Huber: “Necessary” Really Means Necessary

Case C-524/06 | Court of Justice of the European Union | Grand Chamber | 16 December 2008

Practice takeaways: ① “Necessity” is an autonomous concept of EU law; Member States cannot define it differently for themselves. ② A government may process personal data where necessary to administer EU residence rights, but the register must contain only the information necessary for that purpose. ③ Access must likewise be limited: for residence-law purposes, only authorities exercising powers in that field may receive access on the basis of necessity. ④ Centralization is not automatically unlawful, but it must contribute to the more effective application of the relevant legislation. ⑤ Individualized personal data are not necessary merely because the government wants statistics; anonymous information is sufficient for that purpose. ⑥ Systematically processing the data of non-German EU citizens—but not Germans—for general crime-fighting purposes was unlawful nationality discrimination.

Huber asks a deceptively simple question: when a government has a legitimate reason to process personal data, how much processing is actually necessary?

Germany maintained a centralized register containing extensive personal information about foreign nationals residing in the country, including citizens of other EU Member States. Heinz Huber, an Austrian citizen living in Germany, challenged the retention of his information because no comparable federal register existed for German nationals. (Judgment, paras. 19–32.)

The Grand Chamber accepted that Germany could legitimately process some information about EU citizens in order to administer their rights of residence. But a legitimate governmental objective did not make every collection, use, disclosure, or centralization of personal data “necessary.”

That distinction made Huber an important early case on one of EU data-protection law’s recurring questions: a lawful purpose is only the beginning of the analysis. The processing itself must also be necessary for that purpose.

The Short Version

Germany maintained the Central Register of Foreign Nationals (Ausländerzentralregister or AZR), administered by the Federal Office for Migration and Refugees. It covered foreign nationals residing in Germany for more than three months. (Judgment, para. 19.)

The register was extensive. Depending on the individual, it could contain identity and nationality information, marital status, identity-document information, entries into and exits from Germany, residence status, asylum and residence-permit decisions, expulsion proceedings, arrest warrants, suspected drug or immigration offenses, suspected terrorist activity, and related information. (Judgment, paras. 20–28.)

Heinz Huber was an Austrian national who had moved to Germany in 1996 to work as a self-employed insurance agent. His AZR record included his name, date and place of birth, nationality, marital status, sex, entries into and exits from Germany, residence status, passport information, previous statements concerning his domicile, and administrative reference information. (Judgment, paras. 30–31.)

Huber sought deletion of his information, arguing in particular that he was being treated differently because no comparable centralized database existed for German citizens. His request was rejected, eventually producing a preliminary reference to the CJEU. (Judgment, paras. 32–40.)

The case therefore raised both data-protection and nationality-discrimination questions.

The CJEU ultimately held that the AZR could be used for residence-law purposes only to the extent the processing was necessary, that individualized data were not necessary for statistical purposes, and that using the register for general crime-fighting purposes violated the prohibition on nationality discrimination. (Judgment, paras. 66–68, 81.)

Why the case matters

Huber is important because it separates two questions that can easily collapse into one: Does the government have a legitimate purpose for processing the data? and Is this particular processing necessary to accomplish that purpose?

The Court accepted the first proposition in significant part. EU free-movement law permitted Germany to determine whether citizens of other Member States satisfied the conditions governing residence. Germany therefore needed access to relevant information for that task. (Judgment, paras. 54–58.)

But that did not give Germany an unlimited license to build whatever database was most useful or convenient.

Instead, the Court examined what information was collected, who could access it, why it was retained, and whether centralization itself served the legitimate purpose. (Judgment, paras. 59–68.)

That is the enduring contribution of Huber: necessity attaches to the processing, not merely to the government's objective.

The Court’s analysis

1. The information in the AZR was personal data, and operating the register was processing

The threshold issue was straightforward. Information concerning Huber constituted personal data because it related to an identified or identifiable natural person. Its collection, storage, and transmission therefore constituted processing under Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46 or the Data Protection Directive.) (Judgment, para. 43.)

But the purposes mattered.

Directive 95/46 expressly excluded certain processing concerning public security, State security, and criminal-law activities. Processing through the AZR for residence-law and statistical purposes therefore fell within the Directive, while processing connected with fighting crime did not. The Court addressed the latter separately under primary EU law and the prohibition against nationality discrimination. (Judgment, paras. 44–46.)

2. “Necessity” has an independent EU-law meaning

This is Huber’s central data-protection holding.

Article 7(e) of Directive 95/46 permitted processing where it was necessary for the performance of a task carried out in the public interest or in the exercise of official authority. (Judgment, paras. 47–49.)

The Court reasoned that Directive 95/46 sought an equivalent and high level of data protection throughout the EU. Allowing each Member State to decide for itself what “necessary” meant would undermine that harmonization. (Judgment, paras. 50–51.)

