37 See Pato, A., ‘The National Adaptation of Article 80 GDPR: Towards the Effective Private Enforcement of Collective <mask> Rights’, National Adaptations of the GDPR, Blogdroiteuropeen, Collection Open Access Book, Luxembourg, 2019, pp. 98-106. According to that author, ‘the number of actors who potentially have standing to sue is broad’ and ‘consumer associations will usually meet those requirements easily’ (p. 99).


it is established that the law to which the data importer or a sub-processor is subject imposes upon him requirements to derogate from the applicable <mask> law which go beyond the restrictions necessary in a democratic society as provided for in Article 13 of [Directive 95/46] where those requirements are likely to have a substantial adverse effect on the guarantees provided by the applicable data protection law and the standard contractual clauses;


Before the Court, Mr Schrems claims that the ‘privacy shield’ decision is invalid on the ground that the safeguards thus described are not sufficient to ensure an adequate level of protection of the fundamental rights of persons whose data are transferred to the United States. The DPC, the EPIC and the Austrian, Polish and Portuguese Governments, without directly calling into question the validity of that decision, dispute the assessments made by the Commission in that decision concerning the adequacy of the level of protection against the interferences resulting from the activities of the United States intelligence services. Those doubts convey the concerns expressed by the Parliament,   the EDPB   and the European <mask> Supervisor.


See Article 29 Working Party on <mask> (‘WP29’), Opinion 1/2016 on the EU-U.S. Privacy Shield draft adequacy decision, 13 April 2016, WP 238; WP29, EU-US Privacy Shield — First Annual Joint Review, 28 November 2017, WP 255, and EDPB, EU-US Privacy Shield — Second Annual Joint Review, 22 January 2019. WP29 had been set up pursuant to Article 29(1) of Directive 95/46, which provided that it was to have advisory status and to act independently. In accordance with paragraph 2 of that article, that working party was composed of a representative of each national supervisory authority, a representative of each authority established for the Community institutions and bodies and a representative of the Commission. Since the entry into force of the GDPR, the Article 29 Working Party has been replaced by the EDPB (see Article 94(2) of that regulation).


What should then perhaps be required, at a minimum, is a change, alteration, manipulation, or any other processing in the sense of ‘added value’ to, or ‘fair use’ of, the personal data at issue. Alternatively, or in connection, a finer emphasis should be placed on the concept of automated means that would exclude all other forms of mere disclosure by non-automated means, whether that be orally or by a mere inspection of a written document. The addition of such, or any other similar, threshold test could thus help refocus the <mask> rules on activities that were supposed to be caught in the first place,   while leaving aside those accidental, incidental, or minimal uses of personal data that would otherwise incur the full wrath and force of the GDPR’s rights and obligations.


The order for reference does not indicate whether the Saeima, prior to the adoption of the provision at issue, considered other means of achieving the objective of promoting road safety which would have led to less interference with the right of individuals to <mask>. Furthermore, the legislature must be able to demonstrate that the derogations and limitations to data protection would be in strict compliance with the limits imposed. A careful assessment of the impact on data protection should be carried out before publishing a data set (or before adopting a law requiring its publication), including an assessment of the possibilities for re-use and the potential impact of re-use.


A point that would later be made by the much-missed Advocate General Bot in his Opinion in Ireland v Parliament and Council (C‑301/06, EU:C:2008:558). He stated that the judgment in Parliament v Council and Commission‘does not mean that only the examination of the objective pursued by the processing of personal data is relevant for the purpose of including or excluding such processing from the scope of the system of <mask> instituted by Directive 95/46. It is also necessary to ascertain in the course of which type of activity data processing is carried out. It is only where it is undertaken in course of activities specific to States or to State authorities and unrelated to the fields of activity of individuals that it is excluded from the Community system of personal data protection arising from Directive 95/46 pursuant to the first indent of Article 3(2) thereof’ (point 122).


As regards the interpretation of Article 6(1)(f) of Regulation 2016/679, it lays down three cumulative conditions in order for the processing of personal data to be lawful, namely, first, the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the fundamental rights and freedoms of the person concerned by the <mask> do not take precedence.


‘Mutatis mutandis, a Commission decision adopted pursuant to Article 26(4) of Directive [95/46] is binding on all organs of the Member States to which it is addressed, including their independent supervisory authorities, in so far as it has the effect of recognising that transfers taking place on the basis of standard contractual clauses set out therein offer sufficient safeguards as required by Article 26(2) of that Directive. This does not prevent a national supervisory authority from exercising its powers to oversee data flows, including the power to suspend or ban a transfer of personal data when it determines that the transfer is carried out in violation of EU or national <mask> law, such as, for instance, when the data importer does not respect the standard contractual clauses.’


In particular, as is clear from the wording of the seventh question and the corresponding explanations in the request for a preliminary ruling, the referring court asks whether the SCC Decision is capable of ensuring an adequate level of protection of the personal data transferred to third countries given that the standard <mask> clauses provided for in that decision do not bind the supervisory authorities of those third countries.


By its ninth question, the referring court wishes to know, in essence, whether and to what extent findings in the Privacy Shield Decision to the effect that the United States ensures an adequate level of protection are binding on the supervisory authority of a Member State. By its 4th, 5th and 10th questions, that court asks, in essence, whether, in view of its own findings on US law, the transfer to that third country of personal data pursuant to the standard <mask> clauses in the annex to the SCC Decision breaches the rights enshrined in Articles 7, 8 and 47 of the Charter and asks the Court, in particular, whether the introduction of the ombudsperson referred to in Annex III to the Privacy Shield Decision is compatible with Article 47 of the Charter.


In that regard, it is apparent from the information set out in that request that, although those contracts contain a clause stating that the customers concerned have been informed of, and have given their consent to, the storage of a copy of their identity document for identification purposes, the box relating to that clause had already been ticked by Orange România’s sales agents before those customers signed in acceptance of all the clauses, that is to say, both of that clause and of clauses not linked to <mask>. The request further states that although not specified in the contracts at issue in the main proceedings, Orange România agreed to conclude those contracts with customers who refused to consent to a copy of their identity document being stored, and at the same time required in that case that those customers sign a specific form setting out their refusal.


In the absence of common personal <mask> safeguards at global level, cross-border flows of such data entail a risk of a breach in continuity of the level of protection guaranteed in the European Union. Desirous of facilitating those flows while limiting that risk, the EU legislature has established three mechanisms whereby personal data may be transferred from the European Union to a third State.


In addition, a recipient of personal data established in a third country undertakes, pursuant to Clause 5(a), to inform the controller established in the European Union promptly of any inability to comply with its obligations under the contract concluded. In particular, according to Clause 5(b), the recipient certifies that it has no reason to believe that the legislation applicable to it prevents it from fulfilling its obligations under the contract entered into and undertakes to notify the data controller about any change in the national legislation applicable to it which is likely to have a substantial adverse effect on the warranties and obligations provided by the standard <mask> clauses in the annex to the SCC Decision, promptly upon notice thereof. Furthermore, although Clause 5(d)(i) allows a recipient of personal data not to notify a controller established in the European Union of a legally binding request for disclosure of the personal data by a law enforcement authority, in the event of legislation prohibiting that recipient from doing so, such as a prohibition under criminal law the aim of which is to preserve the confidentiality of a law enforcement investigation, the recipient is nevertheless required, pursuant to Clause 5(a) in the annex to the SCC Decision, to inform the controller of his or her inability to comply with the standard data protection clauses.


On the one hand, as regards infringements by controllers or processors of the <mask> rules that took place prior to the date in which the GDPR became applicable, I believe that those proceedings may continue. I cannot see any good reason to force the authorities to terminate enforcement actions which relate to past conduct that was (allegedly) unlawful when committed, and against which they were (at the time) competent to take action. A different solution would lead to a sort of amnesty with regard to certain breaches of data protection laws.


‘Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.’ See Position (EU) No 6/2016 of the Council at first reading with a view to the adoption of a Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General <mask> Regulation), adopted by the Council on 8 April 2016 (OJ 2016 C 159, p. 1), at p. 36.


If a third country data importer is subject to surveillance laws that in the view of a [supervisory authority] conflict with [the standard contractual clauses] or Article 25 and 26 of Directive [95/46] and/or the Charter, is a <mask> authority required to use its enforcement powers under Article 28(3) of the Directive to suspend data flows or is the exercise of those powers limited to exceptional cases only, in light of recital 11 of [Decision 2010/87], or can a [supervisory authority] use its discretion not to suspend data flows?


