CELEX%3A62022CJ0017%3AEN%3ATXT

Reports of Cases
JUDGMENT OF THE COURT (Fourth Chamber)
12 September 2024 *
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing
of personal data – Regulation (EU) 2016/679 – Points (b), (c) and (f) of the first subparagraph of
Article 6(1) – Lawfulness of processing – Necessity of processing for the purpose of performing
a contract to which the data subject is party – Necessity of processing for the purpose of
complying with a legal obligation incumbent on the controller – Necessity of processing for the
purposes of the legitimate interests pursued by the controller or by a third party –
Investment fund established in the form of a limited partnership offering shares for public
subscription – Request of a partner seeking to obtain the contact details of other partners with
indirect shareholdings in an investment fund through a trust company)
In Joined Cases C-17/22 and C-18/22,
REQUESTS for a preliminary ruling under Article 267 TFEU from the Amtsgericht München
(Local Court, Munich, Germany), made by decisions of 21 December 2021, received at the Court
on 7 January 2022, in the proceedings
HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG
Müller Rechtsanwaltsgesellschaft mbH (C-17/22),
and
Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG
WealthCap Photovoltaik 1 GmbH Co. KG,
WealthCap PEIA Komplementär GmbH,
WealthCap Investorenbetreuung GmbH (C-18/22),
THE COURT (Fourth Chamber),
composed of C. Lycourgos, President of the Chamber, O. Spineanu-Matei, J.-C. Bonichot,

S. Rodin and L.S. Rossi (Rapporteur), Judges,
* Language of the case: German.
EN ECLI:EU:C:2024:738 1
JUDGMENT OF 12. 9. 2024 – JOINED CASES C-17/22 AND C-18/22
HTB NEUNTE IMMOBILIEN PORTFOLIO AND ÖKORENTA NEUE ENERGIEN ÖKOSTABIL IV
Advocate General: J. Richard de la Tour,
Registrar: I. Illéssy, Administrator,
having regard to the written procedure and further to the hearing on 29 February 2024,
after considering the observations submitted on behalf of:
– HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG, by M. Handlos and
R. Veil, Rechtsanwälte,
– Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG, by
U. Brinkmöller, Rechtsanwalt,
– WealthCap Photovoltaik 1 GmbH Co. KG, WealthCap PEIA Komplementär GmbH and
WealthCap Investorenbetreuung GmbH, by N. Bartmann, U. Baumgartner and A. Höder,
Rechtsanwälte,
– the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,
having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,
gives the following
Judgment
1 These requests for a preliminary ruling concern the interpretation of points (b) and (f) of the first
subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing Directive 95/46/EC (General
Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
2 The requests have been made in proceedings between (i) HTB Neunte Immobilien Portfolio
geschlossene Investment UG & Co. KG (‘HTB’) and Müller Rechtsanwaltsgesellschaft mbH (Case
C-17/22); and (ii) Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co.
KG (‘Ökorenta’) and WealthCap Photovoltaik 1 GmbH Co. KG, WealthCap PEIA Komplementär
GmbH and WealthCap Investorenbetreuung (Case C-18/22).
Legal context
European Union law
3 Recitals 1, 10, 39, 41, 47 and 48 of the GDPR are worded as follows:
‘(1) The protection of natural persons in relation to the processing of personal data is a
fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union
(the “Charter”) and Article 16(1) [TFEU] provide that everyone has the right to the
protection of personal data concerning him or her.
2 ECLI:EU:C:2024:738
(10) In order to ensure a consistent and high level of protection of natural persons and to
remove the obstacles to flows of personal data within the [European] Union, the level of
protection of the rights and freedoms of natural persons with regard to the processing of
such data should be equivalent in all Member States. Consistent and homogenous
application of the rules for the protection of the fundamental rights and freedoms of
natural persons with regard to the processing of personal data should be ensured
throughout the [European] Union. …
(39) Any processing of personal data should be lawful and fair. It should be transparent to
natural persons that personal data concerning them are collected, used, consulted or
otherwise processed and to what extent the personal data are or will be processed. …
(41) Where this Regulation refers to a legal basis or a legislative measure, this does not
necessarily require a legislative act adopted by a parliament, without prejudice to
requirements pursuant to the constitutional order of the Member State concerned.
However, such a legal basis or legislative measure should be clear and precise and its
application should be foreseeable to persons subject to it, in accordance with the case-law
of the Court of Justice of the European Union … and the European Court of Human Rights.
(47) The legitimate interests of a controller, including those of a controller to which the personal
data may be disclosed, or of a third party, may provide a legal basis for processing, provided
that the interests or the fundamental rights and freedoms of the data subject are not
overriding, taking into consideration the reasonable expectations of data subjects based on
their relationship with the controller. Such legitimate interest could exist for example
where there is a relevant and appropriate relationship between the data subject and the
controller in situations such as where the data subject is a client or in the service of the
controller. At any rate the existence of a legitimate interest would need careful assessment
including whether a data subject can reasonably expect at the time and in the context of the
collection of the personal data that processing for that purpose may take place. The
interests and fundamental rights of the data subject could in particular override the
interest of the data controller where personal data are processed in circumstances where
data subjects do not reasonably expect further processing. … The processing of personal
data for direct marketing purposes may be regarded as carried out for a legitimate interest.
(48) Controllers that are part of a group of undertakings or institutions affiliated to a central
body may have a legitimate interest in transmitting personal data within the group of
undertakings for internal administrative purposes, including the processing of clients’ or
[of] employees’ personal data. The general principles for the transfer of personal data,
within a group of undertakings, to an undertaking located in a third country remain
unaffected.’
ECLI:EU:C:2024:738 3
4 Article 1 of that regulation, entitled ‘Subject matter and objectives’, provides, in paragraph 2
thereof:
‘This Regulation protects fundamental rights and freedoms of natural persons and in particular their
right to the protection of personal data.’
5 Article 4 of that regulation provides:
‘For the purposes of this Regulation:
(1) “personal data” means any information relating to an identified or identifiable natural person
(“data subject”); an identifiable natural person is one who can be identified, directly or
indirectly, in particular by reference to an identifier such as a name, an identification
number, location data, an online identifier or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that natural person;
(2) “processing” means any operation or set of operations which is performed on personal data or
on sets of personal data, whether or not by automated means, such as collection, recording,
organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making available, alignment or
combination, restriction, erasure or destruction;
(7) “controller” means the natural or legal person, public authority, agency or other body which,
alone or jointly with others, determines the purposes and means of the processing of personal
data; where the purposes and means of such processing are determined by Union or Member
State law, the controller or the specific criteria for its nomination may be provided for by
Union or Member State law;
(11) “consent” of the data subject means any freely given, specific, informed and unambiguous
indication of the data subject’s wishes by which he or she, by a statement or by a clear
affirmative action, signifies agreement to the processing of personal data relating to him or
her;
…’
6 Article 5 of that regulation, entitled ‘Principles relating to processing of personal data’, provides:
‘1. Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject
(“lawfulness, fairness and transparency”);
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner
that is incompatible with those purposes; …
4 ECLI:EU:C:2024:738
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they
are processed (“data minimisation”);
2. The controller shall be responsible for, and be able to demonstrate compliance with,
paragraph 1 (“accountability”).’
7 Article 6 of the GDPR, entitled ‘Lawfulness of processing’, is worded as follows:
‘1. Processing shall be lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more
specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or
in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is
subject;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or
by a third party, except where such interests are overridden by the interests or fundamental
rights and freedoms of the data subject which require protection of personal data, in
particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in
the performance of their tasks.
2. Member States may maintain or introduce more specific provisions to adapt the application of
the rules of this Regulation with regard to processing for compliance with points (c) and (e) of
paragraph 1 by determining more precisely specific requirements for the processing and other
measures to ensure lawful and fair processing including for other specific processing situations as
provided for in Chapter IX.
3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down
by:
(a) Union law; or
(b) Member State law to which the controller is subject.
… The Union or the Member State law shall meet an objective of public interest and be
proportionate to the legitimate aim pursued.’
ECLI:EU:C:2024:738 5
8 Article 13(1) of that regulation provides:
‘Where personal data relating to a data subject are collected from the data subject, the controller
shall, at the time when personal data are obtained, provide the data subject with all of the
following information:
(c) the purposes of the processing for which the personal data are intended as well as the legal
basis for the processing;
(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by
the controller or by a third party;
…’
German law
9 Paragraph 161 of the Handelsgesetzbuch (Commercial Code), in the version applicable to the
disputes in main proceedings, provides:
‘(1) A partnership formed for the purpose of carrying on a commercial business under a joint
business name is a partly limited partnership if the liability of one or more of the partners is
limited vis-à-vis the partnership’s creditors to the amount of a specific contribution of assets
(limited partners), while the other partners have unlimited liability (general partners).
(2) Unless this Part provides otherwise, the provisions applicable to the general partnership shall
apply to the partly limited partnership.’
10 Paragraph 162(1) of that code is worded as follows:

