Data Protection
GDPR
Principles
Principles relating to processing of personal data
Article 6
Lawfulness of processing
Article 7
Conditions for consent
Article 8
Conditions applicable to child’s consent in relation to information society services
Article 9
Processing of special categories of personal data
Article 10
Processing of personal data relating to criminal convictions and offences
Article 11
Processing which does not require identification
CHAPTER III
Transparent information, communication and modalities for the exercise of the rights of the data subject
Section 2
Information to be provided where personal data are collected from the data subject
Article 14
Information to be provided where personal data have not been obtained from the data subject
Right of access by the data subject
Section 3
Right to rectification
Right to erasure (‘right to be forgotten’)
Article 18
Right to restriction of processing
Article 19
Notification obligation regarding rectification or erasure of personal data or restriction of processing
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.Section 4
Right to object and automated individual decision-making
Article 22
Automated individual decision-making, including profiling
Cases
Johnson v The Medical Defence Union Ltd (2) [2006] EWHC 321
MR JUSTICE RIMER :
“Introduction
The primary claim I am concerned with is under section 13 of the DPA (Compensation for failure to comply with certain requirements). I have explained that Mr Johnson’s case is that he is entitled to such compensation because he says the MDU’s alleged unfair processing of his data in breach of the first data protection principle was directly causative of the termination of his MDU membership. All aspects of that claim are in issue, and I now turn to it. I must first refer to the relevant provisions of the DPA.
…..
……
Mr Johnson’s primary complaint is that the MDU processed his personal data unfairly in breach of the first data protection principle. It is that breach, and that alone, that is said to have caused the non-renewal of his MDU membership. The first issue is whether MDU did in fact “process” any of his personal data. The only acts of processing alleged by Mr Johnson are (i) selecting the information contained in his personal data and thereby presenting a false picture of the situation, and (ii) holding inaccurate personal data. Only the first act is relied upon in relation to the alleged breach by the MDU of the first data protection principle. The reference in it to the selection of information is a reference to Dr Roberts’s activities in preparing the material for the RAG. Mr Spearman’s submission was that that selection of information did not amount to “processing” either for the purposes of that principle or at all. If that is correct, it provides a complete answer to the claim. Mr Howe submitted that it was incorrect.
The definition of “data” in section 1(1) of the DPA shows that it encompasses information which is “being processed by means of equipment operating automatically in response to instructions given for that purpose” as well as information that is recorded with the intention that it should be processed by means of such equipment. Those parts of the definition refer to information stored on a computerised system. But “data” can also encompass information recorded as “part of a relevant filing system or with the intention that it should form part of a relevant filing system, …”. That part of the definition extends to information held within certain types of manual filing systems, although such a system has to be a “relevant” one. A “relevant filing system” is defined in section 1(1) as meaning a “structured” filing system as there explained and its meaning was considered by the Court of Appeal in Durant v. Financial Services Authority [2000] FSR 28, in particular in paragraph 50 of the judgment of Auld LJ.
In the present case, 12 of Mr Johnson’s files were manual ones and it is not suggested by Mr Howe that any of them amounted to a “relevant filing system” within the relevant definitions. Of the other files, three (0010691, 0010574 and 0001331) were held in electronic form; one (9208720) was held on a compact disc (which was similarly capable of being electronically searched); and one (9205597) was held on a microfiche file, which was not readily searchable and which I understood to be agreed to be outside the definition of “data” within the definition in section 1(1). The day one summaries in relation to all the files were, however, computerised: they formed part of Mr Johnson’s case history, which also included the numbers of the various files relating to him and identified any applicable reserves or costs provisions.
As it is disclaimed that any of the manual files constituted a relevant filing system, Mr Spearman said it followed that there was no relevant processing of any of those files by Dr Roberts. Nor, he said, did her selection of material from the computerised files amount to “processing”. Mr Spearman referred to various recitals of the Directive, which he said provide the basis upon which the relevant provisions of the DPA have to be interpreted. He referred to recitals (2), (3), (10) and (11), which emphasise the intention of the Directive as being to protect individuals’ right to privacy. He then focused on recitals (15) and (27). The latter is concerned primarily with manual filing systems, but the former provides:
“(15) Whereas the processing of such data is covered by this Directive only if it is automated or if the data processed are contained or are intended to be contained in a filing system structured according to specific criteria relating to individuals, so as to permit easy access to the personal data in question.”
…..
……
I accept, therefore, that Dr Roberts’s selection of material from the various manual and microfiche files and their inputting into a computer amounted to “processing” within the meaning of the definition of “processing” in section 1(1) as expanded in section 1(2)(a); and that it makes no difference that none of such files was or formed part of a “relevant filing system.” I accept also that her selection of information from the computerised files for inputting into the computer similarly amounted to “processing” within the meaning of that definition as elaborated in section 1(2)(a) and/or (b).
The First Data Protection Principle
Having held that there was relevant processing of Mr Johnson’s personal data within the meaning of the first data protection principle, the next question I have to consider is whether there was any breach of that principle by the MDU. The only issue here is whether Mr Johnson’s data was processed “fairly”. The complaint advanced by him that it was not is in part based on the assertion that the MDU did not comply with paragraph 2(1)(a) or (b) of Part II of Schedule I because he was not provided with certain of the information prescribed by paragraph 2(3). Paragraph 2(1)(a) relates to data obtained from Mr Johnson himself (the lead files) and paragraph 2(1)(b) relates to data obtained from others (the two non-lead files). Paragraph 2(1)(a) does not specify by when the paragraph 2(3) information has to be provided. Paragraph 2(1)(b), read with paragraph 2(2)(a), shows that, in a case to which that paragraph applies, it must be provided either before the data controller processes the data or as soon as practicable afterwards.
It is accepted that Mr Johnson was informed of the identity of the data controller and representative for the purposes of paragraphs 2(3)(a) and (b). What is not accepted is that he was also informed of “the purpose or purposes for which the data [were] intended to be processed” as required by paragraph 2(3)(c) or that he was given the “further information” necessary under paragraph 2(3)(d). In considering this, it will be convenient to deal separately with the processing of (a) the lead files and (b) the non-lead files.
(a) The processing of the lead files
As to the point based on paragraph 2(3)(c), the MDU asserts that Mr Johnson was duly informed of the relevant purpose or purposes and it relies upon what I have called “the processing agreement”. That is the March 2001 document by reference to which, when renewing his membership, Mr Johnson agreed to the processing by MDUSL and the MDU of his personal data for “risk management” purposes. It is said that that is precisely what Mr Johnson’s personal data were used for when MDU carried out its risk review. The processing agreement was sent to Mr Johnson in March 2001 – during the period when the transitional provisions of the DPA were in operation – and Mr Spearman submitted that it was obviously drafted in the way it was in order to cater for the requirements of the DPA. The MDU’s argument on this issue is straightforward and calls for no elaboration.
…..
……
I consider it helpful first to refer to the provisions of the Directive from which paragraphs 2(1)(a) and (b) are derived, namely recital (38)/article 10 and recital (39)/article 11 respectively. They provide, so far as material, as follows:
“(38) Whereas, if the processing of data is to be fair, the data subject must be in a position to learn of the existence of a processing operation and, where the data are collected from him, must be given accurate and full information, bearing in mind the circumstances of the collection.
(39) Whereas certain processing operations involve data which the controller has not collected directly from the data subject; whereas, furthermore, data can be legitimately disclosed to a third party, even if the disclosure was not anticipated at the time the data were collected from the data subject; whereas, in all these cases, the data subject should be informed when the data are recorded or at the latest when the data are first disclosed to a third party. …
SECTION IV
INFORMATION TO BE GIVEN TO THE DATA SUBJECT
Article 10
Information in cases of collection data from the data subject
Member States shall provide that the controller or his representative must provide a data subject from whom data relating to himself are collected with at least the following information, except where he already has it:
(a) the identity of the controller and his representative, if any;
(b) the purposes of the processing for which the data are intended;
(c) any further information such as
– the recipients or categories of recipients of the data,
– whether replies to the questions are obligatory or voluntary, as well as the possible consequences of failure to reply,
– the existence of the right of access to and the right to rectify the data concerning him
in so far as such further information is necessary, having regard to the specific circumstances in which data are collected, to guarantee fair processing in respect of the data subject.
Article 11
Information where the data have not been obtained from the data subject
1. Where the data have not been obtained from the data subject, Member States shall provide that the controller or his representative must at the time of undertaking the recording of personal data or if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide the data subject with at least the following information, except where he already has it:
(a) the identity of the controller and of his representative, if any;
(b) the purpose of the processing;
(c) any further information such as
– the categories of data concerned,
– the recipients or categories of recipients,
– the existence of the right of access to and the right to rectify data concerning him
in so far as such further information is necessary, having regard to the specific circumstances in which the data are processed to guarantee fair processing in respect of the data subject. …”
Coming now to the point based on paragraph 2(3)(d), I consider, first, that in so far as article 10 may be viewed as casting light on the type of “further information” that paragraph 2(3)(d) has in mind, it provides no support for the proposition that compliance with the fair processing requirements of the first data protection principle required Dr Roberts’s processing exercise to be followed by a consultation with Mr Johnson. Nor, in my judgment, does the more succinct language of paragraph 2(3)(d) support the proposition. That sub-paragraph is not concerned with explaining the “purposes” of the processing, a matter which is covered by paragraph 2(3)(c). Nor is it about consulting with the data subject. It is about providing him with certain “further information” having regard to “the specific circumstances in which the data are or are to be processed.” That is not naturally to be interpreted as requiring the data controller to engage in a consultation exercise after the completion of the processing. Article 10 suggests that it might (inter alia) require the data subject to be told of his right of access to, and to rectify, his personal data, but in this case Mr Johnson had already been told of those rights in the processing agreement. In a case in which the data was, for example, being, or was to be, processed by a “data processor” as defined in section 1(1) of the DPA, it might also require notice of that to be given to the data subject. But I do not accept that the paragraph 2(3)(d) extends to the lengths of requiring the MDU to have consulted with Mr Johnson as part of the processing exercise.
Secondly, I anyway cannot see how the suggested consultation procedure can be part of the processing exercise. The complaint is that, having processed the personal data from the lead files, Dr Roberts did not consult Mr Johnson about the fruit of her work. But by then the relevant processing had been done and the suggested consultation cannot naturally be regarded as a continuation of the processing. Mr Johnson’s complaint that he was not consulted about Dr Roberts’s work is, in substance, nothing other than a complaint that he was not entitled to make representations to the RAG about his case. He has specifically disclaimed that he had any right to do so, and so his case under this head is nothing other than an attempt to say that he should have enjoyed a like right at an earlier stage and as part of the processing exercise. In my judgment, that contention is misconceived.