It follows from those provisions that the supervisory authorities’ primary responsibility is to monitor the application of the GDPR and to ensure its enforcement. The exercise of that responsibility is of particular importance where personal data is transferred to a third country since, as is clear from recital 116 of that regulation, ‘when personal data moves across borders outside the Union it may put at increased risk the ability of natural persons to exercise <mask> rights in particular to protect themselves from the unlawful use or disclosure of that information’. In such cases, as is stated in that recital, ‘supervisory authorities may find that they are unable to pursue complaints or conduct investigations relating to the activities outside their borders’.


1. The present request for a preliminary ruling from the Hof van beroep te Brussel (Court of Appeal, Brussels, Belgium) arises out of a request by a person who subscribes to a telecommunications service that his contact details no longer appear in public electronic telephone directories or be available from directory enquiry services. It raises important issues as to the interpretation of Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General <mask> Regulation), (2) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (3) and the relationship between those two acts.


the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, <mask> rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred;


On this issue, see generally Giurgiu, A. and Larsen, T., ‘Roles and Powers of National <mask> Authorities – Moving from Directive 95/46/EC to the GDPR: Stronger and More “European” DPAs as Guardians of Consistency?’European Data Protection Law Review, 2016, pp. 342-352, at 349; and Voigt, P., von dem Bussche, A., The EU General Data Protection Regulation (GDPR) – A Practical Guide, Springer, 2017, pp. 190-192.


Following that judgment, the referring court annulled the rejection of Mr Schrems’s complaint and referred that decision back to the Commissioner. In the course of the Commissioner’s investigation, Facebook Ireland explained that a large part of personal data was transferred to Facebook Inc. pursuant to the standard <mask> clauses set out in the annex to the SCC Decision. On that basis, the Commissioner asked Mr Schrems to reformulate his complaint.


88. This approach, however, presents a number of difficulties: – It would probably not be enough to identify a group of potential aggressors if the latter use anonymisation techniques or falsify their identities. Choosing such groups could also have the effect of creating a climate of general suspicion in relation to certain segments of the population and might be considered discriminatory, depending on the algorithm used. – Selection by geographical criteria (which, to be effective, would involve targeting areas of a not insignificant size) raises the same problems and creates yet more, as the European <mask> Supervisor indicated at the hearing, in that it could stigmatise certain areas.


Pursuant to Article 3 of the Wet van 3 december 2017 tot oprichting van de Gegevensbeschermingsautoriteit (Law of 3 December 2017 establishing the Belgian <mask> Authority; ‘the DPA Law’), which entered into force on 25 May 2018, a Data Protection Authority (‘the DPA’) was established to succeed the Privacy Commission. In accordance with Article 6 of that law, the DPA ‘has the power to bring any infringement of the fundamental principles of personal data protection, within the framework of this law and laws containing provisions on the protection of the processing of personal data, to the attention of the judicial authorities and, where appropriate, to take legal action to have these fundamental principles applied’.


The aim of the rule laid down in point (j) is — I assume — to permit the EU or national legislature to decide that, in the context of proceedings for the enforcement of civil law claims, the specific rules on discovery prevail, in case of conflict, over the general rules stemming from <mask>. Indeed, most jurisdictions provide for special regimes of discovery in the context of judicial procedures, including civil law procedures. However, Member States’ regimes vary significantly. Given the importance of such regimes, it is possible to assume that the EU legislature could decide that their application should not be affected by the rules on data protection. Logically, that must be so, irrespective of whether the parties are subjects of private or public law, and regardless of the private or public interest on which their action or defence is based.


‘Without prejudice to the law on the protection of industrial and commercial property, medicinal products for human use which have been authorised in accordance with the provisions of this Regulation shall benefit from an eight-year period of <mask> and a ten-year period of marketing protection, in which connection the latter period shall be extended to a maximum of 11 years if, during the first eight years of those ten years, the marketing authorisation holders obtains an authorisation for one or more new therapeutic indications which, during the scientific evaluation prior to their authorisation, are held to bring a significant clinical benefit in comparison with existing therapies.’


As mentioned in points 76 and 77 above, the GDPR is built on a delicate equilibrium between the need to ensure a high level of protection of natural persons and the need to remove the obstacles to flows of personal data within the Union. Those two objectives are, as evidenced in particular by recital 10 and Article 1(1) of the GDPR, inextricably linked. National supervisory authorities must therefore ensure a fair balance between them, as the Court has consistently emphasised from its first judgments in the field of <mask>.   Article 51(1) of the GDPR, in defining the supervisory authorities’ mission, reflects that approach.


The limits of the system set up under Directive 95/46 also became evident in a number of judgments of the Court. In Weltimmo, the Court held that the powers of <mask> authorities were strictly limited by the principle of territoriality: those authorities could act against breaches taking place only within their own territory, having in all other cases to ask the authorities of the other Member States to intervene.   In Wirtschaftsakademie Schleswig-Holstein, the Court ruled that, in the case of cross-border processing, each data protection authority could exercise its powers with respect to an entity established in its territory, independently of the views and actions of the data protection authority of the Member State where the entity responsible for that processing has its seat.


A person established within the Union who manufactures or imports a relevant substance, on its own or in biocidal products … or who manufactures or makes available on the market a biocidal product consisting of, containing or generating that relevant substance …, may at any time submit to the Agency either a complete substance dossier for that relevant substance, a letter of access to a complete substance dossier, or a reference to a complete substance dossier for which all <mask> periods have expired. …


The latter aspect should be emphasised. Under Directive 95/46, economic operators active throughout the European Union were required to comply with the various sets of national rules implementing the directive, and to liaise, at the same time, with all the national <mask> authorities. That situation was not only costly, burdensome and time-consuming for the economic operators, but also an inevitable source of uncertainty and conflicts for those operators and their customers.


The provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General <mask> Regulation) permit the supervisory authority of a Member State to bring proceedings before a court of that State for an alleged infringement of that regulation with respect to cross-border data processing, despite not being the lead supervisory authority, provided that it does so in the situations and according to the procedures set out in the same regulation;


Article 55(1), Articles 56 to 58 and Articles 60 to 66 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General <mask> Regulation), read together with Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that a supervisory authority of a Member State which, under the national legislation adopted in order to transpose Article 58(5) of that regulation, has the power to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where necessary, to initiate or engage in legal proceedings, may exercise that power in relation to an instance of cross‑border data processing even though it is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, with respect to that data processing, provided that that power is exercised in one of the situations where Regulation 2016/679 confers on that supervisory authority a competence to adopt a decision finding that such processing is in breach of the rules contained in that regulation and that the cooperation and consistency procedures laid down by that regulation are respected.


However, it should be noted that, in the judgment of 28 June 2017, Novartis Europharm v Commission (C‑629/15 P and C‑630/15 P, EU:C:2017:498), the Court of Justice gave no indication to the effect proposed by Advocate General Bobek. Furthermore, in the case which gave rise to that Opinion, the Court of Justice was not asked to rule on whether a marketing authorisation granted at EU level for a component of a combination medicinal product previously authorised by a national authority was covered by the same global authorisation as the combination at issue. Furthermore, it must be pointed out that, as is apparent from paragraphs 150 to 282 above, an approach based solely on a difference in active substances presented the risk, in the present case, of regulatory <mask> being granted contrary to the objectives pursued by the concept of a global marketing authorisation.


77 In the third place, it is still necessary to ascertain, as requested by the referring court, whether Article 80(2) of the GDPR precludes the bringing of a representative action independently of a specific infringement of a right of a data subject and of a mandate conferred by that data subject, where infringement of <mask> rules has been alleged in the context of an action seeking to review the application of other legal rules intended to ensure consumer protection.


See European <mask> Supervisor, Opinion 4/2016 of 30 May 2016 on the ‘EU-US Privacy Shield draft adequacy decision’. The European Data Protection Supervisor was established by Article 1(2) of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1). He monitors the application of the provisions of that regulation.


In that regard, the Court observes that the European <mask> Board, in its Opinion 5/2019 of 12 March 2019 on the interplay between the [Directive on privacy and electronic communications] and the [General Data Protection Regulation], in particular regarding the competence, tasks and powers of data protection authorities, stated that storing and obtaining access to personal data by means of cookies fell within the scope of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37), and not within the scope of the ‘one-stop shop’ mechanism. On the other hand, all earlier processing operations, and all subsequent processing activities, with respect to that personal data, by means of other technologies, do fall within the scope of Regulation 2016/679, and consequently within the scope of the ‘one‑stop shop’ mechanism. Given that its request for mutual assistance concerned subsequent personal data processing operations, the DPA in April 2019 asked the Data Protection Commissioner (Ireland) to respond to its request as expeditiously as possible, but no response was provided.