‘The application for registration of the partnership shall contain, in addition to the particulars
specified in Paragraph 106(2) [(including each partner’s surname, forename, date of birth and place of
residence)], the names of the limited partners and each limited partner’s respective amount of
contribution for which the limited partner is liable towards third parties. …’
11 Paragraph 127a(1) and (3) of the Aktiengesetz (Law on Public Limited Companies), in the version
applicable to the disputes in the main proceedings, provides:
‘(1) Shareholders or associations of shareholders may invite other shareholders in the

shareholder forum of the Bundesanzeiger [(German Federal Gazette)] to act jointly or by proxy
for the purpose of filing a motion or request in accordance with the present act or to exercise
their voting rights at a general meeting.
(3) The invitation may contain information concerning the website of the person making the
invitation and that person’s electronic address. …’
6 ECLI:EU:C:2024:738
12 The first sentence of Paragraph 33(1) of the Wertpapierhandelsgesetz (Law on Securities

Trading), in the version applicable to the disputes in the main proceedings, provides:
‘Any party (the party subject to the notification requirement) whose home country is the Federal
Republic of Germany and whose shareholding in an issuer reaches, exceeds or falls below 3%, 5%,
10%, 15%, 20%, 25%, 30%, 50% or 75% of the voting rights attaching to shares belonging to that party by
purchase, sale or other means, must notify this to the issuer and simultaneously to the Bundesanstalt
(Federal Financial Supervisory Authority) without undue delay, and at the latest within four trading
days, in compliance with Paragraph 34(1) and (2). …’
The disputes in the main proceedings and the questions referred for a preliminary ruling
13 It is apparent from the orders for reference that HTB and Ökorenta are investment companies
which each hold shares indirectly through a trust company in investment funds. Those
investment funds are organised in the form of a limited partnership, that is to say, a partnership
offering shares for public subscription. Shareholdings in those limited partnerships are devised as
a financial investment. Where those shareholdings are indirect, partners exercise their right
through trust companies.
14 The applicants in the main proceedings request the defendants in the main proceedings, which are
trust companies, to disclose the names and addresses of all their partners with indirect
shareholdings in the investment funds concerned, through trust companies.
15 The defendants in the main proceedings object to such a disclosure, taking the view that the data
requested are intended to serve the economic interests of the applicants in the main proceedings,
consisting in advertising their own investment products, causing concern among investors, or
purchasing their shares at a price below their value and making a profit by reselling them. The
investment and trust agreements under which the partners of the defendants in the main
proceedings have acquired shareholdings held indirectly in the investment funds concerned
contain clauses prohibiting disclosure of those data to other shareholders.
16 The applicants in the main proceedings deny having such intentions and assert their right to
contact the other limited partners with shareholdings in the investment funds concerned, inter
alia, in order to enter into share purchase negotiations.
17 The referring court notes, in essence, that, in accordance with the case-law of the
Bundesgerichtshof (Federal Court of Justice, Germany) and the Oberlandesgericht München
(Higher Regional Court, Munich, Germany), the disclosure of personal data requested by the
applicants in the main proceedings could prove to be mandatory. However, it observes that since
that case-law in part predates the entry into force of the GDPR, it might have to be assessed
differently in the present case, having regard to points (b) and (f) of the first subparagraph of
Article 6(1) of that regulation, the interpretation of which is decisive for the resolution of the
disputes in the main proceedings.
18 In particular, the referring court states that it follows from the order of the Bundesgerichtshof
(Federal Court of Justice) of 19 November 2019 (II ZR 263/18), that, in a partnership, such as a
limited partnership, the right of a partner to know the name and address of other partners is part
of the ‘essential core rights of partners’. That right also applies in relation to limited partnerships
with only indirect shareholdings. The knowledge of all other partners, including those with
indirect shareholdings, is necessary to make effective use of the rights held by each partner in a
ECLI:EU:C:2024:738 7
partnership offering shares for public subscription. Disclosure of those personal data to other
partners is therefore in keeping with the obligations which are incumbent on the partnership
pursuant to the contract under which it is established. The only exception to the right of
obtaining such data under German law consists in the prohibition of an abuse of rights, which
prohibits the right to information from being exercised unlawfully or with harmful intent.
19 In accordance with the case-law of the Bundesgerichtshof (Federal Court of Justice), the abuse of
rights is, in any event, ruled out where an investor seeks contact with other investors in order to
discuss matters concerning the partnership with them and, where appropriate, to organise a
commonality of interests between investors. Moreover, there is no reason to refuse to provide
information on the ground that there is a purely abstract risk of misuse of those personal data. In
addition, a partner must be able to access the data of the other partners of the partnership directly,
without depending on that partnership’s managing bodies.
20 It also follows from that case-law that such a right to information cannot be precluded by
contractual provisions, otherwise an essential right of the partners, namely the right to convene
an extraordinary meeting of partners would in fact be suppressed since the quorums necessary
for that purpose can be obtained by a partner with a small shareholding only if that partner joins
other partners, which necessarily presupposes that he or she knows their names and addresses
(order of the Bundesgerichtshof (Federal Court of Justice) of 21 September 2009 – (II
ZR 264/08)). According to that case-law, recital 48 of the GDPR would also justify that, within a
