Data Protection Insider, Issue 135

Data Protection Insider, Issue 135 - DPI 31

-CJEU: Inadmissibility Decision on Case concerning Access to Judicial Documents-

On 5th June, the CJEU declared the preliminary ruling questions in SQ, from a Bulgarian court inadmissible. However, the Court indicated under which conditions the questions can be made admissible and, thus, we presume that in the future the same questions might become the subject to a new preliminary ruling case. Because of this and because of the content of the questions, which we believe to be specific and interesting, below, we summarise the facts of the case and the reasons for the inadmissibility decision. As to the facts of the case, the applicants in the main proceedings are the heirs to individuals whose property was taken away from them by the ex-Communist regime. The applicants seek the restoration of this property. The case is pending in front of the Sofia regional court, which sent the preliminary ruling questions to the CJEU. At the same time the right to ownership over the contested property is the subject to another case, pending before the Sofia court of appeals. The applicants requested that the proceedings before the court of appeals be stayed until the regional court has rendered its judgment, which they believe is decisive for the outcome of the case before the court of appeals. The latter court asked the other parties to the case pending before it to indicate whether they agree to the proceedings being stayed. The lawyers for one of the parties who is not a party to the case before the regional court – SQ – requested access to the case file of the case before the regional court in order to advise their client if they should agree to the proceedings being stopped. The request is based on Bulgarian legal provisions which allow every lawyer to have access to any court case file in order to be able to decide whether they want to represent a certain individual in that case. The applicants in the case before the regional court agreed that the case file be disclosed to the SQ’s lawyer. However, the court administrator to the case is of the opinion that the Bulgarian legal provisions are contrary to the applicable GDPR provisions. Hence, the regional court requested the CJEU to guide it on whether the disclosure of the case file to a lawyer who does not represent any party to the case would be in breach of the GDPR. The CJEU declared the case inadmissible for two main reasons. First, the Court noted that the preliminary ruling questions do not concern questions which form part of the dispute pending before the referring court, in casu questions on the right to restoration of property. Second, the preliminary ruling questions do not relate to a potential judicial decision being rendered, but to an administrative decision on access to the case file, which was issued by the court administrator in casu. The Court recalled that when a national court acts as an administrative body, it is not entitled to send preliminary ruling questions to the CJEU. The CJEU indicated, however, that if the referring court would render a judicial decision, refusing SQ access to the case file, or if its decision to provide access would be appealed in court, then the referring court could re-send the questions for preliminary ruling.

Editorial note: The inadmissibility decision was available only in Bulgarian and French at the time of writing the above summary. The summary is based on the Bulgarian version of the text.

-ECtHR: Gender Change in Official Identity Documents Made too Difficult in the Czech Republic-

On 12th June, the ECtHR decided that the rules on gender change in official identity documents in the Czech Republic breach Article 8 ECHR in T.H. v Czech Republic. As to the facts of the case, the applicant was born male and was registered as such in the official documents. However, from an early age, the applicant identified as non-binary. As of May 2012 ‘the applicant repeatedly requested to have the “sex/gender marker” and personal numerical code on his national identity card changed to either a neutral one or, at the very least, a female one’. However, the request was turned down with the argument that the applicant had not undergone a gender reassignment surgery, which was a legal requirement in force until 30 June 2025. The applicant had undergone, however, hormonal treatment and a Swiss doctor had issued a medical report. The applicant claimed that the refusal breached his Article 3 ECHR and Article 8 ECHR rights. The Court decided to examine the complaint only under Article 8 ECHR. It first established that the case will be examined as a matter of the positive obligations of the State under Article 8 ECHR. The Court recalled its previous case law in which it had established that ‘it is the States’ positive obligation under Article 8 to provide quick, transparent and accessible procedures for changing the registered sex/gender marker of transgender people’ and that in the course of time the requirements on gender change Europe- and worldwide had been relaxed, i.e. they did not require a mental disorder to be diagnosed or a gender reassignment surgery to have taken place. The Court argued that the contested legal requirements for gender change in the official documents applicable in casu until 30 June 2025 breached the rights guaranteed in Article 8 ECHR. The main reason was that: ‘In the present case, the applicant faced precisely such an insoluble dilemma, being required either to undergo surgery and waive the full exercise of his right to respect for his physical integrity, or to renounce the recognition of his gender identity, which relates to his right to respect for private life. While admitting that safeguarding the principle of the inalienability of civil status, ensuring the reliability and consistency of civil‑status records and, more generally, ensuring legal certainty, are in the general interest…, the Court finds that the domestic authorities disregarded the fair balance which has to be struck between the general interest and the interests of the individual’. We believe that the case contributes to the discussion on the burden of proof in cases when rectification of official documents has been requested.