On 10 August 2015, OLAF provided the applicant with the information requested, except for the information which was subject to strict confidentiality and personal <mask> rules and which included its investigation report. OLAF thus specified the facts at issue, the period and the projects to which those facts related (namely the grant agreements at issue, the SAPHYRE project and the ONEFIT project), as well as the recommendations addressed to the competent directorate-general concerning the recovery of the amount concerned.


In that respect, Article 46(1) of the GDPR provides that the controller or processor may, in the absence of an adequacy decision, transfer personal data to a third country ‘only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available’ (emphasis added).   In the words of Article 46(2)(c) of the GDPR, those safeguards may be provided by standard <mask> clauses drawn up by the Commission.


The [EMA] shall ensure that healthcare professionals and the public have appropriate levels of access to the Eudravigilance database, while guaranteeing personal <mask>. The [EMA] shall work together with all stakeholders, including research institutions, healthcare professionals, and patient and consumer organisations, in order to define the “appropriate level of access” for healthcare professionals and the public to the Eudravigilance database.


The second exception is in Article 66 of Regulation 2016/679, which provides, by way of derogation from the consistency mechanisms referred to in Articles 60 and Article 63 to 65 of that regulation, for an urgency procedure. That urgency procedure makes it possible, in exceptional circumstances, where the supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, immediately to adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which is not to exceed three months, while Article 66(2) of Regulation 2016/679 further provides that, where a supervisory authority has taken a measure under Article 66(1) and considers that final measures must urgently be adopted, it may request an urgent opinion or an urgent binding decision from the European <mask> Board, giving reasons for requesting such an opinion or decision.


It follows that Clause 4(a) and Clause 5(a) and (b) in that annex oblige the controller established in the European Union and the recipient of personal data to satisfy themselves that the legislation of the third country of destination enables the recipient to comply with the standard <mask> clauses in the annex to the SCC Decision, before transferring personal data to that third country. As regards that verification, the footnote to Clause 5 states that mandatory requirements of that legislation which do not go beyond what is necessary in a democratic society to safeguard, inter alia, national security, defence and public security are not in contradiction with those standard data protection clauses. Conversely, as stated by the Advocate General in point 131 of his Opinion, compliance with an obligation prescribed by the law of the third country of destination which goes beyond what is necessary for those purposes must be treated as a breach of those clauses. Operators’ assessments of the necessity of such an obligation must, where relevant, take into account a finding that the level of protection ensured by the third country in a Commission adequacy decision, adopted under Article 45(3) of the GDPR, is appropriate.


In the preamble of the GDPR, it is noted, inter alia, that: ‘the objectives and principles of Directive 95/46/EC remain sound, but it has not prevented fragmentation in the implementation of <mask> across the Union [and] legal uncertainty’ (recital 9); a consistent and homogenous application of the data protection rules should be ensured throughout the Union (recital 10); the supervisory authorities should monitor the application of the rules and contribute to its consistent application, in order to protect natural persons and to facilitate the free flow of personal data within the internal market (recital 123); in situations involving cross-border processing ‘the supervisory authority for the main establishment of the controller or processor or for the single establishment of the controller or processor should act as lead authority’ and that authority has to ‘cooperate with the other authorities concerned’ (recital 124).


“recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable <mask> rules according to the purposes of the processing;


Therefore, the answer to the second, third and sixth questions is that Article 46(1) and Article 46(2)(c) of the GDPR must be interpreted as meaning that the appropriate safeguards, enforceable rights and effective legal remedies required by those provisions must ensure that data subjects whose personal data are transferred to a third country pursuant to standard <mask> clauses are afforded a level of protection essentially equivalent to that guaranteed within the European Union by that regulation, read in the light of the Charter. To that end, the assessment of the level of protection afforded in the context of such a transfer must, in particular, take into consideration both the contractual clauses agreed between the controller or processor established in the European Union and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the personal data transferred, the relevant aspects of the legal system of that third country, in particular those set out, in a non-exhaustive manner, in Article 45(2) of that regulation.


3 Recitals 9, 10, 13 and 142 of the GDPR state: ‘(9) The objectives and principles of Directive [95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31)] remain sound, but it has not prevented fragmentation in the implementation of <mask> across the Union, legal uncertainty or a widespread public perception that there are significant risks to the protection of natural persons, in particular with regard to online activity. Differences in the level of protection of the rights and freedoms of natural persons, in particular the right to the protection of personal data, with regard to the processing of personal data in the Member States may prevent the free flow of personal data throughout the Union. Those differences may therefore constitute an obstacle to the pursuit of economic activities at the level of the Union, distort competition and impede authorities in the discharge of their responsibilities under Union law. Such a difference in levels of protection is due to the existence of differences in the implementation and application of Directive [95/46]. (10) In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union. … … (13) In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a Regulation is necessary to provide legal certainty and transparency for economic operators, including micro, small and medium-sized enterprises, and to provide natural persons in all Member States with the same level of legally enforceable rights and obligations and responsibilities for controllers and processors, to ensure consistent monitoring of the processing of personal data, and equivalent sanctions in all Member States as well as effective cooperation between the supervisory authorities of different Member States. … … (142) Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest and is active in the field of the protection of personal data to lodge a complaint on his or her behalf with a supervisory authority, exercise the right to a judicial remedy on behalf of data subjects or, if provided for in Member State law, exercise the right to receive compensation on behalf of data subjects. A Member State may provide for such a body, organisation or association to have the right to lodge a complaint in that Member State, independently of a data subject’s mandate, and the right to an effective judicial remedy where it has reasons to consider that the rights of a data subject have been infringed as a result of the processing of personal data which infringes this Regulation. That body, organisation or association may not be allowed to claim compensation on a data subject’s behalf independently of the data subject’s mandate.’


With regard to the TRIPs Agreement, the Court has ruled, that, while it is not directly applicable, in the areas governed by the TRIPs Agreement, the Union rules must nonetheless be interpreted in a manner consistent with the TRIPs Agreement in so far as it is possible to do so.   Taking into account the fact that Article 39(3) of the TRIPs Agreement requires the protection of data against disclosure, then, if no effective steps are otherwise taken to ensure the protection of the data against unfair commercial use, the question arises whether the <mask> conferred by Article 39(10) of Regulation No 726/2004 in conjunction with Article 13 of Directive 2001/82 confers such effective protection.


Accordingly, I believe that the DPA and certain governments misinterpret Article 55 and Article 56(1) of the GDPR. Those interveners take the first part of the sentence in Article 56(1) out of its context, in order to reverse the relationship between the rule and the exception. To do so results in watering down the prescriptive content of several provisions of the GDPR, and frustrates the objective, emphasised inter alia in recital 10 thereof, of ensuring a more consistent and homogenous application of the <mask> rules. It would essentially amount to a return to the previous regime of Directive 95/46.


If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard <mask> clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.


That would, in turn, also render meaningless one of the main functions of the Board – a body established by the GDPR – composed of the head of one supervisory authority of each Member State and of the European <mask> Supervisor.   One of the Board’s task is precisely that of monitoring and ensuring the correct application of the GDPR where disagreement between different supervisory authorities arises.   In those cases, the Board acts as a dispute settlement forum and decision-making body. Were the interpretation defended by the DPA and some governments to be followed, the mechanism set out in Article 65 of the GDPR could be entirely sidelined: each authority could go its own way, bypassing the Board.


The challenges posed to EU law by the extraterritoriality of certain legislation should also be raised with acuteness in the forthcoming years in an area dear to the Court, namely that of personal <mask>. Indeed, the US Clarifying Lawful Overseas Use of Data Act 2018, which amended the 1986 Stored Communications Act, gives American law-enforcement authorities the power to request data stored by most major cloud providers, even if stored outside the United States. However, the data-storage market is largely dominated by US companies, at more than 85%.


By contrast, in the case of a Commission decision adopting standard <mask> clauses, such as the SCC Decision, in so far as such a decision does not refer to a third country, a territory or one or more specific sectors in a third country, it cannot be inferred from Article 46(1) and Article 46(2)(c) of the GDPR that the Commission is required, before adopting such a decision, to assess the adequacy of the level of protection ensured by the third countries to which personal data could be transferred pursuant to such clauses.


Which may have been one of the motives why, for reasons of ‘commonsense and justice alike’, the Court of Appeal (England & Wales) (United Kingdom) held that the act of anonymising personal data does not itself qualify as ‘processing’ under the UK <mask> Act 1998. See judgment of 21 December 1999 in Regina v Department of Health, Ex Parte Source Informatics Ltd [1999] EWCA Civ 3011 at [45].


