DATA PROTECTION
EU Court of Justice: the concept of 'identifiability' of the natural person as a prerequisite for the application of data protection law.
With the judgment of the Court of Justice of the European Union of 7/3/2024, rendered in Case C-479/22, further clarification was provided on the concept of 'personal data' and the concept of 'identifiability' of a natural person.
The case.
A Greek professor was placed under investigation by the European Anti-Fraud Office (Olaf) for the contested use of EU funds for a research activity. In the course of the proceedings, OLAF issued a press release in which it described some fraudulent conduct (undue payments and favouritism towards her father) by the professor, but never named her. From the press release, however, a whole series of non-named information was inferred, such as the gender, nationality and profession of the person involved, the institute to which he or she belonged, his or her young age, being in charge of the research project, the amount of the grant and the granting body, reference to the person's father, etc. So much so that journalists in her country, without much effort, cross-referenced the data on the Internet and identified the professor in their news articles. Following a lawsuit brought against Olaf by the person concerned, the EU body replied that it did not process personal data.
The decision.
A position rejected by the CJEU, which on the contrary recalls that the concept of personal data also covers information referring to an unidentified but indirectly identifiable person. The Court therefore clarifies the concept of identifiability: a person is identifiable even from unnamed information, using reasonable means, i.e. taking into account the time, cost and technology available.
In the present case, it was not difficult for journalists to search the Internet using the information in the press release.
As a consequence, if technologies (such as the Internet and artificial intelligence) make it possible to arrive at identification by reasonable means, this narrows the space for qualifying anonymous data and consequently expands the application of the provisions on privacy and data protection
The case.
A Greek professor was placed under investigation by the European Anti-Fraud Office (Olaf) for the contested use of EU funds for a research activity. In the course of the proceedings, OLAF issued a press release in which it described some fraudulent conduct (undue payments and favouritism towards her father) by the professor, but never named her. From the press release, however, a whole series of non-named information was inferred, such as the gender, nationality and profession of the person involved, the institute to which he or she belonged, his or her young age, being in charge of the research project, the amount of the grant and the granting body, reference to the person's father, etc. So much so that journalists in her country, without much effort, cross-referenced the data on the Internet and identified the professor in their news articles. Following a lawsuit brought against Olaf by the person concerned, the EU body replied that it did not process personal data.
The decision.
A position rejected by the CJEU, which on the contrary recalls that the concept of personal data also covers information referring to an unidentified but indirectly identifiable person. The Court therefore clarifies the concept of identifiability: a person is identifiable even from unnamed information, using reasonable means, i.e. taking into account the time, cost and technology available.
In the present case, it was not difficult for journalists to search the Internet using the information in the press release.
As a consequence, if technologies (such as the Internet and artificial intelligence) make it possible to arrive at identification by reasonable means, this narrows the space for qualifying anonymous data and consequently expands the application of the provisions on privacy and data protection
