Preliminary ruling from the Court of Justice of the European Union indicates less strict interpretation of the Personal Data Processing Act

Date 4 apr. 2012
Download PDF version PDF

 

Introduction

The Court of justice of the European Union (hereafter “the Court of Justice”) made a ruling in a case (C-468-469/10) concerning the interpretation of Article 7, sub-section f, in the personal data directive (directive 95/46/EF) and the article’s immediate applicability in the member states. The article is the directive’s rule on balancing of interest and equates to Section 6(1)(7) in the Personal Data Processing Act.


The question to the Court of Justice

A Spanish Court of Justice asked the following question:


 “Is Article 7(f) of Directive 95/46/EC ( 1 ) of the European Parliament and of the Council of 24 October 1995, on the protection of individuals with regard to the processing of personal data and on the free movement of such data to be interpreted as a preclusion of the application of national rules which, in the absence of the interested party’s consent and to allow processing of his personal data which is necessary to pursue a legitimate interest of the controller or of third parties to whom the data will be disclosed, not only require fundamental rights and freedoms not to be prejudiced, but also require the data to appear in public sources?”


The legal framework

Article 7, sub-section f, of the Directive reads as follows:


“Member States shall provide that personal data may be processed only if:

(…)

f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1).”


Article 5 of the Directive reads as follows:


“Member States shall, within the limits of the provisions of this Chapter (chapter 2), determine more precisely the conditions under which the processing of personal data is lawful.”


Chapter 2 in the Directive contains the fundamental rules for processing ordinary or sensitive information as well as disclosure obligations, right of access, right of objection, security, and registration with the national authorities.


The Courts of Justice’s ruling

The Court of justice determined that the Personal Data Directive exhaustively and completely states the grounds on which processing of personal data can be based. Furthermore, the Court of Justice referred to the previous ruling which established that the Directive’s harmonization of the rules on personal data in the member states does not constitute minimum harmonization, but is in principle a total harmonization of the rules on personal data.


Therefore, the member states cannot add new principles or supplement the Directive, but are, as is made clear by article 5 of the directive, only allowed to clarify the rules contained in the Directive.


Furthermore, the Court of Justice established that article 7 of the Directive, wherein the legal grounds for processing of personal data are listed, are adequately precise to have immediate applicability in the member states and can therefore be invoked by a citizen and applied by the national courts.


Consequences of the ruling

The ruling establishes that the directive constitutes a total harmonization, and the ruling will therefore also have an influence on the interpretation of the Danish Personal Processing Data Act.


The Personal Processing Data Act distinguishes between different categories of information: ordinary, semi sensitive and sensitive information, of which the semi sensitive category is a supplementary category compared to the Directive. Among other things, semi sensitive information contains “significant social problems” and “other private information”, where the latter, for instance, is information about divorces and adoptions or personality test. The Directive only operates with ordinary or sensitive information and therefore, the semi sensitive category in the Personal Data Processing Act cannot be maintained. The ruling means that information classed by the Personal Data Processing Act as semi sensitive must from now on be treated as ordinary person data according to Section 6 of the Personal Data Processing Act, which are not as strict.


 

If you have any questions or require additional information on the above, please contact Partner Thomas Weitemeyer (twe@mwblaw.dk) or Junior Associate Kim David Lexner (kdl@mwblaw.dk).


The above does not constitute legal counseling and Moalem Weitemeyer Bendtsen does not warrant the accuracy of the information. With the above text, Moalem Weitemeyer Bendtsen has not assumed responsibility of any kind as a consequence of a reader’s use of the above.