GDPR Articles With Commentary & EU Case Laws by Adv. Prashant Mali (red seas under red skies txt) 📕

DEFINITION OF PROCESSING

Lindquist: The operation of loading personal data on an Internet page must be considered to be processing.

Tietosuojavaltuutettu: The collection, publication, transfer on a CD-ROM and by text messaging all constitute processing of personal data. This includes personal data that have already been published in unaltered form in the media, as cooperation referred to in Article 2(b) must be classified as processing also where they exclusively concern material that has already been published in unaltered form in the media. A general derogation from the application of the Directive in such a case would largely deprive the Directive of its effect.

Bavarian Lager: Communication of personal data in response to a request for access to documents constitutes processing.

Bonnier: Communication of name and address sought by applicants constitutes processing of personal data.

Google: The operation of loading personal data on an Internet page must be considered processing (Lindquist). In exploring the internet automatically, constantly and systematically in search of the information which is published there, the operator of a search engine “collects” such data which it subsequently “retrieves”, “records” and “organizes” within the framework of its indexing programmes, “stores” on its servers and, as the case may be, “discloses” and “makes available” to its users in the form of lists of search results, which constitute processing, regardless of the fact that the operator of the search engine also carries out the same operations in respect of other types of information and does not distinguish between the latter and the personal data. This finding is not affected by the fact that those data have already been published on the Internet and are not altered by the search engine. It is not necessary that the personal data be altered. While alteration of personal data constitutes processing under Article 2(b), the other operations mentioned there do not require the alteration of personal data.

The processing done by the search engine operator is distinguished from and in addition to that done by publishers of websites, consisting in loading those data on an Internet page.

Schwartz: Taking and storing fingerprints constitute processing.

Bara: Both the transfer of the data by ANAF, and the subsequent processing by CNAS, constitute processing of personal data.

Weltimmo: The operation of loading personal data on an Internet page constitutes processing.

Esch-Leonhardt: Inclusion of the letters in the personal files constitutes processing by saving data in a personal data filing system as provided in Article 2(a), (b) and (c) of Regulation 45/2001.

Nikolaou: 1. the leak (unauthorised transmission of personal data to a journalist by someone inside OLAF) and 2. the publication of a press release each constitute processing of personal data. Jordana: Transfer of the data constitutes processing.

DEFINITION OF CONTROLLER

Google: The search engine operator determines the purposes and means of that activity and thus of the processing of personal data that it itself carries out within the framework of the activity and is thus a controller. It would be contrary not only to the clear wording of Article 2(d) and to its objective, which is to ensure through a broad definition of the concept of controller, effective and complete protection of data subjects, to exclude the operator of a search engine on the ground that it does not exercise control over the personal data published on the web pages of third parties. Moreover, the activity of search engines plays a decisive role in the overall dissemination of the personal data in that it renders the latter accessible to any internet user making a search on the basis of the data subject’s name, including to internet users who otherwise would not have found the web page on which those data are published. The search results also provide a structured overview of the information relating to that individual that can be found on the Internet, enabling them to establish a detailed profile of the data subject. The fact that publishers of websites have the option of indicating to operators by means of exclusion protocols that they wish some information published on their site to be excluded from search engines’ automatic indexing does not mean if publishers do not so indicate, the operator of the search engine is released from responsibility for its processing of personal data.

Rynes: Arts. 7(f), 11(2) and 13(1)(d) and (g) make it possible to take into account the legitimate interests of the controller in protecting the property, health and life of his family and himself.

LEGAL PERSONS

Schecke: Legal persons can claim protection of Articles 7 and 8 of the CFR only insofar as the official title of a legal person identifies one or more natural persons. Here, the name of the legal person directly identifies natural persons who are its partners.

Bank Austria: A legal person does not belong to the circle of persons which Regulation 45/2001 is intended to protect. That conclusion cannot be invalidated by the applicant's arguments of its supposed obligations towards directors and employees under Member State law, given that they consist of unsubstantiated contentions. These arguments are not sufficient to demonstrate the applicant's personal interest in relying on a breach of Regulation 45/2001.

SENSITIVE PERSONAL DATA

Lindquist: Reference to the fact that an individual has injured her foot and is on medical leave constitutes personal data concerning health within the meaning of Article 8(1), as that provision must be given a wide interpretation so as to include all aspects, both physical and mental, of the health of an individual.

Esch-Leonhardt: Inclusion of a letter concerning an ECB staff member’s use of internal e-mail to transmit union information in his personal file does not infringe Article 10(1) as it concerns data which the person himself has manifestly made public within the meaning of Article 10(2)(d).