Thirdly, Mr Johnson’s point that, as part of the processing exercise, proper compliance with paragraph 2(3)(d) required the MDU to go to the lengths of providing Dr Roberts’s selection of his data to him for his comments prior to its submission to the RAG appears to me to be anyway wrong in principle. It is easy to have instinctive sympathy with the proposition that, in broad terms, it would have been “fair” for the MDU to have done this. Having heard Mr Johnson give oral evidence, there is no doubt that, given that opportunity, he would have taken it and would have argued his corner in response to every point, and at length. This goes back to Mr Howe’s general point that the risk review procedure actually adopted by the MDU was inherently unfair, one criticism he made being that Mr Johnson was given no opportunity of making representations on his case following the completion of the processing exercise.
In considering this, I regard the starting point as the MDU’s risk assessment policy. As I have explained, and find, that policy was one under which the MDU assessed a member’s potential risk to MDU funds by reference exclusively to the allegations made against him, or the nature of the incidents in which he was allegedly involved. Whether the allegation was justified or not was regarded by the policy as irrelevant, as was (at least generally) the outcome of the allegation (if known). It is easy for an outsider, with no experience of the type of risk management in which the MDU was engaged, to leap to a judgment that such a policy was unfair and that a fairer one – which might perhaps be expected to enable a more reliable assessment of future risk – would be one in which the merits of each allegation are, so far as possible, assessed, although there are obvious limits to that possibility. If a policy of that sort were one that the MDU in fact employed, it is also easy to see that a fair assessment of the merits could only be arrived at after (at least) consulting the subject member for his comments on the allegations made against him.
That, however, is not the policy that the MDU has developed and adopted and, with respect to Mr Howe’s unqualified submission to the contrary, I regard it as no part of the court’s function to pass judgment on the merits of the policy that it did adopt. The policy was devised as a result of the MDU’s own experience and its formulation was essentially a matter of commercial judgment exercised in what I have no doubt was complete good faith in the interests of the members of the MDU generally. It was also formulated against the background of a contractual relationship between the MDU and its members under which the MDU had and has an absolute discretion to terminate a member’s membership and in which it was in the interests of all members that it should have a sound risk assessment policy. There might be legitimate scope for disagreement between those competent to judge these things as to whether the MDU risk assessment policy was sound or otherwise, or as to whether it could be improved. But I have no reason to believe that it was arrived at other than after proper consideration and that it was regarded as other than the most appropriate policy for the needs of the MDU. Mr Johnson might, and clearly does, view it as an unfair one, but in my judgment that assessment is not one to which any regard should be accorded in the present context: Mr Johnson is no doubt very skilled in his own sphere of expertise, but his expertise does not extend to matters of risk management. Like all MDU members, he must take the MDU risk assessment policy as he finds it; and, given its nature, I see no basis on which it can be said that his input was necessary in order that the data could be fairly processed. The MDU could process his data in the circumstances in which it did perfectly fairly without his input, and the evidence from the MDU witnesses satisfied me that his input would be unlikely to have made any difference to the assessment of his case: because, put shortly, the policy regards a member’s input as essentially irrelevant.
In my judgment, therefore, as regards the processing of the lead files, and contrary to Mr Johnson’s submission, no “further information” also needed to be provided to him in compliance with paragraphs 2(1)(a) and 2(3)(d). I do not accept that the enactment of the DPA had the consequence of requiring the MDU to change its risk assessment policy.”
Lindqvist (Approximation of laws)
[2003] EUECJ C-101/01 [2004] 2 WLR 1385, [2003] ECR I-12971, [2004] Info TLR 1, ECLI:EU:C:2003:596, [2004] CEC 117, [2004] QB 1014, EU:C:2003:596, [2004] 1 CMLR 20, [2004] All ER (EC) 561, [2003] EUECJ C-101/01, C-101/01
By order of 23 February 2001, received at the Court on 1 March 2001, the Göta hovrätt (Göta Court of Appeal) referred to the Court for a preliminary ruling under Article 234 EC seven questions concerning inter alia the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
Those questions were raised in criminal proceedings before that court against Mrs Lindqvist, who was charged with breach of the Swedish legislation on the protection of personal data for publishing on her internet site personal data on a number of people working with her on a voluntary basis in a parish of the Swedish Protestant Church.
Legal background
Community legislation
Directive 95/46 is intended, according to the terms of Article 1(1), to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy, with respect to the processing of personal data.
Article 3 of Directive 95/46 provides, regarding the scope of the directive:
1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.
2. This Directive shall not apply to the processing of personal data:
– in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,
– by a natural person in the course of a purely personal or household activity.
Article 8 of Directive 95/46, entitled The processing of special categories of data, provides:
1. Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.
2. Paragraph 1 shall not apply where:
(a) the data subject has given his explicit consent to the processing of those data, except where the laws of the Member State provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject’s giving his consent; or
(b) processing is necessary for the purposes of carrying out the obligations and specific rights of the controller in the field of employment law in so far as it is authorised by national law providing for adequate safeguards; or
(c) processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his consent; or
(d) processing is carried out in the course of its legitimate activities with appropriate guarantees by a foundation, association or any other non-profit-seeking body with a political, philosophical, religious or trade-union aim and on condition that the processing relates solely to the members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed to a third party without the consent of the data subjects; or
(e) the processing relates to data which are manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims.
3. Paragraph 1 shall not apply where processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and where those data are processed by a health professional subject under national law or rules established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy.
4. Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by decision of the supervisory authority.
5. Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority.
Member States may provide that data relating to administrative sanctions or judgements in civil cases shall also be processed under the control of official authority.
6. Derogations from paragraph 1 provided for in paragraphs 4 and 5 shall be notified to the Commission.
7. Member States shall determine the conditions under which a national identification number or any other identifier of general application may be processed.
Article 9 of Directive 95/46, entitled Processing of personal data and freedom of expression, provides:
Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.
Article 13 of Directive 95/46, entitled Exemptions and restrictions, provides that Member States may adopt measures restricting the scope of some of the obligations imposed by the directive on the controller of the data, inter alia as regards information given to the persons concerned, where such a restriction is necessary to safeguard, for example, national security, defence, public security, an important economic or financial interest of a Member State or of the European Union, or the investigation and prosecution of criminal offences or of breaches of ethics for regulated professions.
Article 25 of Directive 95/46, which is part of Chapter IV entitled Transfer of personal data to third countries, reads as follows:
1. The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection.
2. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country.
3. The Member States and the Commission shall inform each other of cases where they consider that a third country does not ensure an adequate level of protection within the meaning of paragraph 2.
4. Where the Commission finds, under the procedure provided for in Article 31(2), that a third country does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, Member States shall take the measures necessary to prevent any transfer of data of the same type to the third country in question.
5. At the appropriate time, the Commission shall enter into negotiations with a view to remedying the situation resulting from the finding made pursuant to paragraph 4.
6. The Commission may find, in accordance with the procedure referred to in Article 31(2), that a third country ensures an adequate level of protection within the meaning of paragraph 2 of this Article, by reason of its domestic law or of the international commitments it has entered into, particularly upon conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic freedoms and rights of individuals.
Member States shall take the measures necessary to comply with the Commission’s decision.
At the time of the adoption of Directive 95/46, the Kingdom of Sweden made the following statement on the subject of Article 9, which was entered in the Council minutes (document No 4649/95 of the Council, of 2 February 1995):
The Kingdom of Sweden considers that artistic and literary expression refers to the means of expression rather than to the contents of the communication or its quality.
The European Convention for the Protection of Human Rights and Fundamental Freedoms signed at Rome on 4 November 1950 (the ECHR), provides, in Article 8, for a right to respect for private and family life and, in Article 10, contains provisions concerning freedom of expression.
The national legislation
Directive 95/46 was implemented in Swedish law by the Personuppgiftslag (SFS 1998:204) (Swedish law on personal data, the PUL).
The main proceedings and the questions referred
In addition to her job as a maintenance worker, Mrs Lindqvist worked as a catechist in the parish of Alseda (Sweden). She followed a data processing course on which she had inter alia to set up a home page on the internet. At the end of 1998, Mrs Lindqvist set up internet pages at home on her personal computer in order to allow parishioners preparing for their confirmation to obtain information they might need. At her request, the administrator of the Swedish Church’s website set up a link between those pages and that site.
The pages in question contained information about Mrs Lindqvist and 18 colleagues in the parish, sometimes including their full names and in other cases only their first names. Mrs Lindqvistalso described, in a mildly humorous manner, the jobs held by her colleagues and their hobbies. In many cases family circumstances and telephone numbers and other matters were mentioned. She also stated that one colleague had injured her foot and was on half-time on medical grounds.
Mrs Lindqvist had not informed her colleagues of the existence of those pages or obtained their consent, nor did she notify the Datainspektionen (supervisory authority for the protection of electronically transmitted data) of her activity. She removed the pages in question as soon as she became aware that they were not appreciated by some of her colleagues.
The public prosecutor brought a prosecution against Mrs Lindqvist charging her with breach of the PUL on the grounds that she had:
– processed personal data by automatic means without giving prior written notification to the Datainspektionen (Paragraph 36 of the PUL);
– processed sensitive personal data (injured foot and half-time on medical grounds) without authorisation (Paragraph 13 of the PUL);
– transferred processed personal data to a third country without authorisation (Paragraph 33 of the PUL).
Mrs Lindqvist accepted the facts but disputed that she was guilty of an offence. Mrs Lindqvist was fined by the Eksjö tingsrätt (District Court) (Sweden) and appealed against that sentence to the referring court.
The amount of the fine was SEK 4 000, which was arrived at by multiplying the sum of SEK 100, representing Mrs Lindqvist’s financial position, by a factor of 40, reflecting the severity of the offence. Mrs Lindqvist was also sentenced to pay SEK 300 to a Swedish fund to assist victims of crimes.
As it had doubts as to the interpretation of the Community law applicable in this area, inter alia Directive 95/46, the Göta hovrätt decided to stay proceedings and refer the following questions to the Court for a preliminary ruling:
(1) Is the mention of a person – by name or with name and telephone number – on an internet home page an action which falls within the scope of [Directive 95/46]? Does it constitute the processing of personal data wholly or partly by automatic means to list on a self-made internet home page a number of persons with comments and statements about their jobs and hobbies etc.?