“Necessity” could not have a meaning that varied from one Member State to another.

It was an autonomous concept of EU law, to be interpreted consistently with the Directive's objective of protecting fundamental rights and freedoms. (Judgment, para. 52.)

That makes Huber much more than a case about an immigration database.

3. Some processing for residence administration could be necessary

The Court did not hold that maintaining information about non-national EU citizens was inherently unlawful.

• EU citizens' right to reside in another Member State was subject to conditions established under EU law. A host Member State could therefore need relevant documents and information to determine whether those conditions were satisfied and whether grounds existed for restricting residence. (Judgment, paras. 54–58.)
• The use of a register to assist authorities administering residence legislation was consequently legitimate in principle. (Judgment, para. 58.)

But in principle did substantial work.

4. A necessary database cannot contain unnecessary data

Even where maintaining a register served a legitimate residence-law function, the Court imposed a straightforward limitation: the register could not contain information beyond what was necessary for that purpose. (Judgment, para. 59.)

The Court also connected necessity to data quality over time. Because changes in an individual's circumstances could affect residence status, authorities needed to keep relevant information current—and remove information that had become irrelevant. (Judgment, para. 60.)

Necessity therefore constrained not simply the initial decision to collect data, but also what remained in the system.

5. Necessity also limits access

The same reasoning applied to disclosure.

• For purposes of administering residence legislation, the Court held that only access by authorities exercising powers in that field could be regarded as necessary under Article 7(e). (Judgment, para. 61.)

This point is particularly important because the AZR was not merely a storage mechanism. German law allowed information to be supplied to numerous public authorities, with certain bodies capable of consulting the system directly through automated procedures. (Judgment, paras. 22–28.)

Necessity therefore concerns not only whether data may be collected, but also who needs access to them for the stated purpose.

6. Centralization could be necessary—but only if it actually improved the administration of residence law

The Court took a more permissive approach to the centralized nature of the AZR.

• Even if Germany's decentralized population registers contained all the relevant information, centralization could still qualify as necessary if it contributed to the more effective application of the legislation governing EU citizens' residence rights. (Judgment, para. 62.)
• The Court ultimately left that factual determination to the national court. (Judgment, paras. 66–67.)

The holding was therefore not “centralized databases are unnecessary.” It was narrower: centralization itself requires justification by reference to the purpose for which the data are processed.

7. Statistics did not require individualized personal data

Germany also invoked statistical purposes.

• The Court accepted that Member States may collect information needed to understand population movements and noted that EU legislation itself contemplated migration statistics. (Judgment, paras. 63–64.)

But that did not establish that individualized personal information had to be retained.

Relying expressly on Advocate General Poiares Maduro, the Court concluded that anonymous information was sufficient for the statistical objective. Individualized personal information in the AZR therefore could not be regarded as necessary for statistical purposes under Article 7(e). (Judgment, paras. 65, 68; Opinion, para. 23.)

This is one of Huber’s cleanest illustrations of necessity: if the purpose can be achieved without identifiable data, the existence of a useful statistical purpose does not justify retaining identifiable data.

8. Crime prevention could not justify treating non-German EU citizens as a separate surveillance population

Crime fighting presented a different legal question because that processing fell outside Directive 95/46's material scope. (Judgment, paras. 44–46.)

The Court instead examined the AZR under the EU prohibition against nationality discrimination.

• Germany's problem was basic: crime is committed regardless of the perpetrator's nationality. For that objective, German nationals and EU citizens from other Member States living in Germany were therefore in comparable positions. (Judgment, paras. 75–79.)
• Germany could not justify systematically processing personal data for crime-fighting purposes only for non-German EU citizens. The resulting difference in treatment constituted prohibited nationality discrimination. (Judgment, paras. 77–81.)

The Advocate General’s Opinion

Advocate General Poiares Maduro reached substantially the same result but articulated necessity more aggressively.

For him, necessity was part of the proportionality inquiry. When a measure interfered with a protected right in pursuit of a legitimate objective, the government had to demonstrate that the measure was the least restrictive means of achieving that objective. He also connected that inquiry to Article 8 European Convention on Human Rights (ECHR) and the requirement that interference with private life respond to a pressing social need and remain proportionate to the legitimate aim. (Opinion, para. 27.)

That approach led him to question the AZR on three fronts.

• First, providing information to authorities beyond those responsible for immigration and residence law was unnecessary for the residence-law purpose. (Opinion, paras. 12, 20, 28.)
• Second, collecting information beyond what was required to determine EU citizens' residence rights was likewise unnecessary. (Opinion, paras. 13, 20, 28.)
• Third, he applied a stricter test to centralization than the Court ultimately adopted. In his view, Germany needed to demonstrate that there was no other effective means of enforcing the residence rules. Greater convenience, speed, or ease of use was not enough. (Opinion, paras. 16, 29, 31.)

