# VOLKER UND MARKUS SCHECKE GBR V. LAND HESSEN, EIFERT V. LAND HESSEN AND BUNDESANSTALT FUR LANDWIRTSCHAFT UND ERNAHRUNG, 9.Nov.2010 (“SCHECKE”)

- Type: Case Law
- Source: CJEU
- Date: 2010-11-09
- Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62009CJ0092&ref=6180
- Canonical: https://overview.legal/posts/6180
- Topics: Consent, Personal Data, Right to Restriction, Identification, Data Portability, Certification, Controllers, Processors, Recipient, Minors

## Summary

Purpose for processing: The legislation at issue does base the processing on consent. Rather, it provides that they are to be informed. Thus, processing is not based on their consent. (¶ 54)

## Sections (59)

### ¶900

KB. Apply EUR-Lex Access to European Union law This document is an excerpt from the EUR-Lex website You are here EUROPA EUR-Lex home EUR-Lex - 62009CJ0092 - EN Help Print Menu EU law Treaties Treaties currently in force Founding Treaties Accession Treaties Other treaties and protocols Chronological overview Legal acts Consolidated texts International agreements Preparatory documents EFTA documents Lawmaking procedures Summaries of EU legislation Browse by EU institutions European Parliament European Council Council of the European Union European Commission Court of Justice of the European Union European Central Bank European Court of Auditors European Economic and Social Committee European Committee of the Regions Browse by EuroVoc EU case-law Case-law Reports of cases Directory of case-law Official Journal Access to the Official Journal Official Journal L series daily view Official Journal C series daily view Browse the Official Journal Legally binding printed editions Special edition National law and case-law National transposition National case-law JURE case-law Information Themes in focus EUR-Lex developments Statistics ELI register What is ELI ELI background Why implement ELI Countries implementing ELI Testimonials Implementing ELI Glossary EU budget online Quick search Use quotation marks to search for an "exact phrase". Append an asterisk ( * ) to a search term to find variations of it (transp * , 32019R * ). Use a question mark ( ? ) instead of a single character in your search term to find variations of it (ca ? e finds case, cane, care). Search tips Need more search options? Use the Advanced search Document 62009CJ0092 Help Print Text Document information Summary / Keywords Permanent link Download notice Save to My items Create an email alert Create an RSS alert ​ Judgment of the Court (Grand Chamber) of

> Topics: Statistics

### ¶264

TFEU, which is also applicable by analogy to a reference under Article

### ¶267

TFEU for a preliminary ruling on the validity of acts of the European Union, confers on the Court a discretion to decide, in each particular case, which specific effects of the act in question must be regarded as definitive. In the context of a judgment declaring invalid Articles 42(8b) and 44a of Regulation No 1290/2005 on the financing of the common agricultural policy, as amended by Regulation No 1437/2007, and Regulation No 259/2008 laying down detailed rules for the application of Regulation No 1290/2005 as regards the publication of information on the beneficiaries of funds deriving from the European Agricultural Guarantee Fund (EAGF) and the European Agricultural Fund for Rural Development (EAFRD), and in view of the large number of publications which have taken place in the Member States on the basis of rules which were regarded as being valid, the invalidity of the provisions concerned does not allow any action to be brought to challenge the effects of the publication of the lists of beneficiaries of EAGF and EAFRD aid carried out by the national authorities on the basis of those provisions during the period prior to the date on which the judgment is delivered. (see paras 93-94, operative part 2)

### ¶2010

( * ) (Protection of natural persons with regard to the processing of personal data – Publication of information on beneficiaries of agricultural aid – Validity of the provisions of European Union law providing for that publication and laying down detailed rules for such publication – Charter of Fundamental Rights of the European Union – Articles 7 and 8 – Directive 95/46/EC – Interpretation of Articles 18 and

> Topics: Personal Data, Processing

### ¶234

EC from the Verwaltungsgericht Wiesbaden (Germany), made by decisions of

### ¶2005

L 209, p. 1), as amended by Council Regulation (EC) No 1437/2007 of

### ¶2006

L 105, p. 54). Should the Court find that the European Union legislation referred to above is not invalid, the references for preliminary rulings also concern the interpretation of Article 7, the second indent of Article 18(2) and Article 20 of Directive 95/46/EC of the European Parliament and of the Council of

> Applies: gdpr-art-18-par-2-en, gdpr-art-7-en, gdpr-art-20-en

### ¶1995

L 281, p. 31).

