Court of Justice of the European Communities (including Court of First Instance Decisions)

Provisional text

JUDGMENT OF THE COURT (Eighth Chamber)

25 February 2021 (*)

(Failure of a Member State to fulfil obligations – Article 258 TFEU – Directive (EU) 2016/680 – Processing of personal data – Prevention, investigation, detection or prosecution of criminal offences – Failure to transpose and notify the transposition measures – Article 260(3) TFEU – Application for the imposition of a lump sum and a penalty payment)

In Case C‑658/19,

ACTION for failure to fulfil obligations under Article 258 and Article 260(3) TFEU, brought on 4 September 2019,

European Commission, represented by D. Nardi, G. von Rintelen and S. Pardo Quintillán, acting as Agents,

applicant,

v

Kingdom of Spain, represented by L. Aguilera Ruiz, acting as Agent,

defendant,

supported by:

Republic of Poland, represented by B. Majczyna, acting as Agent,

intervener,

THE COURT (Eighth Chamber),

composed of N. Wahl, President of the Chamber, F. Biltgen (Rapporteur) and L.S. Rossi, Judges,

Advocate General: G. Pitruzzella,

Registrar: A. Calot Escobar,

having regard to the written procedure,

having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,

gives the following

Judgment

1        By its application, the European Commission claims that the Court should:

–        declare that, by failing to adopt, by 6 May 2018 at the latest, the laws, regulations and administrative provisions necessary to comply with Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89), or, in any event, by failing to notify those measures to the Commission, the Kingdom of Spain has failed to fulfil its obligations under Article 63(1) of Directive 2016/680;

–        impose a penalty payment on that Member State, pursuant to Article 260(3) TFEU, in the amount of EUR 89 548.20 for each day of delay, as from the date of the judgment of the Court, for failure to fulfil its obligation to notify the measures transposing that directive;

–        impose the payment of a lump sum on that Member State pursuant to Article 260(3) TFEU, on the basis of a daily amount of EUR 21 321.00 multiplied by the number of days which have elapsed between the day following the expiry of the transposition deadline laid down in the directive and the date on which the infringement comes to an end, or, failing compliance, the date of delivery of this judgment, with a minimum lump sum of EUR 5 290 000; and

–        order the Kingdom of Spain to pay the costs.

 Legal context

2        Article 1 of Directive 2016/680 is worded as follows:

‘1.      This Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

2.      In accordance with this Directive, Member States shall:

(a)      protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data; and

(b)      ensure that the exchange of personal data by competent authorities within the Union, where such exchange is required by Union or Member State law, is neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.

3.      This Directive shall not preclude Member States from providing higher safeguards than those established in this Directive for the protection of the rights and freedoms of the data subject with regard to the processing of personal data by competent authorities.’

3        Article 63(1) of Directive 2016/680 provides:

‘1.      Member States shall adopt and publish, by 6 May 2018, the laws, regulations and administrative provisions necessary to comply with this Directive. They shall forthwith notify to the Commission the text of those provisions. They shall apply those provisions from 6 May 2018.

When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made.

2.      By way of derogation from paragraph 1, a Member State may provide, exceptionally, where it involves disproportionate effort, for automated processing systems set up before 6 May 2016 to be brought into conformity with Article 25(1) by 6 May 2023.

3.      By way of derogation from paragraphs 1 and 2 of this Article, a Member State may, in exceptional circumstances, bring an automated processing system as referred to in paragraph 2 of this Article into conformity with Article 25(1) within a specified period after the period referred to in paragraph 2 of this Article, if it would otherwise cause serious difficulties for the operation of that particular automated processing system. The Member State concerned shall notify the Commission of the grounds for those serious difficulties and the grounds for the specified period within which it shall bring that particular automated processing system into conformity with Article 25(1). The specified period shall in any event not be later than 6 May 2026.

4.      Member States shall communicate to the Commission the text of the main provisions of national law which they adopt in the field covered by this Directive.’

 Pre-litigation procedure and proceedings before the Court

4        Since the Commission had not received from the Kingdom of Spain any information concerning the adoption and publication of the laws, regulations and administrative provisions necessary to comply with Directive 2016/680 by the expiry of the transposition deadline laid down in Article 63 of that directive, namely 6 May 2018, the Commission sent a letter of formal notice to that Member State on 20 July 2018.

5        In the Kingdom of Spain’s reply, dated 26 September 2018, it became clear that, on that date, no transposition measure had yet been adopted. On 25 January 2019, the Commission therefore sent a reasoned opinion to that Member State, inviting it to adopt the measures necessary to comply with the requirements of Directive 2016/680 within two months of receipt of that opinion.

6        In its response to the reasoned opinion, dated 27 March 2019, the Kingdom of Spain stated that the administrative procedure for the adoption of the measures transposing Directive 2016/680 was ongoing and would be finalised at the end of July 2019. It specified that the parliamentary procedure should be completed by the end of March 2020. In addition, that Member State stated that the delay in transposition was essentially due to the particular political context and the need to transpose that directive by means of an organic law.

7        Considering that the Kingdom of Spain had not adopted the national measures transposing Directive 2016/680, nor notified those measures, the Commission brought the present action on 4 September 2019.