-ECtHR: Court considers Positive Obligations connected with Name Changes-

On 3rd June, the ECtHR ruled that the refusal of the Austrian authorities to change the first name of the applicant in official documents did not breach Article 8 ECHR in Sahiner v Austria. As to the facts of the case, the applicant in the main proceedings was called Özlem by first name at birth. However, this was the name chosen by the applicant’s father, who the mother then divorced. The mother always called her daughter ‘Lemilia’ and this is the name by which the applicant was known amongst her friends. In February 2019 the applicant requested the official name change in her identity documents to Lemilia. The request was turned down with the argument that Lemilia was not a ‘common’ name as required by Austrian law. The applicant claimed that the refusal breached her right to private life under Article 8 ECHR. The Court decided to examine the case as a matter of the positive obligations of the State and in terms of whether the latter had struck a fair balance between the competing interests. The Court noted that ‘the authorities referred to the lack of commonness of the forename “Lemilia”, which was an essential legal requirement and the cause for the refusal of the applicant’s request from the outset. They consulted databases to establish whether the forename was common in Austria and did not limit their research to Austria but extended it to other countries by consulting linguistic experts in the Italian and Spanish languages. The explanatory notes to the draft laws (the Name Change Act and the Civil Status Act) and the case-law of the Constitutional Court…also explain that the requirement in question was introduced for the protection of public order, as well as to ensure that only forenames common for the identification of persons are registered, and the Court is satisfied that it is in the public interest…. The Court further attaches special weight to the fact that the Constitutional Court has emphasised in its case-law that the domestic courts must, when applying the conditions of the Name Change Act, interpret them in line with the Convention and take into account the identity-forming significance of the name for a person’. Thus, the ECtHR concluded that the name change refusal in casu did not violate Article 8 ECHR. We believe that the present case, similarly to the T.H. v Czech Republic case examined also in the present issue, contributes to the discussion on the burden of proof in relation to raising or refusing rectification/correction claims.

-ECtHR Decides in Case on Prisoner’s Correspondence-

On 3rd June, the ECtHR decided in the case of Uygun v. Türkiye. In terms of the facts, the case concerned a prisoner who had been arrested ‘on charges of membership of an organisation described by the Turkish authorities as the FETÖ/PDY (“Fetullahist Terrorist Organisation/Parallel State Structure”), which was considered by the national authorities to have instigated the coup attempt’. At the time of the relevant events, the applicant had been convicted, but was awaiting a decision on appeal. Whilst in prison, the applicant submitted a long letter to the authorities, to be sent to his fiancé. The prison authorities refused to send the letter, highlighting one paragraph as problematic, as suggesting ‘an intention to prevent the person mentioned from informing on the FETÖ/PDY and that the applicant continued to have ties with that organisation and to play an active role within it’. Whilst the applicant objected to this decision in a series of judicial proceedings before the national courts, they were unsuccessful. In this regard, the applicant complained to the ECtHR under Article 8 that ‘the refusal by the prison authorities to send the letter in question to his fiancée, with whom he was not permitted to speak on the telephone or to receive visits from during the state of emergency, constituted a breach of his right to respect for his private life and correspondence’ – the applicant made a further complaint under Article 6 which will not be considered here. The Court found a violation of Article 8. In particular, the Court highlighted that the measure was not proportionate, stating: ‘The prison authorities and the trial courts…failed to provide sufficient reasoning as to whether the letter could have been sent after redacting the specific objectionable content…In this regard, the Court notes that the letter consisted of ten pages, yet the Disciplinary Board only referred to a single paragraph…Furthermore, the applicant’s argument that at the time of the events in question written correspondence was his only means of communication with his fiancée is of particular significance in this case….The Court notes that the authorities did not assert that the applicant was corresponding with convicted persons or with dangerous individuals, but rather with a person with whom the applicant was reportedly about to marry and with whom he had previously exchanged several letters without hindrance. Therefore, apart from the paragraph cited by the authorities, no concern was expressed regarding the rest of the ten-page letter, which consisted of personal thoughts and feelings that the applicant shared with his fiancée. Accordingly, while the reasons provided by the authorities may be deemed relevant, they were not sufficient to justify the withholding of the complete letter’.