### ¶7

Under the second indent of Article 18(2) of the directive, Member States may provide for the simplification of or exemption from notification inter alia in the following case: ‘where the controller, in compliance with the national law which governs him, appoints a personal data protection official, responsible in particular: – for ensuring in an independent manner the internal application of the national provisions taken pursuant to this Directive; – for keeping the register of processing operations carried out by the controller, containing the items of information referred to in Article 21(2), thereby ensuring that the rights and freedoms of the data subjects are unlikely to be adversely affected by the processing operations’.

> Topics: Personal Data, Controllers · Applies: gdpr-art-18-par-2-en, gdpr-art-21-par-2-en

### ¶9

Article 20 of the directive, ‘Prior checking’, provides in paragraphs 1 and 2: ‘1. Member States shall determine the processing operations likely to present specific risks to the rights and freedoms of data subjects and shall check that these processing operations are examined prior to the start thereof.

> Applies: gdpr-art-20-en

### ¶11

Under Article 28 of the directive, each Member State is to designate one or more public authorities (‘supervisory authority’) to be responsible for monitoring, acting with complete independence, the application within that State’s territory of the national provisions adopted pursuant to that directive.

> Topics: Monitoring, Supervisory Authorities, Supervision · Applies: gdpr-art-28-en

### ¶12

Regulation (EC) No 45/2001 of the European Parliament and of the Council of

### ¶2001

L 8, p. 1) provides in Article 27(1) and (2): ‘1. Processing operations likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes shall be subject to prior checking by the European Data Protection Supervisor.

> Applies: gdpr-art-27-par-1-en

### ¶13

Directive 2006/24 requires the Member States to retain for a certain time data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks.

> Topics: Telecommunications

### ¶14

Regulation No 1290/2005 sets the specific requirements and rules on the financing of expenditure falling under the common agricultural policy (‘the CAP’).

### ¶15

Article 42 of Regulation No 1290/2005 provides that the detailed rules for the application of that regulation are to be adopted by the European Commission. Under Article 42(8b) of the regulation, the Commission is to determine inter alia: ‘the detailed rules on the publication of information concerning beneficiaries referred to in Article 44a and on the practical aspects related to the protection of individuals with regard to the processing of their personal data in accordance with the principles laid down in Community legislation on data protection. These rules shall ensure, in particular, that the beneficiaries of funds are informed that these data may be made public and may be processed by auditing and investigating bodies for the purpose of safeguarding the financial interests of the Communities, including the time that this information shall take place’.

> Topics: Personal Data · Applies: gdpr-art-42-en, gdpr-art-44-en

### ¶16

Article 44a of Regulation No 1290/2005, ‘Publication of the beneficiaries’, states: ‘… Member States shall ensure annual ex-post publication of the beneficiaries of the EAGF and the EAFRD and the amounts received per beneficiary under each of these Funds. The publication shall contain at least: (a) for the EAGF, the amount subdivided in direct payments within the meaning of Article 2(d) of Regulation (EC) No 1782/2003 and other expenditure; (b) for the EAFRD, the total amount of public funding per beneficiary.’