Mr Schrems brought an action against the decision rejecting his complaint before the High Court, which considered that, although Mr Schrems had not formally contested the validity of the ‘safe harbour’ decision, his complaint impugned, in reality, the legality of the regime established by that decision. In those circumstances, the High Court referred a number of questions to the Court, seeking, in essence, to ascertain whether the authorities of the Member States responsible for <mask> (the ‘supervisory authorities’), when dealing with a complaint concerning the protection of the rights and freedoms of a person in regard to the processing of personal data relating to him which have been transferred to a third State, are bound by the findings as to the adequacy of the level of protection afforded by that third State made by the Commission pursuant to Article 25(6) of Directive 95/46, when the complainant disputes those findings.


This makes the present case an almost classic <mask> case in the sense that it is predominantly set in the offline-world and involves a vertical relationship between a State and an individual, placing it seamlessly within a line of cases which have reached the Court since the seminal Stauder judgment,   arguably the first case on data protection au sens large.


Since by their inherently contractual nature standard <mask> clauses cannot bind the public authorities of third countries, as is clear from paragraph 125 above, but that Article 44, Article 46(1) and Article 46(2)(c) of the GDPR, interpreted in the light of Articles 7, 8 and 47 of the Charter, require that the level of protection of natural persons guaranteed by that regulation is not undermined, it may prove necessary to supplement the guarantees contained in those standard data protection clauses. In that regard, recital 109 of the regulation states that ‘the possibility for the controller … to use standard data-protection clauses adopted by the Commission … should [not] prevent [it] … from adding other clauses or additional safeguards’ and states, in particular, that the controller ‘should be encouraged to provide additional safeguards … that supplement standard [data] protection clauses’.


Third, there is the scenario of parallel or subsequent administrative proceedings in different Member States, where the criminal nature of those proceedings is established on the basis of the Engel criteria. Those situations may arise within one and the same regulatory regime within the European Union (such as competition, <mask>, and so on), but may also arise with regard to the same facts which are pursued under different regulatory frameworks by different authorities.   It will be in such situations, in particular, that the issue of identity of the protected legal interest is bound to arise. On the other hand, such situations are, in practical terms, frequently likely to fall short of the identity of the facts in view of the territoriality of the offence, as explained for instance in the context of competition law by Advocate General Kokott in her Opinion in Toshiba   and developed further in my Opinion in the parallel case of Nordzucker.


With the two notable exceptions in Articles 26 and 28 of the GDPR mentioned in the previous footnote, or, for instance, Article 19 of the GDPR. However, also with regard to those provisions, the regulatory inclusion of these categories could still be considered as one of <mask>, essentially ensuring that the controller cannot abdicate responsibility and escape liability either by sharing the data, or by outsourcing its processing.


That impression is confirmed by the order for reference. The referring court states that if Interpol, in a situation such as that at issue in the main proceedings, does not ensure that the personal data contained in a red notice are duly erased or corrected, because of the applicability of the principle ne bis in idem, doubts may arise regarding the adequacy of Interpol’s <mask> rules under Directive 2016/680. That would ultimately lead to the question – in the view of the referring court – of whether Member States should refrain from cooperating with Interpol.


Article 65(1)(a) of the GDPR, that article being entitled ‘Dispute resolution by the Board’, provides that, in order to ensure the correct and consistent application of the regulation in individual cases, the European <mask> Board (‘the Board’) is to adopt a binding decision in, inter alia, the cases where a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead authority or where the lead authority has rejected such an objection as being not relevant or reasoned.


Ireland claims further that, if the EU legislature had wanted the investigative body to be independent of all public bodies or any possible influence, as the Commission maintains, it could have expressed that condition, as was done in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281 p. 31) and in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General <mask> Regulation) (OJ 2016 L 119, p. 1).


8 For the purposes of implementing Regulation 2016/679, the Kingdom of the Netherlands adopted the wet houdende regels ter uitvoering van Verordening (EU) 2016/679 van het Europees Parlement en de Raad van 27 april 2016 betreffende de bescherming van natuurlijke personen in verband met de verwerking van persoonsgegevens en betreffende het vrije verkeer van die gegevens en tot intrekking van Richtlijn 95/46/EG (algemene verordening gegevensbescherming) (PbEU 2016, L 119) (Uitvoeringswet Algemene verordening gegevensbescherming) (Law laying down the rules for the implementation of Regulation 2016/679 (Law implementing the General <mask> Regulation)) of 16 May 2018 (Stb. 2018, No 144). Article 6 of that law entrusts the AP with the task of supervising compliance with Regulation 2016/679 in the Netherlands. None of the provisions of that law reproduces the exception provided for in Article 55(3) of Regulation 2016/679.


‘Without prejudice to the law on the protection of industrial and commercial property, medicinal products for human use which have been authorised in accordance with the provisions of this Regulation shall benefit from an eight-year period of <mask> and a 10-year period of marketing protection, in which connection the latter period shall be extended to a maximum of 11 years if, during the first eight years of those 10 years, the marketing authorisation holder obtains an authorisation for one or more new therapeutic indications which, during the scientific evaluation prior to their authorisation, are held to bring a significant clinical benefit in comparison with existing therapies.’


By its eighth question, the referring court wishes to know, in essence, whether Article 58(2)(f) and (j) of the GDPR must be interpreted as meaning that the competent supervisory authority is required to suspend or prohibit a transfer of personal data to a third country pursuant to standard <mask> clauses adopted by the Commission, if, in the view of that supervisory authority, those clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law, in particular by Articles 45 and 46 of the GDPR and by the Charter, cannot be ensured, or as meaning that the exercise of those powers is limited to exceptional cases.


42. For the sake of completeness, it should be pointed out that, where the conditions laid down by it are met, Article 49(3) of Decision 2007/533 by no means gives the competent authorities of the requested Member State the option to refuse to execute the action requested based on the alert. That provision in fact states that, if the requested Member State has evidence suggesting that an item of data is factually incorrect or has been unlawfully stored, that State must, through the exchange of supplementary information, inform the Member State that issued the alert thereof at the earliest opportunity (and not later than 10 days after the said evidence has come to its attention) and, in the event of disagreement with the latter State, the requested Member State must submit the matter to the European <mask> Supervisor (EDPS) so that that body can act as mediator, jointly with the national supervisory authorities. In other words, the competent authorities of the requested Member State are required simply to inform the Member State that issued the alert that the data are incorrect or have been unlawfully stored, with the latter State remaining ultimately responsible for the correction or deletion of those data.


III. For the purposes of investigating, detecting and prosecuting criminal offences or a failure to fulfil an obligation laid down in Article L. 336‑3 of the Code de la propriété intellectuelle (Intellectual Property Code) or for the purposes of preventing breaches of automated data processing systems as provided for and punishable under Articles 323‑1 to 323‑3‑1 of the Criminal Code, and for the sole purpose of making information available, as necessary, to the judicial authority or high authority mentioned in Article L. 331‑12 of the Intellectual Property Code or to the national authority for the security of information systems mentioned in Article L. 2321‑1 of the Code de la défense (Defence Code), operations designed to erase or render anonymous certain categories of technical data may be deferred for a maximum period of one year. A decree adopted in the Conseil d’État (Council of State, France) following consultation of the Commission nationale de l’informatique et des libertés (French <mask> Authority) shall, within the limits laid down in point VI, determine the categories of data involved and the period for which they are to be retained, depending on the business of the operators, the nature of the communications and the methods of offsetting any identifiable and specific additional costs associated with the services provided for these purposes by operators at the request of the State.


It is true that, based on its wording, Article 8 of the Charter (‘person’, ‘personal data’) would be applicable here. According to the case-law of the Court, however, in line with the wording of the secondary legislation on <mask>,   only natural persons fall, in principle, within the scope of the fundamental right to data protection under Article 8 of the Charter. Legal persons, on the other hand, should be able to claim the protection of ‘personal data’ under Article 8 of the Charter only in so far as their official title identifies a natural person.   The question of whether this is the case here can be left open, as companies may be able to rely on a right under Article 7 of the Charter.


At the times relevant to this investigation, all disclosure requests had to be approved in the first instance by a superintendent (or an inspector acting in that capacity) and were then sent to be processed by the TLU. Investigators were directed to include sufficient detail in the request to enable an informed decision to be made, and to bear in mind that the chief superintendent might have to justify the decision later in court or to the designated High Court judge. The TLU and the detective chief superintendent are required to verify the legality, proportionality and necessity of disclosure requests sought by members of An Garda Siochana. Applications deemed not to comply with the requirements of the law or of internal garda protocols were returned for clarification or additional information. Under a Memorandum of Understanding issued in May 2011, service providers would not process requests for call related data that did not come through this process. The TLU is also subject to audit by the <mask> Commissioner.’


