[2025] UKUT 319 (AAC)

In support of her narrow construction of Article 2(2)(a) Ms Demetriou referred us to a series of decisions of the CJEU that concerned the proper interpretation of the GDPR, and of Article 2(2) in particular.

In Schrems II (summarised at [83] to [92] above), a case decided before the UK’s exit from the EU and therefore binding on us, the CJEU held at [84] that, by analogy with Article 3(2) of the 95 Directive, the exceptions provided for in Article 2(2) must be read strictly. This point was developed in the later case of Latvijas(summarised at [73] to [82] above), which was decided following the UK’s exit from the EU and is therefore of persuasive, rather than binding, authority)the CJEU stated (at [64] to [65]) that Article 2(2(a) of the GDPR could not be interpreted in broader terms than the exception resulting from the first indent to Article 3(2) of the 95 Directive (which had itself been narrowly interpreted in Lindqvist, as we explained at [82] above.

The issue before the CJEU in Latvijas (summarised at [76] to [77] above) was whether the exclusion of “outside scope” activities under Article 2(2)(a) applied only to Member States’ national security and similar functions, or whether it should be interpreted more broadly to apply to other Member State functions, such as those relating to road safety, which was the function relevant in that case.

The CJEU was not tasked with deciding whether Article 2(2)(a) also applies to foreign state activities, but it is clear from the Advocate General’s opinion (at [58]) that he considered Article 2(2)(a) to be nothing more than a restatement of the EU’s respect for the reservation by Member States of powers in respect of their essential functions. As we noted earlier, this paragraph of the Attorney General’s opinion was endorsed by the CJEU at [67] of its judgment (albeit in the course of highlighting a different point).

Ms Proops argued that the CJEU’s construction of Article 2(2)(a) was applied in the context only of the specific question of which Member State functions were within scope, and which were outside it, and a narrow reading of the exception was not required in other contexts. She said that the exception created by Article 3(2) of the 95 Directive was drafted deliberately broadly (as she says Article 2(2)(a) GDPR was), with mere examples being given (“such as those provided for by Titles V and Title VI of the Treaty on European Union”), and she did not accept that it was only concerned with the activities of Member States.

However, the proposition that Article 3(2) of the 95 Directive was intended to have a broad effect is inconsistent with the CJEU’s analysis in Lindqvist (discussed at [82] above) and in Schrems II at [89] above, which is binding on us. In further support of Ms Demetriou’s reading, we note that the examples given in Article 3(2) of the 95 Directive concern the division of responsibility between the Union and its Member States, and Recital 16 to the GDPR, which concerns the exclusion of “activities which fall outside the scope of Union law”, explains that the regulation does not apply to processing “by Member States when carrying out activities in relation to the common foreign and security policy of the Union”. This supports Ms Demetriou’s case that Article 2(2) of the GDPR only deals with the division of responsibility between the Union and its Member States.