> Applies: gdpr-art-2-en, gdpr-art-44-en

### ¶17

Recitals 13 and 14 in the preamble to Regulation No 1437/2007 amending Regulation No 1290/2005 read as follows: ‘(13) In the context of the revision of Council Regulation (EC, Euratom) No 1605/2002 of

### ¶2002

L 248, p. 1], the provisions on the annual ex-post publication of beneficiaries of funds deriving from the budget were inserted into that Regulation in order to implement the European Transparency Initiative. Sector-specific Regulations are to provide the means for such a publication. Both the EAGF and the EAFRD form part of the general budget of the European Communities and finance expenditure in a context of shared management between the Member States and the Community. Rules should therefore be laid down for the publication of information on the beneficiaries of these Funds. To that end, Member States should ensure annual ex-post publication of the beneficiaries and the amounts received per beneficiary under each of these Funds. (14) Making this information accessible to the public enhances transparency regarding the use of Community funds in the [CAP] and improves the sound financial management of these funds, in particular by reinforcing public control of the money used. Given the overriding weight of the objectives pursued, it is justified with regard to the principle of proportionality and the requirement of the protection of personal data to provide for the general publication of the relevant information as it does not go beyond what is necessary in a democratic society and for the prevention of irregularities. Taking into account the opinion of the European Data Protection Supervisor of

> Topics: Transparency, Personal Data

### ¶10

April 2007 [OJ

### ¶2007

C 134, p. 1], it is appropriate to make provision for the beneficiaries of funds to be informed that those data may be made public and that they may be processed by auditing and investigating bodies.’

### ¶19

Recital 6 in the preamble to Regulation No 259/2008 reads as follows: ‘(6) Making … information [concerning beneficiaries of funds from the EAGF and EAFRD] accessible to the public enhances transparency regarding the use of Community funds in the [CAP] and improves the sound financial management of these funds, in particular by reinforcing public control of the money used. Given the overriding weight of the objectives pursued, it is justified with regard to the principle of proportionality and the requirement of the protection of personal data to provide for the general publication of the relevant information as it does not go beyond what is necessary in a democratic society and for the prevention of irregularities.’

> Topics: Transparency, Personal Data

### ¶20

Recital 7 in the preamble states that ‘[t]o comply with the data protection requirements beneficiaries of the Funds should be informed of the publication of their data before the publication takes place’.

### ¶21

Article 1(1) of Regulation No 259/2008 specifies the content of the publication referred to in Article 44a of Regulation No 1290/2005 and provides that it is to include the following information: ‘(a) the first name and the surname where the beneficiaries are natural persons; (b) the full legal name as registered where the beneficiaries are legal persons; (c) the full name of the association as registered or otherwise officially recognised where the beneficiaries are associations of natural or legal persons without an own legal personality; (d) the municipality where the beneficiary resides or is registered and, where available, the postal code or the part thereof identifying the municipality; (e) for the … EAGF, the amount of direct payments within the meaning of Article 2(d) of Regulation (EC) No 1782/2003 received by each beneficiary in the financial year concerned; (f) for the EAGF, the amount of payments other than those referred to in point (e) received by each beneficiary in the financial year concerned; (g) for the … EAFRD, the total amount of public funding received by each beneficiary in the financial year concerned, which includes both the Community and the national contribution; (h) the sum of the amounts referred to in points (e), (f) and (g) received by each beneficiary in the financial year concerned; (i) the currency of these amounts.’

> Topics: Public Authority · Applies: gdpr-art-1-par-1-en, gdpr-art-2-en, gdpr-art-44-en

### ¶22

In accordance with Article 2 of Regulation No 259/2008, ‘[the] information referred to in Article 1 shall be made available on a single website per Member State through a search tool allowing the users to search for beneficiaries by name, municipality, amounts received as referred to in (e), (f), (g) and (h) of Article 1 or a combination thereof and to extract all the corresponding information as a single set of data.’

> Topics: Public Authority · Applies: gdpr-art-1-en, gdpr-art-2-en

### ¶23

Article 3(3) of that regulation provides that ‘[t]he information shall remain available on the website for two years from the date of [its] initial publication’.

> Applies: gdpr-art-3-par-3-en

### ¶24

Article 4 of Regulation No 259/2008 provides: ‘1. Member States shall inform the beneficiaries that their data will be made public in accordance with Regulation … No 1290/2005 and this Regulation and that they may be processed by auditing and investigating bodies of the Communities and the Member States for the purpose of safeguarding the Communities’ financial interests.