8        By decision of the President of the Court of 10 December 2019, the Republic of Poland was granted leave to intervene in support of the Kingdom of Spain.

 The action

 Failure to fulfil obligations under Article 258 TFEU

 Arguments of the parties

9        According to the Commission, by failing to adopt, by 6 May 2018 at the latest, all the laws, regulations and administrative provisions necessary to comply with Directive 2016/680 or, in any event, by failing to notify those provisions to the Commission, the Kingdom of Spain has failed to fulfil its obligations under Article 63 of that directive.

10      The Commission also claims that that Member State has failed to fulfil its obligations by failing to adopt a specific transposition measure since, according to the Court’s case-law, where, as in Article 63 of Directive 2016/680, a directive expressly requires that the measures transposing it include a reference to the directive or that such reference is made when they are officially published, it is in any event necessary to adopt a specific transposition measure.

11      Moreover, in its judgment of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks) (C‑543/17, EU:C:2019:573), the Court held that the Member States must provide to the Commission clear and precise information and indicate unequivocally the laws, regulations and administrative provisions by means of which they consider that they have satisfied the various requirements imposed on them by a directive.

12      In the present case, the Commission considers that none of those obligations has been complied with by the Kingdom of Spain.

13      The Kingdom of Spain does not dispute that it has failed to fulfil its obligations to adopt and notify measures transposing Directive 2016/680.

14      However, that Member State explains that a series of very exceptional circumstances delayed the activities of the national government and parliament with regard to the adoption of the transposition measures required, which will be notified to the Commission in accordance with Article 63 of Directive 2016/680 as soon as they are adopted. While acknowledging that the institutional circumstances of the case do not, under the Court’s case-law, allow the alleged failure to be justified, the Kingdom of Spain maintains that those circumstances are particularly relevant to assess the proportionality of the sanctions proposed by the Commission.

 Findings of the Court

15      According to the Court’s settled case-law, the question whether a Member State has failed to fulfil its obligations must be determined by reference to the situation prevailing in that Member State at the end of the period laid down in the reasoned opinion, the Court being unable to take account of any subsequent changes (judgments of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 23; of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 19; and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 30).

16      In addition, the Court has repeatedly held that if a directive expressly requires Member States to ensure that the necessary measures transposing the directive include a reference to it or that such reference is made when those measures are officially published, it is, in any event, necessary for Member States to adopt a specific measure transposing the directive in question (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 20, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 31).

17      In the present case, since the Commission sent the reasoned opinion to the Kingdom of Spain on 25 January 2019, the two-month period within which it was required to comply with its obligations expired on 25 March 2019. It is therefore necessary to assess whether or not the alleged failure to fulfil obligations exists in the light of the state of the domestic legislation in force on that date (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 21, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 32).

18      In that regard, as is apparent both from the Kingdom of Spain’s response to the letter of formal notice and the reply lodged by that Member State in the present proceedings, it is common ground that, by the expiry of the period laid down  in the reasoned opinion, namely 25 March 2019, the Kingdom of Spain had not adopted the measures necessary to ensure the transposition of Directive 2016/680 and, accordingly, had not notified those measures to the Commission.

19      As regards the arguments put forward by the Kingdom of Spain seeking to justify non-compliance with the transposition deadline in question and based, primarily, on the interim nature of the Spanish Government during the relevant period, it is sufficient to recall that, according to the Court’s settled case-law, a Member State cannot plead provisions, practices or situations prevailing in its domestic legal order to justify failure to observe obligations arising under EU law such as failure to transpose a directive within the period prescribed (judgment of 4 October 2018, Commission v Spain, C‑599/17, not published, EU:C:2018:813, paragraph 23).

20      It must, therefore, be concluded that, by the expiry of the period prescribed in the reasoned opinion, the Kingdom of Spain had neither adopted the measures necessary to ensure the transposition of Directive 2016/680 nor, therefore, notified those measures to the Commission.

21      Accordingly, it must be held that, by failing to adopt, by the expiry of the period prescribed in the reasoned opinion, the laws, regulations and administrative provisions necessary to comply with Directive 2016/680 and, therefore, by failing to notify those provisions to the Commission, the Kingdom of Spain has failed to fulfil its obligations under Article 63 of that directive.

 Failure to fulfil obligations under Article 260(3) TFEU

 Application of Article 260(3) TFEU

–       Arguments of the parties

22      The Commission observes that the Court held, in paragraphs 53 to 59 of its judgment of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks) (C‑543/17, EU:C:2019:573), that Article 260(3) TFEU covers both the situation where a Member State has failed to notify any transposition measure and the situation where it has notified those measures only in part. That situation can occur either where the transposition measures notified to the Commission do not cover the whole territory of the Member State, or where the notification is deficient in respect of transposition measures corresponding to part of the directive.

23      That institution notes moreover that, in its Communication entitled ‘EU law: Better results through better application’ (OJ 2017 C 18, p. 10), it recalled that it attaches a high importance to the timely transposition of directives. Noting that Member States continue to fail to meet transposition deadlines, the Commission announced that it would adjust its practice in cases brought before the Court under Article 260(3) TFEU and systematically ask the Court to impose a lump sum, as well as a penalty payment. The Commission also stated that, when determining the amount of the lump sum in accordance with its practice, it takes into account the extent of transposition when determining the seriousness of the failure to transpose.

