CELEX: 62006CJ0524
Language: en
Date: 2008-12-16 00:00:00
Title: Judgment of the Court (Grand Chamber) of 16 December 2008.#Heinz Huber v Bundesrepublik Deutschland.#Reference for a preliminary ruling: Oberverwaltungsgericht für das Land Nordrhein-Westfalen - Germany.#Protection of personal data - European citizenship - Principle of non-discrimination on grounds of nationality - Directive 95/46/EC - Concept of necessity - General processing of personal data relating to citizens of the Union who are nationals of another Member State - Central register of foreign nationals.#Case C-524/06.

Case C-524/06
      Heinz Huber
      v
      Bundesrepublik Deutschland
      (Reference for a preliminary ruling from the 
      Oberverwaltungsgericht für das Land Nordrhein-Westfalen)
      (Protection of personal data – European citizenship – Principle of non‑discrimination on grounds of nationality – Directive 95/46/EC – Concept of necessity – General processing of personal data relating to citizens of the Union who are nationals of another Member State – Central register of foreign nationals)
      Summary of the Judgment
      1.        Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – Scope
            
      (European Parliament and Council Directive 95/46, Art. 3(2))
      2.        Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46
      (Art. 12(1) EC; European Parliament and Council Directive 95/46, Art. 7(e))
      3.        Community law – Principles – Equal treatment – Discrimination on grounds of nationality – System for processing personal data
            
      (Art. 12 EC)
      1.        Article 3(2) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the
         free movement of such data expressly excludes from its scope of application, inter alia, the processing of personal data concerning
         public security, defence, State security and the activities of the State in areas of criminal law. It follows that, while
         the processing of personal data for the purposes of the application of the legislation relating to the right of residence
         and for statistical purposes falls within the scope of application of Directive 95/46, the position is otherwise where the
         objective of processing those data is connected with the fight against crime. 
      
      (see paras 44-45)
      2.        A system for processing personal data relating to Union citizens who are not nationals of the Member State concerned, putting
         in place a central register of foreign nationals and having as its object the provision of support to the national authorities
         responsible for the application of the law relating to the right of residence does not satisfy the requirement of necessity
         laid down by Article 7(e) of Directive 95/46 on the protection of individuals with regard to the processing of personal data
         and on the free movement of such data, interpreted in the light of the prohibition on any discrimination on grounds of nationality,
         unless:
      
      – it contains only the data which are necessary for the application by those authorities of that legislation, and
      – its centralised nature enables that legislation to be more effectively applied as regards the right of residence of Union
         citizens who are not nationals of that Member State.
      
      It is for the national court to ascertain whether those conditions are satisfied. 
      Having regard to the objective of Directive 95/46 of ensuring an equivalent level of protection in all Member States, the
         concept of necessity laid down by Article 7(e) of the directive cannot have a meaning which varies between the Member States.
         It follows that what is at issue is a concept which has its own independent meaning in Community law.
      
      As regards the use of a central register of foreign nationals for the purpose of the application of the legislation relating
         to the right of residence, it is necessary for a Member State, within the meaning of Article 7(e), to have the relevant particulars
         and documents available to it in order to ascertain, within the framework laid down under the applicable Community legislation,
         whether a right of residence in its territory exists in relation to a national of another Member State and to establish that
         there are no grounds which would justify a restriction on that right. It follows that the use of a register for the purpose
         of providing support to the authorities responsible for the application of the legislation relating to the right of residence
         is, in principle, legitimate and, having regard to its nature, compatible with the prohibition of discrimination on grounds
         of nationality laid down by Article 12(1) EC. However, such a register must not contain any information other than what is
         necessary for that purpose. In that regard, as Community law presently stands, the processing of personal data contained in
         the documents referred to in Articles 8(3) and 27(1) of Directive 2004/38 on the right of citizens of the Union and their
         family members to move and reside freely within the territory of the Member States amending Regulation No 1612/68 and repealing
         Directives 64/221, 68/360, 72/194, 73/148, 75/34, 75/35, 90/364, 90/365 and 93/96 must be considered to be necessary, within
         the meaning of Article 7(e) of Directive 95/46, for the application of the legislation relating to the right of residence.
      
      With respect to the necessity that a centralised register be available in order to meet the requirements of the authorities
         responsible for the application of the legislation relating to the right of residence, even if it were to be assumed that
         decentralised registers such as district population registers contain all the data which are relevant for the purposes of
         allowing the authorities to undertake their duties, the centralisation of those data could be necessary, within the meaning
         of Article 7(e) of Directive 95/46, if it contributes to the more effective application of that legislation as regards the
         right of residence of Union citizens who wish to reside in a Member State of which they are not nationals.
      
      The storage and processing of personal data containing individualised personal information in such a register for statistical
         purposes cannot, on any basis, be considered to be necessary within the meaning of Article 7(e) of Directive 95/46. While
         Community law has not excluded the power of Member States to adopt measures enabling the national authorities to have an exact
         knowledge of population movements affecting their territory, the exercise of that power does not, of itself, mean that the
         collection and storage of individualised personal information is necessary. It is only anonymous information that requires
         to be processed in order for such an objective to be attained.
      
      (see paras 52, 58-59, 62-63, 65-68, operative part 1)
      3.        Article 12(1) EC must be interpreted as meaning that it precludes the putting in place by a Member State, for the purpose
         of fighting crime, of a system for processing personal data specific to Union citizens who are not nationals of that Member
         State.
      
      The principle of non-discrimination, which has its basis in Articles 12 EC and 43 EC, requires that comparable situations
         must not be treated differently and that different situations must not be treated in the same way. Such treatment may be justified
         only if it is based on objective considerations independent of the nationality of the persons concerned and is proportionate
         to the objective being legitimately pursued.
      
