Transfer Of Personal Information Relating To Income Betwixt Populace Institutions – The Cjeu's Judgment Inwards C-201/14 Bara

Marcin Kotula, Legal Officer at the European Commission

The views expressed are purely those of the writer in addition to may non inwards whatever circumstances live on regarded equally stating an official seat of the European Commission

Background

In instance C-201/14, a preliminary reference from the Court of Appeal inwards Cluj (Romania), the CJEU was asked to examine a transfer of personal information of the applicants from a populace establishment to exactly about other populace institution. The applicants were earning income from self-employment. The information nigh their declared income was transferred from ANAF (National Tax Administration Agency) to CNAS (National Health Insurance Fund). The CNAS so required the applicants to pay the arrears of contributions to the wellness insurance regime.

The foremost iii questions of the national courtroom focussed on the interpretation of Article 124 TFEU which relates to economical in addition to budgetary policy in addition to to the number of the privileged access of populace institutions to fiscal markets. They were establish past times the CJEU to live on unrelated to the object of the national proceedings in addition to inwards effect inadmissible. The 4th inquiry soundless dealt to a greater extent than explicitly amongst the number of whether the transfer of the applicants' personal information relating to their income complied amongst the information protection rules. Hence, the CJEU examined that compliance inwards exceptional against the background of Articles 6, 7, 10, xi in addition to xiii of the information protection Directive (Directive 95/46/EC).

Article 6(1) of the Directive is 1 of the principal points of reference inwards situations when personal information is passed on from 1 information controller to exactly about other in addition to it specifies, inwards its signal b), that personal information cannot live on farther processed inwards a way that is incompatible amongst the purposes for which it was collected. On the other hand, this Article tin live on restricted past times a legislative mensurate adopted past times a Member State pursuant to Article xiii of the Directive.

Articles 10 in addition to xi of Directive 95/46 depict what information needs to live on provided past times the information controller (the natural or legal somebody which determines the way in addition to purposes of the processing of personal data) to the information acre of report (the identified or identifiable natural somebody whose information is processed). These 2 Articles check to the unlike circumstances inwards which personal information tin live on collected past times the information controller. Whilst Article 10 refers to the information that needs to live on provided when the personal information is collected from the information acre of report him(her)self Article 11(1) covers the situations where the personal information was collected otherwise than from the information subject.

However, the information obligations nether Article 11(1) produce non apply inwards situations envisaged inwards Article 11(2), thus for instance when recording or disclosure of the information is expressly seat downward past times law. In those situations soundless the Member State must furnish appropriate safeguards.

Article xiii of Directive 95/46 is likewise of exceptional importance for the number of the information that needs to live on provided to the information subject. This Article defines which rights in addition to obligations nether the Directive tin live on restricted past times the legislation of the Member US in addition to for which reasons. The information obligations of the information controller towards the information acre of report nether both Article 10 in addition to Article 11(1) are likewise amidst the rights in addition to obligations that tin live on restricted. In principle, the possible reasons for restricting rights refer to for certain populace involvement objectives. The reasons which appeared the most relevant for the instance inwards inquiry are seat downward inwards Article 13(e) in addition to (f).  Article 13(e) allows the Member US to adopt restrictions when these are necessary to safeguard an of import economical or fiscal involvement of a Member State or of the EU, including monetary, budgetary in addition to taxation matters piece Article 13(f) permits restrictions when necessary to safeguard monitoring, inspection or a regulatory business office that is connected, fifty-fifty occasionally, amongst the do of official authorisation inwards for instance monetary, budgetary or taxation matters.

The CJEU's analysis

At the get-go of the judgment the CJEU recalled exactly about of its case-law nigh the basic concepts of information protection police pull such equally the definitions of "personal data" in addition to of "processing". In that component division of the judgment it likewise reiterated the primary importance of Articles half dozen in addition to seven of the Directive which seat out the principles of legitimate in addition to fair processing of personal data. The CJEU establish that the regulation of the fair processing of personal data, enshrined inwards Article 6, implies that the information subjects demand to live on informed nigh the transfer of their personal information from 1 populace establishment to another.

