Court of Justice of the European Union (CJEU)

Court of Justice of the European Union (CJEU) and Data Protection: A Complete Guide

Introduction

The Court of Justice of the European Union (CJEU) plays a pivotal role in shaping the landscape of data protection law across the European Union. For anyone studying for the CIPP/E certification, understanding the CJEU's function, its landmark decisions, and its ongoing influence on data protection is absolutely essential. This guide provides a comprehensive overview of the CJEU in the context of European data protection, helping you understand why it matters, how it works, and how to confidently tackle exam questions on this topic.

Why Is the CJEU Important for Data Protection?

The CJEU is important for several key reasons:

1. Supreme Interpreter of EU Law: The CJEU is the highest court in the European Union, and its interpretations of EU treaties, directives, and regulations — including the General Data Protection Regulation (GDPR) — are binding on all EU Member States. When the CJEU rules on a data protection matter, that ruling becomes the definitive legal interpretation across the entire EU.

2. Shaping Data Protection Principles: Many of the foundational principles of European data protection law have been clarified, expanded, or even created through CJEU rulings. Concepts such as the right to be forgotten, the invalidity of certain international data transfer mechanisms, and the scope of what constitutes personal data have all been significantly shaped by CJEU case law.

3. Ensuring Consistent Application: Without the CJEU, each Member State might interpret data protection rules differently, leading to a fragmented legal landscape. The CJEU ensures uniformity and consistency in the application of data protection law across all 27 Member States.

4. Protecting Fundamental Rights: The CJEU upholds the EU Charter of Fundamental Rights, particularly Article 7 (respect for private and family life) and Article 8 (protection of personal data). These Charter provisions serve as the constitutional backbone for data protection in the EU, and the CJEU actively enforces them.

5. Influencing Global Data Protection Standards: CJEU decisions have had ripple effects far beyond Europe. Rulings on international data transfers, for example, have influenced how companies worldwide handle European citizens' data.

What Is the CJEU?

The Court of Justice of the European Union is the judicial institution of the EU. It is based in Luxembourg and comprises two main courts:

• The Court of Justice: This is the higher court, which deals primarily with requests for preliminary rulings from national courts, actions for annulment, and appeals. It has one judge from each EU Member State and is assisted by Advocates General who provide independent legal opinions on cases.

• The General Court: This court handles actions brought by individuals and companies directly against EU institutions, including in areas that may touch upon data protection (for example, challenges to decisions by EU bodies).

The CJEU's primary role is to ensure that EU law is interpreted and applied uniformly across all Member States. It does not function as a court of appeal from national courts in the traditional sense. Instead, national courts refer questions of EU law to the CJEU through a mechanism known as the preliminary reference procedure (Article 267 TFEU).

How Does the CJEU Work in the Data Protection Context?

Understanding the mechanics of how the CJEU engages with data protection issues is crucial:

1. The Preliminary Reference Procedure (Article 267 TFEU)

This is the most common way data protection issues reach the CJEU. When a national court in any EU Member State is hearing a case that involves a question of EU law (such as the interpretation of the GDPR or the Data Protection Directive before it), that court can — and sometimes must — refer the question to the CJEU. The CJEU then provides a ruling on the interpretation of the relevant EU law, and the national court must apply that interpretation to the case at hand.

Key points to remember:
- Courts of last instance (from which there is no further appeal under national law) are obligated to refer questions to the CJEU.
- Lower courts have the discretion to refer questions but are not required to do so.
- The CJEU provides the interpretation; it does not decide the individual case. The national court applies the CJEU's interpretation to the facts.

2. Actions for Annulment

In some cases, parties may challenge the validity of EU legal acts, including decisions by the European Commission relating to data protection (such as adequacy decisions for international data transfers). The CJEU can annul such acts if they are found to violate EU treaties or fundamental rights.

3. The Role of the Advocate General

Before the CJEU delivers its judgment, an Advocate General typically issues a non-binding opinion on the case. While these opinions are advisory, they are highly influential and often provide deep legal analysis that helps predict the Court's final ruling. In data protection cases, the Advocate General's opinions have been particularly significant.

