## Facts

- Germany maintained a centralized electronic Central Register of Foreign Nationals (AZR) containing extensive personal data on non-German nationals residing in Germany, including EU citizens from other Member States.
- Heinz Huber, an Austrian national residing and working in Germany as a self-employed insurance agent, was included in the AZR.
- The AZR stored individualized data such as identity details, nationality, sex, entries/exits, residence status, and administrative identifiers.
- Germany did not maintain a comparable centralized register for German nationals.
- Huber requested deletion of his AZR data; the competent federal authority refused.
- In national litigation, the appellate administrative court stayed proceedings and sought a preliminary ruling on compatibility with EU non-discrimination/free-movement provisions and Directive 95/46/EC data-protection rules.

## Issues

1. Whether processing of personal data in a register like the AZR falls within the scope of Directive 95/46/EC, including in light of the Directive’s exclusion for processing connected with public security and criminal-law activities.
2. Whether maintaining a centralized register limited to EU citizens who are not nationals of the host Member State is compatible with Directive 95/46/EC’s requirement that processing be “necessary” for a public task when used for (a) residence-law administration and (b) statistical purposes.
3. Whether establishing and using such a foreign-national-only processing system for the purpose of fighting crime violates EU law’s prohibition on nationality-based discrimination as applied to EU citizens exercising free movement and establishment rights.

## Decision

- Directive 95/46/EC applied to the AZR insofar as the processing served residence-law administration and statistical purposes, but it did not apply insofar as processing was connected with fighting crime (public security/criminal-law activity).
- A centralized register limited to non-national EU citizens for residence-law administration did not meet the Directive’s “necessity” requirement unless (i) it contained only data necessary to apply residence rules and (ii) centralization made application of those rules more effective for non-national EU citizens.
- Storing and processing individualized personal data in such a register for statistical purposes could not be considered “necessary” under the Directive.
- EU non-discrimination law precluded a Member State from creating a personal-data processing system specific to non-national EU citizens for the purpose of fighting crime.
- The national court was left to apply these interpretations to the AZR and decide Huber’s deletion request.

## Legal Principles

- The applicability of EU data-protection rules to public-sector processing may depend on the specific objective pursued; crime-related processing linked to public security/criminal law may fall outside Directive 95/46/EC’s scope.
- Under Directive 95/46/EC, “necessity” for a public task requires more than administrative convenience; the data set must be limited to what is needed for the stated task, and the chosen architecture (e.g., centralization) must be justified by effectiveness for that task.
- Individualized personal data retention for statistical ends is not “necessary” within the meaning of Directive 95/46/EC where the statistics objective can be achieved without keeping individualized records.
- A crime-fighting data-processing system targeted at EU citizens solely because they are non-nationals constitutes prohibited nationality discrimination under EU law.

## Conclusion

The CJEU held that a foreign-national-only centralized register may be compatible with EU law only under strict necessity conditions for residence administration, that individualized storage for statistical purposes fails the necessity test, and that crime-fighting registries specific to non-national EU citizens are barred as discriminatory; the referring court was to apply these rules to the AZR and Huber’s deletion claim.


Huber v. Bundesrepublik Deutschland, Case C-524/06 (C.J.E.U. 2008)