What is the Court of Justice?
The Court of Justice of the European Union (“CJEU”), and often referred to as only the “Court of Justice”, is a judicial body of the European Union. It is the highest court in the European Union in matters of European Union law. The court was established in 1951, originally known as the “Court of Justice of the European Communities” and is based in Luxembourg. The court is composed of one judge per member state – currently 28 – though it normally hears cases in panels of three, five or 15 judges. It is one of the seven major EU governmental institutions. The Court of Justice ensures that EU law is properly applied in all the member countries. It makes decisions on EU law and enforces decisions such as those taken by individuals or by the European Commission against member states.
The Court of Justice is separate and distinct from the European Court of Human Rights (ECtHR), with which it is sometimes confused. The ECtHR oversees human rights across Europe, including in non-EU countries.
On privacy matters, the European Data Protection Supervisor (EDPS) can intervene before the Court of Justice as expert on data protection law.
The Court of Justice has made some very important decisions in the field of privacy. In the case of Breyer v. Germany it established a precedent that dynamic IP addresses could be personal data in hands of German state because in event of cyber attacks, German law allowed the German state to obtain additional identification information (such as time the dynamic IP address was used and web sites visited) from Internet Service Providers (ISPs) to determine the specific individual to whom a specific IP address related. See http://curia.europa.eu/juris/document/document.jsf?docid=184668&doclang=EN
In the case of Google Spain SL v. Agencia Española de Protección de Datos it enforced the right to be forgotten. Mr. Mario Costeja Gonzáles asked Google to remove an old link to a 1998 newspaper article containing obsolete information regarding a real estate foreclosure as part of social security debt collection activities against Costeja Gonzales. Google refused. Costeja Gonzáles brought the case before the Spanish DPA (AEPD), which upheld his complaint against Google Spain SL and Google Inc. Google appealed to the Court of Justice of the European Union (ECJ). The ECU sided with Costeja Gonzáles. Subsequently, Google set up a delisting service and report: https://transparencyreport.google.com/eu-privacy/overview
See Case C-131/12, Google Spain SL v. Agencia Española de Protección de Datos, EUR-Lex, at ¶¶ [81], [88], [99] (2014), https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:62012CJ0131 [https://perma.cc/C5AF-EXWH]
The Court of Justice has also made important rulings regarding the extraterritorial affect of the GDPR. Per Article 3(1), the GDPR applies to the processing personal data “in the context of the activities of an establishment” of any organization with the EU. “Establishment” means the “…effective and real exercise of activity through stable arrangements”. Importantly, the “…legal form of such arrangements…is not the determining factor”. See Recital 22. The Court of Justice of the European Union found that Google was “established” in the EU with its Spanish-based sales and advertising operations. See Google Spain SL, Google Inc. v AEPD, Mario Costeja Gonzalez (C-131/12). It also has found that a Slovakian property website was subject to Hungarian data protection laws because it was “established” in Hungary. See Weltimmo v NAIH (C-230/14).