The CJEU so turned specifically to the analysis of the requirements of Article 10 in addition to xi of the Directive. This way that at that spot were 2 types of processing of personal information which were relevant inwards this case. On the 1 hand, it was the transfer of the applicants' income information past times the revenue enhancement direction which collected it. On the other hand, it was the processing of the transferred information past times the wellness insurance fund. Whilst Article 10 is applicable to the foremost type of processing the minute 1 is covered past times Article 11.

In its analysis of Article 10 the CJEU pointed out that nether this Article the information acre of report must live on informed nigh the purposes of the processing for which the personal information are intended. In addition, insofar equally it is necessary to guarantee fair processing of the data, the information acre of report must likewise live on informed nigh the recipients of the information in addition to nigh the beingness of diverse rights. Without this information the information acre of report could non live on inwards a seat to do the rights that have got been seat out inwards Articles 12 (right to access his/her personal data, to asking the rectification or erasure of unlawfully processed personal data) in addition to xiv (right to object to the processing inwards for certain circumstances).

The CJEU's assessment on this signal led it to conclude that the revenue enhancement direction did non inform the applicants that their income information would live on transferred to the wellness insurance fund. Whilst it was argued inwards the proceedings that a Romanaian Law requires the government in addition to populace institutions to transfer to the wellness insurance fund the information necessary for determining whether a somebody qualifies equally an insured somebody the CJEU considered that the compass of information that needs to live on transferred pursuant to this Law does non encompass personal information relating to income. This was so because persons without taxable income likewise qualify equally insured persons. In effect thus it was establish that the Romanaian Law inwards inquiry could non constitute an information which complies amongst Article 10 of the Directive.

The CJEU so looked into the number of whether this failure to comply amongst Article 10 could nevertheless live on legalised on the footing of a restriction adopted past times Romania pursuant to Article xiii of the Directive.

Out of the Article xiii reasons that could justify restricting the rights in addition to obligations nether the Directive the CJEU identified “an of import economical or fiscal involvement of a Member State (…) including monetary, budgetary or taxation matters”, i.e. the ground seat out inwards Article 13(e) and  “a monitoring, inspection or regulatory business office connected, fifty-fifty occasionally, amongst the do of official authorisation inwards cases related to (inter alia) inwards (e)”, i.e. the ground seat downward inwards Article 13(f) equally the ones that powerfulness have got been applicable to the instance inwards question. The CJEU establish soundless that these 2 reasons could non legalise the non-compliance amongst Article 10 of the Directive because the restrictions based on them have got to live on imposed inwards the legislation of the Member State. This requirement was non met inwards the applicants' instance given that the Romanaian Law, invoked inwards the proceedings, alone envisaged the regulation of transfer of personal information relating to income from the authorities, populace institutions in addition to other institutions to the wellness insurance fund. The Definition of transferable information in addition to the detailed transfer arrangements were soundless seat downward inwards a unlike measure, namely a Protocol agreed betwixt the revenue enhancement direction in addition to the wellness insurance. This Protocol was non fifty-fifty officially published. On top of that, the CJEU noted 1 time again that information relating to income are non necessary for the conclusion if a somebody is insured.

Next, the CJEU scrutinised the processing inwards inquiry against the requirements of Article 11(1) of the Directive. Under this Article the wellness insurance fund which received the personal information relating to income would demand to inform the applicants that it acts equally the information controller of the information inwards inquiry in addition to nigh the purposes of the processing of that data. To the extent that it is necessary to guarantee fair processing of the information the wellness insurance fund would additionally demand to inform the applicants inwards exceptional nigh the categories of information concerned.

Since no such information was supplied to the applicants the CJEU examined whether this failure to comply amongst Article 11(1) of the Directive could live on legalised nether Article xiii or Article 11(2). The conclusion proved to live on identical equally the 1 reached amongst regard to Article 10.  Already earlier it became clear that the Definition of transferable information in addition to the detailed transfer arrangements were seat downward inwards a Protocol concluded betwixt the 2 populace institutions in addition to non inwards a legislative mensurate in addition to so the benchmark for applying a restriction on the footing of Article xiii was non met.

The same was said amongst reference to a possible derogation nether Article 11(2). This Article likewise requires a police pull for derogating from Article 11(1) which inwards add-on must live on accompanied past times appropriate safeguards. In the instance inwards inquiry at that spot was no police pull which included the required elements. Hence the derogation stipulated inwards Article 11(2) could non apply either.

