E-11/19 Adpublisher AG v J

EFTA-case

Klik hier voor het dossier van het EVA-hof (voor zover beschikbaar).

Deadlines: Motivation ministry:          31 January 2020
Written observations:                          17 March 2020 (ultimate deadline)

Keywords : anonymisation, complaint procedure, GDPR

Subject :

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Facts of the case:

The defendant addressed a request to access by the data subject pursuant to Article 15 of the GDPR to the applicant, a public limited company under Liechtenstein law. The applicant responded to the request by explaining that the personal data of the defendant originates from a competition in which the defendant participated. As evidence the applicant sent the defendant a screenshot. After receiving this response from the applicant, the defendant contacted the applicant again informing him that the email address visible in the screenshot was not his email address and that the domain was a spam domain and requested the applicant to inform him of the source of his data and the legal basis for the processing of his data. On 16-09-2018 the defendant brought a complaint against the applicant for alleged infringement of Articles 5, 6 and 15 of the GDPR to the Commissioner for Data Protection for Lower Saxony. The complaint was uploaded to the IMI system, an electronic system for the exchange of information between the data protection authorities of the Member States. The relevant authority, the Data Protection Authority for the Principality of Liechtenstein, accepted on 08-03-2019 in the IMI system its competence as the lead supervisory authority pursuant to Article 56(3) of the GDPR and affirmed its competence for the complaint at hand. By the decision challenged here, the relevant authority upheld the defendant’s complaint concerning the infringement of Articles 5 and 6 of the GDPR. Further, of its own motion, it determined an infringement of Articles 7, 15 and 32 of the GDPR. The applicant challenged that decision before the Liechtenstein Board of Appeal for Administrative Matters. Since the defendant is anonymous it must be determined whether an anonymous procedure is permissible in the first place. The second question is related to the obligation to reimburse the costs of a complaint procedure. If such an obligation is not precluded the question arises as to how the recovery of costs can be enforced against someone who remains anonymous.

Request for an advisory opinion:

1) Does it follow from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR) or from another provision of EEA law that an adversarial general procedure to hear a complaint may be carried out under the GDPR without disclosing the name and address of the complainant in the complaint procedure?

If the answer to the question is in the affirmative: Is it necessary in this case that a legitimate reason for the anonymisation is at least prima facie established or are no reasons required for the anonymisation?

2) Must a Member State ensure in its national procedural law that in a procedure to hear a complaint in accordance with Article 77 of the GDPR all further national appellate bodies are free of charge for the data subject and that the data subject may also not be ordered to reimburse the costs?

3) If Question 1 is answered in the affirmative and Question 2 is answered in the negative, in other words, an adversarial general procedure to hear a complaint may be carried out under the GDPR without identifying the name and address of the complainant in the complaint procedure and national procedural law is not required to ensure that in a procedure to hear a complaint in accordance with Article 77 of the GDPR all further national appellate bodies are free of charge for the data subject, the question arises how a decision resulting from a complaint procedure and ordering the data subject – who remains, however, anonymous –can be effected to reimburse the costs?

Cited (recent) case-law: /

Policy area: JenV, BZK