Article 55(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General <mask> Regulation) must be interpreted to mean that the practice of the disclosure of procedural documents to a journalist for the purpose of better covering a public hearing is carried out by courts ‘acting in their judicial capacity’.


In line with the fundamental values on which the Union is founded, in particular the protection of human rights, the Commission should, in its assessment of the third country, or of a territory or specified sector within a third country, take into account how a particular third country respects the rule of law, access to justice as well as international human rights norms and standards and its general and sectoral law, including legislation concerning public security, defence and national security as well as public order and criminal law. The adoption of an adequacy decision with regard to a territory or a specified sector in a third country should take into account clear and objective criteria, such as specific processing activities and the scope of applicable legal standards and legislation in force in the third country. The third country should offer guarantees ensuring an adequate level of protection essentially equivalent to that ensured within the Union, in particular where personal data are processed in one or several specific sectors. In particular, the third country should ensure effective independent <mask> supervision and should provide for cooperation mechanisms with the Member States’ data protection authorities, and the data subjects should be provided with effective and enforceable rights and effective administrative and judicial redress.


59. That provision, under the heading ‘Data protection’ and in connection once again with the ‘processing of personal data’: – reaffirms the right, and at the same time the duty, of competent authorities to carry out ‘their tasks for the purposes of this Regulation in accordance with the national laws, regulations or administrative provisions transposing Directive 95/46/EC’; – does not mention the obligation to retain data (24) imposed on electronic communications undertakings, but simply makes a reference to Directive 95/46 (25) when it comes to <mask>.


A data subject intending to enter into a contractual relationship for the provision of telecommunication services with an undertaking does not give his or her ‘consent’, that is, does not indicate his or her ‘specific and informed’ and ‘freely given’ wishes, within the meaning of Article 2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and of Article 4(11) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General <mask> Regulation), to that undertaking when he or she is required to state, in handwriting, on an otherwise standardised contract, that he or she refuses to consent to the photocopying and storage of his or her ID documents.


34. That court emphasises that the Federation’s submissions relate only to the abstract supervision of the presentation of the App Centre by Facebook Ireland in the light of the law on <mask> and that the Federation has not claimed that there has been an infringement of the rights of an identified or identifiable natural person, within the meaning of Article 4(1) of Regulation 2016/679.


That said, I do not think that analogies with the Court’s case-law on the field of application of the Charter should be drawn.   That would be too restrictive and would be counter to the objective pursued by Article 16 TFEU and by the GDPR. Indeed, the logic of the Charter is wholly different from that of the GDPR: the Charter seeks to domesticate the exercise of power by the EU institutions and Member States when they operate within the scope of EU law and, conversely, provide a shield for individuals to assert their respective rights. By contrast, the protection of personal data is more than a fundamental right. As is demonstrated by Article 16 TFEU,   <mask> constitutes an EU policy field in its own right. The very purpose of the GDPR is that it is to apply to any form of processing of personal data, regardless of the subject matter involved – and this, incidentally, whether carried out by Member States or individuals. Interpreting the terms of Article 2(2)(a) of the GDPR restrictively would completely frustrate that objective. The GDPR, which was intended to be a tiger for data protection, would turn out to be a domestic kitten.


Article 2(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General <mask> Regulation), must be interpreted as meaning that that regulation applies to the transfer of personal data for commercial purposes by an economic operator established in a Member State to another economic operator established in a third country, irrespective of whether, at the time of that transfer or thereafter, that data is liable to be processed by the authorities of the third country in question for the purposes of public security, defence and State security.


In the second place, I fear, however, that matters are less clear for Uploaded. In that regard, on the one hand, I do not concur with Elsevier that the fact that an operator allows users of its platform to upload files ‘anonymously’ there shows its intention to facilitate infringements. It is clear from the documents before the Court that in order to upload a file to Uploaded it is necessary to create an account, providing a first name, surname and email address. Elsevier thus criticises the fact that Cyando does not check the accuracy of the information provided by the user by means of an identity verification or authentication system. Although the possibility for anyone to use the internet and online services without an identity check can indeed be misused by ill-intentioned individuals for wrongful activities, I consider that that possibility is, however, protected, above all, by such fundamental norms as the right to privacy, freedom of expression and conscience and <mask>, particularly in EU law   and international law.   Identity verification or authentication systems thus may be used, in my view, only for specific services in certain circumstances laid down in law.


See European Commission, First report on the implementation of the <mask> Directive (95/46/EC) of 15 May 2003, COM(2003) 265 final, pp. 12 and 13, and its Annex ‘Analysis and impact study on the implementation of Directive EC 95/46 in Member States’, p. 40. See also European Union Agency for Fundamental Rights, Access to data protection remedies in EU Member States – Report, 2012, especially pp. 20 to 22.


that after assessment of the requirements of the applicable <mask> law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;


Similar concepts are to be found in Regulation (EU) 2016/679.   That regulation contains a number of exclusions from its scope or states that data processing is lawful with regard to ‘courts acting in a judicial capacity’. Thus, the processing of certain categories of personal data, including sensitive data, is permissible where ‘processing is necessary … whenever courts are acting in their judicial capacity’ (Article 9(2)(f) thereof). Similarly, a <mask> officer must be designated in all cases where processing is carried out by a public authority or body, ‘except for courts acting in their judicial capacity’ (Article 37(1)(a) thereof). In the same way, supervisory authorities entrusted with monitoring the application of Regulation 2016/679 are not competent to supervise processing operations of ‘courts acting in their judicial capacity’ (Article 55(3) of that regulation). These examples clearly suggest that the same activities would fall within the scope of that regulation if carried out in an ‘administrative capacity’.


As illustrated by the foregoing case of Commission v Hungary,   involving the retirement age of judges, along with Fuchs and Köhler, the Court has deemed legitimate certain objectives relating to the alignment of retirement age within the specific framework set out in Directive 2000/78 in respect of the prohibition on discrimination on the basis of age. However, in Commission v Hungary,   involving the pre-term removal of the <mask> supervisor, the Court did not allow such objectives to diminish the independence of national supervisory authorities under EU law. That reasoning is just as compelling in the case of the independence of judges. It may also be inferred from the Court’s consideration of judicial independence as ‘essential’ to effective judicial protection under the second subparagraph of Article 19(1) TEU.


In that regard, it should be observed that the applicant does not appear to be relying on rights relating to the protection of personal data and that she does not take issue with Facebook Ireland for having ‘carried out’ an illegal processing of her data, as her claim is based on the general provisions of civil law. Nor does the referring court rely on the legal instruments of EU law relevant to <mask>. It relies only on Directive 2000/31. However, it follows from Article 1(5)(b) thereof that that directive is not to apply to questions relating to information society services covered by the directives concerning the protection of personal data.


With respect to Article 3(2) of Directive 95/46, the Court has consistently held as much, see judgment of 10 July 2018, Jehovan todistajat (C‑25/17, EU:C:2018:551, paragraph 37 and the case-law cited). See also Sobotta, Chr., in E. Grabitz, M. Hilf and M. Nettesheim, Das Recht der Europäischen Union, 71. EL., updated August 2020, C.H. Beck, Munich, Art. 16 AEUV, point 22, who points to the wide scope ratione materiae of the EU <mask> regime.


Accordingly, that provision lays down three cumulative conditions so that the processing of personal data is lawful, namely, first, the pursuit of a legitimate interest by the data controller or by a third party; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the interests or freedoms and fundamental rights of the person concerned by the <mask> do not take precedence (see, to that effect, as regards Article 7(f) of Directive 95/46, judgment of 4 May 2017, Rīgas satiksme, C‑13/16, EU:C:2017:336, paragraph 28).


In order to answer that question, I take the view that it is pertinent to take into account two branches of the Court’s case-law, namely, on the one hand, the case-law relating to the independence of national <mask> supervisory authorities and, on the other, the case-law relating to the independence of the issuing judicial authority in the context of the European Arrest Warrant.


In accordance with Article 60(7) of that regulation, it is the responsibility of the lead supervisory authority, as a general rule, to adopt a decision with respect to the cross-border processing concerned, to give notice of that decision to the main establishment or the single establishment of the controller or processor, as the case may be, and to inform the other supervisory authorities concerned and the European <mask> Board of the decision in question, including a summary of the relevant facts and grounds.


The requirement of consent of a data subject is a central feature underlying EU <mask> law.   It features in the Charter of Fundamental Rights of the European Union, where it is stipulated in Article 8 that data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by the law. Seen in a wider context, the concept of consent allows the data subject concerned to decide for him or herself on the legitimacy of restrictions to on his or her right to the protection of personal data.