(2) If the answer to the first question is no, can the act of setting up on an internet home page separate pages for about 15 people with links between the pages which make it possible to search by first name be considered to constitute the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system within the meaning of Article 3(1)?
If the answer to either of those questions is yes, the hovrätt also asks the following questions:
(3) Can the act of loading information of the type described about work colleagues onto a private home page which is none the less accessible to anyone who knows its address be regarded as outside the scope of [Directive 95/46] on the ground that it is covered by one of the exceptions in Article 3(2)?
(4) Is information on a home page stating that a named colleague has injured her foot and is on half-time on medical grounds personal data concerning health which, according to Article 8(1), may not be processed?
(5) [Directive 95/46] prohibits the transfer of personal data to third countries in certain cases. If a person in Sweden uses a computer to load personal data onto a home page stored on a server in Sweden – with the result that personal data become accessible to people in third countries – does that constitute a transfer of data to a third country within the meaning of the directive? Would the answer be the same even if, as far as known, no one from the third country had in fact accessed the data or if the server in question was actually physically in a third country?
(6) Can the provisions of [Directive 95/46], in a case such as the above, be regarded as bringing about a restriction which conflicts with the general principles of freedom of expression or other freedoms and rights, which are applicable within the EU and are enshrined in inter alia Article 10 of the European Convention on the Protection of Human Rights and Fundamental Freedoms?
Finally, the hovrätt asks the following question:
(7) Can a Member State, as regards the issues raised in the above questions, provide more extensive protection for personal data or give it a wider scope than the directive, even if none of the circumstances described in Article 13 exists?
The first question
By its first question, the referring court asks whether the act of referring, on an internet page, to various persons and identifying them by name or by other means, for instance by giving their telephone number or information regarding their working conditions and hobbies, constitutes the processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of Directive 95/46.
Observations submitted to the Court
Mrs Lindqvist submits that it is unreasonable to take the view that the mere mention by name of a person or of personal data in a document contained on an internet page constitutes automatic processing of data. On the other hand, reference to such data in a keyword in the meta tags of an internet page, which makes it possible to create an index and find that page using a search engine, might constitute such processing.
The Swedish Government submits that the term the processing of personal data wholly or partly by automatic means in Article 3(1) of Directive 95/46, covers all processing in computer format, in other words, in binary format. Consequently, as soon as personal data are processed by computer, whether using a word processing programme or in order to put them on an internet page, they have been the subject of processing within the meaning of Directive 95/46.
The Netherlands Government submits that personal data are loaded onto an internet page using a computer and a server, which are essential elements of automation, so that it must be considered that such data are subject to automatic processing.
The Commission submits that Directive 95/46 applies to all processing of personal data referred to in Article 3 thereof, regardless of the technical means used. Accordingly, making personal data available on the internet constitutes processing wholly or partly by automatic means, provided that there are no technical limitations which restrict the processing to a purely manual operation. Thus, by its very nature, an internet page falls within the scope of Directive 95/46.
Reply of the Court
The term personal data used in Article 3(1) of Directive 95/46 covers, according to the definition in Article 2(a) thereof, any information relating to an identified or identifiable natural person. The term undoubtedly covers the name of a person in conjunction with his telephone coordinates or information about his working conditions or hobbies.
According to the definition in Article 2(b) of Directive 95/46, the term processing of such data used in Article 3(1) covers any operation or set of operations which is performed upon personal data, whether or not by automatic means. That provision gives several examples of such operations, including disclosure by transmission, dissemination or otherwise making data available. It follows that the operation of loading personal data on an internet page must be considered to be such processing.
It remains to be determined whether such processing is wholly or partly by automatic means. In that connection, placing information on an internet page entails, under current technical and computer procedures, the operation of loading that page onto a server and the operations necessary to make that page accessible to people who are connected to the internet. Such operations are performed, at least in part, automatically.
The answer to the first question must therefore be that the act of referring, on an internet page, to various persons and identifying them by name or by other means, for instance by giving their telephone number or information regarding their working conditions and hobbies, constitutes the processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of Directive 95/46.
The second question
As the first question has been answered in the affirmative, there is no need to reply to the second question, which arises only in the event that the first question is answered in the negative.
The third question
By its third question, the national court essentially seeks to know whether processing of personal data such as that described in the first question is covered by one of the exceptions in Article 3(2) of Directive 95/46.
Observations submitted to the Court
Mrs Lindqvist submits that private individuals who make use of their freedom of expression to create internet pages in the course of a non-profit-making or leisure activity are not carrying out an economic activity and are thus not subject to Community law. If the Court were to hold otherwise, the question of the validity of Directive 95/46 would arise, as, in adopting it, the Community legislature would have exceeded the powers conferred on it by Article 100a of the EC Treaty (now, after amendment, Article 95 EC). The approximation of laws, which concerns the establishment and functioning of the common market, cannot serve as a legal basis for Community measures regulating the right of private individuals to freedom of expression on the internet.
The Swedish Government submits that, when Directive 95/46 was implemented in national law, the Swedish legislature took the view that processing of personal data by a natural person which consisted in publishing those data to an indeterminate number of people, for example through the internet, could not be described as a purely personal or household activity within the meaning of the second indent of Article 3(2) of Directive 95/46. However, that Government does not rule out that the exception provided for in the first indent of that paragraph might cover cases in which a natural person publishes personal data on an internet page solely in the exercise of his freedom of expression and without any connection with a professional or commercial activity.
According to the Netherlands Government, automatic processing of data such as that at issue in the main proceedings does not fall within any of the exceptions in Article 3(2) of Directive 95/46. As regards the exception in the second indent of that paragraph in particular, it observes that the creator of an internet page brings the data placed on it to the knowledge of a generally indeterminate group of people.
The Commission submits that an internet page such as that at issue in the main proceedings cannot be considered to fall outside the scope of Directive 95/46 by virtue of Article 3(2) thereof, but constitutes, given the purpose of the internet page at issue in the main proceedings, an artistic and literary creation within the meaning of Article 9 of that Directive.
It takes the view that the first indent of Article 3(2) of Directive 95/46 lends itself to two different interpretations. The first consists in limiting the scope of that provision to the areas cited as examples, in other words, to activities which essentially fall within what are generally called the second and third pillars. The other interpretation consists in excluding from the scope of Directive 95/46 the exercise of any activity which is not covered by Community law.
The Commission argues that Community law is not limited to economic activities connected with the four fundamental freedoms. Referring to the legal basis of Directive 95/46, to its objective, to Article 6 EU, to the Charter of fundamental rights of the European Union proclaimed in Nice on 18 December 2000 (OJ 2000 C 364, p. 1), and to the Council of Europe Convention of 28 January 1981 for the protection of individuals with regard to automatic processing of personal data, it concludes that that directive is intended to regulate the free movement of personal data in the exercise not only of an economic activity, but also of social activity in the course of the integration and functioning of the common market.
It adds that to exclude generally from the scope of Directive 95/46 internet pages which contain no element of commerce or of provision of services might entail serious problems of demarcation. A large number of internet pages containing personal data intended to disparage certain persons with a particular end in view might then be excluded from the scope of that directive.
Reply of the Court
Article 3(2) of Directive 95/46 provides for two exceptions to its scope.
The first exception concerns the processing of personal data in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union, and in any case processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law.
As the activities of Mrs Lindqvist which are at issue in the main proceedings are essentially not economic but charitable and religious, it is necessary to consider whether they constitute the processing of personal data in the course of an activity which falls outside the scope of Community law within the meaning of the first indent of Article 3(2) of Directive 95/46.
The Court has held, on the subject of Directive 95/46, which is based on Article 100a of the Treaty, that recourse to that legal basis does not presuppose the existence of an actual link with free movement between Member States in every situation referred to by the measure founded on that basis (see Joined Cases C-465/00, C-138/01 and C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-0000, paragraph 41, and the case-law cited therein).
A contrary interpretation could make the limits of the field of application of the directive particularly unsure and uncertain, which would be contrary to its essential objective of approximating the laws, regulations and administrative provisions of the Member States in order to eliminate obstacles to the functioning of the internal market deriving precisely from disparities between national legislations (Österreichischer Rundfunk and Others, cited above, paragraph 42).
Against that background, it would not be appropriate to interpret the expression activity which falls outside the scope of Community law as having a scope which would require it to be determined in each individual case whether the specific activity at issue directly affected freedom of movement between Member States.
The activities mentioned by way of example in the first indent of Article 3(2) of Directive 95/46 (in other words, the activities provided for by Titles V and VI of the Treaty on European Union and processing operations concerning public security, defence, State security and activities in areas of criminal law) are, in any event, activities of the State or of State authorities and unrelated to the fields of activity of individuals.
It must therefore be considered that the activities mentioned by way of example in the first indent of Article 3(2) of Directive 95/46 are intended to define the scope of the exception provided for there, with the result that that exception applies only to the activities which are expressly listed there or which can be classified in the same category (ejusdem generis).
Charitable or religious activities such as those carried out by Mrs Lindqvist cannot be considered equivalent to the activities listed in the first indent of Article 3(2) of Directive 95/46 and are thus not covered by that exception.
As regards the exception provided for in the second indent of Article 3(2) of Directive 95/46, the 12th recital in the preamble to that directive, which concerns that exception, cites, as examples of the processing of data carried out by a natural person in the exercise of activities which are exclusively personal or domestic, correspondence and the holding of records of addresses.
That exception must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people.
The answer to the third question must therefore be that processing of personal data such as that described in the reply to the first question is not covered by any of the exceptions in Article 3(2) of Directive 95/46.
The fourth question
By its fourth question, the referring court seeks to know whether reference to the fact that an individual has injured her foot and is on half-time on medical grounds constitutes personal data concerning health within the meaning of Article 8(1) of Directive 95/46.
In the light of the purpose of the directive, the expression data concerning health used in Article 8(1) thereof must be given a wide interpretation so as to include information concerning all aspects, both physical and mental, of the health of an individual.
The answer to the fourth question must therefore be that reference to the fact that an individual has injured her foot and is on half-time on medical grounds constitutes personal data concerning health within the meaning of Article 8(1) of Directive 95/46.