Landmark CJEU Data Protection Cases

The following cases are essential knowledge for the CIPP/E exam:

1. Google Spain v AEPD and Mario Costeja González (2014) — The Right to Be Forgotten
The CJEU ruled that individuals have the right to request search engines to delist links to personal information that is inadequate, irrelevant, or no longer relevant. This case established the right to be forgotten (now codified under Article 17 of the GDPR). It also clarified that a search engine operator is a data controller.

2. Schrems I — Maximillian Schrems v Data Protection Commissioner (2015)
The CJEU invalidated the EU-US Safe Harbor framework, finding that it did not adequately protect EU citizens' personal data when transferred to the United States. The Court emphasized that national supervisory authorities must be able to independently examine claims regarding data transfers, even when a Commission adequacy decision exists.

3. Schrems II — Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (2020)
The CJEU invalidated the EU-US Privacy Shield and upheld the validity of Standard Contractual Clauses (SCCs) as a transfer mechanism, but emphasized that data exporters must verify that the legal framework in the recipient country provides adequate protection. This ruling significantly impacted international data transfer practices worldwide.

4. Digital Rights Ireland (2014)
The CJEU struck down the Data Retention Directive (2006/24/EC), finding that it constituted a serious and disproportionate interference with the fundamental rights to privacy and data protection under Articles 7 and 8 of the EU Charter. This case reinforced the principle of proportionality in data protection law.

5. Weltimmo (2015)
This case addressed the question of establishment under EU data protection law. The CJEU ruled that a company can be considered established in a Member State even with a minimal presence, such as operating a website in the language of that Member State and engaging in economic activity there. This case is relevant to understanding the territorial scope of data protection law.

6. Breyer v Germany (2016)
The CJEU ruled that dynamic IP addresses can constitute personal data where the data controller has the legal means to identify the individual. This expanded the understanding of what qualifies as personal data.

7. Planet49 (2019)
The CJEU ruled that pre-ticked checkboxes do not constitute valid consent for the use of cookies. Consent must be freely given, specific, informed, and indicated by a clear affirmative act. This ruling clarified consent requirements under both the ePrivacy Directive and the GDPR.

8. Fashion ID (2019)
This case addressed joint controllership in the context of social media plugins (Facebook Like button). The CJEU ruled that a website operator embedding a social plugin can be a joint controller with the social media platform for the collection and transmission of personal data, though not for subsequent processing by the platform.

Key Themes in CJEU Data Protection Jurisprudence

When studying the CJEU's role in data protection, keep these recurring themes in mind:

• Fundamental rights as the foundation: The CJEU consistently anchors its data protection rulings in Articles 7 and 8 of the EU Charter of Fundamental Rights.
• Proportionality and necessity: The Court consistently applies proportionality tests when assessing data processing activities, particularly those involving surveillance or mass data retention.
• Broad interpretation of personal data: The CJEU tends to interpret the concept of personal data broadly, expanding its scope to include dynamic IP addresses and other identifiers.
• Effective protection for data subjects: The CJEU ensures that data subjects have real, effective rights — not just theoretical ones — including access to independent supervisory authorities and judicial remedies.
• Accountability for data controllers: The CJEU holds data controllers to high standards, requiring them to actively demonstrate compliance rather than relying on passive assurances.
• Strict approach to international data transfers: The CJEU demands that data transferred outside the EU receives essentially equivalent protection to that guaranteed within the EU.

How the CJEU Interacts with Other EU Institutions

Understanding the CJEU's relationship with other bodies is also important:

• European Commission: The CJEU can review and invalidate Commission decisions (e.g., adequacy decisions like Safe Harbor and Privacy Shield).
• National Data Protection Authorities (DPAs): The CJEU has clarified that DPAs must retain their independence and cannot be bound by Commission adequacy decisions without the ability to challenge them.
• European Data Protection Board (EDPB): While the EDPB provides guidance and opinions, the CJEU's interpretations of the GDPR are legally binding and take precedence.
• National Courts: National courts implement CJEU rulings and serve as the primary channel through which data protection questions are referred to the CJEU via the preliminary reference procedure.