      While it is true that the objective of fighting crime is a legitimate one, it cannot be relied on in order to justify the
         systematic processing of personal data when that processing is restricted to the data of Union citizens who are not nationals
         of the Member State concerned. The fight against crime necessarily involves the prosecution of crimes and offences committed,
         irrespective of the nationality of their perpetrators. It follows that, as regards a Member State, the situation of its nationals
         cannot, as regards the objective of fighting crime, be different from that of Union citizens who are not nationals of that
         Member State and who are resident in its territory. Therefore, a difference in treatment between those nationals and those
         Union citizens which arises by virtue of the systematic processing of personal data relating only to Union citizens who are
         not nationals of the Member State concerned for the purposes of fighting crime constitutes discrimination which is prohibited
         by Article 12(1) EC.
      
      (see paras 75, 77-81, operative part 2)
JUDGMENT OF THE COURT (Grand Chamber)
      16 December 2008 (*)
      
      (Protection of personal data – European citizenship – Principle of non-discrimination on grounds of nationality – Directive 95/46/EC – Concept of necessity – General processing of personal data relating to citizens of the Union who are nationals of another Member State – Central register of foreign nationals)
      In Case C‑524/06,
      REFERENCE for a preliminary ruling under Article 234 EC from the Oberverwaltungsgericht für das Land Nordrhein-Westfalen (Germany),
         made by decision of 15 December 2006, received at the Court on 28 December 2006, in the proceedings
      
      Heinz Huber
      v
      Bundesrepublik Deutschland,
      THE COURT (Grand Chamber),
      composed of V. Skouris, President, P. Jann, C.W.A. Timmermans and K. Lenaerts, Presidents of Chambers, P. Kūris, G. Arestis,
         U. Lõhmus, E. Levits (Rapporteur) and L. Bay Larsen, Judges,
      
      Advocate General: M. Poiares Maduro,
      Registrar: B. Fülöp, Administrator,
      having regard to the written procedure and further to the hearing on 8 January 2008,
      after considering the observations submitted on behalf of:
      –        Mr Huber, by A. Widmann, Rechtsanwalt,
      –        the German Government, by M. Lumma and C. Schulze-Bahr, acting as Agents, and by Professor K. Hailbronner, 
      –        the Belgian Government, by L. Van den Broeck, acting as Agent,
      –        the Danish Government, by B. Weis Fogh, acting as Agent,
      –        the Greek Government, by E.-M. Mamouna and K. Boskovits, acting as Agents,
      –        the Italian Government, by I.M. Braguglia, acting as Agent, and by W. Ferrante, avvocato dello Stato,
      –        the Netherlands Government, by H.G. Sevenster, C.M. Wissels and C. ten Dam, acting as Agents,
      –        the Finnish Government, by J. Heliskoski, acting as Agent,
      –        the United Kingdom Government, by E. O’Neill, acting as Agent, and J. Stratford, Barrister,
      –        the Commission of the European Communities, by C. Docksey and C. Ladenburger, acting as Agents,
      after hearing the Opinion of the Advocate General at the sitting on 3 April 2008,
      gives the following
      Judgment
      1        This reference for a preliminary ruling concerns Article 12(1) EC, read in conjunction with Articles 17 EC and 18 EC, the
         first paragraph of Article 43 EC, as well as Article 7(e) of Directive 95/46/EC of the European Parliament and of the Council
         of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement
         of such data (OJ 1995 L 281, p. 31). 
      
      2        The reference was made in proceedings between Mr Huber, an Austrian national who is resident in Germany, and the Bundesrepublik
         Deutschland, represented by the Bundesamt für Migration und Flüchtlinge (Federal Office for Migration and Refugees) (‘the
         Bundesamt’), regarding Mr Huber’s request for the deletion of the data relating to him in the Central Register of Foreign
         Nationals (Ausländerzentralregister) (‘the AZR’).
      
       Legal context
       Community legislation
      3        The eighth recital in the preamble to Directive 95/46 states:
      
      ‘Whereas, in order to remove the obstacles to flows of personal data, the level of protection of the rights and freedoms of
         individuals with regard to the processing of such data must be equivalent in all Member States; …’.
      
      4        The tenth recital in the preamble to that directive adds:
      
      ‘… the approximation of [the national laws on the processing of personal data] must not result in any lessening of the protection
         they afford but must, on the contrary, seek to ensure a high level of protection in the Community’. 
      
      5        Article 1 of Directive 95/46 is entitled ‘Object of the Directive’ and Article 1(1) provides:
      
      ‘In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and
         in particular their right to privacy with respect to the processing of personal data.’
      
      6        Article 2 of that directive includes the following definitions:
      
      ‘…
      (a)      “personal data” shall mean any information relating to an identified or identifiable natural  person (“data subject”); an
         identifiable person is one who can be identified, directly or  indirectly, in particular by reference to an identification
         number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
      
      (b)      “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal
         data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval,
         consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination,  blocking,
         erasure or destruction;
      
      …’.
      7        The scope of application of Directive 95/46 is laid down by Article 3, in the following  terms:
      
      ‘1.      This Directive shall apply to the processing of personal data wholly or partly  by automatic means, and to the processing
         otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing
         system.
      