The fifth question
By its fifth question the referring court seeks essentially to know whether there is any transfer [of data] to a third country within the meaning of Article 25 of Directive 95/46 where an individual in a Member State loads personal data onto an internet page which is stored on an internet site on which the page can be consulted and which is hosted by a natural or legal person (the hosting provider) who is established in that State or in another Member State, thereby making those data accessible to anyone who connects to the internet, including people in a third country. The referring court also asks whether the reply to that question would be the same if no one from the third country had in fact accessed the data or if the server where the page was stored was physically in a third country.
Observations submitted to the Court
The Commission and the Swedish Government consider that the loading, using a computer, of personal data onto an internet page, so that they become accessible to nationals of third countries, constitutes a transfer of data to third countries within the meaning of Directive 95/46. The answer would be the same if no one from the third country had in fact accessed the data or if the server where it was stored was physically in a third country.
The Netherlands Government points out that the term transfer is not defined by Directive 95/46. It takes the view, first, that that term must be understood to refer to the act of intentionally transferring personal data from the territory of a Member State to a third country and, second, that no distinction can be made between the different ways in which data are made accessible to third parties. It concludes that loading personal data onto an internet page using a computer cannot be considered to be a transfer of personal data to a third country within the meaning of Article 25 of Directive 95/46.
The United Kingdom Government submits that Article 25 of Directive 95/46 concerns the transfer of data to third countries and not their accessibility from third countries. The term transfer connotes the transmission of personal data from one place and person to another place and person. It is only in the event of such a transfer that Article 25 of Directive 95/46 requires Member States to ensure an adequate level of protection of personal data in a third country.
Reply of the Court
Directive 95/46 does not define the expression transfer to a third country in Article 25 or any other provision, including Article 2.
In order to determine whether loading personal data onto an internet page constitutes a transfer of those data to a third country within the meaning of Article 25 of Directive 95/46 merely because it makes them accessible to people in a third country, it is necessary to take account both of the technical nature of the operations thus carried out and of the purpose and structure of Chapter IV of that directive where Article 25 appears.
Information on the internet can be consulted by an indefinite number of people living in many places at almost any time. The ubiquitous nature of that information is a result inter alia of the fact that the technical means used in connection with the internet are relatively simple and becoming less and less expensive.
Under the procedures for use of the internet available to individuals like Mrs Lindqvist during the 1990s, the author of a page intended for publication on the internet transmits the data making up that page to his hosting provider. That provider manages the computer infrastructure needed to store those data and connect the server hosting the site to the internet. That allows the subsequent transmission of those data to anyone who connects to the internet and seeks access to it. The computers which constitute that infrastructure may be located, and indeed often are located, in one or more countries other than that where the hosting provider is established, without its clients being aware or being in a position to be aware of it.
It appears from the court file that, in order to obtain the information appearing on the internet pages on which Mrs Lindqvist had included information about her colleagues, an internet user would not only have to connect to the internet but also personally carry out the necessary actions to consult those pages. In other words, Mrs Lindqvist’s internet pages did not contain the technical means to send that information automatically to people who did not intentionally seek access to those pages.
It follows that, in circumstances such as those in the case in the main proceedings, personal data which appear on the computer of a person in a third country, coming from a person who has loaded them onto an internet site, were not directly transferred between those two people but through the computer infrastructure of the hosting provider where the page is stored.
It is in that light that it must be examined whether the Community legislature intended, for the purposes of the application of Chapter IV of Directive 95/46, to include within the expression transfer [of data] to a third country within the meaning of Article 25 of that directive activities such as those carried out by Mrs Lindqvist. It must be stressed that the fifth question asked by the referring court concerns only those activities and not those carried out by the hosting providers.
Chapter IV of Directive 95/46, in which Article 25 appears, sets up a special regime, with specific rules, intended to allow the Member States to monitor transfers of personal data to third countries. That Chapter sets up a complementary regime to the general regime set up by Chapter II of that directive concerning the lawfulness of processing of personal data.
The objective of Chapter IV is defined in the 56th to 60th recitals in the preamble to Directive 95/46, which state inter alia that, although the protection of individuals guaranteed in the Community by that Directive does not stand in the way of transfers of personal data to third countries which ensure an adequate level of protection, the adequacy of such protection must be assessed in the light of all the circumstances surrounding the transfer operation or set of transfer operations. Where a third country does not ensure an adequate level of protection the transfer of personal data to that country must be prohibited.
For its part, Article 25 of Directive 95/46 imposes a series of obligations on Member States and on the Commission for the purposes of monitoring transfers of personal data to third countries in the light of the level of protection afforded to such data in each of those countries.
In particular, Article 25(4) of Directive 95/46 provides that, where the Commission finds that a third country does not ensure an adequate level of protection, Member States are to take the measures necessary to prevent any transfer of personal data to the third country in question.
Chapter IV of Directive 95/46 contains no provision concerning use of the internet. In particular, it does not lay down criteria for deciding whether operations carried out by hosting providers should be deemed to occur in the place of establishment of the service or at its business address or in the place where the computer or computers constituting the service’s infrastructure are located.
Given, first, the state of development of the internet at the time Directive 95/46 was drawn up and, second, the absence, in Chapter IV, of criteria applicable to use of the internet, one cannot presume that the Community legislature intended the expression transfer [of data] to a third country to cover the loading, by an individual in Mrs Lindqvist’s position, of data onto an internet page, even if those data are thereby made accessible to persons in third countries with the technical means to access them.
If Article 25 of Directive 95/46 were interpreted to mean that there is transfer [of data] to a third country every time that personal data are loaded onto an internet page, that transfer would necessarily be a transfer to all the third countries where there are the technical means needed to access the internet. The special regime provided for by Chapter IV of the directive would thus necessarily become a regime of general application, as regards operations on the internet. Thus, if the Commission found, pursuant to Article 25(4) of Directive 95/46, that even one third country did not ensure adequate protection, the Member States would be obliged to prevent any personal data being placed on the internet.
Accordingly, it must be concluded that Article 25 of Directive 95/46 is to be interpreted as meaning that operations such as those carried out by Mrs Lindqvist do not as such constitute a transfer [of data] to a third country. It is thus unnecessary to investigate whether an individual from a third country has accessed the internet page concerned or whether the server of that hosting service is physically in a third country.
The reply to the fifth question must therefore be that there is no transfer [of data] to a third country within the meaning of Article 25 of Directive 95/46 where an individual in a Member State loads personal data onto an internet page which is stored with his hosting provider which is established in that State or in another Member State, thereby making those data accessible to anyone who connects to the internet, including people in a third country.
The sixth question
By its sixth question the referring court seeks to know whether the provisions of Directive 95/46, in a case such as that in the main proceedings, bring about a restriction which conflicts with the general principles of freedom of expression or other freedoms and rights, which are applicable within the European Union and are enshrined in inter alia Article 10 of the ECHR.
Observations submitted to the Court
Citing inter alia Case C-274/99 P Connolly v Commission [2001] ECR I-1611, Mrs Lindqvist submits that Directive 95/46 and the PUL, in so far as they lay down requirements of prior consent and prior notification of a supervisory authority and a principle of prohibiting processing of personal data of a sensitive nature, are contrary to the general principle of freedom of expression enshrined in Community law. More particularly, she argues that the definition of processing of personal data wholly or partly by automatic means does not fulfil the criteria of predictability and accuracy.
She argues further that merely mentioning a natural person by name, revealing their telephone details and working conditions and giving information about their state of health and hobbies, information which is in the public domain, well-known or trivial, does not constitute a significant breach of the right to respect for private life. Mrs Lindqvist considers that, in any event, the constraints imposed by Directive 95/46 are disproportionate to the objective of protecting the reputation and private life of others.
The Swedish Government considers that Directive 95/46 allows the interests at stake to be weighed against each other and freedom of expression and protection of private life to be thereby safeguarded. It adds that only the national court can assess, in the light of the facts of each individual case, whether the restriction on the exercise of the right to freedom of expression entailed by the application of the rules on the protection of the rights of others is proportionate.
The Netherlands Government points out that both freedom of expression and the right to respect for private life are among the general principles of law for which the Court ensures respect and that the ECHR does not establish any hierarchy between the various fundamental rights. It therefore considers that the national court must endeavour to balance the various fundamental rights at issue by taking account of the circumstances of the individual case.
The United Kingdom Government points out that its proposed reply to the fifth question, set out in paragraph 55 of this judgment, is wholly in accordance with fundamental rights and avoids any disproportionate restriction on freedom of expression. It adds that it is difficult to justify an interpretation which would mean that the publication of personal data in a particular form, that is to say, on an internet page, is subject to far greater restrictions than those applicable to publication in other forms, such as on paper.
The Commission also submits that Directive 95/46 does not entail any restriction contrary to the general principle of freedom of expression or other rights and freedoms applicable in the European Union corresponding inter alia to the right provided for in Article 10 of the ECHR.
Reply of the Court
According to the seventh recital in the preamble to Directive 95/46, the establishment and functioning of the common market are liable to be seriously affected by differences in national rules applicable to the processing of personal data. According to the third recital of that directive the harmonisation of those national rules must seek to ensure not only the free flow of such data between Member States but also the safeguarding of the fundamental rights of individuals. Those objectives may of course be inconsistent with one another.
On the one hand, the economic and social integration resulting from the establishment and functioning of the internal market will necessarily lead to a substantial increase in cross-border flows of personal data between all those involved in a private or public capacity in economic and social activity in the Member States, whether businesses or public authorities of the Member States. Those so involved will, to a certain extent, need to have access to personal data to perform their transactions or carry out their tasks within the area without internal frontiers which the internal market constitutes.
On the other hand, those affected by the processing of personal data understandably require those data to be effectively protected.
The mechanisms allowing those different rights and interests to be balanced are contained, first, in Directive 95/46 itself, in that it provides for rules which determine in what circumstances and to what extent the processing of personal data is lawful and what safeguards must be provided for. Second, they result from the adoption, by the Member States, of national provisions implementing that directive and their application by the national authorities.
As regards Directive 95/46 itself, its provisions are necessarily relatively general since it has to be applied to a large number of very different situations. Contrary to Mrs Lindqvist’s contentions, the directive quite properly includes rules with a degree of flexibility and, in many instances, leaves to the Member States the task of deciding the details or choosing between options.
It is true that, in many respects, the Member States have a margin for manoeuvre in implementing Directive 95/46. However, there is nothing to suggest that the regime it provides for lacks predictability or that its provisions are, as such, contrary to the general principles of Community law and, in particular, to the fundamental rights protected by the Community legal order.