-AG Opinion on FIFA Rules concerning Agents and Personal Data-

On 15th May, the AG published their Opinion in the case FT, RRC Sports GmbH v Fédération internationale de football association (FIFA). In terms of the facts, ‘FIFA’s Council adopted the FIFA Football Agent Regulations (‘the FFAR’)…. Those regulations provide the framework governing, inter alia, the remuneration, activities and conduct of players’ agents…. Among those rules, the FFAR impose limits on players’ agents’ fees and introduces other rules on conflicts of interest and on contractual terms… The applicants in the main proceedings brought an action for an injunction before the Landgericht Mainz…seeking to bar the application of certain rules of the FFAR…on the ground that they infringe…Article 6 of the GDPR’ related to data processing requirements – the case in fact deals with a wide range of other issues beyond data protection, which will not be considered here. In this regard, the referring national Court asked the following question to the CJEU: Should Article 6 GDPR be ‘interpreted as precluding rules adopted by…FIFA…to which 211 national sports federations…belong, and whose rules are therefore binding in any event on the majority of the actors active in the respective national professional leagues…players…and players’ agents…, and which have the following content…. Article 16(2)(j)(ii) to (v) and (k)(ii) of the FFAR require agents to upload details regarding client agreements, remuneration and collaboration to a platform operated by FIFA within 14 days. Article 19 of the FFAR further mandates that agents disclose personal data to FIFA, including information about clients, services and transactions, which are then made accessible to certain stakeholders for the purposes of monitoring compliance with the substantive provisions of the FFAR’. The AG begins by highlighting that ‘from the information in the order for reference and the nature of the FFAR rules at issue…Article 6(1)(f) is relevant in this context’. The AG then goes on to examine each of the three cumulative conditions relevant for Article 6(1)(f) to be relevant – ‘the controller or a third party must pursue a legitimate interest…the processing of personal data must be necessary to achieve that interest…the interests or fundamental freedoms and rights of the person whose personal data are at stake must not take precedence over the legitimate interest of the controller or of a third party’. The AG concludes that ‘the rules set out in regulations issued by sports associations which concern the activity of football agents are not precluded’ in relation to Article 6(1)(f), if ‘those which concern the submission of personal data of natural persons and their disclosure to third parties genuinely pursue interests worthy of protection, only concern data that is strictly necessary to that end and do not place an intolerable burden on the data subjects as regards their right to privacy and their financial interests’. Whilst the final conclusion is not surprising, the AG makes a number of interesting comments in their reasoning, which make the Opinion worth reading. These concern, for example: the possibility that failure to fulfil information obligations under Article 13 may invalidate legitimation under Article 6(1)(f); the differing utility of transparency as a goal between public and private parties; and the need for authorities to consider potential hidden motives when evaluating the necessity of data collection and processing. As always, it remains to be seen whether, and if so to which degree, the Court follows the AG’s Opinion.

