OPINION OF ADVOCATE GENERAL
JÄÄSKINEN
delivered on 10 July 2014 (1)
Case C‑212/13
František Ryneš
v
Úřad pro ochranu osobních údajů
(Request for a preliminary ruling from the Nejvyšší správní soud (Czech Republic))
(Approximation of laws — Processing of personal data — Directive 95/46/EC — Scope — Exceptions — Article 3(2) — Meaning of ‘in the course of a purely personal or household activity’ — Use of a surveillance camera to record footage of the entrance to the recording system operator’s home, a public space and the entrance to the house opposite)
I – Introduction
1. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (2) regulates these matters in detail. However, under the second indent of Article 3(2) of Directive 95/46, the directive does not apply to the processing of personal data ‘by a natural person in the course of a purely personal or household activity’. (3)
2. In the context of a dispute between Mr Ryneš and the Úřad pro ochranu osobních údajů (Office for Personal Data Protection; or ‘the Office’), the Nejvyšší správní soud (Supreme Administrative Court of the Czech Republic; or ‘the referring court’) seeks from the Court of Justice an interpretation of that exception. The dispute before the referring court concerns a decision by which the Office found that Mr Ryneš had committed a number of offences in relation to the protection of personal data by installing a surveillance camera under the eaves of his house which recorded not only his own home but also the public footpath and the house opposite.
3. Unless I am mistaken, the Court has never had to deal with a case in which it has found that the conditions for applying the second indent of Article 3(2) of Directive 95/46 were satisfied, even though the applicability of that provision was invoked — notably, in Lindqvist. (4) Given the approach underpinning the Court’s case-law and particularly in view of the recent judgments in Digital Rights Ireland and Seitlinger and Others (5) and Google Spain and Google (6) which accord precedence to the fundamental right to the protection of personal data, I will propose in this Opinion that it be held that the above exception does not cover circumstances such as those of the case before the referring court and that, in consequence, Directive 95/46 applies.
4. It should be noted that the question whether the activities engaged in by Mr Ryneš ‘for the purposes of protecting the property, health and life of the owners of the home’ fall within the scope of Directive 95/46 has no bearing whatsoever on the question whether surveillance of that kind may be carried out. The sole purpose of this case is to identify the applicable legal framework.
II – Legal framework
A – EU law
5. Article 7 of the Charter of Fundamental Rights of the European Union (‘the Charter’) states that ‘[e]veryone has the right to respect for his or her private and family life, home and communications’.
6. Under Article 8(1) of the Charter, ‘[e]veryone has the right to the protection of personal data concerning him or her’. Paragraphs 2 and 3 of Article 8 of the Charter add the following details:
‘2. [Personal data] must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.’ (7)
7. Recitals 12 and 16 in the preamble to Directive 95/46 state:
‘(12) … there should be excluded the processing of data carried out by a natural person in the exercise of activities which are exclusively personal or domestic, such as correspondence and the holding of records of addresses;
(16) … the processing of sound and image data, such as in cases of video surveillance, does not come within the scope of this Directive if it is carried out for the purposes of public security, defence, national security or in the course of State activities relating to the area of criminal law or of other activities which do not come within the scope of Community law.’
8. Article 3 of the directive, entitled ‘Scope’, provides:
‘1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.
2. This Directive shall not apply to the processing of personal data:
– in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,
– by a natural person in the course of a purely personal or household activity.’
B – Czech legislation
9. Paragraph 3(3) of Law No 101/2000 Sb. on the Protection of Personal Data and the Amendment of Various Laws (‘Law No 101/2000’) provides:
‘This Law does not cover the processing of personal data carried out by a natural person solely for personal use.’
10. Under Paragraph 5(2)(e) of that law, the processing of personal data is in principle only possible with the consent of the data subject. In the absence of such consent, personal data may be processed where doing so is necessary to safeguard the legally protected rights and interests of the data controller, recipient or other data subjects. However, such processing must not adversely affect the data subject’s right to respect for his private and family life.