      2.      This Directive shall not apply to the processing of personal data:
      –        in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI
         of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security
         (including the economic well-being of the State when the processing operation relates to State security matters) and the activities
         of  the State in areas of criminal law,
      
      –        by a natural person in the course of a purely personal or household activity.’
      8        Article 7(e) of Directive 95/46 states:
      
      ‘Member States shall provide that personal data may be processed only if:
      …
      (e)       processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority
         vested in the controller or in a third party to whom the data are disclosed; 
      
      …’.
      9        Article 4 of Council Directive 68/360/EEC of 15 October 1968 on the abolition of restrictions on movement and residence within
         the Community for workers of Member States and their families (OJ, English Special Edition 1968 (II), p. 485) provides:
      
      ‘1.      Member States shall grant the right of residence in their territory to the persons referred to in Article 1 who are able to
         produce the documents listed in paragraph 3.
      
      2.      As proof of the right of residence, a document entitled “Residence Permit for a National of a Member State of the EEC” shall
         be issued. … 
      
      3.      For the issue of a Residence Permit for a National of a Member State of the EEC, Member States may require only the production
         of the following documents:
      
      –         by the worker:    
      (a)      the document with which he entered their territory;
      (b)      a confirmation of engagement from the employer or a certificate of employment;
      –        by the members of the worker’s family:    
      (c)      the document with which they entered the territory;
      (d)      a document issued by the competent authority of the State of origin or the State whence they came, proving their relationship;
      (e)      in the cases referred to in Article 10(1) and (2) of [Council Regulation (EEC) No 1612/68 of 15 October 1968 on freedom of
         movement for workers within the Community (OJ, English Special Edition 1968 (II), p. 475)], a document issued by the competent
         authority of the State of origin or the State whence they came, testifying that they are dependent on the worker or that they
         live under his roof in such country.
      
      …’
      10      Article 10 of Directive 68/360 provides:
      
      ‘Member States shall not derogate from the provisions of this Directive save on grounds of public policy, public security
         or public health.’
      
      11      Article 4(1) of Council Directive 73/148/EEC of 21 May 1973 on the abolition of restrictions on movement and residence within
         the Community for nationals of Member States with regard to establishment and the provision of services (OJ 1973 L 172, p.
         14) states:
      
      ‘Each Member State shall grant the right of permanent residence to nationals of other Member States who establish themselves
         within its territory in order to pursue activities as self-employed persons, when the restrictions on these activities have
         been abolished pursuant to the Treaty.
      
      As proof of the right of residence, a document entitled “Residence Permit for a National of a Member State of the European
         Communities” shall be issued. This document shall be valid for not less than five years from the date of issue and shall be
         automatically renewable.
      
      …’
      12      Article 6 of Directive 73/148 states:
      
      ‘An applicant for a residence permit or right of abode shall not be required by a Member State to produce anything other than
         the following, namely:
      
      (a)      the identity card or passport with which he or she entered its territory;
      (b)      proof that he or she comes within one of the classes of person referred to in Articles 1 and 4.’
      13      Article 8 of that directive sets out the derogation provided for in Article 10 of Directive 68/360. 
      
      14      On 29 April 2004, the European Parliament and the Council of the European Union adopted Directive 2004/38/EC on the right
         of citizens of the Union and their family members to move and reside freely within the territory of the Member States amending
         Regulation (EEC) No 1612/68 and repealing Directives 64/221/EEC, 68/360/EEC, 72/194/EEC, 73/148/EEC, 75/34/EEC, 75/35/EEC,
         90/364/EEC, 90/365/EEC and 93/96/EEC (OJ 2004 L 158, p. 77, with Corrigendum, OJ 2004 L 229, p. 35), which required to be
         transposed by 30 April 2006. Article 5 of that directive provides: 
      
      ‘1.      Without prejudice to the provisions on travel documents applicable to national border controls, Member States shall grant
         Union citizens leave to enter their territory with a valid identity card or passport and shall grant family members who are
         not nationals of a Member State leave to enter their territory with a valid passport.
      
      …
      5.      The Member State may require the person concerned to report his/her presence within its territory within a reasonable and
         non-discriminatory period of time. Failure to comply with this requirement may make the person concerned liable to proportionate
         and non-discriminatory sanctions.’
      
      15      Article 7(1) of that directive governs the right of residence for a period of more than three months of Union citizens in
         a Member State of which they are not nationals in the following terms:
      
      ‘All Union citizens shall have the right of residence on the territory of another Member State for a period of longer than
         three months if they:
      
      (a)      are workers or self-employed persons in the host Member State; or 
      (b)      have sufficient resources for themselves and their family members not to become a burden on the social assistance system of
         the host Member State during their period of residence and have comprehensive sickness insurance cover in the host Member
         State; or 
      
      (c)      –       are enrolled at a private or public establishment, accredited or financed by the host Member State on the basis of its legislation
         or administrative practice, for the principal purpose of following a course of study, including vocational training; and
      
               –       have comprehensive sickness insurance cover in the host Member State and assure the relevant national authority, by means
         of a declaration or by such equivalent means as they may choose, that they have sufficient resources for themselves and their
         family members not to become a burden on the social assistance system of the host Member State during their period of residence;
         or
      
      …’.
      16      Article 8 of Directive 2004/38 provides: 
      
      ‘1.      Without prejudice to Article 5(5), for periods of residence longer than three months, the host Member State may require Union
         citizens to register with the relevant authorities.
      
      2.      The deadline for registration may not be less than three months from the date of arrival. A registration certificate shall
         be issued immediately, stating the name and address of the person registering and the date of the registration. Failure to
         comply with the registration requirement may render the person concerned liable to proportionate and non-discriminatory sanctions.
      