Thus, it is, rather, at the stage of the application at national level of the legislation implementing Directive 95/46 in individual cases that a balance must be found between the rights and interests involved.
In that context, fundamental rights have a particular importance, as demonstrated by the case in the main proceedings, in which, in essence, Mrs Lindqvist’s freedom of expression in her work preparing people for Communion and her freedom to carry out activities contributing to religious life have to be weighed against the protection of the private life of the individuals about whom Mrs Lindqvist has placed data on her internet site.
Consequently, it is for the authorities and courts of the Member States not only to interpret their national law in a manner consistent with Directive 95/46 but also to make sure they do not rely on an interpretation of it which would be in conflict with the fundamental rights protected by the Community legal order or with the other general principles of Community law, such as inter alia the principle of proportionality.
Whilst it is true that the protection of private life requires the application of effective sanctions against people processing personal data in ways inconsistent with Directive 95/46, such sanctions must always respect the principle of proportionality. That is so a fortiori since the scope of Directive 95/46 is very wide and the obligations of those who process personal data are many and significant.
It is for the referring court to take account, in accordance with the principle of proportionality, of all the circumstances of the case before it, in particular the duration of the breach of the rules implementing Directive 95/46 and the importance, for the persons concerned, of the protection of the data disclosed.
The answer to the sixth question must therefore be that the provisions of Directive 95/46 do not, in themselves, bring about a restriction which conflicts with the general principles of freedom of expression or other freedoms and rights, which are applicable within the European Union and are enshrined inter alia in Article 10 of the ECHR. It is for the national authorities and courts responsible for applying the national legislation implementing Directive 95/46 to ensure a fair balance between the rights and interests in question, including the fundamental rights protected by the Community legal order.
The seventh question
By its seventh question, the referring court essentially seeks to know whether it is permissible for the Member States to provide for greater protection for personal data or a wider scope than are required under Directive 95/46.
Observations submitted to the Court
The Swedish Government states that Directive 95/46 is not confined to fixing minimum conditions for the protection of personal data. Member States are obliged, in the course of implementing that directive, to attain the level of protection dictated by it and are not empowered to provide for greater or less protection. However, account must be taken of the discretion which the Member States have in implementing the directive to lay down in their domestic law the general conditions for the lawfulness of the processing of personal data.
The Netherlands Government submits that Directive 95/46 does not preclude Member States from providing for greater protection in certain areas. It is clear, for example, from Article 10, Article 11(1), subparagraph (a) of the first paragraph of Article 14, Article 17(3), Article 18(5) and Article 19(1) of that directive that the Member States may make provision for wider protection. Moreover, the Member States are free to apply the principles of Directive 95/46 also to activities which do not fall within its scope.
The Commission submits that Directive 95/46 is based on Article 100a of the Treaty and that, if a Member State wishes to maintain or introduce legislation which derogates from such a harmonising directive, it is obliged to notify the Commission pursuant to Article 95(4) or 95(5) EC. The Commission therefore submits that a Member State cannot make provision for more extensive protection for personal data or a wider scope than are required under the directive.
Reply of the Court
Directive 95/46 is intended, as appears from the eighth recital in the preamble thereto, to ensure that the level of protection of the rights and freedoms of individuals with regard to the processing of personal data is equivalent in all Member States. The tenth recital adds that the approximation of the national laws applicable in this area must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community.
The harmonisation of those national laws is therefore not limited to minimal harmonisation but amounts to harmonisation which is generally complete. It is upon that view that Directive 95/46 is intended to ensure free movement of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate.
It is true that Directive 95/46 allows the Member States a margin for manoeuvre in certain areas and authorises them to maintain or introduce particular rules for specific situations as a large number of its provisions demonstrate. However, such possibilities must be made use of in the manner provided for by Directive 95/46 and in accordance with its objective of maintaining a balance between the free movement of personal data and the protection of private life.
On the other hand, nothing prevents a Member State from extending the scope of the national legislation implementing the provisions of Directive 95/46 to areas not included within the scope thereof, provided that no other provision of Community law precludes it.
In the light of those considerations, the answer to the seventh question must be that measures taken by the Member States to ensure the protection of personal data must be consistent both with the provisions of Directive 95/46 and with its objective of maintaining a balance between freedom of movement of personal data and the protection of private life. However, nothing prevents a Member State from extending the scope of the national legislation implementing the provisions of Directive 95/46 to areas not included in the scope thereof provided that no other provision of Community law precludes it.
Costs
100. The costs incurred by the Swedish, Netherlands and United Kingdom Governments and by the Commission and the EFTA Surveillance Authority, which have submitted observations to the Court, are not recoverable. Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court.
On those grounds,
THE COURT,
in answer to the questions referred to it by the Göta hovrätt by order of 23 February 2001, hereby rules:
1. The act of referring, on an internet page, to various persons and identifying them by name or by other means, for instance by giving their telephone number or information regarding their working conditions and hobbies, constitutes the processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
2. Such processing of personal data is not covered by any of the exceptions in Article 3(2) of Directive 95/46.
3. Reference to the fact that an individual has injured her foot and is on half-time on medical grounds constitutes personal data concerning health within the meaning of Article 8(1) of Directive 95/46.
4. There is no transfer [of data] to a third country within the meaning of Article 25 of Directive 95/46 where an individual in a Member State loads personal data onto an internet page which is stored on an internet site on which the page can be consulted and which is hosted by a natural or legal person who is established in that State or in another Member State, thereby making those data accessible to anyone who connects to the internet, including people in a third country.
5. The provisions of Directive 95/46 do not, in themselves, bring about a restriction which conflicts with the general principles of freedom of expression or other freedoms and rights, which are applicable within the European Union and are enshrined inter alia in Article 10 of the European Convention for the Protection of Human Rights and Fundamental Freedoms signed at Rome on 4 November 1950. It is for the national authorities and courts responsible for applying the national legislation implementing Directive 95/46 to ensure a fair balance between the rights and interests in question, including the fundamental rights protected by the Community legal order.
6. Measures taken by the Member States to ensure the protection of personal data must be consistent both with the provisions of Directive 95/46 and with its objective of maintaining a balance between freedom of movement of personal data and the protection of private life. However, nothing prevents a Member State from extending the scope of the national legislation implementing the provisions of Directive 95/46 to areas not included in the scope thereof provided that no other provision of Community law precludes it.
Jann
Timmermans
Gulmann
Cunha Rodrigues
Rosas
Edward
Puissochet
Macken
von Bahr
Delivered in open court in Luxembourg on 6 November 2003.
Osterreichischer Rundfunk & Ors
EU:C:2003:294, [2003] EUECJ C-465/00, [2003] ECR I-4989,
JUDGMENT OF THE COURT
20 May 2003(1)
(Protection of individuals with regard to the processing of personal data – Directive 95/46/EC – Protection of private life – Disclosure of data on the income of employees of bodies subject to control by the Rechnungshof)
In Joined Cases C-465/00, C-138/01 and C-139/01,
REFERENCES to the Court under Article 234 EC by the Verfassungsgerichtshof (C-465/00) and the Oberster Gerichtshof (C
Community legislation
Recitals 5 to 9 in the preamble to Directive 95/46 show that it was adopted on the basis of Article 100a of the EC Treaty (now, after amendment, Article 95 EC) to encourage the free movement of personal data through the harmonisation of the laws, regulations and administrative provisions of the Member States on the protection of individuals with regard to the processing of such data.
According to Article 1 of Directive 95/46:
1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.
2. Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection afforded under paragraph 1.
In this connection, recitals 2 and 3 of Directive 95/46 read as follows:
(2) Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy, and contribute to economic and social progress, trade expansion and the well-being of individuals;
(3) Whereas the establishment and functioning of an internal market in which, in accordance with Article 7a of the Treaty, the free movement of goods, persons, services and capital is ensured require not only that personal data should be able to flow freely from one Member State to another, but also that the fundamental rights of individuals should be safeguarded.
Recital 10 of Directive 95/46 adds:
(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of Community law; …
Under Article 6(1) of Directive 95/46, personal data (that is, in accordance with Article 2(a), any information relating to an identified or identifiable natural person) must be:
(a) processed fairly and lawfully;
(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes …
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
…
Article 2(b) of Directive 95/46 defines processing of personal data as:
any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
Under Article 7 of Directive 95/46, personal data may be processed only if one of the six conditions it sets out is satisfied, and in particular if:
(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or
…
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller … to whom the data are disclosed.
According to recital 72 of Directive 95/46, the directive allows for the principle of public access to official documents to be taken into account when implementing the principles set out in the directive.
As regards the scope of Directive 95/46, Article 3(1) provides that it is to apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system. However, under Article 3(2), the directive shall not apply to the processing of personal data:
– in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law;
– by a natural person in the course of a purely personal or household activity.
In addition, Article 13 of Directive 95/46 authorises Member States to derogate from certain of its provisions, in particular Article 6(1), where this is necessary to safeguard inter alia an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters (Article 13(1)(e)) or a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in certain cases referred to, including that in subparagraph (e) (Article 13(1)(f)).
The main proceedings and the questions referred for preliminary rulings
Case C-465/00
Differences of opinion as to the interpretation of Paragraph 8 of the BezBegrBVG arose between the Rechnungshof and a large number of bodies under its control with respect to salaries and pensions paid in 1998 and 1999.
The defendants in the main proceedings, which include local and regional authorities (a Land and two municipalities), public undertakings, some of which are in competition with other Austrian or foreign undertakings not subject to control by the Rechnungshof, and a statutory professional body (Wirtschaftskammer Steiermark), did not communicate the data on the income of the employees in question, or communicated the data, to a greater or lesser extent, in anonymised form. They refused access to the relevant documents or made access subject to conditions which the Rechnungshofdid not accept. The Rechnungshof therefore brought proceedings before the Verfassungsgerichtshof pursuant to Article 126a of the Bundes-Verfassungsgesetz (Federal Constitutional Law), which gives that court jurisdiction to rule on differences of opinion concerning the interpretation of the statutory provisions governing the jurisdiction of the Rechnungshof.
The Rechnungshof infers from Paragraph 8 of the BezBegrBVG an obligation to list in the Report the names of the persons concerned and show their annual income. The defendants in the main proceedings take a different view and consider that they are not obliged to communicate personal data relating to that income, such as the names or positions of the persons concerned, with an indication of the emoluments received by them. They rely principally on Directive 95/46, Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms signed in Rome on 4 November 1950 (the Convention), which guarantees respect for private life, and on the argument that the obligation of publicity creates a barrier to the movement of workers, contrary to Article 39 EC.
