On 16 November 2023, the ECJ delivered a judgment on the interpretation of the right of indirect access to personal data as foreseen in Art. 17 of Directive 2016/680 known as the Law Enforcement (Data Protection) Directive (LED).

Background of the case

The case concerns the implementation of this provision in Belgium. In a concrete case brought to the Belgian courts by BA it revealed that individuals, whose data protection rights to information and data access vis-à-vis the police are restricted for public interest purposes, have no judicial remedies against the decision taken by the Belgian Supervisory Body for Police Information (OCIP). Next to the question on the availability of effective judicial remedies, the referring court (the Brussels Court of Appeal) asked whether Art. 17(3) of Directive 2016/680 is actually valid having regard to Arts. 8(3) and 47 CFR in so far as it obliges the supervisory authority only to inform the data subject (i) that all necessary verifications or a review by the supervisory authority have taken place and (ii) that that person has a right to seek a judicial remedy. For further details on the case (C-333/22 (Ligue des droits humains ASBL, BA v Organe de contrôle de l’information policière)), the questions referred and the opinion by AG Medina → eucrim 2/2023, 151-152.

ECJ on the necessity of a judicial remedy

The Court first finds that, in informing the data subject of the result of the verifications made, the competent supervisory authority adopts a legally binding decision. This decision must be amenable to judicial review in order for the data subject to be able to challenge the assessment made by the supervisory authority concerning the lawfulness of the data processing and the decision as to whether or not to adopt corrective measures.

ECJ on the validity of Art. 17(3) LED

Second, the Court points out with regard to the validity of Art. 17(3) LED that this provision is a limitation on the right to an effective judicial remedy, guaranteed in Art. 47 CFR when it allows the supervising authority to submit minimum particulars only in the statement of reasons for its decision. This can be legitimate in particular where rules seek to avoid compromising the public interest purposes provided for by the LED. However, national implementing law must satisfy the other criteria of Art. 52 CFR, i.e., (i) respect the essence of the right to effective judicial protection and (ii) being based on a weighing up of the public interest purposes warranting limitation of that information and of the fundamental rights and legitimate interests of the data subject, in accordance with the principles of necessity and proportionality. Thus, it is for the Member States to provide the following rules:

• Under certain conditions, the information disclosed to the data subject may go beyond the minimum information;
• The competent authority has a degree of discretion to determine whether it may communicate to the data subject, at least in brief, the result of its verifications;
• The court which exercises judicial review of the correct application of Art. 17 LED by the supervisory authority must have the possibility to examine both all the grounds and the related evidence on the basis of which that authority based the verification of the lawfulness of the processing of the data at issue as well as the conclusions which it drew from that verification.

Having regard to these considerations, the ECJ held that there is nothing calling into question the validity of Art. 17(3) of Directive 2016/680.