      3.      For the registration certificate to be issued, Member States may only require that:
      –        Union citizens to whom point (a) of Article 7(1) applies present a valid identity card or passport, a confirmation of engagement
         from the employer or a certificate of employment, or proof that they are self-employed persons;
      
      –        Union citizens to whom point (b) of Article 7(1) applies present a valid identity card or passport and provide proof that
         they satisfy the conditions laid down therein;
      
      –        Union citizens to whom point (c) of Article 7(1) applies present a valid identity card or passport, provide proof of enrolment
         at an accredited establishment and of comprehensive sickness insurance cover and the declaration or equivalent means referred
         to in point (c) of Article 7(1). …’
      
      17      Article 27 of that directive, entitled ‘General principles’, states: 
      
      ‘1.      Subject to the provisions of this Chapter, Member States may restrict the freedom of movement and residence of Union citizens
         and their family members, irrespective of nationality, on grounds of public policy, public security or public health. These
         grounds shall not be invoked to serve economic ends.
      
      2.      Measures taken on grounds of public policy or public security shall comply with the principle of proportionality and shall
         be based exclusively on the personal conduct of the individual concerned. Previous criminal convictions shall not in themselves
         constitute grounds for taking such measures.
      
      The personal conduct of the individual concerned must represent a genuine, present and sufficiently serious threat affecting
         one of the fundamental interests of society. Justifications that are isolated from the particulars of the case or that rely
         on considerations of general prevention shall not be accepted.
      
      3.      In order to ascertain whether the person concerned represents a danger for public policy or public security, when issuing
         the registration certificate or, in the absence of a registration system, not later than three months from the date of arrival
         of the person concerned on its territory or from the date of reporting his/her presence within the territory, as provided
         for in Article 5(5), or when issuing the residence card, the host Member State may, should it consider this essential, request
         the Member State of origin and, if need be, other Member States to provide information concerning any previous police record
         the person concerned may have. Such enquiries shall not be made as a matter of routine. …
      
      …’
      18      Lastly, Regulation (EC) No 862/2007 of the European Parliament and of the Council of 11 July 2007 on Community statistics
         on migration and international protection and repealing Council Regulation (EEC) No 311/76 on the compilation of statistics
         on foreign workers (OJ 2007 L 199, p. 23) lays down the framework in which the Member States are to supply statistics to the
         Commission of the European Communities relating to migratory flows in their territories. 
      
       National legislation
      19      In accordance with Paragraph 1(1) of the Law on the central register of foreign nationals (Gesetz über das Ausländerzentralregister)
         of 2 September 1994 (BGBl. 1994 I, p. 2265), as amended by the Law of 21 June 2005 (BGBl. 1994 I, p. 1818) (‘the AZRG’), the
         Bundesamt, which is attached to the Federal Ministry of the Interior, is responsible for the management of the AZR, a centralised
         register which contains certain personal data relating to foreign nationals who, inter alia, are resident in Germany on a
         basis which is not purely temporary. The foreign nationals concerned are those who reside in that territory for a period of
         more than three months, as is shown by the general administrative circular of the Federal Ministry of the Interior relating
         to the AZRG and to the regulation implementing that Law (Allgemeine Verwaltungsvorschrift des Bundesministeriums des Innern
         zum Gesetz über das AZR und zur AZRG-Durchführungsverordnung) of 4 June 1996. That information is collected in two databases
         which are managed separately. One contains personal data relating to foreign nationals who live or have lived in Germany and
         the other to those who have applied for a visa.
      
      20      In accordance with Paragraph 3 of the AZRG, the first database contains, in particular, the following information: 
      
      –        the name of the authority which provided the data;
      –        the reference number allocated by the Bundesamt;
      –        the grounds of registration; 
      –        surname, surname at birth, given names, date and place of birth, sex and nationality; 
      –        previous and other patronymics, marital status, particulars of identity documents, the last place of residence in the country
         of origin, and information supplied on a voluntary basis as to religion and the nationality of the spouse or partner; 
      
      –        particulars of entries into and exits from the territory, residence status, decisions of the Federal Employment Agency relating
         to a work permit, refugee status granted by another State, date of death;
      
      –        decisions relating, inter alia, to any application for asylum, any previous application for a residence permit, and particulars
         of, inter alia, any expulsion proceedings, arrest warrants, suspected contraventions of the laws on drugs or immigration,
         and suspected participation in terrorist activities, or convictions in respect of such activities; and
      
      –        search warrants.
      21      As the authority entrusted with the management of the AZR, the Bundesamt is responsible for the accuracy of the data registered
         in it.
      
      22      According to Paragraph 1(2) of the AZRG, by registering and supplying personal data relating to foreign nationals, the Bundesamt
         assists the public authorities responsible for the application of the law on foreign nationals and the law on asylum, together
         with other public bodies. 
      
      23      Paragraph 10(1) of the AZRG provides that every application made by a public authority to consult the AZR or for the making
         available of personal data contained in it must satisfy certain conditions, compliance with which must be determined by the
         Bundesamt on a case-by-case basis. The Bundesamt must, in particular, examine whether the data requested by an authority are
         necessary for the performance of its tasks and must also examine the precise use to which those data are intended to be put.
         The Bundesamt may reject an application if it does not satisfy the prescribed conditions.
      
      24      Paragraphs 14 to 21 and 25 to 27 of the Law specify the personal data which may be made available depending on the body which
         made the application in respect of them.
      
      25      Thus, Paragraph 14(1) of the AZRG authorises the communication to all German public authorities of data relating to identity
         and domicile, as well as the date of death and particulars of the authority responsible for the file and of any decision not
         to make data available.
      
      26      Paragraph 12 of the AZRG provides that applications, termed ‘group applications’, that is to say, which relate to a group
         of persons having one or more common characteristics, are to be subject to certain substantive and formal conditions. Such
         applications may be made only by a limited number of public bodies. In addition, every communication of personal data pursuant
         to such an application must be notified to the Federal and regional regulators responsible for the protection of personal
         data.
      
