rights and freedoms
         of the persons concerned. The official is thus responsible for, among other things, ‘keeping the register of processing operations
         carried out by the controller, containing the items of information referred to in Article 21(2) [of Directive 95/46]’. The
         latter provision refers to Article 19(1)(a) to (e) of Directive 95/46.
      
      99      However, contrary to the view expressed by the referring court, the second indent of Article 18(2) of Directive 95/46 does
         not require any provision to be adopted which imposes an obligation on the personal data protection official to maintain a
         register containing the information referred to in Article 21(2) of that directive, read in conjunction with Article 19(1)(a)
         to (e) thereof, before the processing of the data concerned is undertaken. The register referred to in the second indent of
         Article 18(2) of Directive 95/46 need contain only ‘processing operations carried out’. 
      
      100    In those circumstances, the absence, established by the referring court, of a full register prior to the data processing cannot
         affect the legality of a publication such as that resulting from Articles 42(8b) and 44a of Regulation No 1290/2005 and from
         Regulation No 259/2008.
      
      101    The answer to the third question is therefore that the second indent of Article 18(2) of Directive 95/46 must be interpreted
         as not placing the personal data protection official under an obligation to keep the register provided for by that provision
         before an operation for the processing of personal data, such as that resulting from Articles 42(8b) and 44a of Regulation
         No 1290/2005 and from Regulation No 259/2008, is carried out.
      
      3.     The fourth question
      102    By its fourth question, the referring court seeks, essentially, to ascertain whether Article 20 of Directive 95/46 is to be
         interpreted as making the publication of the information resulting from Articles 42(8b) and 44a of Regulation No 1290/2005
         and from Regulation No 259/2008 subject to the prior checks for which that Article 20 provides. 
      
      103    It must first be pointed out that Article 20(1) of Directive 95/46 provides that ‘Member States shall determine the processing
         operations likely to present specific risks to the rights and freedoms of data subjects and shall check that these processing
         operations are examined prior to the start thereof’.
      
      104    It follows that Directive 95/46 does not make the processing of personal data subject, in general, to a prior check. As is
         clear from recital 52 in the preamble to Directive 95/46, the European Union legislature took the view that ‘ex post facto verification by the competent authorities must in general be considered a sufficient measure’.
      
      105    With regard to processing operations which are subject to prior checks, that is to say, processing operations which are likely
         to pose specific risks to the rights and freedoms of data subjects, recital 53 in the preamble to Directive 95/46 states that
         processing operations are likely to pose such risks ‘by virtue of their nature, their scope or their purposes’. Even though
         Member States have the option of specifying in greater detail in their legislation the processing operations which may pose
         specific risks to the rights and freedoms of data subjects, Directive 95/46 provides, as is evident from recital 54 in its
         preamble, that the number of such operations ‘should be very limited’. 
      
      106    It must further be pointed out that, under Article 27(1) of Regulation No 45/2001, processing operations which are likely
         to present specific risks to the rights and freedoms of data subjects are also subject to prior checking when carried out
         by institutions and bodies of the European Union. Article 27(2) of that regulation specifies the operations which are likely
         to present such risks. In view of the parallel relationship between the provisions of Directive 95/46 and those of Regulation
         No 45/2001 which relate to prior checks, the listing in Article 27(2) of Regulation No 45/2001 of the processing operations
         which are likely to present specific risks to the rights and freedoms of data subjects must be considered relevant for the
         purpose of interpreting Article 20 of Directive 95/46.
      
      107    However, it does not appear that the publication of the data imposed by Articles 42(8b) and 44a of Regulation No 1290/2005
         and by Regulation No 259/2008 comes within any of the categories of processing operations covered by Article 27(2) of Regulation
         No 45/2001.
      
      108    In those circumstances, the answer to the fourth question is that Article 20 of Directive 95/46 must be interpreted as not
         imposing an obligation on the Member States to make the publication of information resulting from Articles 42(8b) and 44a
         of Regulation No 1290/2005 and from Regulation No 259/2008 subject to the prior checks for which that Article 20 provides.
      
      109    In view of the answer to the fourth question, there is no longer any need to answer the fifth question.
      
      IV –  Costs
      110    Since these proceedings are, for the parties to the main proceedings, a step in the actions pending before the national court,
         the decisions on costs are a matter for that court. Costs incurred in submitting observations to the Court, other than the
         costs of those parties, are not recoverable.
      
      On those grounds, the Court (Grand Chamber) hereby rules:
      1.      Articles 42(8b) and 44a of Council Regulation (EC) No 1290/2005 of 21 June 2005 on the financing of the common agricultural
            policy, as amended by Council Regulation (EC) No 1437/2007 of 26 November 2007, and Commission Regulation (EC) No 259/2008
            of 18 March 2008 laying down detailed rules for the application of Regulation No 1290/2005 as regards the publication of information
            on the beneficiaries of funds deriving from the European Agricultural Guarantee Fund (EAGF) and the European Agricultural
            Fund for Rural Development (EAFRD) are invalid in so far as, with regard to natural persons who are beneficiaries of EAGF
            and EAFRD aid, those provisions impose an obligation to publish personal data relating to each beneficiary without drawing
            a distinction based on relevant criteria such as the periods during which those persons have received such aid, the frequency
            of such aid or the nature and amount thereof.
      2.      The invalidity of the provisions of European Union law mentioned in paragraph 1 of this operative part does not allow any
            action to be brought to challenge the effects of the publication of the lists of beneficiaries of EAGF and EAFRD aid carried
            out by the national authorities on the basis of those provisions during the period prior to the date on which the present
            judgment is delivered.
      3.      The second indent of Article 18(2) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995
            on the protection of individuals with regard to the processing of personal data and on the free movement of such data must
            be interpreted as not placing the personal data protection official under an obligation to keep the register provided for
            by that provision before an operation for the processing of personal data, such as that resulting from Articles 42(8b) and
            44a of Regulation No 1290/2005, as amended by Regulation No 1437/2007, and from Regulation No 259/2008, is carried out.
      4.      Article 20 of Directive 95/46 must be interpreted as not imposing an obligation on the Member States to make the publication
            of information resulting from Articles 42(8b) and 44a of Regulation No 1290/2005, as amended by Regulation No 1437/2007, and
            from Regulation No 259/2008 subject to the prior checks for which that Article 20 provides.
      [Signatures]
      *  Language of the cases: German.