CURIA - Documents
53 of 58
http://curia.europa.eu/juris/document/document_print.jsf?docid=2320...
207
As regards the requirements stemming from Regulation 2016/679, it should be noted that the
purpose of that regulation is, inter alia, as is apparent from recital 10 thereof, to ensure a high level
of protection of natural persons within the European Union and, to that end, to ensure a consistent
and homogeneous application of the rules for the protection of the fundamental rights and freedoms
of such natural persons with regard to the processing of personal data throughout the European
Union (see, to that effect, judgment of 16 July 2020, Facebook Ireland and Schrems, C‑311/18,
EU:C:2020:559, paragraph 101).
208
To that end, any processing of personal data must, subject to the derogations permitted in
Article 23 of Regulation 2016/679, observe the principles governing the processing of personal data
and the rights of the person concerned set out, respectively, in Chapters II and III of that regulation.
In particular, any processing of personal data must, first, comply with the principles set out in
Article 5 of that regulation and, second, satisfy the lawfulness conditions listed in Article 6 of that
regulation (see, by analogy, with regard to Directive 95/46, judgment of 30 May 2013, Worten,
C‑342/12, EU:C:2013:355, paragraph 33 and the case-law cited).
209
With regard, more specifically, to Article 23(1) of Regulation 2016/679, that provision, much like
Article 15(1) of Directive 2002/58, allows Member States to restrict, for the purposes of the
objectives that it provides for and by means of legislative measures, the scope of the obligations and
rights that are referred to therein ‘when such a restriction respects the essence of the fundamental
rights and freedoms and is a necessary and proportionate measure in a democratic society to
safeguard’ the objective pursued. Any legislative measure adopted on that basis must, in particular,
comply with the specific requirements set out in Article 23(2) of that regulation.
210
Accordingly, Article 23(1) and (2) of Regulation 2016/679 cannot be interpreted as being capable
of conferring on Member States the power to undermine respect for private life, disregarding
Article 7 of the Charter, or any of the other guarantees enshrined therein (see, by analogy, with
regard to Directive 95/46, judgment of 20 May 2003, Österreichischer Rundfunk and Others,
C‑465/00, C‑138/01 and C‑139/01, EU:C:2003:294, paragraph 91). In particular, as is the case for
Article 15(1) of Directive 2002/58, the power conferred on Member States by Article 23(1) of
Regulation 2016/679 may be exercised only in accordance with the requirement of proportionality,
according to which derogations and limitations in relation to the protection of personal data must
apply only in so far as is strictly necessary (see, by analogy, with regard to Directive 95/46,
judgment of 7 November 2013, IPI, C‑473/12, EU:C:2013:715, paragraph 39 and the case-law
cited).
211
It follows that the findings and assessments made in the context of the answer given to question 1
in each of Cases C‑511/18 and C‑512/18 and to questions 1 and 2 in Case C‑520/18 apply, mutatis
mutandis, to Article 23 of Regulation 2016/679.
212
In the light of the foregoing, the answer to question 2 in Case C‑512/18 is that Directive 2000/31
must be interpreted as not being applicable in the field of the protection of the confidentiality of
communications and of natural persons as regards the processing of personal data in the context of
information society services, such protection being governed by Directive 2002/58 or by Regulation
2016/679, as appropriate. Article 23(1) of Regulation 2016/679, read in the light of Articles 7, 8 and
11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation which
requires that providers of access to online public communication services and hosting service
providers retain, generally and indiscriminately, inter alia, personal data relating to those services.
Question 3 in Case C‑520/18
213
By question 3 in Case C‑520/18, the referring court seeks, in essence, to ascertain whether a
national court may apply a provision of national law empowering it to limit the temporal effects of a
declaration of illegality which it is bound to make under that law in respect of national legislation
imposing on providers of electronic communications services – with a view to, inter alia, pursuing
2/15/2021, 4:58 PM