      27      In addition, Paragraph 22 of the AZRG permits public bodies authorised for that purpose to consult the AZR directly through
         an automated procedure. However, the right to do so arises only in strictly defined circumstances and after a weighing up
         by the Bundesamt of the interests of the data subject and the public interest. Moreover, such consultation is allowed only
         in the case of so-called group applications. The public bodies having rights under Paragraph 22 of the AZRG are, by virtue
         of Paragraph 7 of that Law, also authorised to enter data and information directly in the AZR.
      
      28      Lastly, Paragraphs 25 to 27 of the AZRG specify the public bodies which may obtain certain data contained in the AZR.
      
      29      The national court adds that, in Germany, every inhabitant, whether a German national or not, must have his particulars entered
         in the register kept by the authorities of the district in which he resides (Einwohnermelderegister). The Commission has stated
         in that regard that that type of register contains only some of the data comprised in the AZR, with those relating, in particular,
         to a person’s status as regards his right of residence not appearing there. There are currently some 7 700 district registers.
      
       The facts and the questions referred 
      30      Mr Huber, an Austrian national, moved to Germany in 1996 in order to carry on business there as a self-employed insurance
         agent. 
      
      31      The following data relating to him are stored in the AZR:
      
      –        his name, given name, date and place of birth, nationality, marital status, sex;
      –        a record of his entries into and exits from Germany, and his residence status;
      –        particulars of passports issued to him;
      –        a record of his previous statements as to domicile; and
      –        reference numbers issued by the Bundesamt, particulars of the authorities which supplied the data and the reference numbers
         used by those authorities.
      
      32      Since he took the view that he was discriminated against by reason of the processing of the data concerning him contained
         in the AZR, in particular because such a database does not exist in respect of German nationals, Mr Huber requested the deletion
         of those data on 22 July 2000. That request was rejected on 29 September 2000 by the administrative authority which was responsible
         for maintaining the AZR at the time.
      
      33      The challenge to that decision also having been unsuccessful, Mr Huber brought an action before the Verwaltungsgericht Köln
         (Administrative Court, Cologne) which upheld the action by judgment of 19 December 2002. The Verwaltungsgericht Köln held
         that the general processing, through the AZR, of data regarding a Union citizen who is not a German national constitutes a
         restriction of Articles 49 EC and 50 EC which cannot be justified by the objective of the swift treatment of cases relating
         to the right of residence of foreign nationals. In addition, that court took the view that the storage and processing of the
         data at issue were contrary to Articles 12 EC and 18 EC, as well as Articles 6(1)(b) and 7(e) of  Directive 95/46.
      
      34      The Bundesrepublik Deutschland, acting through the Bundesamt, brought an appeal against that judgment before the Oberverwaltungsgericht
         für das Land Nordrhein-Westfalen (Higher Administrative Court for the Land North-Rhine Westphalia), which considers that certain of the questions of law raised before it require an interpretation of
         Community law by the Court.
      
      35      First, the national court notes that, according to the Court’s case-law, a citizen of the European Union lawfully resident
         in the territory of a Member State of which he is not a national can rely on Article 12 EC in all situations which fall within
         the scope of Community law. It refers in that regard to Case C‑85/96 Martínez Sala [1998] ECR I‑2691, paragraph 63; Case C-184/99 Grzelczyk [2001] ECR I-6193, paragraph 32; and Case C-209/03 Bidar [2005] ECR I-2119, paragraph 32. Accordingly, having exercised the right to the freedom of movement conferred on him by Article
         18(1) EC, Mr Huber was entitled to rely on the prohibition of discrimination laid down by Article 12 EC.
      
      36      The national court states that the general processing of personal data relating to Mr Huber in the AZR differs from the processing
         of data relating to a German national in two respects: first, some of the data relating to Mr Huber are stored not only in
         the register of the district in which he resides but also in the AZR, and, secondly, the AZR contains additional data. 
      
      37      The national court doubts whether such a difference in treatment can be justified by the need to monitor the residence of
         foreign nationals in Germany. It also raises the question whether the general processing of personal data relating to Union
         citizens who are not German nationals and who reside or have resided in Germany is proportionate to the objective of protecting
         public security, inasmuch as the AZR covers all of those citizens and not only those who are subject to an expulsion order
         or a prohibition on residing in Germany.
      
      38      Secondly, the national court is of the opinion that, in the circumstances of the main proceedings, Mr Huber falls within the
         scope of application of Article 43 EC. Since the freedom of establishment extends not only to the taking up of activities
         as a self-employed person but also the framework conditions for that activity, the national court raises the question whether
         the general processing of data relating to Mr Huber in the AZR is liable to affect those conditions to such an extent that
         it comprises a restriction on the exercise of that freedom.
      
      39      Thirdly, the national court raises the question whether the criterion of necessity imposed by Article 7(e) of Directive 95/46
         can be a criterion for assessing a system of general data processing such as the system put in place under the AZR. The national
         court does not, in fact, rule out the possibility that the directive may leave it open to the national legislature itself
         to define that requirement of necessity. However, should that not be the case, the question arises how that requirement is
         to be understood, and more particularly whether the objective of administrative simplification might justify data processing
         of the kind put in place by the AZRG.
      
      40      In those circumstances, the Oberverwaltungsgericht für das Land Nordrhein-Westfalen decided to stay the proceedings and refer
         the following questions to the Court of Justice for a preliminary ruling:
      
      ‘(1)      Is the general processing of personal data of foreign citizens of the Union in a central register of foreign nationals compatible
         with … the prohibition of discrimination on grounds of nationality against citizens of the Union who exercise their right
         to move and reside freely within the territory of the Member States (Article 12(1) EC, in conjunction with Articles 17 EC
         and 18(1) EC)[?]
      