24      The present case specifically concerns penalties for, in addition to the failure to notify the transposition measures to the Commission, the Kingdom of Spain’s failure to adopt and publish all the legal provisions necessary to ensure the transposition of Directive 2016/680 into national law.

25      The Kingdom of Spain considers that, although the national institutional circumstances do not justify the allegation that it failed to fulfil its obligations, they should be taken into account when assessing the proportionality of the penalties proposed by the Commission in the present case, since the two-month deadline for reply laid down in the letter of formal notice expired less than one month before the dissolution of the national parliament and the start of the electoral process.

26      The Kingdom of Spain contends that, in view of the governmental situation at that time – the government was dealing only with day-to-day business pending the formation of a new government – and the characteristics of the Spanish parliamentary system, the bringing of an action for failure to fulfil obligations together with an application for imposition of a periodic penalty payment and a lump sum pursuant to Article 260(3) TFEU constitutes a serious precedent likely to affect the rights of the Member States. In support of its argument, it invokes Articles 4 and 5 TEU, in particular Article 4(2) TEU, which lays down the obligation to respect the national identity of the Member States. In exceptional circumstances such as those of the present case, the Kingdom of Spain considers it necessary to reconcile, first, the requirements of Article 4(2) TEU and of the principle of proportionality and, second, the Commission’s discretion to bring an action under Article 260(3) TFEU. In the absence of such reconciliation, recourse to Article 260(3) TFEU could become an instrument which alters the democratic process in the Member States and affects their constitutional functioning.

27      The Republic of Poland submits that, by bringing the present action, the Commission failed to comply with the conditions laid down in Article 260(3) TFEU in that it has not demonstrated, first, in a specific and individual manner that the application for the imposition of a financial penalty was justified and, second, the need to impose on the Kingdom of Spain the payment of both a daily penalty payment and a lump sum.

–       Findings of the Court

28      It must be borne in mind that the first subparagraph of Article 260(3) TFEU provides that when the Commission brings a case before the Court pursuant to Article 258 TFEU on the ground that the Member State concerned has failed to fulfil its obligation to notify measures transposing a directive adopted under a legislative procedure, it may, when it deems appropriate, specify the amount of the lump sum or penalty payment to be paid by the Member State concerned which it considers appropriate in the circumstances. In accordance with the second subparagraph of Article 260(3) TFEU, if the Court finds that there is an infringement it may impose a lump sum or penalty payment on the Member State concerned not exceeding the amount specified by the Commission. The payment obligation is to take effect on the date set by the Court in its judgment.

29      As regards the scope of Article 260(3) TFEU, the Court has held that that provision had to be interpreted in a manner which, on the one hand, allows prerogatives held by the Commission for the purposes of ensuring the effective application of EU law and protecting the rights of the defence and the procedural position enjoyed by the Member States under Article 258 TFEU, read in conjunction with Article 260(2) TFEU, to be guaranteed, and, on the other, puts the Court in a position of being able to exercise its judicial function of determining, in a single set of proceedings, whether the Member State in question has fulfilled its obligations to notify the measures transposing the directive in question and, where relevant, assess the seriousness of the declared failure and impose the financial penalty which it considers to be the most suited to the circumstances of the case (judgments of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 58; of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 45; and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 55).

30      In that context, the Court has interpreted the expression ‘obligation to notify measures transposing a directive’ in Article 260(3) TFEU as referring to the obligation of the Member States to provide sufficiently clear and precise information on the measures transposing a directive. In order to satisfy the obligation of legal certainty and to ensure the transposition of the provisions of that directive in full throughout their territory, the Member States are required to state, for each provision of the directive, the national provision or provisions ensuring its transposition. Once notified, and having also received a correlation table where relevant, it is for the Commission to establish, for the purposes of seeking a financial penalty to be imposed on the Member State in question provided for in Article 260(3) TFEU, whether certain transposition measures are clearly lacking or do not cover all the territory of the Member State in question, bearing in mind that it is not for the Court, in judicial proceedings brought under Article 260(3) TFEU, to examine whether the national measures notified to the Commission ensure a correct transposition of the provisions of the directive in question (judgments of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 59; of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 46; and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 56).

31      Since, as is apparent from paragraphs 20 and 21 of this judgment, it is established that, by the expiry of the period prescribed in the reasoned opinion, the Kingdom of Spain had not notified to the Commission any measure transposing Directive 2016/680 within the meaning of Article 260(3) TFEU, that failure to fulfil obligations falls within the scope of that provision.

32      As regards whether, as the Republic of Poland has argued, the Commission must state reasons, on a case-by-case basis, for its decision to request a financial penalty under Article 260(3) TFEU or whether it may take such a decision without stating reasons, in all cases falling with the scope of that provision, it must be borne in mind that the Court has held that, as guardian of the Treaties pursuant to the second sentence of Article 17(1) TEU, the Commission enjoys a discretion to take such a decision (judgment of 13 January 2021, Commission v Slovenia (MiFID II), C‑628/18, EU:C:2021:1, paragraph 47). It is also settled case-law that the conditions for the application of Article 260(3) TFEU may not be more restrictive than those governing the implementation of Article 258 TFEU (see, to that effect, judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 49, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 59). In addition, it must be noted that under Article 260(3) TFEU the Court alone has the power to impose a financial penalty on a Member State. Where the Court takes such a decision at the end of inter partes proceedings, it must state reasons. Consequently, the Commission’s failure to state reasons for its decision to request the Court to apply Article 260(3) TFEU does not affect the procedural guarantees of the Member State in question (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 50, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 60).