group of undertakings, the personal data of all the partners may be transmitted to one of them
for internal administrative purposes.
21 In the view of the referring court, the case-law of the Bundesgerichtshof (Federal Court of Justice)
thus affirms the existence, in essence, of a right to information of the partners which is limited
only by an abuse of rights.
22 The referring court also refers to the judgment of 16 January 2019 of the Oberlandesgericht
München (Higher Regional Court, Munich) (7 U 342/18), according to which the main subject
matter of the partnership agreement is the exercise of the partners’ rights, including that of
strengthening their position within the partnership. The purchase of shares in a partnership thus
constitutes a lawful exercise of those rights and the disclosure of information relating to other
partners for that purpose equates to a reasonable interest. Such a disclosure should be refused
only if it is not intended to satisfy any reasonable interest.
23 The referring court is uncertain as to the compatibility of the case-law of the Bundesgerichtshof
(Federal Court of Justice) and the Oberlandesgericht München (Higher Regional Court, Munich)
with EU law, in so far as it allows extensive disclosure of the personal data of partners with indirect
shareholdings in an investment fund on the basis of a purely formal claim of an interest on the part
of the other partners to obtain such data, for example, for the purpose of acquiring shareholdings.
24 It takes the view that, under EU law, protection of personal data is the rule, with the result that the
exception to that principle, provided for inter alia in points (b) and (f) of the first subparagraph of
Article 6(1) of the GDPR, which authorises disclosure of that data, must be based on ‘sufficient
justification’. That court further states that there is no legal obligation under German law to
publish the data concerning persons with shareholdings in a trust company. Thus, the referring
court asks whether a right of access to partners’ data should not be subject, first, to a certain
8 ECLI:EU:C:2024:738
shareholding threshold, by analogy to what is provided for in German law in respect of listed
public limited companies and, second, to a specific and precise reason, linked to the partnership,
concerning the partners in respect of whom such information is requested.
25 In those circumstances the Amtsgericht München (Local Court, Munich, Germany) decided to
stay the proceedings in the two cases in the main proceedings and to refer the following identical
questions to the Court of Justice for a preliminary ruling:
‘(1) (a) Is [the first subparagraph of] Article 6(1)(b) and (f) of the [GDPR] to be interpreted as
meaning that, in the case of a [partnership offering shares for public subscription], a
limited partner with negligible liability has a “legitimate interest” in obtaining
information relating to all partners with shares held indirectly through a trustee,
together with their contact details and the number of their shares in such a partnership,
and a contractual obligation to that effect must be inferred from the partnership
agreement?
(b) Or is a legitimate interest restricted under such circumstances to obtaining from the
partnership information on limited partners with shares held indirectly and, rather than
bearing negligible liability, hold shares above a minimum threshold that may, at least
potentially, allow them to influence the future of the partnership?
(2) (a) Does the intention to make contact for the purpose of becoming better acquainted,
exchanging views or negotiating the purchase of shares in the partnership suffice in
order not to exceed the limits to prevent abuse of rights inherent in such an unrestricted
right [Question (1)(a)] or to make an exception to the restriction applicable to a restricted
right to information [Question (1)(b)]?
(b) Or is an interest in information potentially relevant only where its disclosure is requested
with the express intention of contacting other partners in order to invite them to
coordinate on specifically designated matters on which a consensus is needed for the
purpose of partners’ resolutions?’
Procedure before the Court
26 By decision of 23 September 2022, the President of the Court stayed the present proceedings
pending final judgment in Case C-252/21.
27 In accordance with the decision of the President of the Court of 7 July 2023, the Registry notified
the referring court of the judgment of 4 July 2023, Meta Platforms and Others (General terms of
use of a social network), C-252/21, EU:C:2023:537, requesting it to state whether, in the light of
that judgment, it wished to maintain its requests for a preliminary ruling, in whole or in part.
28 By letter of 4 August 2023, lodged at the Court Registry the same day, that court stated that it
maintained its requests for a preliminary ruling.
Consideration of the questions referred
29 By its questions referred for a preliminary ruling, which it is appropriate to consider together, the
referring court asks, in essence, whether points (b) and (f) of the first subparagraph Article of 6(1)
of the GDPR must be interpreted as meaning that the processing of personal data which consists
in disclosing, at the request of a partner of an investment fund established in the form of a
ECLI:EU:C:2024:738 9
partnership offering shares for public subscription, information on all the partners with indirect
shareholdings in that fund, through trust companies, irrespective of the size of their shareholding
in the capital of those funds, for the purpose of contacting them and negotiating the purchase of
their shares or to coordinate with them for the purpose of reaching a consensus in connection
with partners’ resolutions, may be regarded as being necessary for the performance of a contract
to which the data subjects are parties within the meaning of point (b), or for the purposes of
legitimate interests pursued by the controller or by a third party within the meaning of point (f).
30 Since it is apparent from the requests for a preliminary ruling that the referring court is uncertain
as to the compatibility with the GDPR of the obligation to disclose such data arising, under
German law, from the case-law of the national courts, it is necessary to reformulate the questions
referred as extending to the interpretation of point (c) of the first subparagraph of Article 6(1) of
that regulation and to take the view that, by its questions, the referring court is also uncertain as to