      (2)      [Is such processing compatible with] the prohibition of restrictions on the freedom of establishment of nationals of a Member
         State in the territory of another Member State (first paragraph of Article 43 EC)[?]
      
      (3)       [Is such treatment compatible with] the requirement of necessity under Article 7(e) of Directive 95/46 …?’
       The questions referred
       Preliminary observations
      41      By its questions, the national court asks the Court whether the processing of personal data which is undertaken in a register
         such as the AZR is compatible with Community law. 
      
      42      In that regard, it must be noted that Paragraph 1(2) of the AZRG provides that, through the storage of certain personal data
         relating to foreign nationals in the AZR and the making available of those data, the Bundesamt, which is responsible for maintaining
         that register, assists the public authorities responsible for the application of the legislation relating to the law on foreign
         nationals and the law on asylum, together with other public bodies. In particular, the German Government has stated in its
         written observations that the AZR is used for statistical purposes and on the exercise by the security and police services
         and by the judicial authorities of their powers in relation to the prosecution and investigation of activities which are criminal
         or threaten public security. 
      
      43      At the outset, it must be stated that data such as those which, according to the order for reference, the AZR contains in
         relation to Mr Huber constitute personal data within the meaning of Article 2(a) of Directive 95/46, because they represent
         ‘information relating to an identified or identifiable natural person’. Their collection, storage and transmission by the
         body responsible for the management of the register in which they are kept thus represents the ‘processing of personal data’
         within the meaning of Article 2(b) of that directive.
      
      44      However, Article 3(2) of Directive 95/46 expressly excludes from its scope of application, inter alia, the processing of personal
         data concerning public security, defence, State security and the activities of  the State in areas of criminal law.
      
      45      It follows that, while the processing of personal data for the purposes of the application of the legislation relating to
         the right of residence and for statistical purposes falls within the scope of application of Directive 95/46, the position
         is otherwise where the objective of processing those data is connected with the fight against crime.
      
      46      Consequently, the compatibility with Community law of the processing of personal data undertaken through a register such as
         the AZR should be examined, first, in the context of its function of providing support to the authorities responsible for
         the application of the legislation relating to the right of residence and to its use for statistical purposes, by having regard
         to Directive 95/46 and more particularly, in view of the third question, to the condition of necessity laid down by Article
         7(e) of that directive, as interpreted in the light of the requirements of the Treaty including in particular the prohibition
         of any discrimination on grounds of nationality under Article 12(1) EC, and, secondly, in the context of its function in the
         fight against crime, by having regard to primary Community law.
      
       The processing of personal data for the purpose of the application of the legislation relating to the right of residence and
            for statistical purposes 
       The concept of necessity 
      47      Article 1 of Directive 95/46 requires Member States to ensure the protection of the fundamental rights and freedoms of natural
         persons, and in particular their privacy, in relation to the handling of personal data.
      
      48      Chapter II of Directive 95/46, entitled ‘General rules on the lawfulness of the processing of personal data’, provides that,
         subject to the exceptions permitted under Article 13, all processing of personal data must comply, first, with the principles
         relating to data quality set out in Article 6 of the directive and, secondly, with one of the criteria for making data processing
         legitimate listed in Article 7 (see, to that effect, Joined Cases C-465/00, C-138/01 and C-139/01 Österreichischer Rundfunk and Others [2003] ECR I‑4989, paragraph 65).
      
      49      In particular, Article 7(e) provides that personal data may lawfully be processed if ‘it is necessary for the performance
         of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third
         party to whom the data are disclosed’.
      
      50      In that context, it must be noted that Directive 95/46 is intended, as appears from the eighth recital in the preamble thereto,
         to ensure that the level of protection of the rights and freedoms of individuals with regard to the processing of personal
         data is equivalent in all Member States. The tenth recital adds that the approximation of the national laws applicable in
         this area must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high
         level of protection in the Community.
      
      51      Thus, it has been held that the harmonisation of those national laws is not limited to minimal harmonisation but amounts to
         harmonisation which is generally complete (see Case C-101/01 Lindqvist [2003] ECR I‑12971, paragraph 96).
      
      52      Consequently, having regard to the objective of ensuring an equivalent level of protection in all Member States, the concept
         of necessity laid down by Article 7(e) of Directive 95/46, the purpose of which is to delimit precisely one of the situations
         in which the processing of personal data is lawful, cannot have a meaning which varies between the Member States. It therefore
         follows that what is at issue is a concept which has its own independent meaning in Community law and which must be interpreted
         in a manner which fully reflects the objective of that directive, as laid down in Article 1(1) thereof.
      
       The necessity for the processing of personal data, such as the processing undertaken through the AZR, for the purpose of the
         application of the legislation relating to the right of residence and for statistical purposes 
      
      53      It is apparent from the order for reference that the AZR is a centralised register which contains certain personal data relating
         to Union citizens who are not German nationals and that it may be consulted by a number of public and private bodies. 
      
      54      As regards the use of a register such as the AZR for the purpose of the application of the legislation relating to the right
         of residence, it is important to bear in mind that, as Community law presently stands, the right of free movement of a Union
         citizen in the territory of a Member State of which he is not a national is not unconditional but may be subject to the limitations
         and conditions imposed by the Treaty and by the measures adopted to give it effect (see, to that effect, Case C‑33/07 Jippa [2008] ECR I-0000, paragraph 21 and the case-law cited).
      
