General Data Protection Regulation

Article 52

Independence

1. Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation.

2. The member or members of each supervisory authority shall, in the performance of their tasks and exercise of their powers in accordance with this Regulation, remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from anybody.

3. Member or members of each supervisory authority shall refrain from any action incompatible with their duties and shall not, during their term of office, engage in any incompatible occupation, whether gainful or not.

4. Each Member State shall ensure that each supervisory authority is provided with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers, including those to be carried out in the context of mutual assistance, cooperation and participation in the Board.

5. Each Member State shall ensure that each supervisory authority chooses and has its own staff which shall be subject to the exclusive direction of the member or members of the supervisory authority concerned.

6. Each Member State shall ensure that each supervisory authority is subject to financial control which does not affect its independence and that it has separate, public annual budgets, which may be part of the overall state or national budget.

Holdings

/
C-484/2418 Jun 2026

NTH Haustechnik GmbH v EM

1. Point (c) of the first subparagraph of Article 6(1) and Article 6(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in the light of Article 8(2) and Article 52 of the Charter of Fundamental Rights of the European Union,

must be interpreted as not precluding national legislation which, as regards the processing of personal data, undertaken in the context of a court examining the facts and taking evidence, merely prescribes that it is for the parties to submit detailed factual evidence which is truthful and requires that court to take such evidence fully into consideration, before, as the case may be, assessing that evidence, without providing any indication as to the circumstances and conditions under which the facts stated and the evidence adduced by the parties containing personal data may be used by that court, provided that (i) there is clear and precise national case-law, the application of which is foreseeable, and which itself establishes the circumstances and conditions under which the facts stated and the evidence adduced by the parties containing personal data may be used by a court, (ii) that case-law meets an objective of public interest and (iii) that case-law is proportionate to that objective.

C-484/2418 Jun 2026

NTH Haustechnik GmbH v EM

3. Article 5(1)(c) of Regulation 2016/679, read in conjunction with the second sentence of Article 52(1) of the Charter of Fundamental Rights,

must be interpreted as meaning that the principle of 'data minimisation' does not require a court to ensure, for each processing of personal data it undertakes, that the principle of proportionality is observed, by ensuring that the data processed on that occasion are such as to enable the objective pursued by that processing to be achieved and are strictly necessary for achieving it, and that the seriousness of the interference with fundamental rights entailed by taking such data into account in order to undertake that processing is proportionate to the interest which that court has in using those data in order to undertake that processing, provided that the conditions laid down in Article 5(1)(c) of Regulation 2016/679 are met.

C-312/244 Jun 2026

CL v Prokuratura na Republika Bulgaria

2. Article 17(3)(b) of Regulation 2016/679, read in conjunction with point (c) of the first subparagraph of Article 6(1)and Article 6(3) thereof, and in the light of Article 52(1) of the Charter of Fundamental Rights of the European Union,

must be interpreted as meaning that the storage, in the personnel file of a police officer, for the purposes of the management of his career and the monitoring of compliance, by that staff member, with the rules inherent in his or her duties, of personal data relating to his or her status as a suspect in a suspended criminal investigation, where that officer has not been accused of or faced criminal charges for the offence concerned, may be regarded as justified for the purposes of compliance with a legal obligation to which the public authority, the employer of that officer, is subject on the basis of national law, provided that that legal basis is clear and precise, that its application is foreseeable for data subjects and that that obligation meets an objective of public interest and is proportionate to that objective.