Court of Justice judgment · Case C-683/21

Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija

Reviewed by Sergio Maldonado Elvira on 29 October 2026

Case: C-683/21
Court: Court of Justice
Date of judgment: 5 December 2023
ECLI: ECLI:EU:C:2023:949
Instrument: Regulation (EU) 2016/679 (GDPR)
Provisions: Article 4(2), Article 4(7), Article 26(1), Article 83

Holding (summary, not the official text)

A body that commissioned an app and helped decide its purposes and means can be a controller without processing the data itself; joint control needs no formal arrangement; using real personal data to test software is processing; and a fine requires intent or negligence and can cover processing done by a processor on the controller's behalf.

Checked against the official source on 28 October 2026.

Only the judgment as published by the Court of Justice is authoritative. This is reference material, not legal advice.

All judgments