11. Paragraph 44(2) of Law No 101/2000 governs the liability of the personal data controller, who commits an offence if he processes personal data without the consent of the data subject; or if he does not provide the data subject with the relevant information; or if he does not comply with the obligation to report to the competent authority.
III – The dispute in the main proceedings, the question referred and the procedure before the Court
12. Between 5 October 2007 and 11 April 2008, Mr Ryneš used a camera located under the eaves of his house. The camera was in a fixed position and could not be rotated. It recorded the entrance to his home, the public footpath and the entrance to the house opposite. The system allowed only a visual recording, which was stored on a continuous recording device, that is to say, on a hard disk drive. Once full capacity was reached, the existing recording would be erased and recorded over. No monitor was installed on the recording equipment, so it was not possible for the images to be viewed in real time. Only Mr Ryneš had direct access to the system and the recorded data.
13. The referring court points out that Mr Ryneš’ only reason for using the camera was to protect the property, health and life of his family and himself. This was because both Mr Ryneš and his family had been attacked over a number of years by persons unknown whom it had not been possible to identify. Also, the windows of the house, which belongs to his wife, had been broken on several occasions between 2005 and 2007.
14. On the night of 6 to 7 October 2007, a window was broken at Mr Ryneš’ home by a shot from a catapult. The video surveillance system in question made it possible to identify two suspects. The recording was handed over to the police and subsequently used as evidence in criminal proceedings.
15. One of the suspects asked for confirmation that Mr Ryneš’s surveillance system was legitimate. By decision of 4 August 2008, the Office found that Mr Ryneš had committed offences under Law No 101/2000, owing to the following facts:
– as data controller, he had used a camera system to collect, without their consent, the personal data of persons moving along the street or entering the house opposite;
– the data subjects had not been informed of the processing of those personal data; the extent and purpose of such processing; the identity of the data processor and the method of processing; or the persons who might have access to the data at issue; and
– as data controller, Mr Ryneš had not complied with the requirement to report the processing in question to the Office.
16. Mr Ryneš brought an action contesting that decision, which the Městský soud v Praze (Prague City Court) dismissed by judgment of 25 April 2012. He then lodged an appeal on a point of law against that judgment before the referring court.
17. In those circumstances, the Nejvyšší správní soud decided by decision of 20 March 2013 to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:
‘Can the operation of a camera system installed on a family home for the purposes of protecting the property, health and life of the owners of the home be classified as the processing of personal data “by a natural person in the course of a purely personal or household activity” for the purposes of Article 3(2) of Directive 95/46 …, even though such a system monitors also a public space?’
18. Written observations have been submitted by Mr Ryneš, the Office, the Czech, Spanish, Italian, Austrian, Polish, Portuguese and UK Governments, and the European Commission. The Czech, Austrian, Polish and UK Governments were represented at the hearing on 20 March 2014, as was the Commission.
IV – Analysis
A – Preliminary remarks
1. Outline of the case
19. It should be observed, first, that the question referred in the present case is very precise and focuses on the interpretation of the expression ‘in the course of a purely personal or household activity’, on which the applicability of Directive 95/46 to the video surveillance carried out by Mr Ryneš depends. The Court’s response to this request for interpretation cannot be conditioned by the fact that the video surveillance achieved the objective pursued, namely the identification of the wrongdoers. The same response should be given if the video surveillance had been unsuccessful and resulted only in recordings — ultimately erased and, therefore, never used — of persons in the public space in front of Mr Ryneš’s home.
20. Secondly, the case essentially concerns the characterisation of the video surveillance at issue for the purposes of applying Directive 95/46. Consequently, the subsequent use of the recorded images cannot, to my mind, be a decisive factor in deciding whether the directive is applicable. (8) The legal characterisation of the video surveillance carried out by Mr Ryneš cannot vary according to whether the images were ultimately erased or saved.
