DATA PROTECTION | The ECJ on order of personal data erasure by DPAs without a prior request by the data subject

On 14 March 2024, the EU Court of Justice (ECJ) issued a judgment in case C-46/2023 (Újpesti Polgármesteri Hivatal v Hungarian DPA) whereby it stated that a national data protection authority (DPA) may order of its own motion the erasure of unlawfully processed personal data even in the absence of a prior request from the data subject. The request for a preliminary ruling arose from the alleged unlawful processing of personal data carried out by the Hungarian administration for the purpose of providing financial support to vulnerable people. The investigations of the DPA revealed that the administration had processed the data of all the people eligible for the aid without informing the data subjects by means of a privacy information notice, and ordered the erasure of the data. The Hungarian administration challenged the DPA’s order, arguing it lacked authority since the DPA had acted without a prior request from a data subject. The ECJ highlighted that mandating a prior request from the data subject could allow controllers to unlawfully retain and process personal data without consequences in cases where no such request is made and could lead to a weakening of the protection provided by the law, leaving individuals who do not take proactive measures vulnerable to unlawful processing activities.

Newsletter n. 95 – April 2024