Comments

In contrast to many other recent CJEU judgments related to personal information protection (Data Retention [Digital Rights Ireland], Google Spain, Safe Harbour [Schrems]) Bara was decided without whatever specific references to Charter Articles seven in addition to 8 which bargain amongst the right to individual life in addition to the right to the protection of personal information respectively. The number at stake inwards Bara seems to have got been sufficiently comprehensively addressed already inwards the provisions of Directive 95/46 itself without the demand to await into the Charter for additional elements of interpretation.

In essence, inwards Bara the CJEU followed its previous case-law on the relation betwixt the information subject's right to access his/her personal data, equally seat downward inwards Article 12(a) of Directive 95/46, in addition to the other rights conferred on the information acre of report inwards the Directive. Those other rights include inter alia the rights to asking erasure, rectification or blocking of the information in addition to to object to the processing of personal data, seat downward inwards Articles 12(b) in addition to xiv respectively. In the CJEU's previous case-law (Rijkeboer, here in addition to here), the latter rights were seen equally dependent on the availability of the right of access because without the information nigh the processing of their personal information in addition to nigh the diverse parameters of that processing the information subjects are much less probable to live on inwards a seat to do whatever rights. The same logic tin live on transposed to the information that the information controller is required to furnish to the information acre of report nether Articles 10 in addition to 11(1) of the Directive since the type of information specified inwards those 2 Articles tin likewise live on seen equally essential to the do of the other rights of the information subject.

The CJEU searched for possible derogations inwards Articles xiii in addition to 11(2) of the Directive but establish that neither of them could justify the non-compliance amongst the information obligations nether Articles 10 in addition to 11(1). As both Article xiii in addition to 11(2) specify that derogations or restrictions tin alone live on imposed past times police pull in addition to non past times a mensurate of a lower condition at that spot was no footing for a valid derogation or restriction inwards the applicants' case. Indeed, the most of import parameters of the transfer of the applicants' personal information relating to their income were seat out inwards an administrative organization (which was non officially published) concluded betwixt the revenue enhancement direction agency which collected that information in addition to the wellness insurance fund to which it was transferred.

Would the province of affairs live on unlike had the restrictions been adopted inwards a legislative measure, equally required inwards Article xiii of the Directive? On the 1 hand, the restrictions stipulated inwards Article 13(e) in addition to (f) seem to live on especially well-suited for the purposes of the central of information relating to taxation matters. On the other hand, when analysing the possibility of applying the Article xiii restrictions inwards this case, the CJEU noted that information relating to income are non component division of the personal information necessary for the conclusion of whether a somebody is insured. Necessity soundless is required both for adopting a restriction nether Article xiii of the Directive in addition to for processing personal information on a legitimate footing nether Article 7. Thus, this judgement of the judgment could either hateful that the restriction was only non necessary inwards this instance or rather that the whole processing of information relating to income past times the wellness insurance fund was non necessary. If the latter pregnant is right an Article xiii restriction could non have got applied at all inwards this instance because Article xiii does non constitute a footing for restricting Article 7. In whatever event, inwards the Advocate General's opinion it was the business of the national courtroom to verify if the processing of this information past times the wellness insurance fund was necessary.

In its analysis the CJEU relied quite heavily likewise on the requirement of the fair processing of personal information which is amidst the information protection principles inwards Article half dozen of the Directive. In paragraph 34 of the Bara judgment the CJEU states that the obligation of a populace establishment to inform the information subjects nigh the transfer of their personal information to exactly about other populace establishment derives already from this regulation of the fair processing of personal data.

It powerfulness live on interesting to banker's complaint that the text adopted by the European Parliament inwards the foremost reading of the novel Data Protection Regulation specifies what elements must live on included inwards a legislative mensurate adopted past times a Member State (pursuant to Article 21 of the proposed novel rules) to bound rights in addition to obligations nether the information protection rules. The novel information protection framework, including a listing of these elements inwards Article 21(2), immediately seems destined for adoption after an understanding on the compromise text was reached between the Commission, the European Parliament in addition to the Council on 15 December in addition to confirmed past times the EP LIBE Committee in addition to the Coreper a few days later.

Photo credit: europarl.europa.eu

Share this post