21. Thirdly, the case giving rise to the reference for a preliminary ruling differs from situations in which video surveillance is carried out by public authorities or legal persons. In the case of public authorities, Directive 95/46 is applicable, except in the situations referred to in the first indent of Article 3(2) of Directive 95/46. In the case of legal persons, Directive 95/46 applies without restrictions. That is why the case-law of the European Court of Human Rights — which, incidentally, is quite extensive in this field — does not, it seems to me, provide guidelines which may be directly transposed. (9)
22. Lastly, it is clear in the present case that the Charter applies, particularly Articles 7 and 8. The situation at issue is liable to create a conflict between the fundamental rights of the data controller and those of the data subject. In the present case, the conflict pits Mr Ryneš against the wrongdoers who were identified. However, in the context of the applicability of Directive 95/46 generally, the conflict is between, on the one hand, the right of all natural persons carrying out video surveillance of a public space to the protection of their private life and, on the other, the right of all persons in that public space to respect for personal data.
23. If the Court finds that Directive 95/46 is applicable in these circumstances, a balance would have to be struck between the various rights and interests affected under the terms of the material provisions of Directive 95/46 and, in particular, under Article 7(f) of that directive. (10) I should point out that it would be for the referring court to do so, but that this goes beyond the bounds of the present reference for a preliminary ruling. (11)
2. Guidance in the case-law regarding the protection of personal data
24. Directive 95/46 is intended to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data. (12)
25. The Court draws inspiration from the Charter for the purposes of interpreting EU law. The case-law also links Directive 95/46 to general legal principles and, by doing so, to Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’). (13) The Court has also held that Directive 95/46 represents a balance, determined by the legislature, between the different fundamental rights in play. (14)
26. Accordingly, in Google Spain and Google, (15) the Court emphasised the importance of the effectiveness of Directive 95/46 and of the effective and complete protection of the fundamental rights and freedoms of natural persons which the directive seeks to ensure, (16) especially their right to privacy with respect to the processing of personal data, a right to which the directive accords special importance, as is confirmed in particular by Article 1(1) of the directive and recitals 2 and 10 thereto. (17)
27. In that regard, the Court has also ruled that, in so far as it governs the processing of personal data liable to infringe fundamental freedoms, in particular the right to privacy, Directive 95/46 must necessarily be interpreted in the light of fundamental rights, which, according to settled case-law, form an integral part of the general principles of law whose observance the Court must ensure and which are now enshrined in the Charter. (18)
28. More specifically, the Court stated in Google Spain and Google: ‘Article 7 of the Charter guarantees the right to respect for private life, whilst Article 8 of the Charter expressly proclaims the right to the protection of personal data. Article 8(2) and (3) specify that such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law, that everyone has the right of access to data which have been collected concerning him or her and the right to have the data rectified, and that compliance with these rules is to be subject to control by an independent authority. Those requirements are implemented inter alia by Articles 6, 7, 12, 14 and 28 of Directive 95/46.’ (19)
29. I should point out that those provisions, with the exception of Article 28, also apply to the horizontal relations between data subjects and data processors who are not public authorities.
3. Video surveillance in the light of the objectives of Directive 95/46
a) Video surveillance
30. Video surveillance is characterised by its continuous and automatic nature, irrespective of the (varying) length of time for which recordings are ultimately stored. (20) I note that the present question referred for a preliminary ruling relates to a type of fixed surveillance system which covers a public space as well as the door of the house opposite, thereby enabling the identification of countless individuals without them having been informed of such surveillance beforehand. By contrast, the legal questions associated with recordings made using mobile phones, camcorders or digital cameras are of a different nature, and so will not be addressed in this Opinion.
31. The fact that video surveillance with image recording falls within the scope of Directive 95/46, in so far as it either constitutes automatic processing (which is the case with digital recordings) or results in such processing, is clear from recital 16 to the directive.
