CJEU: Data subjects have the right to appeal national supervisory authority decisions on personal data processing

The Court of Justice of the EU (CJEU) ruled that data subjects have the right to appeal the decision of the national supervisory authority regarding the processing of their personal data.

The case concerns a Belgian citizen who requested a security clearance certificate from the Belgian National Security Authority, which refused to issue the certificate due to the person’s involvement in various demonstrations.

The citizen seeking access to their data approached the Belgian Supervisory Body for Police Information, which informed them that they would verify the lawfulness of the data processing. However, after conducting the necessary verifications, the body informed the citizen that the verification was carried out but could not give further information. The citizen then turned to the Belgian Court of First Instance Court, asking to verify the controllers responsible for the data processing. However, the Court of First Instance did not review the case as it declared it lacked jurisdiction.

As a result, the case was brought before the Belgian Court of Appeal, which asked the CJEU whether the EU laws request Member states to allow data subjects to challenge decisions by supervisory authorities when those authorities conduct data processing.

The CJEU found that while the decision of the national supervisory authority is legally binding, the data subject should be able to challenge the assessment concerning the lawfulness of the data processing. Additionally, member states must provide more than just the minimum required information to ensure that the data subject has adequate details to defend their rights and decide whether a court has jurisdiction to review the case. In cases where such information is considered the ‘bare minimum, ’ member states must enable the court to review and balance the public interest purposes.