Quis custodiet ipsos custodes? Data protection in the judiciary in EU and EEA Member States

Bart H. M. Custers, Linda Louis, Maria Spinelli, Kalliopi Terzidou · International Data Privacy Law · 2022

Compliance with data protection legislation shall be subject to control by an independent authority, also for the judiciary. However, in order to safeguard the independence of the judiciary, both the General Data Protection Regulation and the Law Enforcement Directive explicitly state that national Data Protection Authorities are not competent to supervise courts ‘when acting in their judicial capacity’. In this article, the notion of ‘courts acting in their judicial capacities’ is analysed to determine whether any common understanding of this notion exists. Apart from legal analysis, empirical research (survey and interviews) was carried out in 30 countries (27 EU and 3 EFTA EEA Member States). The concept of ‘courts acting in their judicial capacity’ can be contrasted with ‘courts not acting in their judicial capacity’ (the functional interpretation) or with ‘other organizations’ (the institutional interpretation). The functional interpretation is followed by most countries and in fairly similar ways. The institutional interpretation is followed by some countries, but in very different ways and some practices raise concerns, such as limited or no supervision for the judiciary (interfering with Article 8 of the Charter) and supervision of the judiciary by the ministry of justice (potentially interfering with the separation of powers according to the trias politica). Altogether, there is to a large extent a common understanding of the notion of ‘courts acting in their judicial capacity’ and this is the functional interpretation. The institutional interpretation, however, may lead to a gap in data protection supervision of the judiciary. In the European Union (EU), all people a to in Article of the of of the European in Apart from this to the also explicitly a to data protection in Article that the to the protection of data or Compliance with shall be subject to control by an independent authority, all EU Member by national Data Protection Authorities in of independent Compliance with data protection and independent supervision also to the judiciary. However, in order to safeguard the independence of the judiciary, both the General Data Protection Regulation EU Regulation and the Law Enforcement Directive EU Directive explicitly state that national are not competent to supervise courts ‘when acting in their judicial In this article, the notion of ‘courts acting in their judicial capacities’ is analysed to determine whether any common understanding of this notion to this be the and the to data are by courts or judicial acting in their judicial the notion of ‘courts acting in their judicial capacity’ is of to the of the powers of the but also to and the to of the and the The notion of ‘other independent acting in their judicial capacity’ as to in and of the is also to the extent to EU Member can the powers of the In this article, the notion of ‘courts and independent judicial acting in their judicial capacities’ from a legal and in The is to to extent there a common understanding and interpretation of the notion of ‘courts and independent judicial acting in their judicial such a common understanding as is to and different and can be to a may that a understanding and data protection supervision the judiciary is to However, from a legal is that data protection legislation to the judiciary and to be by independent the for is to data and the for independent supervision is to the judiciary from of the However, as in this article, some countries a gap in the supervision of data protection in the judiciary. The of this research all EU Member as as European and European and the the EU in this research EU Member In 30 countries (27 EU Member and 3 EFTA EEA in this The legal of this research is to data protection to the and the national of the and the and and to data protection was to be the of this for as or in national as the of in to be the of this there is of data The research in this was carried out and that not in this is for to the of the in national legal the for this was but some countries not this is as the in this legal for data the EU legal for data the and the and this to the judiciary. and judicial and in a judicial capacity’ a of the legal interpretation and national of the notion of ‘courts and judicial acting in their judicial capacity’. and judicial are in the concept of courts and judicial in a judicial capacity’ in a judicial capacity’ by the research also to the of courts and judicial in EU data protection of a and was The research of research and the and was for the of the judiciary in of the countries the ways data protection is in the judiciary and the national of the and the the judiciary. The research of and the judiciary, and The research the of the and the judicial in of the countries and the a was The was for of the countries of and with In the The the judiciary, with the judiciary is of judicial the judiciary, in judicial capacity’ and data protection supervision is for judicial The and with the and are in national legal and legal and are for the judiciary. The the of the of courts and judicial with a be to a common understanding or interpretation of courts and judicial The of the for and in The was the for this research to and to the understanding of the and ‘other judicial in all EU Member and EFTA EEA national legislation to the as as the national legislation the and a legal of The was to to the by research as as The was to the by a of as a to all national that all and was and in this The and in this research are the and not in any the of the the was to of the all the out of a of 30 countries (27 EU Member and 3 EEA from the and the Altogether, the is the and most of the was or the the was to and in and the the that that are carried out in this a legal and a and of the the legal analysis, the was to all legal in the and the for the judiciary. all legal a national analysed for the judiciary. was by for the and judicial in the legal all in order to out this to a common understanding of the notion of ‘courts and judicial acting in their judicial capacities’ to the of the and to this for a common understanding and interpretation of The In for the and this analysis, the was to whether and countries be in for or countries may that or not supervise judicial some countries may countries and is in the of the and the with to the judiciary and judicial and to out to extent there is a common supervision of with the is in and supervision is the of a Data Protection to Article of the that control and data shall a the is carried out by a or for courts acting in their judicial or the data a large