The Court of Justice of the European Union (CJEU) published the Advocate General's Opinion on whether the GDPR would restrict the sale of a database by court enforcement officers to satisfy creditor claims without the consent of the relevant data subjects on 22 February 2024.

A Polish court made the reference to the CJEU, requesting a preliminary ruling, in connection with a debt claim against the NMW, which specialises in online sales. The debt claim resulted in a decision by court enforcement officer to terminate enforcement proceedings on the grounds the company had no assets that could be the subject of the enforcement. The applicant then brought an action against one of the members of the management board, citing Article 299(1) of the Commercial Companies Code, which provides that a member of the management board of a debtor company may be liable for damages where there is no possibility of recovering a debt using that company’s assets. In response, the subject of that action requested dismissal of the action on the grounds the company held, among other things, two databases of users of the platform, which together were worth more than the value of the claim.

It was therefore necessary, according to the court, to consider the question of whether the databases created by the company can be transferred in the context of judicial enforcement proceedings, in compliance with applicable laws. In that context, the Polish proceedings were stayed pending a reference to the CJEU for a preliminary ruling, expressing doubts as wo whether a sale was possible without the consent of the data subjects.

In the view of the Advocate General:

• The proposed sale would fall within the scope of the GDPR. They include various acts of processing within the meaning of GDPR. And the court enforcement officer would act as a controller of the personal data.
• This processing of personal data would be lawful to the extent it is necessary for the performance of a task carried out in the exercise of official authority vested in the enforcement officer. The Advocate General acknowledges that this purpose of processing carried out by the enforcement officer differs from the initial purpose of enabling the use of the online sales platform. In order for the processing to be regarded as compatible with the GDPR, it must constitute a necessary and proportionate measure. The Advocate General notes that the objective of ensuring enforcement of civil claims may in principle justify the proposed processing of personal data. However, he notes that the assessment of whether this would be proportionate is a matter for the Polish court, involving a balancing of the creditor company’s right to property and the right to protection of personal data of the users of the online platform concerned.

The Advocate General’s Opinion is not binding on the CJEU. The CJEU judges are now beginning their deliberations in this case and judgment will be given at a later date.

The press release is available here.