In its judgment of January 12, 2023, the Court of Justice of the European Union (CJEU) interpreted the obligations of Member States in protecting the rights guaranteed to right holders under the GDPR Regulation.
In this particular judgment, the situation was one in which a shareholder of a joint stock company asked its board of directors a number of questions at a general meeting of the company, after which the shareholder requested the company, as the controller of the personal data, to provide the audio recording made at the meeting. The company provided him with the recording, but its content was limited to the shareholder’s statements and the output of all other participants in the general meeting was excluded.
In response, the shareholder made a request to the regulatory authority to secure the unaltered form of the recording, which was declined. The shareholder filed two actions against the decision under the GDPR Regulation and the law of the Member State (Hungary), i.e.: he filed 1) a lawsuit against the decision of the supervising authority; and 2) a civil lawsuit against the company’s decision.
In the civil lawsuit against the company’s decision, the shareholder was successful, and his claim was granted by finding that the company, as a data controller, violated the shareholder’s right of access to personal data. In the second case, a preliminary question was referred to the CJEU.
On the preliminary question, the CJEU stated that The coordination of the different means of protecting individuals’ rights under the GDPR Regulation (i.e., lodging a complaint, civil action, but also other means of judicial protection) is thus a problem that each individual Member State must resolve under national law, ensuring that when multiple means of protecting individuals’ rights are used, decisions on them are not contradictory..
A practical fact resulting from the CJEU judgment is that the means of protection of rights under the GDPR Regulation can also be used in the case of disputes between a shareholder of a company and the company itself.