> Applies: gdpr-art-4-en

### ¶25

The applicants in the main proceedings, one established and the other resident in the Land of Hesse, are an agricultural undertaking in the legal form of a partnership (Case C‑92/09) and a full-time farmer (Case C‑93/09). For the financial year 2008 they made applications to the competent local authorities for funds from the EAGF or the EAFRD, which were approved by decisions of

### ¶27

The referring court explains that the Bundesanstalt’s website makes available to the public the names of beneficiaries of aid from the EAGF and the EAFRD, the place in which they are established or reside and the postcode of that place, and the annual amounts received. The site is provided with a search tool.

### ¶28

On

### ¶26

September

### ¶18

December

### ¶2008

(Case C‑93/09) the applicants in the main proceedings brought proceedings to prevent publication of the data relating to them. In their view, publication of the amounts received from the EAGF or the EAFRD is not justified by overriding public interests. Moreover, the rules governing the European Social Fund do not provide for beneficiaries to be identified by name. In their applications, they ask for the Land of Hesse to be ordered to refrain from, or to be prohibited from, transmitting or publishing those data for the purposes of the general publication of information on the financial amounts granted to them from the EAGF and the EAFRD.

### ¶29

The Land of Hesse, which takes the view that the obligation to publish data relating to the applicants in the main proceedings follows from Regulations No 1290/2005 and No 259/2008, nevertheless undertook not to publish the amounts received by them as beneficiaries of aid from the EAGF and the EAFRD pending final decisions in the main proceedings.

### ¶30

The referring court believes that the obligation to publish under Article 44a of Regulation No 1290/2005 constitutes an unjustified interference with the fundamental right to the protection of personal data. It considers that that provision, which pursues the aim of increasing the transparency of the use of European funds, does not improve the prevention of irregularities, since extensive control mechanisms exist at present for that purpose. On the basis of the judgment in Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I‑4989, it takes the view that, in any event, that obligation to publish is not proportionate to the aim pursued. Moreover, in its view, Article 42(8b) of Regulation No 1290/2005 gives the Commission too broad a discretion with respect to determining both the data to be published and the means of publication and is therefore incompatible with the third indent of Article

> Topics: Transparency, Personal Data · Applies: gdpr-art-42-en, gdpr-art-44-en

### ¶202

EC and with the fourth indent of Article

### ¶211

EC.

### ¶31

Regardless of the validity of Articles 42(8b) and 44a of Regulation No 1290/2005, the referring court considers that Regulation No 259/2008, which prescribes that the information relating to the beneficiaries of aid from the EAGF and the EAFRD is to be published exclusively on the internet, breaches the fundamental right to the protection of personal data. It points out that the latter regulation does not limit access to the internet site concerned to ‘internet protocol’ (IP) addresses situated in the European Union. Furthermore, it is not possible to withdraw the data from the internet after the expiry of the two-year period laid down in Article 3(3) of Regulation No 259/2008. It its view, publication of the data exclusively on the internet also has a deterrent effect. First, citizens wishing to obtain information must have access to the internet. Second, those citizens run the risk of having their data stored under Directive 2006/24. It is paradoxical to strengthen the supervision of telecommunications on the one hand and to provide on the other hand that information which is intended to enable citizens to participate in public affairs is available only electronically.

> Topics: Telecommunications, Personal Data · Applies: gdpr-art-3-par-3-en

### ¶32

In case the Court should find that the provisions referred to in paragraphs 30 and 31 above are not invalid, the referring court further seeks an interpretation of a number of provisions of Directive 95/46. It considers that the publication of personal data may take place only if the measures provided for in the second indent of Article 18(2) of that directive have been taken. According to the information provided by the referring court, the German legislature, in particular that of the Land of Hesse, has made use of the possibility under that provision. However, according to that court, the notification by the Ministry of the Environment, Rural Affairs and Consumer Protection of the Land of Hesse to the personal data protection official was incomplete. Some information was not communicated to that official, such as the fact that the data are processed by the Bundesanstalt on behalf of the Land , in some cases with the assistance of a private third party, specific details of the deletion period and the access provider, and information on the registration of IP addresses.

