CJEU, judgment of 4 May 2023, C-60/22, Bundesrepublik Deutschland (BAMF)

1 Overview

An asylum seeker brought proceedings before the Wiesbaden Administrative Court (VG Wiesbaden) against the Federal Republic of Germany because the German Federal Office for Migration and Refugees (BAMF) had kept his asylum file electronically and had transmitted extracts from it to the court without being able to produce a complete record of processing activities under Article 30 GDPR or an arrangement on joint controllership under Article 26 GDPR. The VG Wiesbaden referred to the CJEU the question whether such infringements render the processing unlawful and whether the data subject has a right to erasure (Article 17 GDPR) or to restriction of processing (Article 18 GDPR).

2 Headnotes

A breach of the obligation to conclude an arrangement on joint controllership under Article 26 GDPR and of the obligation to maintain a record of processing activities under Article 30 GDPR does not constitute a case of unlawful processing within the meaning of Article 17(1)(d) and Article 18(1)(b) GDPR (paras. 60-62, operative part).

What is decisive for the lawfulness of the processing is solely the principles laid down in Article 5 GDPR and the existence of a legal basis under Article 6 GDPR. By contrast, the documentation and organizational obligations under Articles 26 and 30 GDPR constitute self-standing obligations, breaches of which are penalized through the regulatory and administrative fine sanctions of the GDPR, without "infecting" the underlying processing itself.

3 Significance

The decision draws a clean distinction between formal documentation obligations and substantive lawfulness. It takes away from practice the argument that a missing or incomplete record of processing activities (or a missing arrangement on joint controllership) is automatically a lever for claims to erasure or restriction. Conversely, the obligation to maintain proper documentation under Article 30 GDPR remains subject to administrative fines in its own right (Article 83(4)(a) GDPR); it is simply not a benchmark under Article 6 GDPR.

That finding can be transferred to other accompanying obligations: the absence of a data protection impact assessment (Article 35 GDPR) or of proper information to data subjects (Articles 13 and 14 GDPR) likewise does not render otherwise lawful processing unlawful retroactively, although it does make it liable to an administrative fine.