The Court of Justice of the European Union ('CJEU') issued, on 16 March 2023, a press release concerning the Advocate General ('AG') Priit Pikamäe's opinion, as issued on the same day, in joint cases C-26/22 and C-64/22 SCHUFA Holding and Others. In particular, the CJEU noted that the opinion was provided in relation to two requests for preliminary rulings lodged by the Administrative Court of Wiesbaden, which originated from two sets of proceedings between two citizens and the Land Hesse, represented by the Hessen data protection authority ('HBDI'), concerning requests, made, respectively, by them to the HBDI to take steps to ensure the deletion of an entry relating to discharge from remaining debts from the records of SCHUFA Holding AG.

Further to the above, the CJEU noted that, in their opinion, the AG took the view that, if a person decided to seek a remedy against the decisions of a supervisory authority, under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), it would be for the national courts to carry out an effective judicial review. In this regard, the CJEU detailed that, in the AG's view, a legally binding decision of a supervisory authority is subject to a full substantive judicial review, which guarantees an effective judicial remedy.

Moreover, the CJEU explained that, according to the AG, the storage of data by a private credit information agency cannot be lawful, under the provision of the GDPR, once the personal data concerning insolvency has been erased from public registers. Additionally, as regards the specific period of time during which the personal data is available both in public registers and in a private credit information agency's records, the CJEU highlighted that, in the AG's view, it is for the national courts to balance the interests and impacts at play, as well as the negative consequences on the person concerned, in order to determine whether the parallel storage of that data by private credit information agencies is lawful. Lastly, the CJEU continued that the AG pointed out that, when an individual exercises their right of erasure, they have the right to obtain such erasure from the data controller without undue delay, clarifying that it is for the national courts to examine if, exceptionally, there are overriding legitimate grounds for the processing.

You can read the press release here and the opinion, available in various languages, here.