DATA PROTECTION – The ECJ on judicial review of decisions taken by a supervisory authority on the processing of personal data

Newsletter n. 91 – December 2023

DATA PROTECTION

The ECJ on judicial review of decisions taken by a supervisory authority on the processing of personal data

On 16 November 2023, the European Court of Justice (ECJ) issued its judgement in case C‑333/22 (Ligue des droits humains ASBL, BA v Organe de contrôle de l’information policière) within the context of a dispute regarding the exercise, through the Belgian Supervisory Body for Police Information of BA’s rights relating to the personal data concerning him, processed by the Belgian police service and on the basis of which the Belgian National Security Authority rejected BA’s request for security clearance. The ECJ’s ruling clarified that where the rights of a data subject have been exercised, pursuant to Article 17 of Directive (EU) 2016/680, through the competent supervisory authority, the legally binding decision adopted in connection thereof must be amenable to judicial review in order for the data subject to be able to challenge the assessment made by the supervisory authority on the lawfulness of the data processing and the decision as to whether or not to adopt corrective measures. In the context of that judicial review, member states must enable the court to examine the grounds and the evidence behind the supervisory authority’s decision.This comprehensive scrutiny is essential for upholding the rights of data subjects and ensuring accountability in the processing of personal data.