Egan & Hackett: The argument that release of names of former MEP assistants would reveal their political opinions and therefore constitute sensitive data was not substantiated and cannot make up for the fact that the contested decision failed to show why disclosure would specifically and effectively undermine their right to privacy within the meaning of Article 4(1)(b) of Regulation 45/2001.

V: The applicant did not consent to the transfer of her medical file by the Commission to the European Parliament. The transfer was not "necessary for the purposes of complying with the specific rights and obligations of the controller in the field of employment law," in accordance with Article 10(2)(b). The Parliament's obligation to control fitness for duty could have been achieved by less intrusive means. Nor does Article 10(3) justify the transfer.

CONSENT

Schecke: The legislation at issue (EU rules on financing under CAP and publication on internet) does not seek to base the personal data processing for which it provides on consent of the beneficiaries concerned. Rather, it provides that they are to be informed. Thus, processing is not based on their consent. Therefore, it is necessary to analyse whether interference is justified under CFR Article 52(1).

Schwartz: It is essential for citizens of the EU to own a passport in order to travel to a third country, and a passport must contain fingerprints. Therefore, citizens are not free to object to processing of their fingerprints, and thus persons applying for passports cannot be deemed to have consented to that processing.

NECESSITY/PROPORTIONALITY

Huber: Directive 95/46 is intended to ensure an equivalent level of data protection in all Member States, to ensure a high level of protection in the EU. The concept of necessity in Article 7(e) cannot have a meaning which varies among Member States. Thus, it is a concept which has its own independent meaning in EU law, and must be interpreted in a manner which fully reflects the objective of Directive 95/46.

Under EU law, the right of free movement of a Member State national is not unconditional, but may be subject to limitations and conditions imposed by the Treaty and implementing rules. Legislation provides that a Member State may require certain documents to be provided to determine the conditions of entitlement to the right of residence. Thus, it is necessary for a Member State to have relevant particulars and documents available to it in order to ascertain whether a right of residence in its territory exists. Use of a register to support authorities responsible for the application of the legislation on the right of residence is, in principle, legitimate. However, the register must not contain any information other than what is necessary for that purpose, and must be kept up to date. Access must be restricted to the responsible authorities. The central register could be necessary if it contributes to a more effective application of that legislation. The national court should decide whether these conditions are satisfied. Only anonymous information is required for statistical purposes. Scarlet: The contested filtering system (to detect e-communications which use file sharing software, with a view to preventing

copyright infringement) may infringe the right to protection of personal data of the ISP's customers, as it would involve a systematic analysis of all content and the collection and identification of users' IP address from which unlawful content on the network is sent.

Schwartz: Storage of fingerprints on a highly secure storage medium is likely to reduce risk of passports being falsified and to facilitate the work of the authorities responsible for checking the authenticity of passports at EU borders, although it is not wholly reliable. Thus, it is appropriate.

The action involves taking prints of two fingers, causing no physical or mental discomfort, plus a facial image. The only real alternative to fingerprints is iris scan, the technology of which is not yet as advanced as fingerprint recognition. Thus, no apparent alternative exists that is sufficiently effective and less of a threat to the protected rights.

Concern that data may be centrally stored and used for other purposes (e.g. criminal investigation or to monitor the person indirectly) does not affect the validity of the Regulation, which provides only for preventing illegal entry into the EU.

Worten: The referring court must verify that the personal data contained in the record of working time are collected in order to ensure compliance with the national legislation relating to working conditions and that the processing of those data is necessary for compliance with a legal obligation to which Worten is subject and the performance of the monitoring task entrusted to the national authority responsible for monitoring working conditions. Only the grant of access to authorities having powers of monitoring could be considered to be necessary within the meaning of Article 7(e). Further, the obligation to provide immediate access to the record could be necessary if it contributes to the more effective application of the legislation relating to working conditions. It is for the referring court to decide whether this requirement is necessary.

Penalties must respect the principle of proportionality.

Client Earth: No automatic priority can be conferred on the objective of transparency over the right to protection of personal data. However, the information was necessary to ensure the transparency of the process of adoption of a measure likely to have an impact on the activities of economic operators, in particular, to appreciate how the form of participation by each expert might have influenced the content of that measure. Transparency of the process followed by a public authority for adoption of a measure contributes to the authority acquiring greater legitimacy in the eyes of the persons to whom the measure is addressed and increasing their confidence in that authority, and ensuring the authority is more accountable to citizens in a democratic system. Obtaining the information at issue was therefore necessary so that the impartiality of each expert in carrying out their tasks as scientists in the service of EFSA could be ascertained. Thus, a public interest justified the disclosure of the information at issue, in accordance with Article 8(a) and (b).

Esch-Leonhardt: The ECB may be entitled to consider that inclusion of letters concerning ECB staff members’ use of internal e-mail to transmit union