-AG Opinion on Proportionality of Hungarian Law-

On 5th June, the AG delivered their Opinion in the case of European Commission v Hungary. In terms of the facts, the case essentially deals with ‘amendments to various instruments of domestic legislation that were introduced by ‘Law LXXIX of 2021 adopting stricter measures against persons convicted of paedophilia and amending certain laws for the protection of children’ (‘the Amending Law’)…. Several of those amendments, which were, according to Hungary, introduced with the aim of protecting minors, prohibit or restrict access to content that portrays or promotes ‘gender identities that do not correspond to the sex assigned at birth, sex reassignment or homosexuality’…. According to the Commission…Rule 8, contained in the Law on the criminal records system, infringes Article 10 of the GDPR in conjunction with Article 8(2) of the Charter’ – the case in fact deals with a wide range of other issues beyond data protection, which will not be considered here. This rule ‘mandates bodies with access to registered data to provide direct access to the criminal records of individuals convicted of sexual offences against children to ‘authorised persons’. With regard to the categorisation of ‘authorised persons’, Paragraph 75/B(3) of the Law on the criminal records system states that the making available of registered data shall only be allowed if the person requesting those data is an adult who is either a relative of, or educates, supervises or cares for, a person who has not attained 18 years of age….According to the Commission, an infringement has occurred because Rule 8 fails to specify with sufficient clarity who is authorised to submit a data request and thus does not provide sufficient guarantees for the rights and freedoms of data subjects regarding the conditions of access to their personal data’. In their reasoning, the AG pointed to Articles 6(1)(e) and 10 GDPR, and Article 8(2) of the Charter. In light of these, the AG observed that the ‘protection of minors from those who might cause them harm is undoubtedly a public interest of the utmost importance’ whilst ‘criminal record data is highly sensitive and could lead to stigma’ which may ‘seriously impact an individual’s private and professional life, requiring strict justification and clear legal safeguards’. Accordingly, the AG observed that, ‘in balancing these two interests, the national measures designed to attain the goal of the protection of minors must be assessed in terms of the requirements of proportionality’. The AG considered, however, that ‘the conditions set by Rule 8 and other provisions of the Law on the criminal records system do not constitute sufficient safeguards for the purposes of the provisions of the GDPR and of Article 8 of the Charter’. The AG highlighted that: i) ‘the category of persons authorised to access personal data about criminal convictions related to sexual offences against children under Rule 8 is too imprecise and broad to comply with Article 10 of the GDPR’ – including observing ‘that the category of ‘authorised persons’ permitted to make a data request under Rule 8 is’ not ‘sufficiently defined and limited by the various provisions spread across both the Law on the criminal records system and the Hungarian Civil Code.’; and ii) ‘the substantive conditions for access are not defined precisely enough by national law so as to enable the competent authority to check that such access is justified and necessary’ – including observing that the fact that access to data under the rule is ‘governed by a mere self-declaration, and effectively places the assessment of necessity and proportionality in the hands of the requesting individual rather than the competent authority responsible for overseeing access to criminal records’ is not compatible with Article 10 of the GDPR. As always, it remains to be seen whether, and if so to which degree, the Court follows the AG’s Opinion.

Über

DPI Editorial Team

Dara Hallinan, Editor: Legal academic working at FIZ Karlsruhe. His specific focus is on the interaction between law, new technologies – particularly ICT and biotech – and society. He studied law in the UK and Germany, completed a Master’s in Human Rights and Democracy in Italy and Estonia and wrote his PhD at the Vrije Universiteit Brussel on the better regulation of genetic privacy in biobanks and genomic research through data protection law. He is also programme director for the annual Computers, Privacy and Data Protection conference.

Diana Dimitrova, Editor: Researcher at FIZ Karlsruhe. Focus on privacy and data protection, especially on rights of data subjects in the Area of Freedom, Security and Justice. Completed her PhD at the VUB on the topic of ‘Data Subject Rights: The rights of access and rectification in the AFSJ’. Previously, legal researcher at KU Leuven and trainee at EDPS. Holds LL.M. in European Law from Leiden University.

Hinterlasse eine Antwort