Exam Tips: Answering Questions on the Court of Justice of the European Union (CJEU)

Here are targeted strategies to help you excel on CIPP/E exam questions related to the CJEU:

Tip 1: Know the Key Cases and Their Outcomes
You do not need to know every detail of every CJEU case, but you must be able to identify the core holding of each major case. For each landmark case listed above, memorize: (a) the key issue, (b) the ruling, and (c) the principle or concept it established. Exam questions frequently test your ability to match a case name to its outcome or legal significance.

Tip 2: Understand the Preliminary Reference Procedure
Expect questions about how cases reach the CJEU. Remember that the preliminary reference procedure under Article 267 TFEU is the main mechanism. Know the distinction between courts that must refer (courts of last resort) and those that may refer (lower courts).

Tip 3: Link Cases to GDPR Provisions
Many CJEU rulings pre-date the GDPR but influenced its drafting. Be able to connect CJEU case law to specific GDPR articles. For example, Google Spain relates to Article 17 (right to erasure), Planet49 relates to Article 7 and Recital 32 (consent), and Schrems cases relate to Chapter V (international data transfers).

Tip 4: Remember the Charter of Fundamental Rights
The CJEU frequently references Article 7 (privacy) and Article 8 (data protection) of the EU Charter. If a question asks about the legal basis for the CJEU's data protection rulings or the constitutional foundations of EU data protection, these Charter articles are the answer.

Tip 5: Distinguish Between Invalidation and Interpretation
The CJEU can invalidate EU legal acts (e.g., the Data Retention Directive, Safe Harbor, Privacy Shield) or interpret existing law (e.g., what constitutes personal data, what counts as valid consent). Understand which cases involved invalidation and which involved interpretation — exam questions may test this distinction.

Tip 6: Watch for Distractors About the CJEU's Jurisdiction
The CJEU does not decide individual disputes between private parties — it interprets EU law. If an answer choice suggests the CJEU directly decides a case between a data subject and a controller, that is likely incorrect. The CJEU provides the legal interpretation; the national court applies it.

Tip 7: Understand the Broader Impact of Schrems I and II
These are arguably the most frequently tested CJEU cases. Know that Schrems I invalidated Safe Harbor, Schrems II invalidated Privacy Shield, and Schrems II also upheld SCCs while imposing additional obligations on data exporters to conduct transfer impact assessments.

Tip 8: Pay Attention to the Concept of Establishment
The Weltimmo case is important for understanding when a controller is considered established in a Member State. The CJEU adopted a broad, flexible approach, focusing on the real and effective exercise of activity rather than formal registration.

Tip 9: Use Process of Elimination
If you are unsure about a specific case, use what you know about general CJEU principles — broad interpretation of data subject rights, strict approach to international transfers, emphasis on fundamental rights — to eliminate unlikely answer choices.

Tip 10: Don't Confuse CJEU with the European Court of Human Rights (ECtHR)
A common exam trap involves confusing the CJEU with the ECtHR. The CJEU is an EU institution that interprets EU law (including the GDPR and the EU Charter). The ECtHR is a Council of Europe institution that interprets the European Convention on Human Rights (ECHR). While both address privacy and data protection, they are distinct courts with different jurisdictions and legal bases.

Tip 11: Review Advocate General Opinions for Key Cases
While not binding, Advocate General opinions are sometimes referenced in exam questions. Know that the Advocate General provides a legal opinion before the Court delivers its judgment, and the Court may or may not follow it.

Tip 12: Practice Scenario-Based Questions
The CIPP/E exam often presents scenarios where you must apply CJEU principles. Practice by reading a fact pattern and asking: Which CJEU case is most relevant? What principle did the CJEU establish? How would it apply here?

Summary

The CJEU is the ultimate arbiter of EU data protection law. Its rulings have defined key concepts such as the right to be forgotten, the scope of personal data, the requirements for valid consent, and the standards for international data transfers. For the CIPP/E exam, mastering the CJEU's role, its procedures, and its landmark cases is non-negotiable. Focus on understanding the principles behind the rulings, connect them to GDPR provisions, and practice applying them to hypothetical scenarios. With a solid grasp of the CJEU's jurisprudence, you will be well-prepared to tackle any exam question on this critical topic.