33      Furthermore, the fact that the Commission is not required to state reasons on a case-by-case basis for its decision to seek the imposition of a financial penalty under Article 260(3) TFEU does not relieve it of the obligation to state reasons for the nature and the amount of the financial penalty sought, taking into account in that regard the guidelines which it has adopted, such as those in the Commission’s communications which, although not binding on the Court, contribute to ensuring that the action brought by the Commission is transparent, foreseeable and consistent with legal certainty (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 51, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 61).

34      That requirement to state reasons for the nature and the amount of the financial penalty sought is all the more important since, unlike the provisions of Article 260(2) TFEU, Article 260(3) TFEU provides that, in the context of proceedings brought under that provision, the Court has only a limited power to assess, since, where it finds that there is an infringement, the Commission’s proposals are binding on it as to the nature of the financial penalty which the Court may impose and the maximum amount of the penalty which it may set (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 52, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 62).

35      It is apparent from Article 260(3) TFEU that it is for the Commission to specify ‘the amount of the lump sum or penalty payment to be paid’ by the Member State concerned, but that the Court may only impose the payment of a financial penalty ‘not exceeding the amount specified’ by the Commission. The authors of TFEU thus established a direct correlation between the penalty sought by the Commission and the penalty that may be imposed by the Court under Article 260(3) TFEU (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 53, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 63).

36      As regards the Kingdom of Spain’s argument that, in the present case, the pre-litigation procedure was initiated by a letter of formal notice the deadline for reply of which expired less than one month before the dissolution of the national parliament and the start of the electoral process, it should be noted, first, that the letter of formal notice was sent after the expiry of the transposition deadline laid down in Directive 2016/680 and that it is up to Member States to implement the procedure for adopting the measures necessary to ensure the transposition of a directive without waiting for the Commission to issue a letter of formal notice. According to the Court’s settled case-law, in order for a letter of formal notice to be issued, in accordance with the first paragraph of Article 258 TFEU, a prior failure by the Member State concerned to fulfil an obligation owed by it must be capable of being legitimately alleged by the Commission (judgment of 5 December 2019, Commission v Spain (Waste management plans), C‑642/18, EU:C:2019:1051 paragraph 17 and the case-law cited).

37      Second, in any event, the considerations which led the Commission to bring proceedings against the Kingdom of Spain, on the date of its choosing, cannot prejudice the applicability of Article 260(3) TFEU or the admissibility of the action brought under that provision (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 55, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 65).

38      It must, therefore, be held that Article 260(3) TFEU applies in a situation such as that at issue in the present case.

 Imposition of financial penalties in the present case

–       Arguments of the parties

39      As regards the amount of the financial penalties to be imposed, the Commission submits, in accordance with the position reflected in point 23 of the Communication published on 15 January 2011, entitled ‘Implementation of Article 260(3) [TFEU]’ (OJ 2011 C 12, p. 1) that, since a failure to fulfil the obligation to notify measures transposing a directive is no less serious than a failure to fulfil obligations that may be the subject of the penalties mentioned in Article 260(2) TFEU, the method of calculating the financial penalties referred to in Article 260(3) TFEU must be the same as that applied in the context of the procedure set out in Article 260(2) TFEU.

40      In the present case, taking into account, first, the importance of the provisions of EU law which have been disregarded, the protection of personal data being a fundamental right as is apparent from Article 8 of the Charter of Fundamental Rights of the European Union and Article 16 TFEU, second, the existence of specific acts of EU law relating to the protection of personal data, namely Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1), Directive 2016/680, but also Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (OJ 2008 L 350, p. 60), through the national legislation implementing it, and, third, the Kingdom of Spain’s failure to adopt any measure transposing Directive 2016/680, the Commission proposes applying a seriousness coefficient of 10 on a scale of 1 to 20. As regards the duration of the infringement, it considers that a coefficient of 1.4 on a scale of 1 to 3 is appropriate. By applying, the ‘n’ multiplier used for the Kingdom of Spain, namely 2.06, to those coefficients and the flat rate amount of EUR 3 105, the Commission seeks the imposition of a daily penalty payment in the amount of EUR 89 548.20 (3 105 x 10 x 1.4 x 2.06) per day of delay in the transposition of Directive 2016/680.

41      The Commission requests, in addition, the imposition of a lump sum calculated according to the guidelines set out in its Communication of 13 December 2005, entitled ‘Application of Article 228 of the EC Treaty’ (SEC(2005) 1658), as updated by the Communication of 13 December 2017, entitled ‘Updating of data used to calculate lump sum and penalty payments to be proposed by the Commission to the Court of Justice in infringement proceedings’ (C(2017) 8720), and its Communication of 25 February 2019, entitled ‘Modification of the calculation method for lump sum payments and daily penalty payments proposed by the Commission in infringements proceedings before the Court of Justice of the European Union’ (OJ 2019 C 70, p.1, ‘the 2019 Communication’). As is apparent from Annex II to that latter communication, the minimum lump sum for the Kingdom of Spain is EUR 5 290 000. Provided that sum is exceeded in the present case, the Commission proposes to determine the daily amount to be used for the calculation by multiplying the standard flat rate by the seriousness coefficient and the ‘n’ factor. In the present case, the daily amount would therefore amount to 1 035 x 10 x 2.06 = EUR 21 321 per day.

