DATA PROTECTION
EU Court of Justice: interpretation of the basis of lawfulness of processing represented by the performance of a contract, or legal obligation and the pursuit of legitimate interest and disclosure of personal data of investment fund partners.
The EU Court of Justice issued an important preliminary ruling (2024/738) on the proper application of Articles 6(1)(b) and 6(1)(f) of the EU General Data Protection Regulation 679/2016. These are the bases of lawfulness of processing represented by the fulfilment of contractual obligations, of a legal obligation and the pursuit of legitimate interest, either one's own or that of a third party.
The case: at the request of a partner of an investment fund established in the form of a partnership offering shares for public subscription, information on all the partners with indirect shareholdings in that fund, through trust companies, irrespective of the size of their shareholding in the capital of those funds, should have been disclosed by the Data Controller for the purpose of contacting them and negotiating the purchase of their shares or to coordinate with them for the purpose of reaching a consensus in connection with partners’ resolutions.
The EU Court held that the processing represented by the disclosure of partners’ personal data may be regarded as being necessary, within the meaning of article 6(1)(b), for the performance of the contract pursuant to which those partners have purchased such shareholdings, only on condition that that processing is objectively indispensable for a purpose that is integral to the contractual obligation intended for those same partners, with the result that the main subject matter of the contract could not be achieved if that processing were not to occur. That is not the case if that contract expressly prohibits the disclosure of those personal data to other shareholders.
With regard to the pursuit of legitimate interest under Article 6(1)(f) of the GDPR, the CJEU has held that the processing represented by the disclosure of personal data of the partners may be regarded as being necessary for the purposes of legitimate interests pursued by a third party, within the meaning of art. 6(1)(f), only on condition that that processing is strictly necessary to achieve such a legitimate interest and that, in the light of all the relevant circumstances, the interests or fundamental rights and freedoms of those partners do not override that legitimate interest..
As for the fulfilment of a legal obligation under Article 6(1)(c) of the GDPR, the CJEU has held that the processing of personal data is justified, under that provision, where it is necessary for compliance with a legal obligation to which the controller is subject, under the law of the Member State concerned, as stated by the case-law of that Member State, on condition that that case-law is clear and precise, that its application is foreseeable for those persons subject to it and that it meets an objective of public interest and is proportionate to it.
The case: at the request of a partner of an investment fund established in the form of a partnership offering shares for public subscription, information on all the partners with indirect shareholdings in that fund, through trust companies, irrespective of the size of their shareholding in the capital of those funds, should have been disclosed by the Data Controller for the purpose of contacting them and negotiating the purchase of their shares or to coordinate with them for the purpose of reaching a consensus in connection with partners’ resolutions.
The EU Court held that the processing represented by the disclosure of partners’ personal data may be regarded as being necessary, within the meaning of article 6(1)(b), for the performance of the contract pursuant to which those partners have purchased such shareholdings, only on condition that that processing is objectively indispensable for a purpose that is integral to the contractual obligation intended for those same partners, with the result that the main subject matter of the contract could not be achieved if that processing were not to occur. That is not the case if that contract expressly prohibits the disclosure of those personal data to other shareholders.
With regard to the pursuit of legitimate interest under Article 6(1)(f) of the GDPR, the CJEU has held that the processing represented by the disclosure of personal data of the partners may be regarded as being necessary for the purposes of legitimate interests pursued by a third party, within the meaning of art. 6(1)(f), only on condition that that processing is strictly necessary to achieve such a legitimate interest and that, in the light of all the relevant circumstances, the interests or fundamental rights and freedoms of those partners do not override that legitimate interest..
As for the fulfilment of a legal obligation under Article 6(1)(c) of the GDPR, the CJEU has held that the processing of personal data is justified, under that provision, where it is necessary for compliance with a legal obligation to which the controller is subject, under the law of the Member State concerned, as stated by the case-law of that Member State, on condition that that case-law is clear and precise, that its application is foreseeable for those persons subject to it and that it meets an objective of public interest and is proportionate to it.