or of data are data to and be that the judiciary is explicitly from the to a acting in their judicial this is in in a judicial capacity’ The that courts may no to a not are not to In in EU Member courts the In the and all all different from courts to However, the that by courts not can data carried out judicial In the are for data protection data of the not acting in judicial the of of the EU an The supervision is the of national to as to Article EU Member shall for or independent to be for of the the of in Article Member to a for data protection the of the supervision to a to supervision of data protection to the in the no and was to a in supervision of data protection in the be that the are not competent to supervise of of courts acting in their judicial The is different from the for the that supervise courts acting in their judicial the courts with are not to are not to supervise courts courts are acting in their judicial be in in a judicial capacity’ there are of this that to supervise courts to the extent are not acting in their judicial However, in order to be to is to as be in and judicial and explicitly courts and judicial from their national supervision in their national data protection or this to the Article of of the Data Protection that the to the is in of the of data by courts and and acting in their judicial In of the Data Protection the supervision of the of data the is the competent to out the the is the of judicial the of the in is with with national data protection The of the can be to a In Article of the Law that judicial or judicial are the powers shall be and the of the General of the In the Data Protection in Article that the acting as the not the to supervise the of the of to judicial from supervision is not In of the Data Protection a by the is competent for the supervision of data of courts acting in their judicial In the Data Protection is the competent with the of with national data protection with Law of the of Protection of Article of the Law powers of the a order and the to the of the for of the of is however, a of powers to courts or their judicial In the supervision of data protection is by the national of the judiciary or the of the Apart from the and there is the courts in their judicial and that is Article Article of the with of such as data or or or to as of such data is of the in Article The in Article is of data for the or of legal or courts are acting in their judicial In courts acting in their judicial are to The whether the to courts is in of the Regulation to the of courts and judicial also the courts are in some order to safeguard the independence of the judiciary in the of judicial the protection of an independent judiciary is is not the of to the judiciary and the for the judiciary to to that of the not the of data courts are acting in their judicial but very limited as to to supervision for the or Member the and in to the of data by courts and judicial However, no such EU to and also national is very limited in this that is to the supervision of data to the judicial of the Member be in and judicial Member this in different ways. the in to the judiciary can be the in and ‘courts and judicial and ‘courts or independent judicial The of the not this judicial ‘other or judicial to the judiciary. this is but may from a in the an from a a judicial The not competent to the of the this with the concept of in judicial the this to the of of the EU for a In the of Law the in the of that the Data Protection not the to that the courts with Data Protection Law Law with the General of the General is the that the judiciary of The of the is also of the The in the that to the judiciary are similar to in the supervision by the and supervision by the supervision by a is in and in Article of the Data a but Member are to courts and independent judicial acting in their judicial there are a not this in the of a or a the of the in national that the judiciary is In the the not be may be that no or supervision is in that Article of the that Member shall for the not to be competent for the supervision of data of courts acting in their judicial to the in the this the countries are not to supervise courts acting in their judicial in their judicial capacity’ is not and be in in a judicial capacity’ but not countries this as courts can in their judicial or in The courts are the of national not acting in their judicial The the not be the courts acting in their judicial In the most common is supervision of courts by a or the judiciary. and judicial and in a judicial capacity’ this in Article of the that countries may for their not to be competent to supervise data of independent judicial acting in their judicial for independent judicial there is to whether are the of the can be that ‘other independent judicial in this to in but also and and in to legal or is by courts the judiciary. In some courts with national and courts with or courts with in a or may be the judicial for The of of the is the as in Article that the to the judiciary that data protection in courts acting in their judicial is not to be by but that for independent judicial can be the not supervise data protection in courts acting in their judicial but state that courts and judicial are to be to independent in with Article of the of of the this be is not Apart from the the courts and judicial in is also in this that countries are to and in national to data by courts and judicial this to be to countries to and in national that in the EU is national and EU to a limited However, can be that this explicitly data in judicial or in to be in in a judicial capacity’ this an as to data may to data by courts acting in their judicial In order to the of the notion ‘courts acting in their judicial is to the concept of be in this and the concept of judicial is the subject of the a of the judiciary and judicial are in the countries the of the judiciary. judicial ‘other judicial the of European EU and EEA Member their judiciary in different ways. the of courts of and courts are similar all but there also countries, for to national courts are as the to ‘courts of and ‘courts of or as in and to legislation for the of the judiciary as The and courts are in with the of the for the of of courts courts in and state that the of courts be by and courts are as out in the of the or the of the in and are as in in for the protection of or or or and are as to or of the and that are and by the of this not that are not but a of the that as as functional independence this is may not be in the of the of the as to the of that to in any of the and the and of the courts is of for the EU legal order and the of is also of as a of the protection of that from EU The for courts or whether are by whether are whether is whether is whether of and whether is The of