GDPR Articles With Commentary & EU Case Laws by Adv. Prashant Mali (red seas under red skies txt) 📕

between the interest of the data subject in exercising his rights and the burden on the controller to store that information. In the present case, limiting storage of information on recipients and content to one year, while the basic data is stored much longer, does not constitute a fair balance, unless it can be shown that longer storage would constitute an excessive burden.

 

C-557/07, LSG-GESELLSCHAFT ZUR WAHRNEHMUNG VON LEISTUNGSSCHUTZRECHTEN GMBH V. TELE2 TELECOMMUNICATION GMBH, 19.2.2009 (“LSG”)

Reference for a preliminary ruling by the Oberster Gerichtshof (Austria). The applicant is a collecting society, which as trustee enforces rights of recorded music producers in their worldwide recordings and of the recording artists in exploitation of those recordings in Austria. Tele2 is an Internet Service Provider (ISP) that assigns an IP address to its clients. LSG applied to the Austrian court for an order requiring

Tele 2 to send names and addresses of persons to whom it had provided internet access service and whose IP addresses and date and time of connection were known.

Question referred (partial listing): Does Article 8(3) of Directive 2004/48, regard being had to Articles 6 and 15 of Directive 2002/58, not permit the disclosure of personal traffic data to private third parties for the purposes of civil proceedings for alleged infringements of exclusive rights protected by copyright?

Balancing fundamental rights: The judgment refers to 70 of the Promusicae judgment regarding balancing fundamental rights. That decision did not rule out the possibility that Member States may place an ISP under a duty of disclosure. An ISP provides a service which enables users to infringe copyright by providing a connection.

 

C-28/08, COMMISSION V. BAVARIAN LAGER CO., 29.6.2010 (“BAVARIAN LAGER”)

Appeal by the Commission seeking annulment of the General Court judgment, which annulled the Commission's decision rejecting the request of the applicant (a trade association for German beer) for access to the full minutes of a meeting organized by the Commission (including names of attendees). The Commission had denied access to the names of five persons who attended the meeting, were members of a trade association and had not given consent to disclosure of their names, based on Article 4(1)(b) of Regulation 1049/2001. (The General Court decision, which was the subject of appeal, as well as the Advocate General’s opinion, are summarized below.)

Article 4(1)(b) exception: The General Court erred in limiting application of the exception in Article 4(1)(b) to situations in which privacy or the integrity of the individual would be infringed for the purposes of Article 8 of the ECHR and the case law of the European Court of Human Rights, without taking into account the legislation of the EU concerning the protection of personal data, particularly Regulation 45/2001. It disregarded the wording of the Article, which is an indivisible provision and requires that any undermining of privacy and the integrity of the individual must always be examined and assessed in conformity with the EU data protection legislation. The Article establishes a specific and reinforced system of protection of a person whose personal data could, in certain cases, be communicated to the public.

Recital 15 of Regulation 45/2001 indicates legislative intent that Article 6 TEU and thereby Article 8 ECHR should apply where processing is carried out in the exercise of activities outside the scope of Regulation 45/2001 (Titles V and VI of pre-Lisbon TEU). Such reference was unnecessary for activities within the scope of Regulation 45/2001. Thus, where a request based on Regulation 1049/2001 seeks access to documents including personal data, Regulation 45/2001 becomes applicable in its entirety, including Articles 8 and 18. The General Court erred in dismissing the application of Article 8(b) and 18 of Regulation 45/2001, and its decision does not

correspond to the equilibrium, which the legislator intended to establish between the two Regulations. The Commission was right to verify whether the data subjects had given their consent to disclosure of personal data concerning them. By releasing the expurgated version of the minutes, with the names of five participants removed (three could not be contacted, two objected), the Commission did not infringe Regulation 1049/2001 and complied with its duty of openness. By requiring that regarding these five persons, the applicant establish the necessity for those personal data to be transferred, the Commission complied with the provisions of Article 8(b) of Regulation 45/2001. As no necessity was provided, the Commission was not able to weigh up the various interests of the parties concerned, nor to verify whether there was any reason to assume that the data subjects' legitimate interests might be prejudiced, as required by Article 8(b).

Definition of personal data: The General Court correctly held that surnames and forenames may be regarded as personal data. Thus, the list of names of participants in a meeting is personal data, since persons can be identified.

Definition of processing: Communication of personal data in response to a request for access to documents constitutes processing.

Opinion of Advocate General Sharpston, 15.10.2009

Scope of Regulation 45/2001: Article 3(2) should be construed to define the circumstances in which the Regulation applies ("the processing of personal data wholly or partly by automatic means and . . . the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.") Such processing of personal data by all Community institutions is then covered (applying Article 3(1)) insofar as it is "carried out in the exercise of activities all or part of which fall within the scope of Community law"). Other circumstances are not covered by Regulation 45/2001; they should be dealt with under Regulation 1049/2001, where requests are made to Community institutions for access to documents.

Article 4(1)(b) exception: Applicability of Regulation 1049/2001 versus Regulation 45/2001 in request for access to documents: B-1 documents contain an incidental mention of personal data, where the primary purpose of compiling the document has little to do with personal data. The raison d'être of such documents is to store information in which personal data are of minimal importance. B-2 documents contain a large quantity of personal data (e.g. a list of persons and their characteristics). The raison d'être of such documents is to gather together such personal data.

