DATA PROTECTION | The ECJ on the applicability of the GDPR to a parliamentary committee of inquiry

On 16 January 2024, the European Court of Justice (ECJ) issued its judgment in case C33/22 (Österreichische Datenschutzbehörde v WK) and ruled that a parliamentary committee of inquiry is generally bound by the GDPR, unless its activities are explicitly aimed at safeguarding national security. The case originated from the Austrian Supreme Administrative Court seeking guidance to decide a case involving the Austrian Parliament’s committee which, while investigating potential political influence over a security agency, breached the GDPR by publishing a witness’s name without consent. The ECJ found that this committee’s focus on political influence does not fall under national security. Thus, GDPR compliance is necessary unless justified by national security legislation, which was not demonstrated. Moreover, the ECJ clarified that, despite the separation of powers, the Data Protection Authority can monitor GDPR compliance, reflecting GDPR’s precedence over national law.

Newsletter n. 93 – February 2024