GDPR Articles With Commentary & EU Case Laws by Adv. Prashant Mali (red seas under red skies txt) 📕

LSG: The decision refers to of Promusicae decision regarding balancing fundamental rights. That decision did not rule out the possibility that Member States may place ISP under a duty of disclosure. An ISP provides a service which enables users to infringe copyright by providing the connection.

Scarlet: The injunction to install the contested filtering system did not respect the requirement that a fair balance be struck between, on the one hand, the protection of the intellectual property right enjoyed by copyright holders, and, on the other hand, that of the freedom to conduct business, the right to protection of personal data and the freedom to receive or impart information.

Bonnier: The national legislation in question requires, for an order for disclosure of the data in question to be made, that there be clear evidence of an infringement of an intellectual property right, that the information can be regarded as facilitating the investigation into a copyright infringement and that the reasons for the measure outweigh the potential harm to the person affected. Thus, it enables the national court seised of an application for an order for disclosure of personal data to weigh the conflicting interests involved, and thereby in principle ensures a fair balance between protection of intellectual property rights and protection of personal data.

Lindquist: Data protection and freedom of expression must be balanced against each other, and the regime of the Directive provides in itself multiple mechanisms allowing a balancing of the different fundamental rights to be carried out. Therefore it is not a disproportionate violation of the principle of freedom of expression.

Bavarian Lager: The General Court erred in limiting the application of the exception in Article 4(1)(b) to situations in which privacy or the integrity of the individual would be infringed for the purposes of Article 8 of the ECHR and the case law of the European Court of Human Rights, without taking into account the legislation of the EU concerning the protection of personal data, particularly Regulation 45/2001. It disregarded the wording of the Article, which is an indivisible provision and requires that any undermining of privacy and the integrity of the individual must always be examined and assessed in conformity with the EU data protection legislation. The Article establishes a specific and reinforced system of protection of a person whose personal data could, in certain cases, be communicated to the public.

Recital 15 of Regulation 45/2001 indicates legislative intent that Article 6 TEU and thereby Article 8 ECHR should apply where processing is carried out in the exercise of activities outside the scope of Regulation 45/2001 (Titles V and VI of pre-Lisbon TEU). Such reference was unnecessary for activities within the scope of Regulation 45/2001. Thus, where a request based on Regulation 1049/2001 seeks access to documents including personal data, Regulation 45/2001 becomes applicable in its entirety, including Articles 8 and 18. The General Court erred in dismissing the application of Article 8(b) and 18 of Regulation 45/2001, and its decision does not correspond to the equilibrium, which the legislator intended to establish between the two Regulations.

The Commission was right to verify whether the data subjects had given their consent to disclosure of personal data concerning them. By releasing the expurgated version of the minutes, with the names of 5 participants removed (three could not be contacted, two objected), the Commission did not infringe Regulation 1049/2001 and complied with its duty of openness. By requiring that regarding these five persons, the applicant establish the necessity for those personal data to be transferred, the Commission complied with the provisions of Article 8(b) of Regulation 45/2001. As no necessity was provided, the Commission was not able to weigh up the various interests of the parties concerned, nor to verify whether there was any reason to assume that the data subjects’ legitimate interests might be prejudiced, as required by Article 8(b).

Client Earth: Where an application is made seeking access to personal data, the provisions of Regulation 45/2001 (particularly Article 8(b)) become applicable in their entirety. Under Article 8(b), personal data may generally be transferred only if the recipient establishes necessity and if there is no reason to assume that the transfer might prejudice the legitimate interests of the data subject. Thus, the transfer is subject to these two cumulative conditions being satisfied. The applicant must establish the first condition, and the institution must determine whether there is such reason. If there is no such reason, the transfer must be made; if there is such reason, the institution must weigh the various competing interests in order to decide on the request.

The consideration that disclosure was likely to undermine the privacy and integrity of the experts concerned is a consideration of a general nature not otherwise supported by any factor specific to the case. Disclosure would have made it possible for suspicions of partiality to be dispelled or allowed the experts to dispute the merits of those allegations. If a general consideration, unsupported by evidence, were to be accepted, it could be applied to any situation where an EU authority obtains experts opinions, contrary to the requirement that exceptions to the right of access to documents must be interpreted strictly. Thus, the conditions required by Article 8(b) were satisfied.

Jordana: Article 4(1)(b) of Regulation 1049/2001 is indivisible, and requires that the violation of private life and the integrity of the individual are always analysed in conformity with the right to protection of personal data. Thus it establishes a specific regime where personal data may be communicated to the public. Since this case concerns the processing of personal data, the request must be analysed under Regulation 45/2001. In rejecting the application for access to documents, the Commission had failed to apply Regulation 45/2001 in its analysis, and thus erred. Dennekamp I: Regulation 1049/2001 and Regulation 45/2001 do not contain any provisions granting one primacy over the other, therefore full application of both should, in principle, be ensured.