42      In those circumstances, the Commission proposes that the Court impose on the Kingdom of Spain the payment of a lump sum on the basis of a daily amount of EUR 21 321, multiplied by the number of days which elapsed between 7 May 2018, that is to say, the day following the expiry of the transposition deadline laid down in Directive 2016/680, and the day on which the infringement comes to an end or, failing such compliance, the date of delivery of the judgment under Article 260(3) TFEU.

43      The Kingdom of Spain considers that the Commission’s application seeking the imposition of financial penalties is disproportionate in the light of the institutional circumstances in the present case.

44      In line with the Court’s rulings, inter alia, in its judgments of 30 May 2013, Commission v Sweden (C‑270/11, EU:C:2013:339), and of 19 December 2012, Commission v Ireland (C‑279/11, not published, EU:C:2012:834), the particular circumstances characterising the present case should be regarded as mitigating circumstances and the sanctions proposed by the Commission should therefore be reduced. Moreover, the Commission’s proposals regarding the financial penalties cannot bind the Court and merely constitute a useful point of reference. Similarly, guidelines such as those set out in the Commission’s various communications are not binding on the Court but merely contribute to ensuring that the Commission’s own actions are transparent, foreseeable and consistent with legal certainty when that institution makes proposals to the Court.

45      According to the Kingdom of Spain, in proceedings under Article 260(3) TFEU, the Court should remain free to fix the penalty payment imposed in the amount and in the form which it considers appropriate in order to induce the Member State concerned to put an end to the failure to fulfil obligations. In exercising its discretion, it is for the Court to set the penalty payment so that it is both appropriate to the circumstances and proportionate to the  infringement established and the ability to pay of the Member State concerned.

46      The Kingdom of Spain argues that in the present case, first, in order to comply with Article 4(2) TEU, it would be disproportionate to oblige it to pay a daily penalty payment when the government did not have a majority in the Chamber of Deputies and was only dealing with day-to-day business. If such a penalty payment were nevertheless to be imposed, it would be necessary, in order to ensure that it is proportionate and reasonable, to calculate its amount over the period starting on the date of formation of a government enjoying full powers and ending on the date of full compliance with the judgment.

47      Second, the Kingdom of Spain contends that account should be taken of the fact that, since the  deadline for reply to the letter of formal notice expired one month before the dissolution of parliament, it was impossible to put an end to the alleged infringement by relying on the ordinary legislative procedure for the adoption of the required provisions. By imposing, in such circumstances, a lump sum on the Kingdom of Spain, in accordance with the Commission’s application, the Court would set a ‘dangerous precedent’. The circumstance that the Commission could use the procedure in Article 260(3) TFEU in a way that would make it possible to disproportionately affect the constitutional functioning of Member States as a result of the present case should be avoided. The imposition of a lump sum would therefore be unreasonable, since the payment of a daily penalty payment is sufficient in this case.

48      In the event that the Court should nevertheless consider that the imposition of a lump sum is appropriate, the Kingdom of Spain argues that the amount proposed by the Commission is disproportionate. Among the factors which the Court is called upon to take into account when fixing the lump sum feature elements such as the seriousness of the infringement established and the period during which it persisted. As regards the period of the infringement, that Member State considers that, in order to comply with the requirements laid down in Article 4(2) TEU, it would be appropriate to exclude periods during which the government was merely conducting day-to-day business. In the present case, it maintains that the period starting on 4 March 2019 should not be taken into account for the purposes of determining the duration of the infringement.

49      Furthermore, the configuration of the quantification criteria of the financial penalties to be imposed by the Court raises the important question of the method for determining the ‘n’ factor in the manner set out by the Commission in its 2019 Communication. In the present case, that question is not insignificant since, according to the method adopted by the Commission, the resulting minimum lump sum for the Kingdom of Spain places that Member State in fourth place among the Member States with the highest contribution in this respect. Conversely, if the Court were to decide to take gross domestic product (GDP) as the ‘predominant factor’ in calculating the ‘n’ factor, the Kingdom of Spain would then, taking into account the GDP per capita, rank 14th. Thus, according to that Member State, the method of calculation of that factor may give rise to unjustified differences between the Member States, although the Commission, according to its 2019 Communication, sought precisely to avoid them.

50      The Republic of Poland submits, in particular, that the case-law relating to Article 260(2) TFEU cannot be automatically applied to paragraph 3 of that article, since the purpose of paragraph 3 is to penalise a less serious infringement than that referred to in paragraph 2, consisting in non-compliance with a first judgment of the Court finding a failure to fulfil obligations. In any event, the seriousness coefficient of 10 adopted by the Commission is disproportionate in the light of the seriousness of the alleged infringement, in that it does not take into account the real risk of the consequences of the alleged infringement on public and private interests. Moreover, the Commission did not take into account the fact that Directive 2016/680 itself provides that automated processing systems installed before 6 May 2016 may, under certain conditions, be brought into conformity with the requirements of the directive by 6 May 2023 or within a longer period. Therefore, the amount of the lump sum proposed by the Commission should be reduced.