32. I note, in that regard, that the referring court raises the question of the interpretation of the second indent of Article 3(2) of Directive 95/46. I am therefore of the opinion that the referring court implicitly, albeit necessarily, finds that the processing at issue in the proceedings before it satisfies the criteria set out in Article 3(1) of that directive. (21)
33. The referring court does not provide any detailed description of the content of the video recordings at issue. However, it is reasonable to suppose that, in accordance with the Court’s case-law, recordings of this kind ‘taken as a whole, may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them’. (22)
34. Furthermore, ‘[t]he retention of data for the purpose of possible access to them by the competent national authorities’, as was the position in the case before the referring court, ‘directly and specifically affects private life and, consequently, the rights guaranteed by Article 7 of the Charter. Furthermore, such a retention of data also falls under Article 8 of the Charter because it constitutes the processing of personal data within the meaning of that article and, therefore, necessarily has to satisfy the data protection requirements arising from that article’. (23)
b) Objectives of Directive 95/46
35. The Court has stated that, according to recitals 3, 7 and 8 to Directive 95/46, by harmonising national provisions on the protection of individuals with regard to the processing of personal data, the directive seeks principally to ensure the free movement of such data between Member States, which is necessary for the establishment and functioning of the internal market, within the meaning of Article 14(2) EC. (24)
36. In accordance with its title, Directive 95/46 also pursues another aim, which is the ‘protection of individuals with regard to the processing of personal data’. The directive thus creates a framework within which the protection of individuals in relation to the processing of personal data is ensured.
37. Furthermore, it has to be said that the free movement of personal data is liable to interfere with the right to private life, as recognised, inter alia, in Article 8 of the ECHR (25) and the general principles of EU law. (26)
38. For that reason, and as can be seen in particular from Article 1 of Directive 95/46 and recital 10 thereto, that directive is also designed, not to weaken the protection offered by the existing national rules, but on the contrary to ensure, in the European Union, a high level of protection of fundamental rights and freedoms in relation to the processing of personal data. (27)
39. It is clear that, as regards the right to respect for private life, ‘the protection of that fundamental right requires, according to the Court’s settled case-law, in any event, that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary’ (28) and that ‘the protection of personal data resulting from the explicit obligation laid down in Article 8(1) of the Charter is especially important for the right to respect for private life enshrined in Article 7 of the Charter’. (29)
B – The exclusion from the scope of Directive 95/46 laid down in the second indent of Article 3(2)
40. The case before the referring court raises the question whether Mr Ryneš’ activities are excluded from the scope of Directive 95/46 under the terms of the exception laid down in the second indent of Article 3(2) of that directive, which concerns processing ‘by a natural person in the course of a purely personal or household activity’. That provision does not refer to the purpose of the processing of personal data; in the case under consideration, that purpose is described in the question referred for a preliminary ruling as the protection of the ‘property, health and life of the owners of the home’.
41. I should point out that the case before the referring court does not concern State security, or the activities of the State in areas of criminal law, which could come within the exception laid down in the first indent of Article 3(2) of Directive 95/46, even though the collected data were ultimately handed over to the authorities. (30) Mr Ryneš acted as a private individual who was a victim of a criminal offence and not as an officer of the law.
42. Mr Ryneš is of the opinion, as are the Czech, Italian, Polish and UK Governments, that the operation of a video surveillance system such as that at issue, which is intended to protect the property, health and life of the owners of the house, is carried out in the course of a purely personal or household activity for the purposes of the second indent of Article 3(2) of Directive 95/46, even though that system also monitors a public space. On the other hand, the Office, the Austrian, Portuguese and Spanish Governments and the Commission argue that the above exception does not apply in a situation where that system also monitors a public space, as in the present case.
a) Consideration of the purpose of the processing as a criterion for the applicability of Directive 95/46
43. At the hearing, there was a wide-ranging discussion of the question whether the application of the exception could depend on the intention of the individual concerned. More specifically, the question is whether the ‘purely personal or household’ nature of the data processing could be determined in the light of the aim pursued by the data controller.
44. According to the referring court, Mr Ryneš had carried out the surveillance ‘for the purposes of the protection of the property, health and life of the owners of the home’. In my opinion, it is possible for an activity characterised by such a subjective purpose to satisfy the conditions under Article 7(f) of Directive 95/46, which would render the processing of the personal data lawful under that directive. However, that is not the question before the Court. The question referred for a preliminary ruling concerns the scope of Directive 95/46, which is a question logically prior to all questions relating to the interpretation of the directive’s substantive provisions.