whether such a disclosure may be regarded as being based on a legal obligation to which the
controller is subject.
31 In order to answer those questions, as a preliminary point, it should be borne in mind that the
objective pursued by the GDPR, as is apparent from Article 1 thereof and recitals 1 and 10
thereof, consists, inter alia, in ensuring a high level of protection of the fundamental rights and
freedoms of natural persons, in particular their right to privacy with respect to the processing of
personal data, as enshrined in Article 8(1) of the Charter and Article 16(1) TFEU (judgment of
7 March 2024, IAB Europe, C-604/22, EU:C:2024:214, paragraph 53 and the case-law cited).
32 In accordance with that objective, any processing of personal data must, in particular, comply with
the principles relating to the processing of such data set out in Article 5 of that regulation and
satisfy the lawfulness conditions listed in Article 6 of that regulation (see, to that effect,
judgments of 6 October 2020, La Quadrature du Net and Others, C-511/18, C-512/18
and C-520/18, EU:C:2020:791, paragraph 208, and of 11 July 2024, Meta Platforms Ireland
(Representative action), C-757/22, EU:C:2024:598, paragraph 49).
33 In that regard, it should be noted that, under Article 5(1)(a) of the GDPR, personal data are to be
processed lawfully, fairly and in a transparent manner in relation to the data subject.
34 In particular, as regards the conditions for lawful processing, as the Court has held previously, the
first subparagraph of Article 6(1) of the GDPR sets out an exhaustive and restrictive list of the
cases in which processing of personal data can be regarded as lawful. Thus, in order to be capable
of being regarded as such, processing must fall within one of the cases provided for in that
provision (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social
network), C-252/21, EU:C:2023:537, paragraph 90).
35 In the light of the specific features of the disputes in the main proceedings, it must also be
observed that the first subparagraph of Article 6(1) does not, in itself, set out an obligation, but
merely expresses the possibility of processing personal data in the situations that it lists (see, by
analogy, judgment of 4 May 2017, Rīgas satiksme, C-13/16, EU:C:2017:336, paragraph 26).
36 Under point (a) of the first subparagraph of Article 6(1) of the GDPR, the processing of personal
data is lawful if and to the extent that the data subject has given consent to that processing for one
or more specific purposes. In the absence of such consent, or where that consent has not been
given in a free, specific, informed and unambiguous manner within the meaning of point 11 of
10 ECLI:EU:C:2024:738
the first paragraph of Article 4 of that regulation, such processing is nevertheless justified where it
meets one of the requirements of necessity referred to in points (b) to (f) of the first subparagraph
of Article 6(1) of that regulation.
37 In that context, the justifications provided for in that latter provision, in so far as they allow the
processing of personal data carried out in the absence of the data subject’s consent to be made
lawful, must be interpreted restrictively (judgment of 4 July 2023, Meta Platforms and Others
(General terms of use of a social network), C-252/21, EU:C:2023:537, paragraph 93 and the
case-law cited).
38 Furthermore, as the Court has held, where it can be found that the processing of personal data is
necessary in respect of one of the justifications provided for in points (b) to (f) of the first
subparagraph of Article 6(1) of the GDPR, it is not necessary to determine whether that
processing also falls within the scope of another of those justifications (judgment of 4 July 2023,
Meta Platforms and Others (General terms of use of a social network), C-252/21, EU:C:2023:537,
paragraph 94 and the case-law cited).
39 The Court has also held that, in accordance with Article 5 of the GDPR, the controller bears the
burden of proving that those data are collected, inter alia, for specified, explicit and legitimate
purposes and that they are processed lawfully, fairly and in a transparent manner in relation to
the data subject. In addition, according to Article 13(1)(c) of that regulation, where personal data
are collected from the data subject, the controller must inform the data subject of the purposes of
the processing for which those data are intended as well as the legal basis for the processing
(judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social network),
C-252/21, EU:C:2023:537, paragraph 95).
40 In the present case, it is apparent from the documents before the Court that partners with indirect
shareholdings, through trust companies, in the investment funds concerned have not given their
consent, within the meaning of point (a) of the first subparagraph of Article 6(1) of the GDPR, to
the disclosure by the defendants in the main proceedings of their personal data to third parties, in
particular, to HTB and Ökorenta.
41 In those circumstances, in order to answer the questions raised, it must be ascertained whether
the provisions of points (b) and (f) of the first subparagraph of Article 6(1) of that regulation,
referred to specifically in the requests for a preliminary ruling, may be relied on to justify the
possible disclosure of those data to those third parties.
42 As regards, in the first place, point (b) of the first subparagraph of Article 6(1) of the GDPR, that
provision provides that processing of personal data is lawful if it is ‘necessary for the performance
of a contract to which the data subject is party or in order to take steps at the request of the data
subject prior to entering into a contract’.
43 In that regard, the Court has held previously that, in order for the processing of personal data to be
regarded as necessary for the performance of a contract within the meaning of that provision, it
must be objectively indispensable for a purpose that is integral to the contractual obligation
intended for the data subject. The controller must therefore be able to demonstrate how the
main subject matter of the contract cannot be achieved if the processing in question does not
occur (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social
network), C-252/21, EU:C:2023:537, paragraph 98).
ECLI:EU:C:2024:738 11
44 As the Court has also held, the decisive factor for the purposes of applying the justification set out
in point (b) of the first subparagraph of Article 6(1) of the GDPR is that the processing of personal
data by the controller must be essential for the proper performance of the contract concluded