–       Findings of the Court

51      As a preliminary point, it should be noted that, first, the failure of a Member State to fulfil its obligation to notify  measures transposing a directive, whether by providing no information at all, partial information or by providing insufficiently clear and precise information, may of itself justify recourse to the procedure under Article 258 TFEU in order to establish the failure to fulfil the obligation (judgments of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 51; of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 64; and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 74).

52      Second, the objective pursued by the introduction of the system set out in Article 260(3) TFEU is not only to induce Member States to put an end as soon as possible to a  breach of obligations which, in the absence of such a measure, would tend to persist, but also to simplify and speed up the procedure for imposing financial penalties for failures to comply with the obligation to notify a national measure transposing a directive adopted through a legislative procedure, it being specified that, prior to the introduction of such a system, it might be years before a financial penalty was imposed on Member States which had failed to comply in a timely manner with an earlier judgment of the Court and failed to respect their obligations to transpose a directive (judgments of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 52; of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 64; and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 74).

53      It should be noted that, in order to achieve the objective pursued by Article 260(3) TFEU, two types of financial penalties, namely a lump sum and a penalty payment, are provided for.

54      In that regard, it is apparent from the Court’s case-law that the application of each of those measures depends on their respective ability to meet the objective pursued according to the circumstances of the case. While the imposition of a penalty payment seems particularly suited to inducing a Member State to put an end as soon as possible to a breach of obligations which, in the absence of such a measure, would tend to persist, the imposition of a lump sum is based more on assessment of the effects on public and private interests of the failure of the Member State concerned to comply with its obligations, in particular where the breach has persisted for a long period (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 66, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 76).

55      As regards, in the first place, the appropriateness of imposing a penalty payment in the present case, it should be recalled that, according to the Court’s case-law, the imposition of such a penalty payment is, in principle, justified only if the failure continues up to the time of the Court’s examination of the facts (judgment of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 60).

56      The Court held that that case-law, relating to Article 260(2) TFEU, must be applied by analogy to Article 260(3) TFEU, in so far as the penalty payments under both provisions seek to achieve the same objective, namely inducing a Member State to put an end as soon as possible to a breach of obligations which, in the absence of such a measure, would tend to persist (judgment of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 61).

57      It is also apparent from the Court’s case-law that the assessment of the facts by the Court must be considered as being made at the date of conclusion of the proceedings (see, inter alia, judgment of 13 January 2021, Commission v Slovenia (MiFID II), C‑628/18, EU:C:2021:1, paragraph 81 and the case-law cited).

58      It follows that, in order to determine whether, in the present case, the imposition of a penalty payment may be envisaged, it is necessary, first, to examine whether the failure alleged against the Kingdom of Spain under Article 260(3) TFEU, as stated in paragraph 21 of this judgment, persisted until the date of the conclusion of the proceedings, which took place on 6 May 2020.

59      In this respect, it appears from the written observations and documents submitted before the Court that, at the close of the written procedure, the Kingdom of Spain had neither adopted nor, therefore, notified the measures necessary to ensure the transposition of the provisions of Directive 2016/680 into Spanish law.

60      In those circumstances, it must be held that the Kingdom of Spain, by failing to adopt, by that date, the measures necessary to transpose the provisions of Directive 2016/680 into national law, or, a fortiori, to notify those transposition measures to the Commission, persisted in its failure to fulfil its obligations.

61      Therefore, the Court considers that the imposition of a penalty payment on the Kingdom of Spain, sought by the Commission, is an appropriate financial means by which to ensure that that Member State puts a prompt end to the infringement established and complies with its obligations under Directive 2016/680. Conversely, since it cannot be ruled out that, on the date of delivery of the judgment in the present case, the directive is transposed in full, that penalty payment should be imposed only in so far as the infringement persists at the date of delivery of that judgment.

62      It should be recalled that, in exercising its discretion in the matter, it is for the Court to set the penalty payment so that it is, first, appropriate to the circumstances and proportionate to the infringement established and the ability to pay of the Member State concerned and, second, does not exceed, in accordance with the second subparagraph of Article 260(3) TFEU, the amount indicated by the Commission (judgment of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 83).

63      In the assessment which it is for the Court to carry out for the purposes of determining the amount of a penalty payment, the criteria which must be taken into consideration in order to ensure its coercive effect so that EU law is applied uniformly and effectively are, in principle, the duration and seriousness of the infringement and the ability to pay of the Member State in question. In applying those criteria, the Court must have regard, in particular, to the effects of the failure to fulfil its obligations on the public and private interests in question and to how urgent it is for the Member State concerned to be induced to fulfil its obligations (judgment of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 84).

64      As regards the seriousness of the infringement, it must be borne in mind that the obligation to adopt national measures for the purposes of ensuring that a directive is transposed in full and the obligation to notify those measures to the Commission are fundamental obligations incumbent on the Member States in order to ensure optimal effectiveness of EU law and that failure to fulfil those obligations must, therefore, be regarded as definitely serious (judgments of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 85; of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 73; and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 82).