Where a request based on Regulation 1049/2001 seeks access to documents containing personal data, Regulation 45/2001 becomes applicable in its entirety, including Article 8. The applicant cannot claim that the processing he requested was lawful on the basis of Article 5(b) and this suffices, since Article 8(b) applies without prejudice to Article 5.

In order to obtain disclosure of the personal data contained in the documents, the applicant would have had to demonstrate, by providing express and legitimate justifications, the necessity for the requested personal data to be transferred, so that the Parliament could weigh up the various interests of the parties concerned and determine whether legitimate interests of MEPs might be prejudiced by the transfer. The applicant failed to establish why he needed the names to obtain his objectives. He did not explain with express arguments and justifications in what respect the transfer of the data was necessary to satisfy the public interest which he invoked, nor that the transfer would have been proportionate to his aims.

Further, the Parliament was not required to weigh the interests invoked by the applicant against those of MEPs, or to determine whether there was any reason to assume that the legitimate interests of those MEPs might have been prejudiced by such transfer. Thus, no manifest error that the Parliament might have made in weighing up interests has any bearing in this case on the lawfulness of the decision.

Article 4(1)(b) is an indivisible provision requiring the institution concerned always to examine and assess any undermining of privacy and the integrity of the individual in conformity with Regulation 45/2001.

Egan & Hackett: The Parliament systematically took the view that the public should not have access to documents revealing the identity of former MEP assistants. It did not carry out an examination to show that the access would specifically and effectively undermine their privacy within the meaning of the provisions in question, nor did it verify whether the risk of the protected interest being undermined was reasonably foreseeable and not purely hypothetical. Thus, it failed to show to what extent disclosure would specifically and effectively undermine the right to privacy.

Dennekamp II: If the applicant has established necessity, and the institution decides there is no reason to assume that data subject’s legitimate interests may be prejudiced, the data may be transferred and the documents are to be made available to the public. To fulfill the condition of necessity under that article, an applicant for access to documents containing personal data must establish that the transfer of personal data is the most appropriate of the possible measures for attaining the applicant’s objective, and it is proportionate to that objective, which means the applicant must submit express and legitimate reasons to that effect. This strict interpretation cannot be regarded as creating a broad exception to the fundamental right of access to documents, which would result in an unlawful restriction of that right. Rather, it reconciles two fundamental yet opposing rights, the institution being required also to examine whether the legitimate interests of the data subjects might be prejudiced by the transfer. The general nature of the justification for transfer has no direct effect on whether the transfer is necessary for the purposes of attaining the applicant’s aim. Here, the applicant made two arguments to establish necessity. First, that necessity was based on the right to information and freedom of expression. These are not sufficient to establish that the transfer is the most appropriate of the possible measures for attaining the objective, or that it is proportionate to that objective. Moreover, the applicant did not make clear in what respect transferring the names of the MEPs participating in the scheme was the most appropriate measure for attaining the objective he had set for himself. He merely asserted that the measures designed to provide public control over public expenditure in the context of the additional pension scheme, like the discharge procedure, did not protect the fundamental right to information and to communicate it to the public. From this it cannot be determined in what respect the transfer would be the most appropriate measure, or how it is proportionate.

Second, the applicant argued that the transfer of personal data is necessary to determine whether MEPs’ voting behavior regarding the additional pension scheme is influenced by their financial interest, and disclosure of all the names of the MEPs participating in the scheme would be the only way for the public to hold its representatives accountable for their actions in relation to the scheme. The court agreed that the transfer is the only measure by which the applicant’s aim can be attained; no other measure is capable of ensuring that MEPs facing a potential conflict of interest are identified. Further, it is proportionate for this purpose.

The EU institution or body in receipt of the application must refuse the transfer if there is the slightest reason to assume that the data subjects’ legitimate interests would be prejudiced. MEPs as public figures have chosen to expose themselves to scrutiny by third parties, particularly the media and general public, even if such choice in no way implies that their legitimate interests must be regarded as never being prejudiced by a decision to transfer their data. Thus, they have generally already accepted that some of their personal data will be disclosed to the public. That must be taken into account when assessing the risk of prejudice to their legitimate interests. Particular consideration should be given to the link between the personal data at issue and their mandate, and to the legal and financial commitment of the EP to the scheme. In view of the importance of the interests invoked here, which are intended to ensure the proper functioning of the EU by increasing the confidence that citizens may legitimately place in the institutions, the legitimate interests of the MEPs who are members of