between the controller and the data subject and, therefore, that there are no workable, less
intrusive alternatives (judgment of 4 July 2023, Meta Platforms and Others (General terms of use
of a social network), C-252/21, EU:C:2023:537, paragraph 99).
45 In the present case, it is apparent from the orders for reference that the investment and trust
agreements at issue in the main proceedings, under which the indirect shareholdings were
acquired in the investment funds concerned, expressly prohibit the disclosure of data concerning
indirect investors and other shareholders.
46 In that respect, it should be noted that the essential feature of acquiring an indirect shareholding,
through a trust company, in an investment fund offering shares for public subscription is precisely
the anonymity of the partners, including in relations between the partners themselves. In other
words, it is by taking account of the confidential processing of their data by the investment fund
that persons choose a financial investment in such a fund in the form of a shareholding through a
trust company.
47 Accordingly, subject to verification by the referring court, the processing of confidential data,
consisting in disclosing information concerning partners with indirect shareholdings through a
trust company in an investment fund offering shares for public subscription, cannot be regarded
as being ‘necessary for the performance of a contract’ within the meaning of point (b) of the first
subparagraph of Article 6(1) of the GDPR, where the contract on which the acquisition of such a
shareholding is based expressly prohibits the disclosure of those data to other shareholders.
48 As regards, in the second place, point (f) of the first subparagraph of Article 6(1) of the GDPR, that
provision provides that the processing of personal data is lawful if it is necessary for the purposes
of the legitimate interests pursued by the controller or by a third party, except where such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of those personal data.
49 As the Court has held previously, that provision lays down three cumulative conditions so that the
processing of personal data covered by that provision is lawful, namely, first, the pursuit of a
legitimate interest by the data controller or by a third party; second, the need to process personal
data for the purposes of the legitimate interests pursued; and, third, that the interests or
fundamental freedoms and rights of the person concerned by the data protection do not take
precedence (judgment of 4 July 2023, Meta Platforms and Others (General terms of use of a social
network), C-252/21, EU:C:2023:537, paragraph 106 and the case-law cited).
50 As regards, first, the condition relating to the pursuit of a ‘legitimate interest’, it should be
emphasised that, in the absence of a definition of that concept in the GDPR, as the Court has held
previously, a wide range of interests is, in principle, capable of being regarded as legitimate
(judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C-26/22
and C-64/22, EU:C:2023:958, paragraph 76).
51 Second, with regard to the condition that the processing of personal data be necessary for the
purposes of the legitimate interests pursued, that condition requires the referring court to
ascertain that the legitimate data processing interests pursued cannot reasonably be achieved just
as effectively by other means less restrictive of the fundamental rights and freedoms of data
12 ECLI:EU:C:2024:738
subjects, in particular the rights to respect for private life and to the protection of personal data
guaranteed by Articles 7 and 8 of the Charter (judgment of 7 December 2023, SCHUFA Holding
(Discharge from remaining debts), C-26/22 and C-64/22, EU:C:2023:958, paragraph 77 and the
case-law cited).
52 In that context, it should also be recalled that the condition relating to the need for processing
must be examined in conjunction with the ‘data minimisation’ principle enshrined in
Article 5(1)(c) of the GDPR, in accordance with which personal data must be ‘adequate, relevant
and limited to what is necessary in relation to the purposes for which they are processed’
C-252/21, EU:C:2023:537, paragraph 109 and the case-law cited).
53 Lastly, as regards, third, the condition that the interests or fundamental rights and freedoms of the
person concerned by the data protection do not take precedence over the legitimate interests of
the controller or of a third party, the Court has held previously that that condition entails a
balancing of the opposing rights and interests at issue which depends in principle on the specific
circumstances of the particular case and that, consequently, it is for the referring court to carry
out that balancing exercise, taking account of those specific circumstances (judgment of
4 July 2023, Meta Platforms and Others (General terms of use of a social network), C-252/21,
EU:C:2023:537, paragraph 110 and the case-law cited).
54 Furthermore, recital 47 of the GDPR states that the interests and fundamental rights of the data
subject may in particular override the interest of the data controller where personal data are
processed in circumstances where data subjects do not reasonably expect such processing
C-252/21, EU:C:2023:537, paragraph 112).
55 While it is ultimately for the national court to assess whether, in relation to the processing of
personal data at issue in the main proceedings, the three conditions referred to in paragraph 49
of this judgment are satisfied, it is open to the Court, when giving a preliminary ruling on a
reference, to give clarifications to guide the national court in that determination (judgments of
4 July 2023, Meta Platforms and Others (General terms of use of a social network), C-252/21,
EU:C:2023:537, paragraph 96, and of 7 December 2023, SCHUFA Holding (Discharge from
remaining debts), C-26/22 and C-64/22, EU:C:2023:958, paragraph 81 and the case-law cited).
56 In the present case, as regards, first, the condition relating to the pursuit of a legitimate interest by
the controller or by a third party within the meaning of point (f) of the first subparagraph of
Article 6(1) of the GDPR, the referring court refers to the interest of a third party, namely the
interest of a partner with an indirect shareholding in an investment fund established in the form
of a limited partnership offering shares for public subscription, to obtain personal data relating to
the other indirect partners of that partnership with a view to entering into contract with them or
