Table of Contents:
- CJEU: Publishing personal data in an anti-doping context falls within the scope of the GDPR
- CJEU: Enforcement of competition law must comply with Articles 7 and 8 CFREU
- CJEU rules on the balance between access to EU documents and data protection
In the present edition, we inform our readers of three CJEU judgments. These deal with the topics of anti-doping rules on personal data publication, the enforcement of competition law while respecting the fundamental rights to privacy and data protection, and the balance between access to information on MEPs remuneration and expenses and data protection.
1. CJEU: Publishing personal data in an anti-doping context falls within the scope of the GDPR
[1] On 14th July, the CJEU clarified the application of the GDPR and certain of its provisions to rules on publishing personal data in anti-doping matters in NADA Austria and others. As to the facts of the case, in accordance with Austrian law, the National Anti-Doping Agency (NADA) and the Austrian Anti-Doping Legal Commission (ÖADR) published or planned to publish information on the names of several athletes (the applicants in the main proceedings), the discipline they are active in, the established violation against anti-doping rules, and imposed sanctions and their duration. The applicants requested the deletion of their names and disciplines. NADA and ÖADR did not concede to the requests, and the Austrian DPA rejected the applicants’ complaints. One of the complaints was rejected on the grounds that the applicant’s data had not been published yet. The dispute escalated to the domestic courts, which sought guidance from the CJEU on multiple questions, all revolving around the topic of the applicability of the GDPR, the legality of the publication of the personal data and the available remedies in the GDPR against it. In its judgment, the CJEU established first that it is undisputed that the publishing of the personal data in question constitutes the processing of personal data in the meaning of the GDPR. As to the question whether the topic of anti-doping relates to an activity which falls outside the scope of Union law and by extension of the GDPR (Article 2(2)(a) GDPR), the Court ruled in the negative. Second, on the question of whether the publication of the disputed data concerns health data under Article 9 GDPR, the CJEU ruled that “the information that a certain person has committed a specific infringement of the anti-doping rules and is banned from participating in national and international competitions on account of that infringement is not covered, in principle, by the concept of ‘data concerning health’ within the meaning of Article 9. By contrast, the situation is different where such information makes reference to the name or category of the prohibited substance or method concerned by that infringement and where that reference, combined with other information concerning that person, is capable of revealing, even indirectly, by means of an intellectual operation involving collation or deduction, information relating to the past, current or future physical or mental health status of that person”. Third, on the question of the compatibility of the Austrian legislation with Articles 5 (1)(a) and (c) and 6(3) GDPR, the Court decided that the legislation would be compatible with the GDPR where it “allows controllers, apart from (the legally provided) exceptions and prior to such publication, to carry out an individual balancing exercise weighing up the interests involved in order to ensure that that publication is made in a manner consistent with that regulation”. Fourth, the Court ruled that Article 10 GDPR is not applicable to the processing of the data in the present case, because “irrespective of the classification of those offences under national law, those offences and those sanctions are directed only at a particular group of persons, namely athletes, in the same way as disciplinary sanctions whose purpose is to ensure that the members of a group comply with rules of conduct specific to that group”. Finally, with regard to the question whether a complaint submitted under Article 77 GDPR is admissible even before the data processing has taken place, the Court ruled that “a complaint lodged on the basis of that article, seeking to prevent the publication on the internet of personal data relating to the infringement of anti-doping rules, is admissible where, on the date on which that complaint is lodged with the competent supervisory authority, there are specific indications that that publication is imminent or will take place in the near future”.