65      In the present case, it must be held that, as is apparent from paragraph 21 of this judgment, by the expiry of the period prescribed in the reasoned opinion, namely 25 March 2019, the Kingdom of Spain had failed to fulfil its obligations to transpose the directive, with the result that the effectiveness of EU law was not ensured at all times. The seriousness of that failure is reinforced by the fact that, at that date, the Kingdom of Spain had still not notified any measure transposing Directive 2016/680.

66      As regards the duration of the infringement, it must be assessed by reference to the date on which the Court assesses the facts, not the date on which proceedings are brought before it by the Commission (judgment of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 87).

67      In the present case, as is clear from paragraph 57 of this judgment, the alleged failure had not yet come to an end at the close of the written procedure before the Court. It must therefore be considered that that failure persists since the expiry of the deadline laid down in the reasoned opinion, namely 25 March 2019. An infringement of a duration exceeding a year and a half is significant having regard to the fact that, under Article 63 of Directive 2016/680, Member States were bound to transpose the provisions of the directive by 6 May 2018 at the latest.

68      In the light of the foregoing, and having regard to the Court’s discretion under Article 260(3) TFEU, which provides that the Court may not, as regards the penalty payment which it imposes, exceed the amount indicated by the Commission, it is appropriate, should the infringement established in paragraph 21 of this judgment persist at the date of delivery of this judgment, to order the Kingdom of Spain to pay the Commission, as from that date and until that Member State has put an end to that infringement, a daily penalty payment of EUR 89 000.

69      As regards, in the second place, whether or not the payment of a lump sum should be imposed in the present case, it must be borne in mind that, in each case, it is for the Court to determine, in the light of the circumstances of the case before it and according to the degree of persuasion and deterrence which appears to it to be required, the financial penalties that are appropriate, in particular, for preventing the recurrence of similar infringements of EU law (judgments of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 78; of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 68, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 78).

70      In the present case, it must be found that, notwithstanding the fact that the Kingdom of Spain cooperated with the Commission services throughout the pre-litigation procedure and kept them informed of the reasons which prevented it from ensuring the transposition of Directive 2016/680 into national law, all the legal and factual circumstances culminating in the breach of obligations established – namely, the fact that, no measure necessary for the transposition Directive 2016/680 had been notified at the expiry of the period laid down in the reasoned opinion or even at the date on which the present action was brought – indicate that if the future repetition of similar infringements of EU law is to be effectively prevented, a dissuasive measure must be adopted, such as a lump sum payment (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 69, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 79).

71      That assessment is not called into question by the argument set out in paragraph 36 above. First, as observed in that paragraph, it is for the Commission, in particular, to assess whether or not proceedings should be brought against a Member State and to choose the time at which it initiates the infringement proceedings against that Member State. Second, it is not claimed that the time limits for replying which were set in the letter of formal notice and in the reasoned opinion were particularly short or unreasonable and were such as to call into question the aims of the pre-litigation procedure, namely to give the Member State concerned an opportunity to comply with its obligations under EU law and to avail itself of its right to defend itself against the objections formulated by the Commission (judgment of 19 September 2017, Commission v Ireland (Registration tax), C‑552/15, EU:C:2017:698, paragraph 28 and the case-law cited), Moreover, as is clear from the facts set out in paragraphs 5 and 6 of this judgment, the Kingdom of Spain was fully aware that it had failed to fulfil its obligations under Article 63 of Directive 2016/680, at least as from 7 May 2018.

72      Nor is that assessment called into question by the argument based on the institutional situation of the Kingdom of Spain between 27 April 2016, date of adoption of Directive 2016/680, and 6 May 2018, date of expiry of the transposition deadline laid down in that directive, characterised by repeated dissolutions of the national parliament, the interim nature of the government and the holding of new elections. The Court held, in a situation similar to that at issue in the main proceedings, that such circumstances cannot be relied on to justify failure to observe obligations arising under EU law (see, to that effect, judgment of 13 July 2017, Commission v Spain, C‑388/16, not published, EU:C:2017:548, paragraph 41).

73      As regards the calculation of the lump sum which it is appropriate to impose in the present case, it must be borne in mind that, in exercising its discretion in the matter, as delimited by the Commission’s proposals, it is for the Court to fix the amount of the lump sum which may be imposed on a Member State pursuant to Article 260(3) TFEU, in an amount appropriate to the circumstances and proportionate to the failure to fulfil obligations. Relevant considerations in that respect include factors such as the seriousness of the failure to fulfil obligations, the length of time for which the failure has persisted and the relevant Member State’s ability to pay (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 72, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 81).

74      As regards, first, the seriousness of the infringement, it must be borne in mind that the obligation to adopt national measures for the purposes of ensuring that a directive is transposed in full and the obligation to notify those measures to the Commission are fundamental obligations incumbent on the Member States in order to ensure optimal effectiveness of EU law and that failure to fulfil those obligations must, therefore, be regarded as undoubtedly serious (judgments of 8 July 2019, Commission v Belgium (Article 260(3) TFEU – High-speed networks), C‑543/17, EU:C:2019:573, paragraph 85; of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 73; and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 82).

