The Court thus held that Article 2(2)(a) of the GDPR, read in the light of recital 16 and Article 2(2)(b) of that regulation and of the first indent of Article 3(2) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), of which Article 2(2)(a) and (b) of that regulation represents a partial continuation, must be regarded as having the sole purpose of excluding from the scope of the GDPR the processing of personal data carried out by State authorities in the course of an activity which is intended to safeguard national security or of an activity which may be classified in the same category, with the result that the mere fact that an activity is an activity characteristic of the State or of a public authority is not a sufficient ground for that exception to be automatically applicable to such an activity (see, to that effect, judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 63 to 66 and the case-law cited, and of 20 October 2022, Koalitsia Demokratichna Bulgaria – Obedinenie, C‑306/21, EU:C:2022:813, paragraphs 36 to 39).