      55      Thus, Article 4 of Directive 68/360, read in conjunction with Article 1 thereof, and Article 6 of Directive 73/148, read in
         conjunction with Article 1 thereof, provided that, in order for a national of a Member State to be entitled to reside for
         a period of more than three months in the territory of another Member State, that person had to belong to one of the categories
         laid down by those directives and provided for that entitlement to be subject to certain formalities linked to the presentation
         or the provision by the applicant of a residence permit together with various documents and particulars.
      
      56      In addition, Article 10 of Directive 68/360 and Article 8 of Directive 73/148 permitted Member States to derogate from the
         provisions of those directives on grounds of public policy, public security or public health and to limit the right of entry
         and residence of a national of another Member State in their territory.
      
      57      While Directive 2004/38, which fell to be transposed by 30 April 2006 and which accordingly did not apply at the time of the
         facts of the present case, repealed both of the abovementioned directives, it sets out, in Article 7, conditions which are
         generally equivalent to those laid down under its predecessors as regards the right of residence of nationals of other Member
         States and, in Article 27(1), restrictions relating to that right which are essentially identical to those laid down under
         its predecessors. It also provides, in Article 8(1), that the host Member State may require every Union citizen who is a national
         of another Member State and who wishes to reside in its territory for a period of more than three months to register with
         the relevant authorities. In that regard, the host Member State may, by virtue of Article 8(3), require certain documents
         and particulars to be provided in order to enable those authorities to determine that the conditions for entitlement to a
         right of residence are satisfied.
      
      58      It must therefore be held that it is necessary for a Member State to have the relevant particulars and documents available
         to it in order to ascertain, within the framework laid down under the applicable Community legislation, whether a right of
         residence in its territory exists in relation to a national of another Member State and to establish that there are no grounds
         which would justify a restriction on that right. It follows that the use of a register such as the AZR for the purpose of
         providing support to the authorities responsible for the application of the legislation relating to the right of residence
         is, in principle, legitimate and, having regard to its nature, compatible with the prohibition of discrimination on grounds
         of nationality laid down by Article 12(1) EC.
      
      59      However, such a register must not contain any information other than what is necessary for that purpose. In that regard, as
         Community law presently stands, the processing of personal data contained in the documents referred to in Articles 8(3) and
         27(1) of Directive 2004/38 must be considered to be necessary, within the meaning of Article 7(e) of Directive 95/46, for
         the application of the legislation relating to the right of residence.
      
      60      Moreover, while the collection of the data required for the application of the legislation relating to the right of residence
         would be of no practical benefit if those data were not to be stored, it must be emphasised that, since a change in the personal
         situation of a party entitled to a right of residence may have an impact on his status in relation to that right, it is incumbent
         on the authority responsible for a register such as the AZR to ensure that the data which are stored are, where appropriate,
         brought up to date so that, first, they reflect the actual situation of the data subjects and, secondly, irrelevant data are
         removed from that register.
      
      61      As regards the detailed rules for the use of such a register for the purposes of the application of the legislation relating
         to the right of residence, only the grant of access to authorities having powers in that field could be considered to be necessary
         within the meaning of Article 7(e) of Directive 95/46.
      
      62      Lastly, with respect to the necessity that a centralised register such as the AZR be available in order to meet the requirements
         of the authorities responsible for the application of the legislation relating to the right of residence, even if it were
         to be assumed that decentralised registers such as the district population registers contain all the data which are relevant
         for the purposes of allowing the authorities to undertake their duties, the centralisation of those data could be necessary,
         within the meaning of Article 7(e) of Directive 95/46, if it contributes to the more effective application of that legislation
         as regards the right of residence of Union citizens who wish to reside in a Member State of which they are not nationals.
         
      
      63      As regards the statistical function of a register such as the AZR, it must be recalled that, by creating the principle of
         freedom of movement for persons and by conferring on any person falling within its ambit the right of access to the territory
         of the Member States for the purposes intended by the Treaty, Community law has not excluded the power of Member States to
         adopt measures enabling the national authorities to have an exact knowledge of population movements affecting their territory
         (see Case 118/75 Watson and Belmann [1976] ECR 1185, paragraph 17).
      
      64      Similarly, Regulation No 862/2007, which provides for the transmission of statistics relating to migratory flows in the territory
         of the Member States, presupposes that information will be collected by those States which allows those statistics to be determined.
      
      65      However, the exercise of that power does not, of itself, mean that the collection and storage of individualised personal information
         in a register such as the AZR is necessary, within the meaning of Article 7(e) of Directive 95/46. As the Advocate General
         stated at point 23 of his Opinion, it is only anonymous information that requires to be processed in order for such an objective
         to be attained.
      
      66      It follows from all of the above that a system for processing personal data relating to Union citizens who are not nationals
         of the Member State concerned, such as that put in place by the AZRG and having as its object the provision of support to
         the national authorities responsible for the application of the legislation relating to the right of residence, does not satisfy
         the requirement of necessity laid down by Article 7(e) of Directive 95/46, interpreted in the light of the prohibition on
         any discrimination on grounds of nationality, unless:
      
      –        it contains only the data which are necessary for the application by those authorities of that legislation, and
      –        its centralised nature enables that legislation to be more effectively applied as regards the right of residence of Union
         citizens who are not nationals of that Member State.
      
      67      It is for the national court to ascertain whether those conditions are satisfied in the main proceedings.
      
      68      The storage and processing of personal data containing individualised personal information in a register such as the AZR for
         statistical purposes cannot, on any basis, be considered to be necessary within the meaning of Article 7(e) of Directive 95/46.
      