75      In addition, Directive 2016/680 is intended to contribute to the accomplishment of an area of freedom, security and justice within the European Union, while establishing a strong and coherent framework for the protection of personal data in order to ensure respect for the fundamental right of protection of natural persons with regard to the processing of personal data, recognised in Article 8(1) of the Charter of Fundamental Rights of the European Union and Article 16(1) TFEU. The absence or inadequacy, at national level, of rules guaranteeing the proper functioning of the area of freedom, security and justice within the European Union must be considered particularly serious in the light of its effects on public and private interests within the European Union.

76      The seriousness of the infringement established is further increased by the fact that,  on expiry of the period prescribed in the reasoned opinion, namely 25 March 2019, but also at the close of the written procedure before the Court, the Kingdom of Spain had not yet adopted any measure transposing Directive 2016/680.

77      The arguments put forward by the Kingdom of Spain to explain the delay in transposing Directive 2016/680, namely the fact that the government was able to deal with, over a long period of time, only day-to-day business is not such as to affect the seriousness of the infringement at issue since, according to settled case-law, a Member State cannot rely on practices or circumstances existing in its internal legal order to justify its failure to comply with the obligations and time limits laid down by EU directives, nor therefore the late or incomplete implementation of directives (judgment of 13 July 2017, Commission v Spain, not published, EU:C:2017:548, paragraph 41).

78      In that regard, it should be added that, contrary to the Kingdom of Spain’s submission, special institutional circumstances such as those characterising the present failure cannot be regarded as mitigating circumstances within the meaning of the Court’s case-law (see, to that effect, judgment of 30 May 2013, Commission v Sweden, C‑270/11, EU:C:2013:339, paragraphs 54 and 55).

79      As regards, second, the duration of the infringement, it must be recalled that that duration must, in principle, be assessed by reference to the date on which the Court assesses the facts and not the date on which proceedings are brought before it by the Commission. That assessment of the facts must be considered as being made at the date of conclusion of the proceedings (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 77, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 86).

80      In the present case, it is common ground that the failure to fulfil obligations in question had not yet come to an end at the close of the written procedure, on 6 May 2020.

81      As regards the beginning of the period which must be taken into account in order to fix the amount of the lump sum to be imposed pursuant to Article 260(3) TFEU, the Court held that, unlike the daily penalty payment, the relevant date for evaluating the duration of the infringement at issue is not the date of expiry of the period prescribed in the reasoned opinion, but the date of expiry of the transposition deadline laid down in the directive in question (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 79, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 90).

82      In the present case, it is not in dispute that, by the expiry of the transposition deadline laid down in Article 63 of Directive 2016/680, namely 6 May 2018, the Kingdom of Spain had not adopted the laws, regulations and administrative provisions necessary to ensure the transposition of that directive and had not, therefore, notified to the Commission the measures transposing it. It follows that the infringement at issue has lasted for two years.

83      Third, as regards the ability to pay of the Member State concerned, it is apparent from the Court’s case-law that it is necessary to take account of recent trends in that Member State’s GDP at the time of the Court’s examination of the facts (judgments of 16 July 2020, Commission v Romania (Anti-money laundering), C‑549/18, EU:C:2020:563, paragraph 85, and of 16 July 2020, Commission v Ireland (Anti-money laundering), C‑550/18, EU:C:2020:564, paragraph 97).

84      Having regard to all the circumstances of the present case and in the light of the Court’s discretion under Article 260(3) TFEU, which provides that the Court cannot, as regards the payment of the lump sum imposed by it, exceed the amount specified by the Commission, it must be held that the effective prevention of future repetition of infringements similar to that resulting from the infringement of Article 63 of Directive 2016/680 affecting the full effectiveness of EU law requires the imposition of a lump sum in the amount of EUR 15 000 000.

85      The Kingdom of Spain must, therefore, be ordered to pay the Commission a lump sum of EUR 15 000 000.

 Costs

86      Under Article 138(1) of the Rules of Procedure of the Court, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the Commission has applied for costs and the Kingdom of Spain has been unsuccessful, the latter must be ordered to bear its own costs and to pay those incurred by the Commission.

87      Pursuant to Article 140(1) of those rules, which provides that Member States which have intervened in the proceedings are to bear their own costs, the Republic of Poland must be ordered to bear its own costs.

On those grounds, the Court (Eighth Chamber) hereby:

1.      Declares that, by failing to adopt, by the expiry of the period prescribed in the reasoned opinion, the laws, regulations and administrative provisions necessary to comply with Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA and, therefore, by failing to notify those measures to the European Commission, the Kingdom of Spain has failed to fulfil its obligations under Article 63 of that directive;

2.      Declares that, by failing to adopt, by the time the Court examined the facts, the provisions necessary to transpose into its national law the provisions of Directive 2016/680 and, therefore, failing to notify those measures to the Commission, the Kingdom of Spain persisted in its failure to fulfil its obligations;

3.      Should the infringement established in point 1 persist at the date of delivery of this judgment, orders the Kingdom of Spain to pay the Commission, as from that date and until that Member State has put an end to that infringement, a daily penalty payment of EUR 89 000;

4.      Orders the Kingdom of Spain to pay the Commission a lump sum in the amount of EUR 15 000 000;

5.      Orders the Kingdom of Spain to bear its own costs and to pay those incurred by the Commission;

6.      Orders the Republic of Poland to bear its own costs.

[Signatures]

*      Language of the case: Spanish.

© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.