The Verfassungsgerichtshof wishes essentially to know whether Paragraph 8 of the BezBegrBVG, as interpreted by the Rechnungshof, is compatible with Community law, so that it can interpret it consistently with Community law or declare it (partly) inapplicable, as the case may be.
It points out, in this connection, that the provisions of Directive 95/46, in particular Articles 6(1)(b) and (c) and 7(c) and (e), must be interpreted in the light of Article 8 of the Convention. It considers that comprehensive information for the public, as intended by the national legislature with respect to the income of employees of bodies subject to control by the Rechnungshof whose annual remuneration exceeds a certain threshold (ATS 1 127 486 in 1999 and ATS 1 120 000 in 1998), has to be regarded as an interference with private life, which can be justified under Article 8(2) of the Convention only if that information contributes to the economic well-being of the country. An interference with fundamental rights cannot be justified by the existence of a mere public interest in information. The court doubts that the disclosure, by means of the Report, of data on personal income promotes the economic well-being of the country. In any event, it constitutes a disproportionate interference with private life. The audit carried out by the Rechnungshof is indubitably sufficient to ensure the proper use of public funds.
The national court is also uncertain as to whether the scope of Community law varies according to the nature of the body which is required to contribute to the disclosure of the individual income of some of its employees.
In those circumstances, the Verfassungsgerichtshof decided to stay proceedings and refer the following two questions to the Court for a preliminary ruling:
1. Are the provisions of Community law, in particular those on data protection, to be interpreted as precluding national legislation which requires a State body to collect and transmit data on income for the purpose of publishing the names and income of employees of:
(a) a regional or local authority,
(b) a broadcasting organisation governed by public law,
(c) a national central bank,
(d) a statutory representative body,
(e) a partially State-controlled undertaking which is operated for profit?
2. If the answer to at least part of the above question is in the affirmative:
Are the provisions precluding such national legislation directly applicable, in the sense that the persons obliged to make disclosure may rely on them to prevent the application of contrary national provisions?
Cases C-138/01 and C-139/01
Ms Neukomm and Mr Lauermann, who are employees of ÖRF, a body subject to control by the Rechnungshof, brought proceedings in the Austrian courts for interim orders to prevent ÖRF from acceding to the Rechnungshof’s request to communicate data.
The applications for interim orders were dismissed at first instance. The Arbeits- und Sozialgericht Wien (Labour and Social Court, Vienna) (Austria) (C-138/01), distinguishing between the transmission of the data to the Rechnungshof and its inclusion in the Report, considered that the Report had to be anonymous, while the mere transmission of the data to the Rechnungshof, even including names, did not infringe Article 8 of the Convention or Directive 95/46. The Landesgericht St Pölten (Regional Court, St Pölten) (Austria) (C-139/01), on the other hand, held that the inclusion of data with names in the Report was lawful, since an anonymised report would not enable the Rechnungshof to exercise adequate control.
The Oberlandesgericht Wien (Higher Regional Court, Vienna) (Austria) upheld on appeal the dismissal of the applications for interim orders by the courts at first instance. While stating, in connection with Case C-138/01, that in communicating the data in question the employer is merely performing a task imposed on him by law and that the subsequent processing of the data by the Rechnungshofis not carried out under the control of the employer, the Oberlandesgericht held, in the context of Case C-139/01, that Paragraph 8 of the BezBegrBVG was consistent with fundamental rights and with Directive 95/46, even in the case of a list by name of the persons concerned.
Ms Neukomm and Mr Lauermann appealed on a point of law (Revision) to the Oberster Gerichtshof.
The Oberster Gerichtshof, referring to the reference for a preliminary ruling in Case C-465/00 and adopting the points of law raised by the Verfassungsgerichtshof, decided to stay proceedings and refer the following two questions to the Court, using the same wording in Cases C-138/01 and C-139/01:
1. Are the provisions of Community law, in particular those on data protection (Articles 1, 2, 6, 7 and 22 of Directive 95/46/EC in conjunction with Article 6 (formerly Article F) of the Treaty on European Union and Article 8 of the Convention), to be interpreted as precluding national legislation which requires a public broadcasting organisation, as a legal body, to communicate, and a State body to collect and transmit, data on income for the purpose of publishing the names and income of employees of a broadcasting organisation governed by public law?
2. If the Court of Justice of the European Communities answers the above question in the affirmative:
Are the provisions precluding national legislation of the kind described above directly applicable, in the sense that an organisation obliged to make disclosure may rely on them to prevent the application of contrary national legislation, and may not therefore rely on an obligation under national law against the employees concerned by the disclosure?
By order of the President of the Court of 17 May 2001, Cases C-138/01 and C-139/01 were joined for the purposes of the written procedure, the oral procedure and judgment. Case C-465/00 and Cases C-138/01 and C-139/01 should also be joined for the purposes of judgment.
The questions put by the Verfassungsgerichtshof and the Oberster Gerichtshof are essentially the same, and should therefore be examined together.
Applicability of Directive 95/46
To answer the questions as put would presuppose that Directive 95/46 is applicable in the main proceedings. That applicability is, however, disputed before the Court. This point must be decided as a preliminary issue.
Observations submitted to the Court
The defendants in the main proceedings in Case C-465/00 consider essentially that the control activity exercised by the Rechnungshof falls within the scope of Community law and hence of Directive 95/46. In particular, in that it relates to the remuneration received by the employees of the bodies concerned, that activity touches aspects covered by Community provisions in social matters, such as Articles 136 EC, 137 EC and 141 EC, Council Directive 76/207/EEC of 9 February 1976 on the implementation of the principle of equal treatment for men and women as regards access to employment, vocational training and promotion, and working conditions (OJ 1976 L 39, p. 40), and Council Regulation (EEC) No 1408/71 of 14 June 1971 on the application of social security schemes to employed persons, to self-employed persons and to members of their families moving within the Community, as amended and updated by Council Regulation (EC) No 118/97 of 2 December 1996 (OJ 1997 L 28, p. 1).
They further submit that the control exercised by the Rechnungshof, first, affects the possibility for employees of the bodies concerned to seek employment in another Member State, because of the publicity attaching to their salaries which limits their power of negotiation with foreign companies, and, second, deters nationals of other Member States from seeking employment with the bodies subject to that control.
Austrian Airlines, Österreichische Luftverkehrs-AG states that the interference with the freedom of movement of workers is particularly serious in its case because it competes with companies of other Member States which are not subject to such control.
The Rechnungshof and the Austrian and Italian Governments, and to a certain extent the Commission, on the other hand, consider that Directive 95/46 is not applicable in the main proceedings.
According to the Rechnungshof and the Austrian and Italian Governments, the control activity referred to in Paragraph 8 of the BezBegrBVG, which pursues objectives in the public interest in the field of public accounts, does not fall within the scope of Community law.
After observing that the directive, which was adopted on the basis of Article 100a of the Treaty, has the objective of establishing the internal market, an aspect of which is the protection of the right to privacy, the Rechnungshof and the Austrian and Italian Governments submit that the control in question is not such as to obstruct the freedom of movement of workers, since it does not in any way prevent the employees of the bodies concerned from going to work in another Member State or those of other Member States from working for those bodies. In any event, the link between the control activity and the freedom of movement of workers, even supposing that workers do seek to avoid working for a body subject to control by the Rechnungshof because of the publicity attaching to the salaries received, is too uncertain and indirect to constitute an infringement of freedom of movement and thereby to allow a link to be made with Community law.
The Commission adopts a similar position. At the hearing, it nevertheless submitted that the collection of data by the bodies subject to control by the Rechnungshof with a view to communication to the latter and inclusion in the report is itself within the scope of Directive 95/46. Collection serves not only the function of auditing but also, primarily, the payment of remuneration, which constitutes an activity covered by Community law, having regard to the existence of various relevant social provisions in the Treaty, such as Article 141 EC, and to the possible effect of that activity on the freedom of movement of workers.
Findings of the Court
Directive 95/46, adopted on the basis of Article 100a of the Treaty, is intended to ensure the free movement of personal data between Member States through the harmonisation of national provisions on the protection of individuals with regard to the processing of such data. Article 1, which defines the object of the directive, provides in paragraph 2 that Member States may neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection of the fundamental rights and freedoms of natural persons, in particular their private life, with respect to the processing of that data.
Since any personal data can move between Member States, Directive 95/46 requires in principle compliance with the rules for protection of such data with respect to any processing of data as defined by Article 3.
It may be added that recourse to Article 100a of the Treaty as legal basis does not presuppose the existence of an actual link with free movement between Member States in every situation referred to by the measure founded on that basis. As the Court has previously held (see Case C-376/98 Germany v Parliament and Council [2000] ECR I-8419, paragraph 85, and Case C-491/01 British American Tobacco (Investments) and Imperial Tobacco [2002] ECR I-0000, paragraph 60), to justify recourse to Article 100a of the Treaty as the legal basis, what matters is that the measure adopted on that basis must actually be intended to improve the conditions for the establishment and functioning of the internal market. In the present case, that fundamental attribute was never in dispute before the Court with respect to the provisions of Directive 95/46, in particular those in the light of which the national court raises the question of the compatibility of the national legislation in question with Community law.
In those circumstances, the applicability of Directive 95/46 cannot depend on whether the specific situations at issue in the main proceedings have a sufficient link with the exercise of the fundamental freedoms guaranteed by the Treaty, in particular, in those cases, the freedom of movement of workers. A contrary interpretation could make the limits of the field of application of the directive particularly unsure and uncertain, which would be contrary to its essential objective of approximating the laws, regulations and administrative provisions of the Member States in order to eliminate obstacles to the functioning of the internal market deriving precisely from disparities between national legislations.
Moreover, the applicability of Directive 95/46 to situations where there is no direct link with the exercise of the fundamental freedoms of movement guaranteed by the Treaty is confirmed by the wording of Article 3(1) of the directive, which defines its scope in very broad terms, not making the application of the rules on protection depend on whether the processing has an actual connection with freedom of movement between Member States. That is also confirmed by the exceptions in Article 3(2), in particular those concerning the processing of personal data in the course of an activity … provided for by Titles V and VI of the Treaty on European Union or in the course of a purely personal or household activity. Those exceptions would not, at the very least, be worded in that way if the directive were applicable exclusively to situations where there is a sufficient link with the exercise of freedoms of movement.