In the light of the foregoing considerations, the answer to the eighth question is that Article 58(2)(f) and (j) of the GDPR must be interpreted as meaning that, unless there is a valid Commission adequacy decision, the competent supervisory authority is required to suspend or prohibit a transfer of data to a third country pursuant to standard <mask> clauses adopted by the Commission, if, in the view of that supervisory authority and in the light of all the circumstances of that transfer, those clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law, in particular by Articles 45 and 46 of the GDPR and by the Charter, cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.


This request for a preliminary ruling concerns the interpretation of (i) Article 4(7) and Article 15 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General <mask> Regulation) (OJ 2016 L 119, p. 1), and (ii) Article 267 TFEU, read together with the second paragraph of Article 47 of the Charter of Fundamental Rights of the European Union (‘the Charter’).


Article 10 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General <mask> Regulation), is to be interpreted as meaning that it does not cover situations of processing of personal data relating to penalty points recorded against drivers for motoring offences as provided for by a national law such as Article 141 (2) of the Ceļu satiksmes likums (the Law on motoring).


See especially recitals 4 and 73 of Regulation 2016/679. More generally, see Feiler, L., Forgó, N., Weig, M., The EU General <mask> Regulation (GDPR) — A Commentary, GLP, 2018, pp. 138 to 140; Moore, D., ‘Comment to Article 23 — Restrictions’, in Kuner, C., Bygrave, L., Docksey, C., Drechsler, L. (eds), The EU General Data Protection Regulation (GDPR) — A Commentary, Oxford University Press, 2020, pp. 543 to 554; and Ehmann, E., Selmayer, M. (eds.), Datenschutz-Grundverordnung: Kommentar. 2nd edn, C.H.Beck, 2018, pp. 467 to 469.


75. For present purposes it is therefore irrelevant that the <mask> arrangements for retained data provided for in the German legislation: (a) provide effective safeguards to protect those data; (b) place rigorous and effective limits on access conditions, restricting the circle of people who can access the data; and (c) allow the retained data to be used solely for the purposes of investigating serious offences and preventing specific risks to life or a person’s freedom or to the security of the State.


That said, it must be emphasised that the exercise of the power of a Member State’s supervisory authority to bring actions before the courts of that State cannot be ruled out where, after the mutual assistance of the lead supervisory authority has been sought, under Article 61 of Regulation 2016/679, the latter does not provide the former with the requested information. In that situation, under Article 61(8) of that regulation, the supervisory authority concerned may adopt a provisional measure on the territory of its own Member State and, if it considers that there is an urgent need for the adoption of final measures, that authority may, in accordance with Article 66(2) of that regulation, request an urgent opinion or an urgent binding decision from the European <mask> Board. Further, under Article 64(2) of that regulation, a supervisory authority may request that any matter that is of general application or that produces effects in more than one Member State be examined by the European Data Protection Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance imposed on it by Article 61 of that regulation. Following the adoption of such an opinion or such a decision, and provided that the European Data Protection Board approves, after taking account of all the relevant circumstances, the supervisory authority concerned must be able to take the necessary measures to ensure compliance with the rules on the protection of the rights of natural persons as regards the processing of personal data contained in Regulation 2016/679 and, for that purpose, exercise the power conferred on it by Article 58(5) of that regulation.


that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable <mask> law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;


The referring court adds that, during the period concerned by the criminal investigation brought against G.D., all the requests for access were required to be approved in the first place by a superintendent or inspector acting in that capacity, before they were sent to the TLU to be processed, and that the investigators were directed to include sufficient detail in their requests for access so that an informed decision could be taken. In addition, the TLU and the head of the security and intelligence section were required to examine the legality, necessity and proportionality of requests for access, taking into account the fact that that head could be called upon to answer for his or her decision before the judge designated by the High Court. Furthermore, the TLU is also subject to audit by the <mask> Commissioner (Ireland).


The guiding principle at the basis of EU <mask> law is that of a self-determined decision of an individual who is capable of making choices about the use and processing of his or her data.   It is the requirement of consent which enables him or her to make this choice and which at the same time protects him in situations which are by their very nature asymmetrical.   Only when consent is freely given, specific and informed does it meet the test of Directive 95/46 and Regulation 2016/679.


In any event, however, the legal basis provided for must logically cover the specific purpose and type of processing carried out for that purpose. How exactly it will go about that is a matter of specific adaptation provisions adopted by the Member State or the Union under Article 6(3) of the GDPR. In general, the more generalised, larger and permanent the data transfers, the more robust, detailed and express the legislative basis must be since such data transfers represent a greater interference with the safeguarding of <mask>. By contrast, the more discreet and limited the disclosure requests – usually with regard to one or a few data subjects only, or even with regard to a limited amount of data – the more likely those requests can be carried out at the level of individual administrative requests, with the legislative empowering clause remaining rather broad and generic.


A more cautious approach to the concepts of ‘personal data’ and ‘processing’ had also previously been suggested by the Article 29 <mask> Working Party.   It noted that ‘the mere fact that a certain situation may be considered as involving “the processing of personal data” in the sense of the definition does not alone determine that this situation is to be subject to the rules of the [Directive 95/46], in particular pursuant to Article 3 thereof’.   It also emphasised that ‘the scope of the data protection rules should not be overstretched’. It even rather wisely foresaw that ‘a mechanistic application of every single provision of the Directive’ could lead to ‘excessively burdensome or perhaps even absurd consequences’.


In that regard, it must be borne in mind that, according to Article 46(1) of the GDPR, in the absence of a Commission adequacy decision, it is for the controller or processor established in the European Union to provide, inter alia, appropriate safeguards. Recitals 108 and 114 of the GDPR confirm that, where the Commission has not adopted a decision on the adequacy of the level of <mask> in a third country, the controller or, where relevant, the processor ‘should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject’ and that ‘those safeguards should ensure compliance with data protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies … in the Union or in a third country’.


25 Directive repealed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General <mask> Regulation) (OJ 2016 L 119, p. 1). I should recall that, in the judgment in La Quadrature du Net, paragraph 210, the Court held that, ‘… as is the case for Article 15(1) of Directive 2002/58, the power conferred on Member States by Article 23(1) of Regulation 2016/679 may be exercised only in accordance with the requirement of proportionality, according to which derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary (see, by analogy, with regard to Directive 95/46, judgment of 7 November 2013, IPI, C‑473/12, EU:C:2013:715, paragraph 39 and the case-law cited)’.


In the initial Commission proposal, Article 7(1) read as follows: ‘The controller shall bear the burden of proof for the data subject’s consent to the processing of their personal data for specified purposes’. See Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General <mask> Regulation), COM(2012) 11 final, p. 45.


13. The internet platform Facebook includes an area called ‘App-Zentrum’ (‘App Centre’) on which Facebook Ireland, inter alia, makes free games supplied by third parties available to its users. When accessing certain games in the App Centre on 26 November 2012, the user could see certain information under the ‘Sofort spielen’ (‘Play now’) button. It follows, in essence, from that information that the use of the app in question enabled the company having supplied the games to obtain certain personal data and authorised it to post, on behalf of the user, certain information, such as his or her score. That use entailed acceptance by the user of the general terms and conditions of the app and of its <mask> policy. In addition, in the case of the game Scrabble, it is stated that the app is authorised to post the status, photos and other information on behalf of the user.


In addition, the right of access to a lawyer throughout the confiscation proceedings clearly entails the right of that third party to be heard in the context of those proceedings, which, according to the Court’s case-law, guarantees the holder of that right the opportunity to make known his or her views effectively (see, to that effect, judgment of 26 July 2017, Sacko, C‑348/16, EU:C:2017:591, paragraph 34), which is confirmed by recital 33 of Directive 2014/42, according to which the specific safeguards and judicial remedies in order to guarantee the preservation of the <mask> of third parties, in the implementation of that directive, includes the right to be heard for third parties who claim that they are the owner of the property concerned.


This request for a preliminary ruling concerns the validity of Article 13(2) of Directive 2004/38/EC of the European Parliament and of the Council of 29 April 2004 on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States amending Regulation (EEC) No 1612/68 and repealing Directives 64/221/EEC, 68/360/EEC, 72/194/EEC, 73/148/EEC, 75/34/EEC, 75/35/EEC, 90/364/EEC, 90/365/EEC and 93/96/EEC (OJ 2004 L 158, p. 77, and corrigenda OJ 2004 L 229, p. 35 and OJ 2005 L 197, p. 34), in the light of Articles 20 and 21 of the Charter of <mask> of the European Union (‘the Charter’).


