DATA PROTECTION
EU Court of Justice: clarifications on the concepts of "processing based on a legal obligation" and "special categories of personal data" pursuant to articles 6.1 (c) and 9 of the GDPR.
New CJEU judgment on the case 184/2020 on data protection, on two issues:
- What are the conditions for a "legal obligation" under Art. 6(1)(c) #GDPR?
- Do the provisions regarding "special categories" of personal data (e.g. sexual data) cover e.g. only information directly revealing sexual orientation or also information that indirectly reveals it?
1/ Limitations to the fundamental rights to #privacy and #dataprotection (Art. 7 & 8 EU Charter) must be provided by law and respect the essential content of the fundamental rights as well as the principle of proportionality - i.e. be necessary and actually respond to public interest objectives recognised by the EU or to the need to protect the rights and freedoms of others. The rules must be clear and precise.
In the present case (an obligation to publish declarations on private interests for public sector decision-makers), the CJEU questioned the necessity of the measure. One notable quote: "the lack of resources allocated to public authorities can never constitute a legitimate reason to justify an infringement of the fundamental rights guaranteed by the Charter".
2/ Because the law being examined required also publication of the name of the partner of the public official, the referring court considered that this could reveal information on the sexual life or orientation of the official and his/her partner.
The concept of "special categories" of personal data has to be interpreted broadly, notably to ensure that the objective of Art. 9(1) GDPR is met. A strict interpretation would rob that provision of its effectiveness.
As a result, Art. 9(1) GDPR "cannot be interpreted as meaning that the processing of personal data likely to reveal, indirectly, sensitive information concerning a natural person is exempted from the reinforced protection regime provided for by" Art. 9 GDPR.
In short, because the names of spouses/partners could reveal the same sex, the publication of that personal data constituted processing of data revealing sexual orientation.
- What are the conditions for a "legal obligation" under Art. 6(1)(c) #GDPR?
- Do the provisions regarding "special categories" of personal data (e.g. sexual data) cover e.g. only information directly revealing sexual orientation or also information that indirectly reveals it?
1/ Limitations to the fundamental rights to #privacy and #dataprotection (Art. 7 & 8 EU Charter) must be provided by law and respect the essential content of the fundamental rights as well as the principle of proportionality - i.e. be necessary and actually respond to public interest objectives recognised by the EU or to the need to protect the rights and freedoms of others. The rules must be clear and precise.
In the present case (an obligation to publish declarations on private interests for public sector decision-makers), the CJEU questioned the necessity of the measure. One notable quote: "the lack of resources allocated to public authorities can never constitute a legitimate reason to justify an infringement of the fundamental rights guaranteed by the Charter".
2/ Because the law being examined required also publication of the name of the partner of the public official, the referring court considered that this could reveal information on the sexual life or orientation of the official and his/her partner.
The concept of "special categories" of personal data has to be interpreted broadly, notably to ensure that the objective of Art. 9(1) GDPR is met. A strict interpretation would rob that provision of its effectiveness.
As a result, Art. 9(1) GDPR "cannot be interpreted as meaning that the processing of personal data likely to reveal, indirectly, sensitive information concerning a natural person is exempted from the reinforced protection regime provided for by" Art. 9 GDPR.
In short, because the names of spouses/partners could reveal the same sex, the publication of that personal data constituted processing of data revealing sexual orientation.