negotiating with them the purchase of shares, or coordinating with them for the purpose of
reaching a consensus in connection with resolutions of all the partners.
57 It must be held that such an interest is, in principle, likely to constitute, for the purpose of
disclosing personal data, a legitimate interest within the meaning of point (f) of the first
subparagraph of Article 6(1) of the GDPR, having regard, in particular, to the status of such a
partnership, as it results from the national law of the Member State concerned, irrespective of
the size of the shareholding and the powers held in that partnership by the partner which
ECLI:EU:C:2024:738 13
requested disclosure. It is however for the referring court to assess, on a case-by-case basis, the
existence of such an interest, taking into account the legal framework applicable and all the
circumstances of the case.
58 Where such a legitimate interest is established, it is also necessary, in order for the pursuit of that
interest to allow the processing of personal data, under point (f) of the first subparagraph of
Article 6(1) of the GDPR, that the controller comply with all its other obligations under that
regulation.
59 Second, as regards the condition relating to the necessity of such processing to achieve that
interest and, in particular, the existence of means less restrictive of the fundamental rights and
freedoms of data subjects and equally appropriate, it must be stated that it is, in particular,
possible for the partner of an investment fund wishing to obtain information concerning another
partner with an indirect shareholding in that fund through a trust company to ask that fund or
that company directly to transfer its request to the partner concerned, for the purpose of
becoming acquainted or exchanging views with that partner. That partner could then freely
decide whether it wishes to make contact with the requesting partner or whether it prefers not to
allow such a request and to remain anonymous. Such a solution could also be applied in the case
where the requesting partner wishes to enter into negotiations with another partner with the aim
of purchasing shares from that partner or to coordinate with that partner for the purpose of
reaching a consensus in connection with resolutions of all the partners.
60 That solution would also make it possible for the partner concerned by the request for
information, in accordance with the data minimisation principle referred to in paragraph 52 of
this judgment, to retain control over the processing of its personal data and to thus limit their
disclosure to another partner to what is in fact necessary and relevant in the light of the purposes
in respect of which those data are requested and processed.
61 It cannot, therefore, be ruled out that a procedure such as that described in the preceding
paragraph of this judgment may be regarded as a measure involving the least intrusion in the
right to protection of the confidentiality of the data subject’s personal data, whilst allowing the
controller to pursue, in an equally efficient manner, the legitimate interest of the third party
concerned, which it is however for the referring court to ascertain.
62 Third, as regards the balancing of interests which it is for the referring court to carry out in the
light of the specific circumstances of the present case, that court must take account, in particular,
of the reasonable expectations of the data subject as well as the scale of the processing at issue and
its impact on that person (judgment of 4 July 2023, Meta Platforms and Others (General terms of
use of a social network), C-252/21, EU:C:2023:537, paragraph 116).
63 It follows that, in such a balancing exercise, first, in cannot, in principle, be ruled out that the
disclosure of partners’ personal data, even indirect partners, of a partnership, to other partners
may serve, as the case may be, the economic interests of each of them and, therefore, also the
interests of the indirect partners whose personal data those other partners wish to access.
64 Second, nor can it be ruled out that the interest of the partners with indirect shareholdings in an
investment fund in their personal data remaining confidential may override the interest of the
other partners seeking to obtain their contact details. In that light, it is necessary to attach
particular significance to the fact that it is likely, with regard, in particular, to the contractual
provisions referred to in paragraph 45 of this judgment, that the indirect partners of such an
14 ECLI:EU:C:2024:738
investment fund could not reasonably expect, at the time when their personal data are collected,
that those personal data are disclosed to third parties, in the present case, to other indirect
partners of that investment fund.
65 It follows from all the foregoing considerations, and subject to the final assessment of the referring
court, that it appears doubtful that the processing of personal data, such as the disclosure of the
information requested by the applicants in the main proceedings, may be justified in respect of a
legitimate interest within the meaning of point (f) of the first subparagraph of Article 6(1) of the
GDPR.
66 As regards, in the third place, point (c) of the first subparagraph of Article 6(1) of the GDPR, that
provision provides that the processing of personal data is lawful if processing is necessary for
compliance with a legal obligation to which the controller is subject.
67 Article 6(3) of the GDPR specifies, inter alia, in that respect, that the processing must be based on
EU law or on Member State law to which the controller is subject, and that that legal basis must
meet an objective of public interest and be proportionate to the legitimate aim pursued
C-252/21, EU:C:2023:537, paragraph 128).
68 Moreover, as recital 41 of that regulation states, where it refers to a legal basis or a legislative
measure, this does not necessarily require a legislative act adopted by a parliament, without
prejudice to obligations provided for under the constitutional order of the Member State
concerned. However, such a legal basis or legislative measure should be clear and precise and its
application should be foreseeable to persons subject to it, in accordance with the case-law of the
Court and the European Court of Human Rights.
69 In the present case, first, EU law does not lay down any obligation for investment funds or trust
companies, such as those in the cases in the main proceedings, to disclose personal data of