> Topics: Personal Data · Applies: gdpr-art-18-par-2-en

### ¶33

Moreover, according to the national court, the publication of the data relating to the beneficiaries of agricultural aid ought to have been preceded by a prior check as provided for in Article 20 of Directive 95/46. In the present case, however, a prior check was carried out, not by a central supervisory authority, but by the data protection official of the undertaking or office responsible, on the basis of incomplete notifications.

> Topics: Supervisory Authorities, Supervision · Applies: gdpr-art-20-en

### ¶34

Finally, the referring court is uncertain as to the lawfulness, from the point of view of Article 7(e) of Directive 95/46, of the registration of the IP addresses of users who consult the information relating to beneficiaries of aid from the EAGF and the EAFRD on the Bundesanstalt’s website.

> Applies: gdpr-art-7-en

### ¶35

In those circumstances, the Verwaltungsgericht (Administrative Court) Wiesbaden decided to stay the proceedings and to refer the following questions, which are worded identically in Case C‑92/09 and Case C‑93/09, to the Court for preliminary rulings: ‘1. Are Article [42](8b) and Article 44a of … Regulation … No 1290/2005 …, inserted by … Regulation … No 1437/2007 …, invalid?

> Applies: gdpr-art-44-en

### ¶2

Is … Regulation … No 259/2008 … (a) invalid, or (b) valid by reason only of the fact that Directive 2006/24 … is invalid? If the provisions mentioned in the first and second questions are valid:

### ¶3

Must the second indent of Article 18(2) of Directive 95/46 … be interpreted as meaning that publication in accordance with … Regulation … No 259/2008 … may be effected only following implementation of the procedure – in lieu of notification to a supervisory authority – established by that article?

> Topics: Supervisory Authorities, Supervision · Applies: gdpr-art-18-par-2-en

### ¶6

Must Article 7 – and in this case, in particular, subparagraph (e) – of Directive 95/46 … be interpreted as precluding a practice of storing the IP addresses of the users of a homepage without their express consent?’

> Topics: Consent · Applies: gdpr-art-7-en

### ¶36

By order of the President of the Court of

### ¶4

May 2009, Cases C‑92/09 and C‑93/09 were joined for the purposes of the written and oral procedure and the judgment. III – Consideration of the questions referred

### ¶37

The decisions for reference contain questions on the validity of Regulations No 1290/2005 and No 259/2008 (Questions 1 and 2) and questions on the interpretation of Directive 95/46 (Questions 3 to 6). Before examining the substance of the case, the admissibility of the second part of Question 2 and of Question 6 should be considered. A – Admissibility

### ¶38

By the second part of Question 2 and by Question 6 respectively, the referring court asks the Court to rule on the validity of Directive 2006/24 and on the interpretation of Article 7(e) of Directive 95/46, so as to enable it to assess whether the retention of certain data relating to the users of the internet sites, laid down by European Union and German legislation, is lawful.

> Applies: gdpr-art-7-en

### ¶39

It should be recalled at the outset that although, in view of the division of responsibilities in the preliminary-ruling procedure, it is for the referring court alone to determine the subject-matter of the questions which it proposes to refer to the Court, the Court has held that, in exceptional circumstances, it will examine the conditions in which the case was referred to it by the national court, in order to assess whether it has jurisdiction (Case C‑567/07 Woningstichting Sint Servatius [2009] ECR I‑9021, paragraph 42).

### ¶40

That is the case in particular where the problem referred to the Court is purely hypothetical or where the interpretation or consideration of the validity of a rule of European Union law which is sought by the national court has no relation to the actual facts of the main action or to its purpose (see, to that effect, Case C‑415/93 Bosman [1995] ECR I‑4921, paragraph 61; Case C‑466/04 Acereda Herrera [2006] ECR I‑5341, paragraph 48; Case C‑380/05 Centro Europa 7 [2008] ECR I‑349, paragraph 53; and Woningstichting Sint Servatius , paragraph 43).