His formulation is worth keeping distinct from the judgment. The Court asked whether centralization contributed to the more effective application of residence legislation. (Judgment, para. 62.) The Advocate General would have required Germany to show essentially that an adequate alternative could not do the job. (Opinion, paras. 16, 29.)

The Opinion also contains one of the case's sharpest observations about administrative convenience. A centralized database undoubtedly made it easier for police and security services to obtain information about foreign EU citizens. But administrative convenience could not justify discriminatory treatment or restrictions on EU-law rights. (Opinion, para. 22.)

What the Court did—and did not—decide

The Court did decide that:

• “necessity” under Article 7(e) was an autonomous EU-law concept.
• processing information necessary to administer EU residence rights could be legitimate.
• the register could contain only data necessary for that purpose.
• access based on that purpose had to be confined to authorities exercising relevant residence-law powers.
• centralization could qualify as necessary if it made the relevant residence legislation more effective.
• individualized personal data were unnecessary for the statistical purpose identified in the case.
• systematically processing only non-German EU citizens' information for general crime fighting constituted prohibited nationality discrimination.

The Court did not decide that:

• governments may never maintain centralized personal-data registers;
• every difference between centralized and decentralized processing makes the centralized system unlawful;
• EU citizens living in another Member State must always be treated identically to that State's own nationals for residence administration;
• the entire AZR was unlawful for every purpose; or
• the Advocate General's stricter “no other way” formulation was the test ultimately adopted by the Court.

Huber under today’s GDPR

Huber interpreted Article 7(e) of Directive 95/46, the predecessor to today's GDPR public-task lawful basis. Its basic architecture remains recognizable in Article 6(1)(e) GDPR, which permits processing necessary for performing a task carried out in the public interest or exercising official authority.

As discussed in “What Is ‘Public Task’ Under the GDPR?”, that lawful basis still contains a distinct necessity requirement: the public task or official authority must have a basis in law, but the processing must also be objectively necessary to perform it. If the same task can reasonably be accomplished through a less intrusive means, Article 6(1)(e) does not provide the lawful basis.

A controller cannot stop at:

“We have a legitimate public task.”

The next question always is:

“Why is this processing necessary for that task?”

And Huber shows that the answer may require examining the data collected, retention and updating, access, identifiable versus anonymous information, and even the architecture through which the information is organized and made available. (Judgment, paras. 52, 59–68.)

That analysis also connects directly to the GDPR's data-minimization principle. Article 5(1)(c) requires personal data to be “adequate, relevant and limited to what is necessary” for the purposes of the processing. As discussed in “What Is ‘Data Minimization’ Under the GDPR?”, what is necessary must therefore be assessed against the particular purpose: a controller should not collect or retain more personal data than it needs to achieve that purpose.

Huber anticipated that logic in concrete terms. Germany could have a legitimate reason to maintain information needed to administer residence rights, but that did not justify additional data, unnecessary access, or identifiable information where anonymous information would achieve the purpose. (Judgment, paras. 59–68.)

That is why the case remains useful well beyond immigration databases: it connects the lawful basis for processing with a broader principle that remains central to the GDPR—identify the purpose, establish the authority to process, and then limit the processing to what that purpose actually requires.

Conclusion

Huber did not say that governments cannot collect personal data to perform legitimate public functions. It said something more consequential: the existence of a legitimate governmental function does not make all processing serving that function necessary.

Germany could collect information needed to administer EU residence rights. But necessity still constrained what data could be held, who could access them, whether identifiable information was needed, and whether centralization itself was justified.

The distinction is simple but foundational:

The purpose may be legitimate. The processing still has to earn the label “necessary.”

Sources and Additional Resources

Sources

CJEU judgments, Advocate General opinions, procedural notices, summaries, and related case materials are available through InfoCuria, the Court of Justice of the European Union's official case-law database.

• Court of Justice of the European Union, Grand Chamber, Case C-524/06, Heinz Huber v Bundesrepublik Deutschland, Judgment of 16 December 2008, ECLI:EU:C:2008:724.
• Advocate General Poiares Maduro, Opinion in Case C-524/06, delivered 3 April 2008, ECLI:EU:C:2008:194.

Related reading from The de la Torre Review

• “What Is ‘Public Task’ Under the GDPR?” A practical explanation of Article 6(1)(e) GDPR, including the requirement that the public task or official authority have a basis in law and that the processing itself be objectively necessary. Read the Article.
• “What Is ‘Data Minimization’ Under the GDPR?” Explains Article 5(1)(c) GDPR and the related requirement that personal data be adequate, relevant, and limited to what is necessary for the stated processing purpose. Read the Article.