45. In those circumstances, it must be ascertained whether the processing of personal data carried out by Mr Ryneš falls outside the scope of the directive, in view of its subjective purpose, in so far as that purpose could be considered to render the data processing concerned purely personal or household in nature.
46. I would call back to mind the fact that the second indent of Article 3(2) of Directive 95/46 is intended to delimit the scope of the directive by excluding certain situations or activities which, despite satisfying the criteria laid down in the directive, are nevertheless excluded from its scope. In my view, the scope of an EU legal instrument cannot depend on the subjective purpose of the interested party — in this case, the data controller — since that purpose is neither objectively verifiable by reference to external factors nor relevant with respect to the data subjects whose rights and interests are affected by the activity in question.
47. The purpose of the personal data processing cannot be a decisive factor in relation to pedestrians under video surveillance when walking down a public street, from the perspective of their need for protection under specific legislative provisions delimiting their legal position vis-à-vis the personal data controller. On the other hand, the purpose of the processing may come into play when its lawfulness is assessed. The scope of the directive must therefore be established on the basis of objective criteria.
b) A purely personal or household activity
48. In order to illustrate what is meant by the exception in question, Directive 95/46 gives two examples: correspondence and the holding of records of addresses. (31) Obviously, as an exception, this provision must be narrowly construed, a point confirmed by the case-law on Directive 95/46. (32)
49. The very precise definition of this exception helps prevent the unregulated collection of personal data that could take place outwith the framework of EU law and which is therefore not subject to the requirements flowing from Article 8(2) and (3) of the Charter. (33)
50. As in the present case, Lindqvist concerned the processing of personal data carried out by a natural person. Advocate General Tizzano took the view that ‘purely personal or household activities only covered activities such as “correspondence and the holding of records of addresses” …, that is to say, clearly private and confidential activities that are intended to be confined to the personal or domestic circle of the persons concerned’ and that, in the case then under consideration, the exception set out in the second indent was not applicable. (34)
51. In my view, ‘personal’ activities under the second indent of Article 3(2) of Directive 95/46 are activities which are closely and objectively linked to the private life of an individual and which do not significantly impinge upon the personal sphere of others. These activities may, however, take place outside the home. ‘Household’ activities are linked to family life and normally take place at a person’s home or in other places shared with family members, such as second homes, hotel rooms or private cars. All such activities have a link with the protection of private life as provided for under Article 7 of the Charter.
52. I agree with the UK Government that this exception makes it possible — within the current legal framework, namely, that established by the directive — to ensure the protection provided for under Article 7 of the Charter to the benefit of individuals who process personal data in their private and family life.
53. However, in the context of Directive 95/46, if that exception is to operate, it is not enough for the activities contemplated to be linked to personal or household activities; that link must also be an exclusive one. I should add that, to my way of thinking, there is no doubt that the exclusivity condition applies to both personal and household activities.
54. I note that the video surveillance of others, that is to say, the systematic surveillance of places by means of a device which produces a video signal which is recorded for the purposes of identifying individuals, even inside a house, cannot be regarded as purely personal, but that does not mean that it could not fall within the definition of household activity.
55. By contrast, it is true — as the UK Government contends — that the protection of the inviolability of a private dwelling and the protection of that dwelling against theft and illegal access are activities which are essential for each household and, for that reason, activities that can be regarded as household activities.