partners with indirect shareholdings in those funds.
70 Second, it follows from the requests for a preliminary ruling that such an obligation could
nevertheless be inferred, subject to the verifications to be carried out by the referring court in that
regard, from the case-law of the Bundesgerichtshof (Federal Court of Justice) and the
Oberlandesgericht München (Higher Regional Court, Munich), under which the contractual
clauses which ensure confidentiality of contact details of the indirect partners of a partnership
offering shares for public subscription, such as those at issue in the main proceedings, should be
regarded as invalid, with the result that it would be necessary to disclose the personal data of
partners with indirect shareholdings in an investment fund established in the form of a limited
partnership offering shares for public subscription.
71 In that regard, it should be noted that, consistently with what is stated in paragraph 68 of this
judgment, it cannot be ruled out that ‘Member State law to which the controller is subject’ within
the meaning of point (b) of Article 6(3) of the GDPR also covers national case-law.
72 However, as is apparent from recital 41 of that regulation, such case-law must be clear and precise
and its application must be foreseeable by those persons subject to it, in accordance with the
case-law of the Court.
ECLI:EU:C:2024:738 15
73 Furthermore, in accordance with the case-law referred to in paragraph 67 of this judgment, that
case-law must constitute a legal basis, meeting an objective of public interest, it must be
proportionate to that objective and the processing concerned must be carried out only in so far
as is strictly necessary, which it is for the referring court to ascertain (see, to that effect, judgment
of 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C-252/21,
EU:C:2023:537, paragraphs 134 and 138).
74 It will thus be for that court to determine, in particular, whether there are no measures which,
whilst making it possible to ensure transparency between the partners of partnerships, as it
appears to result from German law, and as has been set out in paragraphs 18 to 22 of this
judgment, are less restrictive of the protection of confidential personal data of indirect partners
of limited partnerships offering shares for public subscription than the obligation to disclose
those data to any other partner which requests them.
75 In the light of all the foregoing, the answer to the questions raised is that point (b) of the first
subparagraph of Article of 6(1) of the GDPR must be interpreted as meaning that the processing
of personal data which consists in disclosing, at the request of a partner of an investment fund
established in the form of a partnership offering shares for public subscription, information on
all the partners with indirect shareholdings in that fund, through trust companies, irrespective of
the size of their shareholding in the capital of those funds, for the purpose of contacting them and
negotiating the purchase of their shares or to coordinate with them for the purpose of reaching a
consensus in connection with partners’ resolutions, may be regarded as being necessary, within
the meaning of that provision, for the performance of the contract pursuant to which those
partners have purchased such shareholdings, only on condition that that processing is objectively
indispensable for a purpose that is integral to the contractual obligation intended for those same
partners, with the result that the main subject matter of the contract could not be achieved if that
processing were not to occur. That is not the case if that contract expressly prohibits the
disclosure of those personal data to other shareholders.
76 Point (f) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that
such processing may be regarded as being necessary for the purposes of legitimate interests
pursued by a third party, within the meaning of that provision, only on condition that that
processing is strictly necessary to achieve such a legitimate interest and that, in the light of all the
relevant circumstances, the interests or fundamental rights and freedoms of those partners do not
override that legitimate interest.
77 Point (c) of the first subparagraph of Article 6(1) of the GDPR must be interpreted as meaning that
that processing of personal data is justified, under that provision, where it is necessary for
compliance with a legal obligation to which the controller is subject, under the law of the
Member State concerned, as stated by the case-law of that Member State, on condition that that
case-law is clear and precise, that its application is foreseeable for those persons subject to it and
that it meets an objective of public interest and is proportionate to it.
Costs
78 Since these proceedings are, for the parties to the main proceedings, a step in the action pending
before the national court, the decision on costs is a matter for that court. Costs incurred in
submitting observations to the Court, other than the costs of those parties, are not recoverable.
16 ECLI:EU:C:2024:738
On those grounds, the Court (Fourth Chamber) hereby rules:
1. Point (b) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation),
must be interpreted as meaning that the processing of personal data which consists in
disclosing, at the request of a partner of an investment fund established in the form of a
partnership offering shares for public subscription, information on all the partners with
indirect shareholdings in that fund, through trust companies, irrespective of the size of
their shareholding in the capital of those funds, for the purpose of contacting them and
negotiating the purchase of their shares or to coordinate with them for the purpose of
reaching a consensus in connection with partners’ resolutions, may be regarded as being
necessary, within the meaning of that provision, for the performance of the contract
pursuant to which those partners have purchased such shareholdings, only on
condition that that processing is objectively indispensable for a purpose that is integral
to the contractual obligation intended for those same partners, with the result that the
main subject matter of the contract could not be achieved if that processing were not to
occur. That is not the case if that contract expressly prohibits the disclosure of those
personal data to other shareholders.
2. Point (f) of the first subparagraph of Article 6(1) of Regulation 2016/679
must be interpreted as meaning that such processing may be regarded as being