The same observation may be made with regard to the exceptions in Article 8(2) of Directive 95/46, which concern the processing of specific categories of data, in particular those in Article 8(2)(d), which refers to processing carried out by a foundation, association or any other non-profit-seeking body with a political, philosophical, religious or trade-union aim.
Finally, the processing of personal data at issue in the main proceedings does not fall within the exception in the first indent of Article 3(2) of Directive 95/46. That processing does not concern the exercise of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union. Nor is it a processing operation concerning public security, defence, State security or the activities of the State in areas of criminal law.
The purposes set out in Articles 7(c) and (e) and 13(e) and (f) of Directive 95/46 show, moreover, that it is intended to cover instances of data processing such as those at issue in the main proceedings.
It must therefore be considered that Directive 95/46 is applicable to the processing of personal data provided for by legislation such as that at issue in the main proceedings.
The first question
By their first question, the national courts essentially ask whether Directive 95/46 is to be interpreted as precluding national legislation such as that at issue in the main proceedings which requires a State control body to collect and communicate, for purposes of publication, data on the income of persons employed by the bodies subject to that control, where that income exceeds a certain threshold.
Observations submitted to the Court
The Danish Government considers that Directive 95/46 does not, strictly speaking, govern the right of third parties to obtain access to documents on request. In particular, Article 12 of the directive refers only to the right of any person to obtain data concerning him. According to the Government, the protection of personal data which appear not to be sensitive must give way to the principle of transparency, which holds an essential place in the Community legal order. The Danish Government, with the Swedish Government, observes in this respect that, according to recital 72 of the directive, the principle of public access to official documents may be taken into account when implementing the directive.
The Rechnungshof, the Austrian, Italian, Netherlands, Finnish and Swedish Governments and the Commission consider that the national provisions at issue in the main proceedings are compatible with Directive 95/46, by reason, generally, of the wide discretion the Member States have in implementing it, in particular where a task in the public interest provided for by law is to be carried out, under Articles 6(b) and (c) and 7(c) or (e) of the directive. Both the principles of transparency and of the proper management of public funds and the prevention of abuses are relied on in this respect.
Those objectives in the public interest can justify an interference with private life, protected by Article 8(2) of the Convention, if it is in accordance with the law, is necessary in a democratic society for the pursuit of legitimate aims, and is not disproportionate to the objective pursued.
The Austrian Government notes in particular that, when reviewing proportionality, the extent to which the data affect private life must be taken into account. Data relating to personal intimacy, health, family life or sexuality must therefore be protected more strongly than data relating to income and taxes, which, while also personal, concern personal identity to a lesser extent and are thereby less sensitive (see, to that effect, Fressoz and Roire v. France [GC], no. 29183/95, § 65, ECHR 1999-I).
The Finnish Government likewise considers that protection of private life is not absolute. Data relating to a person acting in the course of a public office or public functions relating thereto do not fall within the protection of private life.
The Italian Government submits that data such as that at issue in the main proceedings are already by their nature public in most Member States, since they are visible from salary scales or remuneration brackets laid down by statute, regulation or collective agreements. In those circumstances, it is not contrary to the principle of proportionality to provide for diffusion of that data with the identities of the various people in receipt of the salaries in question. That diffusion, being thus intended to clarify a situation that is already apparent from data available to the public, constitutes the minimum measure which would ensure realisation of the objectives of transparency and sound administration.
The Netherlands Government adds, however, that the national courts must ascertain, for each public body concerned, whether the objective of public interest can be attained by processing the personal data in a way that interferes less with the private lives of the persons concerned.
The United Kingdom Government submits that, in answering the first question, the provisions of the Charter of Fundamental Rights of the European Union, proclaimed in Nice on 18 December 2000 (OJ 2000 C 364, p. 1), to which the Verfassungsgericht briefly refers, are of no relevance.
In Cases C-138/01 and C-139/01, the Commission questions whether, in the context of examining proportionality under Article 6(1)(b) of Directive 95/46, it might not suffice for attaining the objective pursued by the BezBegrBVG to transmit the data in an anonymised form, for example by indicating the function of the person concerned rather than his name. Even if it is admitted that the Rechnungshof needs details of names in order to carry out a more exact check, it is questionable whether the inclusion of that data in the Report, giving the name of the person concerned, is really necessary for performing that check, especially as the Report is not only submitted to the parliamentary assemblies but must also be widely published.
Moreover, the Commission observes that under Article 13 of Directive 95/46 the Member States may inter alia derogate from Article 6(1)(b) of the directive in order to safeguard a number of objectives in the public interest, in particular an important economic or financial interest of a Member State (Article 13(1)(e)). However, in the Commission’s view, the derogating measures must also comply with the principle of proportionality, which calls for the same considerations as those stated in the preceding paragraph with reference to Article 6(1)(b) of the directive.
The defendants in the main proceedings in Case C-465/00 consider that the national legislation at issue is incompatible with Article 6(1)(b) and (c) of Directive 95/46 and cannot be justified under Article 7(c) or (e) of the directive, since it constitutes an interference which is not justified under Article 8(2) of the Convention, and is in any event disproportionate. The audit performed by the Rechnungshof is sufficient to guarantee the thrifty use of public funds.
More particularly, it has not been shown that publication of the names and the amount of the income of all persons employed by public bodies where that amount exceeds a certain level constitutes a measure aimed at the economic well-being of the country. The aim of the legislature was to exert pressure on the bodies in question to maintain salaries at a low level. The defendants also submit that that measure is aimed, in the present case, at persons who for the most part are not public figures.
Moreover, even if the drawing up by the Rechnungshof of a report containing personal data on income intended for public debate were to be regarded as an interference with private life justified under Article 8(2) of the Convention, Land Niederösterreich and ÖRF consider that that measure also violates Article 14 of the Convention. Persons receiving the same income are treated unequally, depending on whether or not they are employed by a body subject to control by the Rechnungshof.
ÖRF points out a further example of unequal treatment that cannot be justified under Article 14 of the Convention. Among the employees of bodies subject to control by the Rechnungshof, only those whose income exceeds the threshold fixed in Paragraph 8 of the BezBegrBVG have to suffer an interference with their private life. If the legislature attaches real importance to the reasonableness of the remuneration received by the employees of certain bodies, it is then necessary to publish the income of all employees, regardless of its amount.
Finally, ÖRF, Marktgemeinde Kaltenleutgeben and Austrian Airlines, Österreichische Luftverkehrs-AG submit that the wording of Paragraph 8 of the BezBegrBVG lends itself to an interpretation consistent with Community law, under which the salaries in question are required to be communicated to the Rechnungshof and included in the Report only in anonymised form. That interpretation should prevail, as it resolves the contradiction between that provision and Directive 95/46.
Findings of the Court
It should be noted, to begin with, that the data at issue in the main proceedings, which relate both to the monies paid by certain bodies and the recipients, constitute personal data within the meaning of Article 2(a) of Directive 95/46, being information relating to an identified or identifiable natural person. Their recording and use by the body concerned, and their transmission to the Rechnungshofand inclusion by the latter in a report intended to be communicated to various political institutions and widely diffused, constitute processing of personal data within the meaning of Article 2(b) of the directive.
Under Directive 95/46, subject to the exceptions permitted under Article 13, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and, second, with one of the criteria for making data processing legitimate listed in Article 7.
More specifically, the data must be collected for specified, explicit and legitimate purposes (Article 6(1)(b) of Directive 95/46) and must be adequate, relevant and not excessive in relation to those purposes (Article 6(1)(c)). In addition, under Article 7(c) and (e) of the directive respectively, the processing of personal data is permissible only if it is necessary for compliance with a legal obligation to which the controller is subject or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller … to whom the data are disclosed.
However, under Article 13(e) and (f) of the directive, the Member States may derogate inter alia from Article 6(1) where this is necessary to safeguard respectively an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters or a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in particular cases including that referred to in subparagraph (e).
It should also be noted that the provisions of Directive 95/46, in so far as they govern the processing of personal data liable to infringe fundamental freedoms, in particular the right to privacy, must necessarily be interpreted in the light of fundamental rights, which, according to settled case-law, form an integral part of the general principles of law whose observance the Court ensures (see, inter alia, Case C-274/99 P Connolly v Commission [2001] ECR I-1611, paragraph 37).
Those principles have been expressly restated in Article 6(2) EU, which states that [t]he Union shall respect fundamental rights, as guaranteed by the [Convention] and as they result from the constitutional traditions common to the Member States, as general principles of Community law.
Directive 95/46 itself, while having as its principal aim to ensure the free movement of personal data, provides in Article 1(1) that Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data. Several recitals in its preamble, in particular recitals 10 and 11, also express that requirement.
In this respect, it is to be noted that Article 8 of the Convention, while stating in paragraph 1 the principle that the public authorities must not interfere with the right to respect for private life, accepts in paragraph 2 that such an interference is possible where it is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
So, for the purpose of applying Directive 95/46, in particular Articles 6(1)(c), 7(c) and (e) and 13, it must be ascertained, first, whether legislation such as that at issue in the main proceedings provides for an interference with private life, and if so, whether that interference is justified from the point of view of Article 8 of the Convention.
Existence of an interference with private life
First of all, the collection of data by name relating to an individual’s professional income, with a view to communicating it to third parties, falls within the scope of Article 8 of the Convention. The European Court of Human Rights has held in this respect that the expression private life must not be interpreted restrictively and that there is no reason of principle to justify excluding activities of a professional … nature from the notion of private life (see, inter alia, Amann v. Switzerland [GC], no. 27798/95, § 65, ECHR 2000-II and Rotaru v. Romania [GC], no. 28341/95, § 43, ECHR 2000-V).
It necessarily follows that, while the mere recording by an employer of data by name relating to the remuneration paid to his employees cannot as such constitute an interference with private life, the communication of that data to third parties, in the present case a public authority, infringes the right of the persons concerned to respect for private life, whatever the subsequent use of the information thus communicated, and constitutes an interference within the meaning of Article 8 of the Convention.
To establish the existence of such an interference, it does not matter whether the information communicated is of a sensitive character or whether the persons concerned have been inconvenienced in any way (see, to that effect, Amann v. Switzerland, § 70). It suffices to find that data relating to the remuneration received by an employee or pensioner have been communicated by the employer to a third party.
