On 27 October 2022, the Court of Justice of the European Union (“CJEU”) issued its decision in Case C‑129/21 (Proximus – subscriber’s consent and right to erasure relating to publicly available directories).
In a nutshell, the CJEU ruled that:
- Article 12 (2) of the ePrivacy Directive, in conjunction with Article 2 (2) (f) thereof, and Article 95 of the GDPR, must be interpreted as meaning that the consent (i.e., pursuant to Article 4 (11) of the GDPR) of a subscriber of a telephone service operator is required for that subscriber’s personal data to be included in publicly available directories and directory enquiry services published by providers other than that operator. However, consent may be given either to that operator or to one of the providers;
- Article 17 of the GDPR must be interpreted as meaning that a subscriber’s request for the removal of their personal data from publicly available directories and directory enquiry services constitutes an exercise of the right to erasure within the meaning of that article;
- Articles 5 (2) and 24 of the GDPR must be interpreted as meaning that a national DPA may require a provider of publicly available directories and directory enquiry services – in its capacity as controller, to take appropriate technical and organizational measures to inform third-party controllers (i.e., other providers of directories that have received such data from it, as well as the telephone service operator that has provided such data to it) of the withdrawal of the subscriber’s consent;
- Article 17 (2) of the GDPR must be interpreted as meaning that it does not preclude a national DPA from ordering a provider of publicly available directories and directory enquiry services, to which a subscriber has requested that their personal data no longer be published, to take reasonable steps in order to inform search engine providers of the request to delete such data.
The full CJEU decision is not yet available in English, but in Romanian here, and the press release is available here.