18. Veridos appealed against the decision of 25 June 2020 before the Varhoven administrativen sad (Supreme Administrative Court, Bulgaria), which has referred the following questions to the Court of Justice for a preliminary ruling: ‘(1) Is Article 56 of Directive [2014/24] in conjunction with Article 69 thereof, or, respectively, Article 38 of Directive [2009/81] in conjunction with Article 49 thereof, to be interpreted as meaning that, where it is objectively impossible to apply the criterion laid down in national law for the evaluation of an abnormally low tender and in the absence of a different criterion selected by the contracting authority and announced in advance, a contracting authority is not required to verify whether an abnormally low tender exists? (2) Is Article 56 of Directive [2014/24] in conjunction with Article 69 thereof, or, respectively, Article 38 of Directive [2009/81] in conjunction with Article 49 thereof, to be interpreted as meaning that the contracting authority is required to verify whether abnormally low tenders exist only if there is a suspicion regarding any tender; or, conversely, is the contracting authority required to always ensure that the received tenders are genuine, and state the relevant reasons? (3) Does such a requirement apply to the contracting authority if only two tenders have been received during the procedure for the award of a public contract? (4) Is Article 47 of the [Charter of <mask> of the European Union (‘the Charter’)] to be interpreted as meaning that the contracting authority’s assessment as regards a lack of suspicion that an abnormally low tender exists, or, respectively, that contracting authority’s conviction that the first-ranked tenderer has submitted a genuine tender, is subject to judicial review? (5) Should the previous question be answered in the affirmative: is Article 47 of the [Charter] to be interpreted as meaning that a contracting authority in a procedure for the award of a public contract which has not verified whether an abnormally low tender exists is required to provide justification and reasons as to why there is no suspicion that an abnormally low tender has been submitted, in other words, that the first-ranked tender is genuine?’ III. Procedure before the Court of Justice


In that context, having regard to the rules of criminal procedure, the referring court notes that it is not clear whether the unequal treatment of a person such as VA, with a disability such as blindness, in the pursuit of the activity of juror, is lawful in the light of the provisions contained in the UN Convention, the Charter of <mask> of the European Union (‘the Charter’), and Directive 2000/78, which seek to ensure equal treatment in employment and occupation for people with disabilities.


(Request for a preliminary ruling from the Latvijas Republikas Satversmes tiesa (Constitutional Court, Latvia)) (Reference for a preliminary ruling – Article 49 TFEU – Freedom of establishment – Article 56 TFEU – Freedom to provide services – Restriction – National legislation requiring institutions of higher education to promote and develop the national official language – Justification – Proportionality – Article 4(2) TEU – National identity – Article 13 of the Charter of <mask> of the European Union – Academic freedom)


Where those requirements are met, the executing judicial authority may therefore be satisfied that the decision to issue a European arrest warrant for the purpose of criminal prosecution is based on a national procedure that is subject to review by a court and that the person in respect of whom that national arrest warrant was issued has had the benefit of all safeguards appropriate to the adoption of that type of decision, inter alia those derived from the <mask> and fundamental legal principles referred to in Article 1(3) of Framework Decision 2002/584.


‘Is an interpretation of Article 3(2) of Directive 2001/24/EC under which, in legal proceedings pending in other Member States, the courts must, without any further formalities, recognise the effects of a Decision by the competent administrative authority of the home Member State that is intended retrospectively to change the legal framework that existed at the time the proceedings were commenced and that renders ineffective any judgments that do not accord with the provisions of the new decision, compatible with the fundamental right to an effective remedy in Article 47 of the Charter of <mask> of the EU, the principle of the rule of law in Article 2 of the Treaty on European Union, and the general principle of legal certainty?’


Article 7(1) of Directive 2003/88/EC of the European Parliament and of the Council of 4 November 2003 concerning certain aspects of the organisation of working time, read in the light of Article 31(2) of the Charter of <mask> of the European Union, must be interpreted as precluding a provision in a collective labour agreement under which, in order to determine whether the threshold of hours worked granting entitlement to overtime pay is reached, the hours corresponding to the period of paid annual leave taken by the worker are not to be taken into account as hours worked.


(Reference for a preliminary ruling – Public procurement – Directive 89/665/EEC – Article 1 – Right to an effective remedy – Article 47 of the Charter of <mask> of the European Union – Obligation for Member States to provide for a review procedure – Access to review procedures – Action for annulment of the decision awarding a public contract – Counterclaim brought by the successful tenderer – Case-law of the Constitutional Court limiting the cases where an appeal in cassation is possible – Article 267 TFEU)


Secondly, inconsistencies in the case-law on the basis of which an individual’s rights might be subjected to limitations would lead to a situation in which that individual would be unable to arrive at an unambiguous knowledge and understanding of how the limitation which has been imposed on him will work. For an individual, that mechanism plays a key role in guaranteeing the legitimacy of the limitation of his <mask> and in enabling him to contest that limitation before the competent authorities. Thus, in circumstances such as those in the present case, an individual criticising the interpretation recognised by the court of first instance in its case-law will know in advance that the court of second instance, despite sharing his criticism, will nonetheless endorse the initial decision by recourse to the interpretation established in its own case-law.


These requests for a preliminary ruling concern the interpretation of Clause 4(1) of the framework agreement on fixed-term work concluded on 18 March 1999 (‘the framework agreement’), which is annexed to Council Directive 1999/70/EC of 28 June 1999 concerning the framework agreement on fixed-term work concluded by ETUC, UNICE and CEEP (OJ 1999 L 175, p. 43), and the interpretation of Articles 20 and 21 of the Charter of <mask> of the European Union (‘the Charter’).


By its fourth, fifth and tenth questions, the referring court seeks essentially to ascertain whether, having regard to the facts which it has established with respect to United States law, appropriate safeguards are provided for in that country against interferences by the United States intelligence authorities with the exercise of the <mask> to respect for private life, to the protection of personal data and to effective judicial protection.


Secondly, by its first and second questions, Tribunalul Bucureşti (Regional Court, Bucharest, Romania) refers to Articles 8 and 52 of the Charter, taken in isolation or read in conjunction with Article 7(f) of Directive 95/46. The Court has made clear that the assessment of the condition laid down in that provision, relating to the existence of <mask> and freedoms of the data subject which override the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, necessitates a balancing of the opposing rights and interests concerned which depends on the individual circumstances of the particular case in question, and in the context of which account must be taken of the significance of the data subject’s rights arising from Articles 7 and 8 of the Charter (judgment of 24 November 2011, Asociación Nacional de Establecimientos Financieros de Crédito, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 40). It follows that Articles 8 and 52 of the Charter must not, in the present case, be applied in isolation.


(Requests for a preliminary ruling from the Bundesverwaltungsgericht (Federal Administrative Court, Germany)) (Reference for a preliminary ruling – Telecommunications – Processing of personal data and protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 15(1) – Article 4(2) TEU – Charter of <mask> of the European Union – Articles 6, 7, 8, and 11 and Article 52(1) – General and indiscriminate retention of connection data for the purposes of prosecuting serious criminal offences or preventing a specific risk to national security)


In the interests of comprehensiveness, it seems to me to be useful to make clear that, where the application of the ‘actual centre of interests of the child’ test does not in the particular case serve as a basis for the general jurisdiction of the courts of a Member State in a situation such as that in issue in the main proceedings, the protection of the best interests of the child guaranteed in Article 24 of the Charter and of the <mask> enshrined in Articles 4 and 6 of the Charter   would not justify any different conclusion.


It is apparent from settled case-law that the principle of equal treatment is a general principle of EU law, now enshrined in Articles 20 and 21 of the Charter of <mask> of the European Union, which requires that comparable situations must not be treated differently and that different situations must not be treated in the same way unless such treatment is objectively justified (see judgment of 9 March 2017, Milkova, C‑406/15, EU:C:2017:198, paragraph 55 and the case-law cited, and Opinion 1/17 (EU-Canada CET Agreement) of 30 April 2019, EU:C:2019:341, paragraph 176 and the case-law cited).