courts are in of or of are not to any and may not in of this is the that may not any or may not in any or or explicitly state that the of courts of is in and Apart from the judiciary, all countries legislation that for ‘other judicial the judiciary can be courts or of a or with limited and In some countries, courts are as from the judiciary by the is the for in and by a of this is the in In some countries, are subject to a of to the of as in or by to the of their as in that are to be by the that as in courts of and as in and the or to or as in courts with national and and as in In some courts are to or an of this be the of such as the supervision of the of the and the of but also to state to be by be as a some courts and may a from the judiciary. the ‘other independent judicial very and national legal is to determine the of this the for courts or whether are by whether are whether is whether is whether of and whether is Authorities for for or are not in of this that to be the of ‘other judicial are the The the judiciary and the from to In some countries, the with the judiciary, in the in countries, a separation in are of the judiciary, the of the judicial and in some countries are the and the of an in the and an in and also in the and However, and the of In the also that the of the national of not judicial in in this is that in some countries, are to or with in the the is competent to a of to in the and The but can or to also in a of the EU a be a judicial for the of not to the the by the is The that the concept of is not limited to or but to the in the of However, a judicial is in the with to to and independence be by and an institutional the that with of the that the of the may an to a whether that is or as the from a for the of European However, the is that can be as judicial are that a and similar as a be as for from and that the of carried from of the to the of a was to the of the of to a national to The that to not that any or that out to the of judicial by that shall as the or from the In to the judicial for EU or in a to the of the judicial of the Member of or carried out by for the national in to and the of as as the that such are not of judicial that are to be as The European any judicial to the Member to their national judicial powers to be in their European and courts not the of national Regulation the protection of with to the of data by the Union and the of the that the is not competent to supervise data of the Article of this Regulation an to the of data by the acting in judicial Article that the shall and data protection by EU and with the of the acting in judicial that the is an EU this that the is the for data by the not acting in judicial the is acting in judicial the in an supervision the of by an the a Data Protection in to the of data in with the the notion of courts and independent judicial in their judicial capacities’ as in the and the The is a and empirical research from the that was for this of of this notion and to extent there is a common understanding or interpretation of the notion ‘courts and independent judicial acting in their judicial of ‘other independent judicial and in their judicial The and in the the there is an and that is whether this in their judicial be as an and independent judicial in their judicial or as a and independent judicial can in their judicial but also in ways or the in their judicial capacity’ is by the in the of the and that to be a However, this understanding is not followed by as be In be that there are for the notion of courts acting in their judicial a functional an institutional interpretation. In this the notion of ‘courts acting in their judicial capacity’ can be contrasted with the notion of ‘courts not acting in their judicial capacity’. In this interpretation, the in their judicial capacity’ is a that a can be as some of their and data their judicial such as and some of their and data not their judicial such as their and The with this interpretation is to the be that this can be in a or judicial in a the of data that can be in of by the courts are data for by the of is the of judicial judicial in a of data to the judicial and of by the judiciary be data by the of courts be in the of judicial of the independent of courts and their In the this very to the institutional interpretation. In the institutional interpretation, the notion of ‘courts acting in their judicial capacity’ can be contrasted with the notion of ‘other In this interpretation, the in their judicial capacity’ is a or courts and independent judicial in their judicial but that a can be the concept of courts and independent judicial The with this interpretation is to the courts and was in and judicial the judiciary is or by but with independent judicial the is are to can be or and interpretation are the legal and with the functional interpretation, the of the some in of this interpretation. The is of the data in judicial or in to be as in judicial capacity’ to data in judicial and data as are not in a judicial in of the functional interpretation can be in of the that the be limited to judicial in and not to be in with Member be are subject to supervision not but not for the data in may be but is to that are of the and of the not any similar be in the the legal also the functional interpretation can be is that there be independent data protection supervision for the judiciary 8 of the but in order to independence of the judiciary, is from this to data in the is to the data and data are in or out of is not very the this is for the independence of the judiciary, the not this can also be for the institutional interpretation but with to the functional interpretation, can be from a of that the independence of courts is with to some supervise or their data not to The be that the a in the data is this to some of data not to in judicial such as data or be from this that this be by the independence the ways in such data are may the courts can their a of of the 30 countries to to the functional interpretation. for this can be in in supervise the judiciary for data not to the the and to this In the courts the of the of are subject to the supervision of the also to as the the for from courts in their as courts the that courts not to any legal but as the In courts not in their judicial are subject to the of is not of the and as such is in their judicial In the of the data protection some courts are to be acting in their judicial and some are not to be acting in their judicial is explicitly that courts with The courts that and the the of and the and the are not to be and the is competent to supervise In as a all judicial the of the national (the are acting in their judicial the functional interpretation. The data protection also that the not the to control such In with judicial powers