necessary for the purposes of legitimate interests pursued by a third party, within the
meaning of that provision, only on condition that that processing is strictly necessary
to achieve such a legitimate interest and that, in the light of all the relevant
circumstances, the interests or fundamental rights and freedoms of those partners do
not override that legitimate interest.
3. Point (c) of the first subparagraph of Article 6(1) of Regulation 2016/679
must be interpreted as meaning that that processing of personal data is justified, under
that provision, where it is necessary for compliance with a legal obligation to which the
controller is subject, under the law of the Member State concerned, as stated by the
case-law of that Member State, on condition that that case-law is clear and precise, that
its application is foreseeable for those persons subject to it and that it meets an objective
of public interest and is proportionate to it.
[Signatures]
ECLI:EU:C:2024:738 17

CELEX%3A62022CJ0017%3AEN%3ATXT

Uploaded by

Copyright:

Available Formats

CELEX%3A62022CJ0017%3AEN%3ATXT

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CELEX%3A62022CJ0017%3AEN%3ATXT

Uploaded by

Copyright:

Available Formats

Reports of Cases

JUDGMENT OF THE COURT (Fourth Chamber)

In Joined Cases C-17/22 and C-18/22,

HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG

Müller Rechtsanwaltsgesellschaft mbH (C-17/22),

Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG

WealthCap Photovoltaik 1 GmbH Co. KG,

WealthCap PEIA Komplementär GmbH,

WealthCap Investorenbetreuung GmbH (C-18/22),

THE COURT (Fourth Chamber),

composed of C. Lycourgos, President of the Chamber, O. Spineanu-Matei, J.-C. Bonichot,

* Language of the case: German.

Advocate General: J. Richard de la Tour,

Registrar: I. Illéssy, Administrator,

after considering the observations submitted on behalf of:

– the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,

gives the following

European Union law

5 Article 4 of that regulation provides:

‘For the purposes of this Regulation:

‘1. Personal data shall be:

7 Article 6 of the GDPR, entitled ‘Lawfulness of processing’, is worded as follows:

(a) Union law; or

(b) Member State law to which the controller is subject.

8 Article 13(1) of that regulation provides:

10 Paragraph 162(1) of that code is worded as follows:

‘(1) Shareholders or associations of shareholders may invite other shareholders in the

12 The first sentence of Paragraph 33(1) of the Wertpapierhandelsgesetz (Law on Securities

Procedure before the Court

Consideration of the questions referred

On those grounds, the Court (Fourth Chamber) hereby rules:

2. Point (f) of the first subparagraph of Article 6(1) of Regulation 2016/679

must be interpreted as meaning that such processing may be regarded as being

3. Point (c) of the first subparagraph of Article 6(1) of Regulation 2016/679

You might also like