213 In the light of the foregoing considerations, the first question in Cases C‑357/19 and C‑840/19 and the first and fourth questions in Case C‑811/19 must be answered to the effect that Article 325(1) TFEU, read in conjunction with Article 2 of the PFI Convention, and Decision 2006/298 are to be interpreted as precluding national rules or a national practice under which judgments in matters of corruption and VAT fraud, which were not delivered, at first instance, by panels specialised in such matters or, on appeal, by panels all the members of which were selected by drawing lots, are rendered absolutely null and void, such that the cases of corruption and VAT fraud concerned must, as the case may be further to an extraordinary appeal against final judgments, be re-examined at first and/or second instance, where the application of those national rules or that national practice is capable of giving rise to a systemic risk of acts constituting serious fraud affecting the European Union’s financial interests or corruption in general going unpunished. The obligation to ensure that such offences are subject to criminal penalties that are effective and act as a deterrent does not exempt the referring court from verifying the necessary observance of the <mask> guaranteed in Article 47 of the Charter, but does not allow that court to apply a national standard of protection of fundamental rights entailing such a systemic risk of impunity. The second and third questions in Cases C‑357/19, C‑379/19, C‑811/19 and C‑840/19 and the single question in Case C‑547/19


In its defence, the Republic of Poland contends, inter alia, that Articles 47 and 48 of the Charter are not applicable to disciplinary cases concerning national judges in the absence of a situation where EU law is being implemented for the purposes of Article 51(1) of the Charter. In particular, it argues that the second subparagraph of Article 19(1) TEU does not constitute the source of <mask> of the defence or the right to be heard within a reasonable time. That Member State considers that the disciplinary cases conducted on the basis of the procedural provisions challenged by the Commission are of a purely internal nature and that, in defining those procedures, the Polish authorities have not regulated fields covered by Union law for the purposes of that provision, read in conjunction with Article 5 TEU and Articles 3 and 4 TFEU.


Although, in terms of form, the appellant only relied in his application on infringement of the right of access to documents under Article 42 of the Charter of <mask> of the European Union and Regulation No 1049/2001,   in terms of content it clearly follows from his line of argument that he was also complaining that OLAF had refused to allow him to inspect the investigation files because it wrongly failed to consider him to be a person concerned. For example, the appellant stated in his application that a person must have access to the file of a procedure that directly concerns that person; that, within the framework of his rights of defence, he has a right of access to the documents in the investigation file that directly affected his rights; that, in particular, every decision concerning his role as president of Teleorman County Council must be made accessible to him; and that, moreover, all manner of correspondence between OLAF and the Romanian anti-corruption authority concerning him has a material impact on his rights.


In that regard, according to Article 41(2)(c) of the Charter of <mask> of the European Union, the administration has an obligation to give reasons for its decisions. That duty to state reasons requires, according to settled case-law, that, in accordance with Article 296, second paragraph, TFEU, the reasoning followed by the authority which adopted the measure must be disclosed in a clear and unequivocal fashion so as, on the one hand, to inform the persons concerned of the justification for the measure adopted and thus enable them to defend their rights and, on the other, to enable the court to exercise its power of review (judgments of 25 February 2003, Strabag Benelux v Council, T‑183/00, EU:T:2003:36, paragraph 55; of 24 April 2013, Evropaïki Dynamiki v Commission, T‑32/08, not published, EU:T:2013:213, paragraph 37; and of 16 May 2019, Transtec v Commission, T‑228/18, EU:T:2019:336, paragraph 91).


EU law, in particular Article 34(5) of Directive (EU) 2016/801 of the European Parliament and of the Council of 11 May 2016 on the conditions of entry and residence of third-country nationals for the purposes of research, studies, training, voluntary service, pupil exchange schemes or educational projects and au pairing, read in the light of Article 47 of the Charter of <mask> of the European Union, must be interpreted as meaning that it requires the Member States to provide for an appeal procedure against decisions refusing a visa for the purpose of studies, within the meaning of that directive, the procedural rules of which are a matter for the legal order of each Member State, in conformity with the principles of equivalence and effectiveness, and that procedure must, at a certain stage, guarantee a judicial appeal. It is for the referring court to establish whether the application for a national long-term visa for the purpose of studies that is at issue in the main proceedings falls within the scope of that directive.


None of those three <mask> constitutes an unfettered prerogative, as each of them must be considered in relation to its function in society (see, regarding the right to an effective remedy, judgment of 18 March 2010, Alassini and Others, C‑317/08 to C‑320/08, EU:C:2010:146, paragraph 63 and the case-law cited, and, concerning the rights to respect for private life and the protection of personal data, judgment of 16 July 2020, Facebook Ireland and Schrems, C‑311/18, EU:C:2020:559, paragraph 172 and the case-law cited).


That said, I am of the view that, in the absence of rules to that effect in Framework Decision 2002/584, the practical arrangements concerning the surrendered person’s exercise of the right to be heard should be established by an agreement between the competent judicial authorities of the executing Member State and of the issuing Member State, in compliance with the principle of procedural autonomy, in view of the fact that the executing judicial authority is competent to adopt a decision on the additional consent requested and that any arrangement between the judicial authorities concerned must respect the <mask> of the surrendered person and, in particular, the right to effective judicial protection.


Judgment in Aranyosi, paragraph 78. In a different context (the recognition and enforcement of judgments in matrimonial matters and matters of parental responsibility), but in the same vein, the Court has held that ‘the systems for recognition and enforcement of judgments handed down in a Member State which are established by [Council Regulation (EC) No 2201/2003 of 27 November 2003 concerning jurisdiction and the recognition and enforcement of judgments in matrimonial matters and the matters of parental responsibility, repealing Regulation (EC) No 1347/2000 (OJ 2003 L 338, p. 1)] are based on the principle of mutual trust between Member States in the fact that their respective national legal systems are capable of providing an equivalent and effective protection of <mask>, recognised at EU level, in particular, in the Charter of Fundamental Rights’ (judgment of 22 December 2010, Aguirre Zarraga, C‑491/10 PPU, EU:C:2010:828, paragraph 70).


19 In that regard, after stating that, from its point of view, Framework Decision 2002/584 and, consequently, the Charter are applicable in the present case, the referring court explains that it must be satisfied, in particular, before issuing a European arrest warrant, that the protection of the <mask> of the person concerned is guaranteed. To that end, it seeks to ascertain, first, whether a final decision concluding criminal proceedings is covered by the principle ne bis in idem enshrined in Article 50 of the Charter, in particular where such a decision was taken on the basis of an amnesty and subsequently set aside as a result of a legislative measure revoking that amnesty, without a specific court ruling or judicial procedure.


7 The appellant claims that the first argument raises an issue that is significant with respect to the consistency and development of EU law. In that regard, the appellant argues that, following the annulment of the decision of 1 September 2009 of the Second Board of Appeal by the Court in the judgment of 10 November 2016, Simba Toys v EUIPO (C‑30/15 P, EU:C:2016:849), the Board of Appeal adopted a new decision (‘the decision at issue’) based on a new interpretation of the assessment criteria laid down in Article 7(1)(e)(ii) of Council Regulation (EC) No 40/94 of 20 December 1993 on the Community trade mark (OJ 1994 L 11, p. 1) without first inviting the parties to express an opinion on the new assessment criteria established in the judgment in Simba Toys v EUIPO (C‑30/15 P, EU:C:2016:849). The appellant claims to have been thus deprived of the right to submit new legal arguments and facts and to draw the Board’s attention to well-known facts. It follows that the decision at issue, confirmed by the judgment under appeal, was based on facts and grounds on which the appellant has not had the opportunity to express an opinion, which constitutes an infringement of the right to a fair hearing and the right to equality of arms, enshrined in Article 47 of the Charter of <mask> of the European Union (‘the Charter’) and reflected in Article 73 of Regulation No 40/94.


Finally, in the fourth place, in the event that the immunities provided for in the first and second paragraphs of Article 9 of the Protocol on the privileges and immunities of the European Union are applicable, the referring court has doubts regarding, in essence, the consequences that should follow from this with respect to the action brought by Mr Junqueras Vies against the order referred to in paragraph 25 above. More specifically, the referring court seeks to ascertain, by the third question referred, whether – and if so how and by whom – the protection attached to those immunities may be balanced against the other rights and interests to be taken into consideration in dealing with such an action, in the light of Article 39 of the Charter of <mask> of the European Union and the corresponding provisions of Article 3 of Protocol No 1 to the Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950.


As the Advocate General observed, in essence, in point 66 of his Opinion, the grounds relating to respect for the <mask> of the third-country national concerned, in particular the right to respect for family life and the rights of the child, as enshrined in Articles 7 and 24 of the Charter of Fundamental Rights of the European Union, the observance of which is binding on the Member States when the CISA is implemented, which forms an integral part of EU law by virtue of Protocol No 19 on the Schengen acquis, is an integral part of EU law, annexed to the Treaties (OJ 2010 C 83, p. 290), are likely to fall within the scope of the concept of ‘substantive reasons’, within the meaning of that provision.


As has been stated above, the purpose of Article 16(1) of Directive 2008/115 can be understood solely in a manner compatible and consistent with the rights enshrined in the Charter and more specifically in Articles 1 to 4 thereof, which guarantee respect for human dignity and the right to life and to integrity of the person and prohibit inhuman and degrading treatment. Those references are necessarily read into the reference to <mask> contained in Article 1 of Directive 2008/115.