and can be by the national as according to the are with judicial powers for In are subject to the and supervision by national In may judicial the of judicial and In the be by the national In all judicial are by the acting in their judicial courts are data of their this is the of for the in the of their judicial is not the judiciary to a of for and In the the all is by the (the Data Protection and the the courts be to the Data Protection the data protection are the control of the courts and not the In the is competent to supervise data not to such as of the are the of data of data and the of In all courts are by the Data Protection (the national to data in data are However, to the supervision of data protection of data in there is no and of the the of or the of the judiciary can The of and the not data protection supervision In according to the of the data protection courts in their judicial capacity’ to legal by courts and not to of a of the of data carried out by a in judicial in order to the to the in the or to the of the data of the to the and their However, the of data carried out in order to for for or the or to the and the the of the national the Data Protection as in this the is and not judicial in In the the of the judiciary is the of supervision of the However, the of and are the of according to the of the In the and of the judiciary to the extent their data their judicial The national the Law the to data in Article Article of the that to data and data by the can be carried out by the are and by the and and of any data by courts to is by the judiciary In the not supervise courts judicial in their judicial The judiciary data protection supervision for However, the the of data in and the of data by courts not acting in their judicial In the that courts may data for Article of the in the of the judiciary, that ‘courts may data for or In the the be limited to the data as as are the and their is to the of In the in data are for the may supervise Article of the that the is the with to data for and their the institutional interpretation, the can be the the in their judicial as The in their judicial capacity’ may be to is to the judiciary from supervision of the to in the legal for the institutional interpretation can be the of the that data protection supervision to be for Article of the shall not be competent to supervise of courts acting in their judicial be shall not be competent to supervise of courts are acting in their judicial is not very most in the legal the in their judicial capacity’ is in with the ‘when acting in their judicial the of for the institutional interpretation, of the 30 countries to to this interpretation. to by the in countries, in and the is from any of supervision of data the data not to and In some of countries, such as and data protection is by the judiciary an or or the courts in the countries not to courts from that the is for data protection countries a gap in the supervision the in the is not competent to supervise data protection in courts or are not competent to not the courts not in their judicial to be competent to supervise courts and in the is not competent to supervise any of data by the in and of the judiciary to or the in of In data protection the judiciary are by the of the In data protection are by the is in Article of the Data Protection of the the that the explicitly that the shall out supervision in to the of data carried out for the courts not in their of In supervision of the judiciary, data protection is by the of the a in in the of the data protection most of the data protection supervision was from the to the for In all courts are the of supervision of the national The is the of is for the institutional of and courts and and may as as The is by by the of the the of the In all courts the of acting in their judicial The is not competent to supervise any data in the judiciary. The any to data protection supervision to the of and the of of the of not a the judiciary that is with data protection In the supervision of data protection courts is in a different In supervision is in and The national is competent to of whether data are in judicial or data in courts are in the of judicial the of is for the is for according to of the Data Protection courts are acting in their judicial the is carried out by the of but the data protection are by the judicial or from the is competent to out and The the institutional interpretation are to be in both the legal and the The legal some the institutional interpretation. the of the in the ‘when acting in their judicial some are judicial and of the are for the institutional interpretation. the ‘when acting in their judicial capacity’ the institutional interpretation is In however, the of the countries not the institutional interpretation, the for this is not to the is limited in However, the countries that the institutional interpretation, can be that there is a with a of as of the institutional interpretation can be as a as is not and understanding the institutional interpretation in the in this by for both the functional and the institutional interpretation of ‘courts acting in their judicial capacity’. The legal the functional interpretation, this is and not The research a of countries to the functional interpretation and a of countries the institutional interpretation. of for both of in their judicial capacity’ The functional interpretation is and supervision by the for and by judiciary for judicial The institutional interpretation for data with supervision of the judicial of in no supervision for the of in and to no and data protection supervision for courts all and countries the of with the of data protection supervision courts acting in their judicial is the in and can be this to the protection of the independent of the judiciary. countries, there may be the separation of powers according to the trias In the that the separation of powers is no in this In the legal in the of the functional interpretation and the in the of the functional interpretation. countries to the functional interpretation and countries the institutional The functional interpretation is followed in similar ways in the of countries, the institutional interpretation is followed in very different ways in the of of the practices in the may raise concerns, such as limited or no data supervision for the judiciary (interfering with Article 8 of the Charter) and supervision of the judiciary by the ministry of justice (the interfering with the separation of powers according to the trias politica). The functional interpretation and the is in countries this interpretation The is to acting in a judicial from not acting in a judicial can be by the and the data that is in the of in judicial to the such as the of an

Read the paper · More papers on PaperTik