Ruling of 16 December 2008 [.of the Court Grand Chamber] in Case [C‑524/06] Heinz Huber v Bundesrepublik Deutschland  ECR I-09705
Referred by [Oberverwaltungsgericht für das Land Nordrhein-Westfalen – Germany]
German law has established a centralised register which contains certain personal data relating to foreign nationals who are resident in Germany for a period of more than three months. The Federal Office for Migration and Refugees (Bundesamt für Migration und Flüchtlinge) is responsible for maintaining that register and assists, amongst others, the public authorities who have the duty of implementing the legislation concerning the law relating to foreign nationals. In particular, the register is used for statistical purposes and by the security and police services and by the judicial authorities in exercising their powers in relation to the prosecution and investigation of criminal activities or which threaten public security.
Mr. Huber, an Austrian national, moved to Germany in 1996 in order to carry on business there as a self-employed insurance agent. Since he took the view that he was discriminated against because the personal data concerning him are contained in the centralised register and, in particular, because a database of that kind does not exist for German nationals, Mr. Huber requested that those data to be deleted.
Protection of personal data – European citizenship – Principle of non-discrimination on grounds of nationality – Directive 95/46/EC – Concept of necessity – General processing of personal data relating to citizens of the Union who are nationals of another Member State – Central register of foreign nationals/Is the processing of personal data of the kind undertaken in the centralised register, under the German legislation, compatible with Community law?
ANSWER of the COURT:
The processing and storage of those data relating to Union citizens for statistical purposes or with a view to fighting crime is contrary to Community law
REASONING of the Court
The Court of Justice holds, first of all, that the data in question constitute personal data within the meaning of the Data Protection Directive. The directive provides that such data may lawfully be processed only if it is necessary to do so for the performance of a task carried out in the public interest or in the exercise of official authority.
The Court notes that the right of residence of a Union citizen in a Member State of which he is not a national is not unconditional but may be subject to limitations. Thus, it is, in principle, legitimate for a Member State to have relevant particulars and documents relating to foreign nationals available to it and to use a register for the purpose of providing support to the authorities responsible for the application of the legislation relating to the right of residence, provided that there is compliance with the requirement of necessity laid down by the Directive on the Protection of Personal Data.
The Court concludes that such a system for processing personal data complies with Community law if it contains only the data which are necessary for the application by those authorities of that legislation and if its centralised nature enables that legislation to be more effectively applied as regards the right of residence of Union citizens who are not nationals of that State.
As regards the storage and processing of those data for statistical purposes, the Court observes that Community law does not exclude the power of Member States to adopt measures enabling the national authorities to have an exact knowledge of population movements affecting their territory. Those statistics presuppose that certain information will be collected by those States. However, the exercise of that power does not, of itself, mean that the collection and storage of individualised personal information of the kind undertaken in the register at issue is, of itself, necessary. Consequently, the Court decides that such processing of personal data does not satisfy the requirement of necessity laid down by the directive.
Lastly, as regards the question of the use of the data contained in the register for the purposes of fighting crime, the Court holds, in particular, that that objective involves the prosecution of crimes and offences committed, irrespective of the nationality of their perpetrators. The register at issue does not contain personal data relating to nationals of the Member State concerned. Consequently, use for the purposes of fighting crime is contrary to the principle of non-discrimination and hence contrary to Community law.
The principle of non-discrimination was assessed in this Judgment from two standpoints, that led to two different outcomes.
First, the Court dealt with the requirement of necessity, as enshrined by Directive 95/46/EC, which was interpreted in the light of the principle of non-discrimination on grounds of nationality, as provided by Article 12 TEC, now Article 18 TFEU. In this respect, the Court found the German system which imposes a registration for the application of the law relating to the right of residence (more than three months) to be indirectly discriminatory. As a consequence, the assessment continued with the proportionality test, so that it was left for the national court to ascertain whether the two following conditions can justify the German legislation, in respect to the residence matter: a)it contains only the data which are necessary for the application by those authorities of that legislation and; b) its centralised nature enables the legislation relating to the right of residence to be more effectively applied as regards Union citizens who are not nationals of that Member State.
It must be pointed out that, the Court did not assess the matter of indirect discrimination according to its settled case-law, so that unlike the national court, the Luxembourg Court made no reference to cornerstone Cases like C‑85/96 Martínez Sala  ECR I‑2691, C-184/99 Grzelczyk  ECR I-6193, Case C-209/03 Bidar  ECR I-2119, which concerned the principle of non-discrimination the EU citizenship. One common element would be the recalling of the provisions of Directive 2004/38/EC on the right of citizens of the Union and their family members to move and reside freely within the territory of the Member States, which indeed stipulates that may require every Union citizen who is a national of another Member State and who wishes to reside in its territory for a period of more than three months to register with the relevant authorities. So it is lawful for national Authorities to require proof from non-nationals that wish to reside on their territory for more than three months, but to have a register only for non-nationals with the objective of providing support for the national Authorities that apply the law related to the right of residence is not necessary for attaining the objective of Directive 95/46.
Secondly, as regards the processing of personal data relating to Union citizens who are nationals of other Member States for the purposes of fighting crime, the Court assessed the discrimination issue according to its settled case-law, making reference to the landmark Cases aforementioned. The Court recalled that that the principle of non-discrimination, which has its basis in Articles 12 EC and 43 EC, now Article 18 and 49 TFEU, requires that comparable situations must not be treated differently and that different situations must not be treated in the same way. Such treatment may be justified only if it is based on objective considerations independent of the nationality of the persons concerned and is proportionate to the objective being legitimately pursued. The Court applied the principle of equal treatment and found that the fact that comparing the situations of national and non-nationals within that register, where no data of the German citizens is contained, constitutes a case of direct discrimination on grounds of nationality.
 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of data and on the free movement of such data
 Case [C‑524/06] Heinz Huber v Bundesrepublik Deutschland  ECR I-09705 paragraph 57.
 Article 1 of Directive 95/46: “In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data”.