### ¶41

According to the decisions for reference, the applicants in the main proceedings each brought proceedings before the referring court against the publication under Regulations No 1290/2005 and No 259/2008 of data relating to them. Their applications seek for the Land of Hesse to refrain from transmitting or publishing, or to refuse to transmit or publish, the information concerning the aid which they have received from the EAGF and the EAFRD.

### ¶42

The second part of Question 2 and Question 6 have no relation to the subject-matter of the disputes in the main proceedings. They relate, not to the publication of data relating to the beneficiaries of aid under those Funds, such as the applicants in the main proceedings, but to the retention of data relating to persons consulting websites. Since consideration of the second part of Question 2 and Question 6 is therefore of no relevance for the outcome of the main proceedings, there is no need to answer them. B – Substance

### ¶1

Question 1 and the first part of Question 2 a) Preliminary observations

### ¶43

By Question 1 and the first part of Question 2, the national court asks the Court to examine the validity, first, of Article 44a of Regulation No 1290/2005 and of Regulation No 259/2008 containing the detailed rules for the application of the publication obligation laid down by Article 44a and, second, of Article 42(8b) of Regulation No 1290/2005, the provision which is the legal basis of Regulation No 259/2008.

> Applies: gdpr-art-42-en, gdpr-art-44-en

### ¶44

The referring court considers that the obligation to publish data relating to the beneficiaries of aid from the EAGF and the EAFRD, which follows from the provisions cited in the previous paragraph, constitutes an unjustified interference with the fundamental right to the protection of personal data. It refers essentially to Article 8 of the Convention.

> Topics: Personal Data · Applies: gdpr-art-8-en

### ¶45

In accordance with Article 6(1) TEU, the European Union recognises the rights, freedoms and principles set out in the Charter of Fundamental Rights of the European Union (‘the Charter’), ‘which shall have the same legal value as the Treaties’.

> Applies: gdpr-art-6-par-1-en

### ¶46

In those circumstances, the validity of Articles 42(8b) and 44a of Regulation No 1290/2005 and of Regulation No 259/2008 must be assessed in the light of the provisions of the Charter.

### ¶47

In this regard, Article 8(1) of the Charter states that ‘[e]veryone has the right to the protection of personal data concerning him or her’. That fundamental right is closely connected with the right to respect of private life expressed in Article 7 of th

> Topics: Personal Data · Applies: gdpr-art-8-par-1-en, gdpr-art-7-en

## Cited law provisions (23)

### GDPR — gdpr-art-1-par-1-en

This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.

### GDPR — gdpr-art-3-par-3-en

This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

### GDPR — gdpr-art-4-par-1-en

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

### GDPR — gdpr-art-6-par-1-en

Processing shall be lawful only if and to the extent that at least one of the following applies:

### GDPR — gdpr-art-8-par-1-en

Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

### GDPR — gdpr-art-8-par-2-en

The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

### GDPR — gdpr-art-18-par-1-en

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

### GDPR — gdpr-art-18-par-2-en

Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

### GDPR — gdpr-art-21-par-2-en

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

### GDPR — gdpr-art-27-par-1-en

Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.

### GDPR — gdpr-art-52-par-1-en

Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation.

### GDPR — gdpr-art-1-en

Subject-matter and objectives

### GDPR — gdpr-art-2-en

Material scope

### GDPR — gdpr-art-4-en

For the purposes of this Regulation:

### GDPR — gdpr-art-7-en

Conditions for consent

### GDPR — gdpr-art-8-en

Conditions applicable to child's consent in relation to information society services

### GDPR — gdpr-art-11-en

Processing which does not require identification

### GDPR — gdpr-art-18-en

Right to restriction of processing

### GDPR — gdpr-art-19-en

The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

### GDPR — gdpr-art-20-en

Right to data portability

### GDPR — gdpr-art-28-en

Processor

### GDPR — gdpr-art-42-en

Certification

### GDPR — gdpr-art-44-en

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

---
Generated by overview.legal · https://overview.legal/posts/6180 · 2026-08-22