       The processing of personal data relating to Union citizens who are nationals of other Member States for the purposes of fighting
            crime 
      69      As a preliminary point, it should be noted that, according to settled case-law, citizenship of the Union is destined to be
         the fundamental status of nationals of the Member States, enabling those who find themselves in the same situation to receive
         the same treatment in law irrespective of their nationality, subject to such exceptions as are expressly provided for (see,
         to that effect, Grzelczyk, paragraphs 30 and 31; Case C‑148/02 Garcia Avello [2003] ECR I‑11613, paragraphs 22 and 23; and Bidar, paragraph 31).
      
      70      In that regard, a Union citizen lawfully resident in the territory of the host Member State can rely on Article 12 EC in all
         situations which fall within the scope ratione materiae of Community law (see Martínez Sala, paragraph 63; Grzelczyk, paragraph 32; and Bidar, paragraph 32).
      
      71      Those situations include those involving the exercise of the fundamental freedoms guaranteed by the Treaty and those involving
         the exercise of the right to move and reside within the territory of the Member States, as conferred by Article 18 EC (see,
         to that effect, Bidar, paragraph 33 and the case-law cited).
      
      72      It is apparent from Paragraph 1 of the AZRG, read in conjunction with the general administrative circular of the Federal Ministry
         of the Interior of 4 June 1996 relating to the AZRG and to the regulation implementing that Law, that the system of storage
         and processing of personal data put in place through the AZR concerns all Union citizens who are not nationals of the Federal
         Republic of Germany and who reside in Germany for a period of over three months, irrespective of the reasons which lead them
         to reside there.
      
      73      That being the case, since Mr Huber exercised his freedom to move and reside within that territory as conferred by Article
         18 EC, reference should, having regard to the circumstances of the main proceedings, be made to Article 12(1) EC in order
         to determine whether a system for the storage and processing of personal data such as that at issue in the main proceedings
         is compatible with the principle that any discrimination on grounds of nationality is prohibited, in so far as those data
         are stored and processed for the purposes of fighting crime.
      
      74      In that context, it should be pointed out that the order for reference does not contain any detailed information which would
         allow it to be established whether the situation at issue in the main proceedings is covered by Article 43 EC. However, even
         if the national court were to consider that to be the case, the application of the principle of non-discrimination cannot
         vary depending on whether it finds its basis in that provision or on Article 12(1) EC, read in conjunction with Article 18(1)
         EC. 
      
      75      It is settled case-law that the principle of non-discrimination, which has its basis in Articles 12 EC and 43 EC, requires
         that comparable situations must not be treated differently and that different situations must not be treated in the same way.
         Such treatment may be justified only if it is based on objective considerations independent of the nationality of the persons
         concerned and is proportionate to the objective being legitimately pursued (see, to that effect, Case C-164/07 Wood [2008] ECR I-0000, paragraph 13 and the case-law cited).
      
      76      It is therefore, in circumstances such as those at issue in the main proceedings, necessary to compare the situation of Union
         citizens who are not nationals of the Member State concerned and who are resident in the territory of that Member State with
         that of nationals of that Member State as regards the objective of fighting crime. In fact, the German Government relies only
         on that aspect of the protection of public order.
      
      77      Although that objective is a legitimate one, it cannot be relied on in order to justify the systematic processing of personal
         data when that processing is restricted to the data of Union citizens who are not nationals of the Member State concerned.
      
      78      As the Advocate General noted at point 21 of his Opinion, the fight against crime, in the general sense in which that term
         is used by the German Government in its observations, necessarily involves the prosecution of crimes and offences committed,
         irrespective of the nationality of their perpetrators.
      
      79      It follows that, as regards a Member State, the situation of its nationals cannot, as regards the objective of fighting crime,
         be different from that of Union citizens who are not nationals of that Member State and who are resident in its territory.
      
      80      Therefore, the difference in treatment between those nationals and those Union citizens which arises by virtue of the systematic
         processing of personal data relating only to Union citizens who are not nationals of the Member State concerned for the purposes
         of fighting crime constitutes discrimination which is prohibited by Article 12(1) EC.
      
      81      Consequently, Article 12(1) EC must be interpreted as meaning that it precludes the putting in place by a Member State, for
         the purpose of fighting crime, of a system for processing personal data specific to Union citizens who are not nationals of
         that Member State.
      
       Costs
      82      Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court,
         the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs
         of those parties, are not recoverable.
      
      On those grounds, the Court (Grand Chamber) hereby rules:
      1.      A system for processing personal data relating to Union citizens who are not nationals of the Member State concerned, such
            as that put in place by the Law on the central register of foreign nationals (Gesetz über das Ausländerzentralregister) of
            2 September 1994, as amended by the Law of 21 June 2005, and having as its object the provision of support to the national
            authorities responsible for the application of the law relating to the right of residence does not satisfy the requirement
            of necessity laid down by Article 7(e) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995
            on the protection of individuals with regard to the processing of personal data and on the free movement of such data, interpreted
            in the light of the prohibition on any discrimination on grounds of nationality, unless:
      –        it contains only the data which are necessary for the application by those authorities of that legislation, and 
      –        its centralised nature enables the legislation relating to the right of residence to be more effectively applied as regards
            Union citizens who are not nationals of that Member State.
      It is for the national court to ascertain whether those conditions are satisfied in the main proceedings.
      The storage and processing of personal data containing individualised personal information in a register such as the Central
            Register of Foreign Nationals for statistical purposes cannot, on any basis, be considered to be necessary within the meaning
            of Article 7(e) of Directive 95/46.
      2.      Article 12(1) EC must be interpreted as meaning that it precludes the putting in place by a Member State, for the purpose
            of fighting crime, of a system for processing personal data specific to Union citizens who are not nationals of that Member
            State. 
      [Signatures]
      * Language of the case: German.