Justification of the interference
An interference such as that mentioned in paragraph 74 above violates Article 8 of the Convention unless it is in accordance with the law, pursues one or more of the legitimate aims specified in Article 8(2), and is necessary in a democratic society for achieving that aim or aims.
It is common ground that the interference at issue in the main proceedings is in accordance with Paragraph 8 of the BezBegrBVG. However, the question arises whether that paragraph is formulated with sufficient precision to enable the citizen to adjust his conduct accordingly, and so complies with the requirement of foreseeability laid down in the case-law of the European Court of Human Rights (see, inter alia, Rekvényi v. Hungary [GC], no. 25390/94, § 34, ECHR 1999-III).
In this respect, Paragraph 8(3) of the BezBegrBVG states that the report drawn up by the Rechnungshof is to include all persons whose total yearly salaries and pensions from bodies … exceed the amount stated in subparagraph 1, without expressly requiring the names of the persons concerned to be disclosed in relation to the income they receive. According to the orders for reference, it is legal commentators who, on the basis of the travaux préparatoires, interpret the constitutional law in that way.
It is for the national courts to ascertain whether the interpretation to the effect that Paragraph 8(3) of the BezBegrBVG requires disclosure of the names of the persons concerned in relation to the income received complies with the requirement of foreseeability referred to in paragraph 77 above.
However, that question need not arise until it has been determined whether such an interpretation of the national provision at issue is consistent with Article 8 of the Convention, as regards its required proportionality to the aims pursued. That question will be examined below.
It appears from the order for reference in Case C-465/00 that the objective of Paragraph 8 of the BezBegrBVG is to exert pressure on the public bodies concerned to keep salaries within reasonable limits. The Austrian Government observes, more generally, that the interference provided for by that provision is intended to guarantee the thrifty and appropriate use of public funds by the administration. Such an objective constitutes a legitimate aim within the meaning both of Article 8(2) of the Convention, which mentions the economic well-being of the country, and Article 6(1)(b) of Directive 95/46, which refers to specified, explicit and legitimate purposes.
It must next be ascertained whether the interference in question is necessary in a democratic society to achieve the legitimate aim pursued.
According to the European Court of Human Rights, the adjective necessary in Article 8(2) of the Convention implies that a pressing social need is involved and that the measure employed is proportionate to the legitimate aim pursued (see, inter alia, the Gillow v. the United Kingdom judgment of 24 November 1986, Series A no. 109, § 55). The national authorities also enjoy a margin of appreciation, the scope of which will depend not only on the nature of the legitimate aim pursued but also on the particular nature of the interference involved (see the Leander v. Sweden judgment of 26 March 1987, Series A no. 116, § 59).
The interest of the Republic of Austria in ensuring the best use of public funds, and in particular keeping salaries within reasonable limits, must be balanced against the seriousness of the interference with the right of the persons concerned to respect for their private life.
On the one hand, in order to monitor the proper use of public funds, the Rechnungshof and the various parliamentary bodies undoubtedly need to know the amount of expenditure on human resources in the various public bodies. In addition, in a democratic society, taxpayers and public opinion generally have the right to be kept informed of the use of public revenues, in particular as regards expenditure on staff. Such information, put together in the Report, may make a contribution to the public debate on a question of general interest, and thus serves the public interest.
The question nevertheless arises whether stating the names of the persons concerned in relation to the income received is proportionate to the legitimate aim pursued and whether the reasons relied on before the Court to justify such disclosure appear relevant and sufficient.
It is plain that, according to the interpretation adopted by the national courts, Paragraph 8 of the BezBegrBVG requires disclosure of the names of the persons concerned, in relation to income above a certain level, with respect not only to persons filling posts remunerated by salaries on a published scale, but to all persons remunerated by bodies subject to control by the Rechnungshof. Moreover, such information is not only communicated to the Rechnungshof and via the latter to the various parliamentary bodies, but is also made widely available to the public.
It is for the national courts to ascertain whether such publicity is both necessary and proportionate to the aim of keeping salaries within reasonable limits, and in particular to examine whether such an objective could not have been attained equally effectively by transmitting the information as to names to the monitoring bodies alone. Similarly, the question arises whether it would not have been sufficient to inform the general public only of the remuneration and other financial benefits to which persons employed by the public bodies concerned have a contractual or statutory right, but not of the sums which each of them actually received during the year in question, which may depend to a varying extent on their personal and family situation.
With respect, on the other hand, to the seriousness of the interference with the right of the persons concerned to respect for their private life, it is not impossible that they may suffer harm as a result of the negative effects of the publicity attached to their income from employment, in particular on their prospects of being given employment by other undertakings, whether in Austria or elsewhere, which are not subject to control by the Rechnungshof.
It must be concluded that the interference resulting from the application of national legislation such as that at issue in the main proceedings may be justified under Article 8(2) of the Convention only in so far as the wide disclosure not merely of the amounts of the annual income above a certain threshold of persons employed by the bodies subject to control by the Rechnungshof but also of the names of the recipients of that income is both necessary for and appropriate to the aim of keeping salaries within reasonable limits, that being a matter for the national courts to examine.
Consequences with respect to the provisions of Directive 95/46
If the national courts conclude that the national legislation at issue is incompatible with Article 8 of the Convention, that legislation is also incapable of satisfying the requirement of proportionality in Articles 6(1)(c) and 7(c) or (e) of Directive 95/46. Nor could it be covered by any of the exceptions referred to in Article 13 of that directive, which likewise requires compliance with the requirement of proportionality with respect to the public interest objective being pursued. In any event, that provision cannot be interpreted as conferring legitimacy on an interference with the right to respect for private life contrary to Article 8 of the Convention.
If, on the other hand, the national courts were to consider that Paragraph 8 of the BezBegrBVG is both necessary for and appropriate to the public interest objective being pursued, they would then, as appears from paragraphs 77 to 79 above, still have to ascertain whether, by not expressly providing for disclosure of the names of the persons concerned in relation to the income received, Paragraph 8 of the BezBegrBVG complies with the requirement of foreseeability.
Finally, it should be noted, in the light of the above considerations, that the national court must also interpret any provision of national law, as far as possible, in the light of the wording and the purpose of the applicable directive, in order to achieve the result pursued by the latter and thereby comply with the third paragraph of Article 249 EC (see Case C-106/89 Marleasing [1990] ECR I-4135, paragraph 8).
In the light of all the above considerations, the answer to the first question must be that Articles 6(1)(c) and 7(c) and (e) of Directive 95/46 do not preclude national legislation such as that at issue in the main proceedings, provided that it is shown that the wide disclosure not merely of the amounts of the annual income above a certain threshold of persons employed by the bodies subject to control by the Rechnungshof but also of the names of the recipients of that income is necessary for and appropriate to the objective of proper management of public funds pursued by the legislature, that being for the national courts to ascertain.
The second question
By their second question, the national courts ask whether the provisions of Directive 95/46 which preclude national legislation such as that at issue in the main proceedings are directly applicable, in that they may be relied on by individuals before the national courts to oust the application of that legislation.
The defendants in the main proceedings in Case C-465/00 and the Netherlands Government consider that Articles 6(1) and 7 of Directive 95/46 fulfil the criteria stated in the Court’s case-law for having such direct effect. They are sufficiently precise and unconditional for the bodies required to disclose the data relating to the income of the persons concerned to be able to rely on them to prevent application of the national provisions contrary to those provisions.
The Austrian Government submits, on the other hand, that the relevant provisions of Directive 95/46 are not directly applicable. In particular, Articles 6(1) and 7 are not unconditional, since their implementation requires the Member States, which have a wide discretion, to adopt special measures to that effect.
On this point, it should be noted that wherever the provisions of a directive appear, so far as their subject-matter is concerned, to be unconditional and sufficiently precise, they may, in the absence of implementing measures adopted within the prescribed period, be relied on against any national provision which is incompatible with the directive or in so far as they define rights which individuals are able to assert against the State (see, inter alia, Case 8/81 Becker [1982] ECR 53, paragraph 25, and Case C-141/00 Kügler [2002] ECR I-6833, paragraph 51).
In the light of the answer to the first question, the second question seeks to know whether such a character may be attributed to Article 6(1)(c) of Directive 95/46, under which personal data must be … adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed, and to Article 7(c) or (e), under which personal data may be processed only if inter alia processing is necessary for compliance with a legal obligation to which the controller is subject or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller … to whom the data are disclosed.
Those provisions are sufficiently precise to be relied on by individuals and applied by the national courts. Moreover, while Directive 95/46 undoubtedly confers on the Member States a greater or lesser discretion in the implementation of some of its provisions, Articles 6(1)(c) and 7(c) or (e) for their part state unconditional obligations.
The answer to the second question must therefore be that Articles 6(1)(c) and 7(c) and (e) of Directive 95/46 are directly applicable, in that they may be relied on by an individual before the national courts to oust the application of rules of national law which are contrary to those provisions.
Costs
102. The costs incurred by the Austrian, Danish, Italian, Netherlands, Finnish, Swedish and United Kingdom Governments and by the Commission, which have submitted observations to the Court, are not recoverable. Since these proceedings are, for the parties to the main proceedings, a step in the proceedings pending before the national courts, the decisions on costs are a matter for those courts.
On those grounds,
THE COURT,
in answer to the questions referred to it by the Verfassungsgerichtshof by order of 12 December 2000 and by the Oberster Gerichtshof by orders of 14 and 28 February 2001, hereby rules:
1. Articles 6(1)(c) and 7(c) and (e) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data do not preclude national legislation such as that at issue in the main proceedings, provided that it is shown that the wide disclosure not merely of the amounts of the annual income above a certain threshold of persons employed by the bodies subject to control by the Rechnungshof but also of the names of the recipients of that income is necessary for and appropriate to the objective of proper management of public funds pursued by the legislature, that being for the national courts to ascertain.
2. Articles 6(1)(c) and 7(c) and (e) of Directive 95/46 are directly applicable, in that they may be relied on by an individual before the national courts to oust the application of rules of national law which are contrary to those provisions.
Rodríguez Iglesias
Puissochet
Wathelet
Schintgen
Gulmann
Edward
La Pergola
Jann
Skouris
Macken
Colneric
von Bahr
Cunha Rodrigues
Delivered in open court in Luxembourg on 20 May 2003.
R. Grass G.C. Rodríguez Iglesias
Registrar President
1: Language of the case: German.