56. Nevertheless, in my opinion, video surveillance which covers a public space cannot be considered to be a purely household activity, because it covers persons who have no connection with the family in question and who wish to remain anonymous. The Court has found that ‘the fact that data are retained and subsequently used without’ the data subjects in the case in point ‘being informed is likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance’. (35)
57. Accordingly, the systematic video surveillance of a public space by natural persons is not exempt from the requirements, relating to the protection of personal data, which are applicable to video surveillance by legal persons and public authorities. That interpretation also prevents preference being given to persons carrying out video surveillance of a public space in front of a single-family home, as compared with surveillance of the surroundings of buildings in co-ownership, as all personal data controllers, both natural and legal persons, are thus subject to the same requirements. (36)
58. I therefore conclude that processing of personal data akin to that carried out by Mr Ryneš is not covered by the concept of processing ‘in the course of a purely personal or household activity’ and, accordingly, it does not come under the exception in question and falls within the scope of Directive 95/46.
c) Additional observations
59. For the sake of completeness, I should point out that, even though the case-law often refers to the ‘publication’ of personal data as one of the factors taken into account in order to find that the exception laid down in the second indent of Article 3(2) of Directive 95/46 (37) is inapplicable, the lack of publication does not, a contrario, render that exception applicable. The recording and stocking of personal data constitutes in itself an interference with the rights guaranteed by Article 7 of the Charter. (38)
60. In addition, I note that the personal data recorded by Mr Ryneš were disclosed to the authorities in connection with criminal proceedings. It should be observed that, according to the Court’s case-law, ‘the access of the competent national authorities to the data constitutes a further interference with that fundamental right’. (39)
61. If the Court finds, as I suggest, that Directive 95/46 is applicable, the activity pursued by Mr Ryneš will have to be examined in the context of that directive, which is intended to find and ensure a balance between the fundamental rights and interests of individuals.
62. In those circumstances, the ‘lawfulness’ of the data processing in question will have to be reviewed. (40) In that regard, it should be noted that — subject to the exemptions allowed under Article 13 of Directive 95/46 and, in particular, ‘the protection of the data subject or of the rights and freedoms of others’ — all processing of personal data must respect the principles relating to data quality set out in Article 6 of Directive 95/46 and must also meet one of the criteria, listed in Article 7 of that directive, for making data processing legitimate. (41)
63. As for the lawfulness of data processing in the form at issue in the main proceedings, I believe that it may be lawful under Article 7(f) of Directive 95/46.
64. Article 7(f) of Directive 95/46 sets out two cumulative conditions that must be met if the processing of personal data is to be lawful: (i) the processing of the personal data must be necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed; and (ii) such interests must not be overridden by the fundamental rights and freedoms of the data subject. Account must be taken of the fact that the second of those conditions makes it necessary to weigh the opposing rights and interests concerned in order to strike a balance, which depends, in principle, on the individual circumstances of the particular case and in the context of which the person or the institution which weighs those interests must take account of the significance of the data subject’s rights under Articles 7 and 8 of the Charter. (42) Article 7(f) of Directive 95/46 is often the lynchpin for determining the lawfulness of the processing of personal data. (43)
65. In the case currently under consideration, it seems to me that the activity pursued by Mr Ryneš was intended to protect his enjoyment of other fundamental rights, such as the right to property and the right to family life.
66. Accordingly, the fact that Directive 95/46 is applicable is not necessarily unfavourable to the interests of personal data controllers, provided that those interests are actually lawful in accordance with Article 7(f) of that directive. It is illogical to argue that, in order to protect Mr Ryneš’ fundamental rights, it is appropriate to leave unapplied an EU directive which is specifically intended to strike a fair balance between Mr Ryneš’ rights and the rights of other natural persons, namely, the people affected by the processing of personal data.
67. The fact that Directive 95/46 applies to such a situation does not, in itself, mean that the activity pursued by Mr Ryneš is unlawful. However, it is within the framework of Directive 95/46 that a balance between the fundamental rights applicable in the main proceedings will have to be struck.
V – Conclusion
68. In the light of the foregoing considerations, I propose that the Court state as follows in answer to the question referred for a preliminary ruling by the Nejvyšší správní soud:
The operation of a camera system installed on a family home for the protection of the property, health and life of the owners of the home, but which also monitors a public space, cannot be regarded as the processing of personal data by a natural person in the course of a purely personal or household activity for the purposes of Article 3(2) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.