2. CJEU: Enforcement of competition law must comply with Articles 7 and 8 CFREU
[2] On 16th July, the CJEU ruled on the compatibility of communications and personal data processing for competition purposes with Articles 7 and 8 CFREU in Imagens Médicas Integradas S.A. and Others. As to the facts of the case, the applicants in the main proceedings are private companies, against which the Portuguese competition authority opened investigations on suspicions of anti-competitive behaviour. After obtaining an authorisation for carrying out search and seizure operations by the Public Prosecutor, the competition authority seized materials, including documents and business emails. In domestic proceedings, the applicants challenged the compatibility of the seizures, especially of internal correspondence, with Article 7 CFREU. In its ruling, the Court first established that business emails, as exchanged internally, fall within the notion of “communications” under Article 7 CFREU and added that the personal data generated by such exchanges is covered by Article 8 CFREU. Second, the Court examined the compatibility of the contested seizures with both Articles 7 and 8 CFREU. It stated that the seizure of the emails constitutes an interference with both Articles 7 and 8 CFREU, and needs to comply with the conditions in Article 52(1) CFREU (legal basis, respect for the essence of the rights, pursuit of a legitimate objective of general interest and necessity and proportionality). The Court found that the contested interferences had a basis in domestic law and respected the essence of each of the two fundamental rights (as concerns Article 7 CFREU, this is because the seizure was targeted and concerned the professional aspects of the employees’ rights, and Article 8 CFREU, insofar as the data processing complies with the GDPR). Third, with regard to the objective of general interest, the CJEU ruled that the investigations and related seizures seek to enforce the competition rules of the Union, which are anchored in Articles 101 and 102 TFEU. Finally, on necessity and proportionality, the CJEU, after a detailed analysis and taking into account also the available safeguards, ruled that the contested seizures would be compatible with Articles 7 and 8 CFREU in the event in which a prior judicial authorisation has not been granted, “provided that a strict legal framework for the powers of that authority, and adequate and sufficient safeguards against abuse and arbitrariness, such as effective ex post judicial review of the measures at issue, are provided for”.
3. CJEU rules on the balance between access to EU documents and data protection
[3] On July 15th, the CJEU ruled in the case of Kverulant.org v Parliament. In terms of the facts, the applicant was an NGO, which sought access to a range of different types of information, including concerning various types of remuneration and expenses, on Czech Members of the European Parliament. The European Parliament, however, refused provision of much of this information in personally identifiable form, citing data protection concerns under Article 4(1)(b) of Regulation 1049/2001 – on access to EU documents. The applicant thus complained to the CJEU that the Parliament’s decision, in which access to MEP’s financial information was refused, should be annulled. The applicant argued, in this regard, that: i) there had been a violation of Article 4(1)(b) of Regulation 1049/2001, read in light of Article 9(1) of Regulation 2018/1725 – concerning data protection and EU bodies – and that the restriction of access to personal data was thus illegitimate; and ii) there had been a violation of the obligation to state reasons under Article 8(1) of Regulation 1049/2001 and Article 41 of the Charter when issuing the decision. The CJEU began by considering the second of the applicant’s arguments, finding that the Parliament had indeed provided reasons in line with the provisions invoked and dismissing the position as unfounded. The Court then moved to consider the applicant’s first argument. In the first instance, the Court recognised the applicant had a legitimate reason for requesting the personal data at issue – namely exercising control over, and ensuring transparency in relation to – the spending of public money. The Court then, however, considered the applicant had not demonstrated the necessity of provision of the personal data in question as necessary for achieving control and transparency – highlighting, for example, the lack of evidence provided by the applicant supporting the justification that personal data should be provided, the lack of efficacy of provision of the information in question in relation to the applicant’s goals, and the existence of other measures, such as internal Parliamentary mechanisms, which serve the same purposes. Unfortunately, at the time of writing, the case was only available in French, a language in which the editors are not fluent. Accordingly, electronic translations were used to generate this summary. We cannot guarantee the accuracy of these translations, and thus cannot guarantee the accuracy of this summary. We thus suggest all interested in the subject matter of the case to consult the original documents themselves.
More Information:
[1] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0474
[2] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0258
[3] https://infocuria.curia.europa.eu/tabs/document/T/2024/T-0529-24-00000000RD-01-P-01/ARRET_NP/323772-FR-1-html