Applications for B-1 documents should be handled under Regulation 1049/2001, while applications for B-2 documents should be handled under Regulation 45/2001, because they are within its scope by virtue of Article 3(2).

Requests for B-1 documents do not require a reason, by virtue of Article 6(1) of Regulation 49/2001, while requests for B-2 documents will have to demonstrate the need for transfer of data, in accordance with Article 8(b) of Regulation 45/2001.

Article 8 ECHR (including the justification test, where interference with privacy exists) must be applied with respect to an application for B-1 documents to determine whether personal data must be redacted, following Article 4(1)(b) of Regulation 45/2001. B-2 documents will be subject to the procedure outlined in Regulation 45/2001: processing must be lawful within the meaning of Article 5. The applicant will have to give reasons in accordance with Article 8; Article 9 applies for applications from non-Member States or non-Community international organizations; Article 10 applies regarding sensitive data; and Article 18 requires the institution to inform the data subject that he can object to processing.

Disclosure under Regulation 1049/2001 of B-1 documents is erga omnes; disclosure under Regulation 45/2001 of B-2 documents is case-by-case and not erga omnes.

The first part of the exception applies to B-1 and B-2 documents; the second part applies only to B-2 documents.

General Court decision, T-194/04, 8.11.2007

Lawfulness: The right of access to documents of the institutions laid down by Article 2 of Regulation 1049/2001 constitutes a legal obligation for purposes of Article 5(b) of Regulation 45/2001. Therefore, if Regulation 1049/2001 requires communication of data, Article 5 of Regulation 45/2001 makes such communication lawful.

Transfers: Access to documents containing personal data falls within the application of Regulation 1049/2001. Article 6(1) states that the applicant is not required to justify his request. Therefore, where personal data are transferred in the context of Regulation 1049/2001, the applicant does not need to prove necessity of disclosure of data for purposes of Article 8 of Regulation 45/2001, otherwise it would be contrary to the principle of the widest possible public access to documents held by the institutions. Exceptions must be interpreted narrowly. Given that access to a document will be refused under Article 4(1)(b) of Regulation 1049/2001 where disclosure would undermine protection of privacy and integrity of the individual, a transfer that does not fall under that exception cannot, in principle, prejudice the legitimate interests of the person concerned within the meaning of Article 8(b) of Regulation 45/2001.

Right to object: The data subject has the right to object to processing, except in cases covered by Article 5(b), among others. Given that processing envisaged by Regulation 1049/2001 constitutes a legal obligation for purposes of Article 5(b), the data subject does not have a right to object. However, since Article 4(1)(b) of Regulation 1049/2001 lays down an exception to the obligation to provide access, it is necessary to consider the impact of disclosure on the data subject. If communication would not undermine protection of privacy etc., then the person's objection cannot prevent disclosure.

Balancing fundamental rights: Regulation 45/2001 must be interpreted in light of fundamental rights, which form an integral part of general principles of law with respect to which the ECJ ensures compliance.

Article 8 ECHR: ECHR case law interprets "private life" broadly, and there is no reason in principle to exclude professional or business activities from the concept of private life. To determine whether there is a breach of Article 8, it is necessary to determine (1) whether there has been an interference with private life of the data subject, (2) whether that interference is justified (i.e., it is in accordance with the law, pursues a legitimate aim, and is necessary in a democratic society – meaning that it is relevant and sufficient, and proportionate to the legitimate aims pursued). In cases concerning disclosure of personal data, the competent authorities have to be granted a certain discretion in order to establish a fair balance between competing public and private interests, subject to judicial review, referring to factors such as nature and importance of interests at stake and seriousness of interference.

Any decision taken pursuant to Regulation 1049/2001 must comply with Article 8 ECHR.

Article 4(1)(b) exception: To determine whether the exception applies, it is necessary to examine whether public access is capable of actually and specifically undermining the protection of the privacy and integrity of the persons concerned.

The mere fact that a document contains personal data does not necessarily mean that privacy or integrity of the data subject is affected, even though professional activities are not, in principle, excluded from the concept of private life. Here, persons present at the meeting whose names were not disclosed were present as representatives of a trade association, and not in their personal capacity. Therefore, the fact that the minutes contain their names does not affect their private life. The minutes do not contain their personal opinions. Disclosure of the names is not capable of actually and specifically affecting the protection of privacy and the integrity of those persons. The mere presence of their name on the list does not constitute an interference. Regulation 45/2001 does not require the Commission to keep secret the names of persons who communicate opinions or information to it concerning the exercise of its functions.

The court distinguishes the Osterreichischer Rundfunk decision on the ground that there, the specific combination of name and income received was at issue, in contrast to this case, where the name of persons acting in a professional capacity as representatives of a collective body is at issue, where no personal opinions can be identified.

 

C-92/09 VOLKER UND MARKUS SCHECKE GBR V. LAND HESSEN, AND C- 93/09, EIFERT V. LAND HESSEN AND BUNDESANSTALT FUR LANDWIRTSCHAFT UND ERNAHRUNG, 9.11.2010 (“SCHECKE”)

Reference for a preliminary ruling by the Verwaltungsgericht Wiesbaden (Germany). A partnership established in the Land of Hesse and a farmer resident there received EU funds from the EAGF and EAFRD. The defendant's website published