-CJEU Dismisses Access to Personal Data Claim against EPSO-
On 3rd December, the CJEU ruled that the European Personnel Selection Office (EPSO) did not infringe the right of access to the applicant’s data in WS v European Commission. As to the facts of the case, the applicant had created a profile with EPSO in order to participate in four selection procedures. He passed the test for one of them. Hence, his data was processed both in the EPSO talent system and the recruitment portal. As to the access to the data on the two portals and the logging of this access: ‘The Talent system establishes logs of persons who have consulted an EPSO account, but does not record the precise purpose of the consultation. The recruitment portal establishes logs of persons who have accessed the portal as such, but does not record the consultation of the personal data of each of the candidates on that portal.…Only the data subject and certain EPSO staff members can access that person’s EPSO account in the Talent system. By contrast, staff members of other institutions who are responsible for human resources or recruitment may have access to the recruitment portal, but that access is limited to the data of a successful candidate’. The applicant requested access to his data as processed by EPSO, under Article 17 EUDPR, including to information on which staff members had accessed his data. His access was gradually extended following a complaint to the EDPS and the Pannki S judgment. However, he was not satisfied and submitted a complaint with the CJEU, claiming infringement of Articles 17(1) and (3) (right of access to one’s data), Articles 4(1)(a), (d), (f) and 4(2) (the principles of accuracy, integrity and confidentiality, lawfulness, fairness and transparency, and accountability), Articles 20 and 23 (rights to restriction of processing and right to object) and Articles 14 (1)–(3) (transparent information, communication and modalities for the exercise of data subject rights) EUDPR. First, with regards to Articles 17(1) and (3) EUDPR, the applicant claimed that the EPSO did not provide him with ‘a copy of the personal data concerning him which had been deleted unlawfully but which ought to be restored, minutes of meetings which contained personal data concerning him held at the Commission or outside it as well as all internal or external communications between the Commission and third parties containing personal data concerning him and log files, complying in all respects with the requirements of Regulation 2018/1725 in the light of the judgment of 22 June 2023, Pankki S…, containing the recipients, categories of recipients, purposes of access, etc.’. The CJEU ruled that the alleged unlawful deletion of the data to which the applicant sought access was lawful and that ‘Regulation 2018/1725 does not confer a right to restoration of the deleted data on data subjects’. The Court also accepted EPSO’s claim that no minutes of meetings in relation to the applicant were drawn up and that no data related to him were included in EPSO’s internal and external communication and that his right of access included the right to access data concerning him and not to documents as such. The CJEU also repeated that the right of the data subject to know to which recipients his data have been disclosed does not extend to the identity of the employees of the EU institutions who had accessed his data. With regard to the second claim, regarding Article 4 EUDPR, the CJEU in essence repeated its arguments to the first claim, namely that the requested data was not deleted unlawfully and that the EPSO is not required to maintain certain log data for the purposes of accountability. With regards to the third claim in relation to Articles 20 and 23 EUDPR, the CJEU ruled that Articles 20(1) (b) and (d) did not apply in the present case, because the data of the applicant was neither unlawfully processed, in casu deleted, nor could he object to the processing of his data, because the deletion was based on a legal requirement (Article 5 (1)(b) EUDPR) and not on the necessity of fulfilling public tasks or exercising official authority (Article 5(1)(a) EUDPR). With regards to the alleged infringement of Article 14 EUDPR, the Court noted that the plea was in essence similar to the foregoing complaints, which the Court had dismissed. It noted that the only new claim was that two of the contested EPSO decisions were adopted after the expiry of the deadline elaborated in Article 14 EUDPR for responding to access requests. The CJEU acknowledged the delay, but ruled that the delay ‘does not, in itself, render them unlawful’. Finally, the CJEU decided to dismiss the applicant’s complaint in its entirety.
-CJEU Rules that Bodycams Collect Data Directly from Data Subjects-
On 18th December, the CJEU ruled that when bodycams are in operation, the controller should provide the concerned data subjects with information on the processing of the data according to Article 13 GDPR, and not Article 14 GDPR, in Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik. As to the facts of the case, a dispute between the Swedish Data Protection Authority and the local traffic company arose as to the compliance of the usage of bodycams by ticket inspectors with the GDPR, including with GDPR transparency requirements. The dispute resulted in a fine issued to the traffic company. It escalated to the domestic courts, which were uncertain as to whether Article 13 or Article 14 GDPR applied to the provision of information collected by bodycams. As a background note, Article 13 GDPR applies where the data are collected directly from the data subject, whereas Article 14 GDPR applies where the data acre collected indirectly – e.g. obtained from another controller. The categories of information which must be provided, and the timing of provision, differ depending on the applicable article. In its ruling, the CJEU, referring to the EDPB transparency guidelines, first explained that ‘Article 13 of the GDPR applies either where the data subject knowingly provides personal data to the controller or where the controller collects the data from that data subject by observation, in particular by means of cameras’. Second, the CJEU ruled that Articles 13 and 14 GDPR should be read in light of the transparency principle elaborated in Article 5, allowing individuals to be informed of the processing of their personal data at the time of its collection, e.g. via bodycams. Third, the CJEU ruled that since one of the objectives of the GDPR is to ensure a high level of data protection, this objective would not be achieved if individuals would not be informed at the time of the data collection and would risk being subject to ‘to hidden surveillance practices’. The Court recalled that a layered approach to providing information can be implemented in practice.
-ECtHR Rules that Italy Does Not Protect Individuals’ Banking Data-
On 8th January, the ECtHR ruled that Italy’s legal framework does not sufficiently protect individuals’ banking data in Ferrieri and Bonassisa v Italy. As to the facts of the case, the two applicants received, on two different dates, a notice by their banks that ‘the banks had received requests from the Tax Authority to provide information about their bank accounts, transaction histories, and other financial operations either related to them or traceable to them, for a specified period of time, in respect of the first applicant from 1 January to 31 December 2017 and in respect of the second applicant from 1 January 2016 to 31 December 2017. The banks informed the applicants that they were going to comply with their legal obligation to provide the requested information’. The requests were based on domestic law. The applicants claimed that the measures violated their rights under Article 8 ECHR because ‘of the excessively broad scope of the discretion conferred on the domestic authorities by the national legislation, and’ because ‘of the lack of sufficient procedural safeguards capable of protecting them against any abuse or arbitrariness, in particular the lack of ex ante and/or ex post judicial or independent review of the contested measures’. In its ruling, the ECtHR first confirmed that consulting one’s bank account constitutes an interference with one’s right to private life as protected by Article 8 ECHR. Then, the Court examined whether the interference was justified. It concluded that ‘even if there could be said to be a general legal basis for the impugned measures in Italian law, that law does not meet the quality requirements imposed under the Convention. In particular, even taking into account the Contracting States’ broad margin of appreciation in respect of bank data, that is to say purely financial information…, and the importance of the aim of similar measures in the field of taxation…, the Court considers that the domestic legal framework afforded the domestic authorities unfettered discretion with regard to both the conditions in which the contested measures could be implemented and the scope of those measures. At the same time, that framework did not provide sufficient procedural safeguards, as the contested measures were not subjected to a judicial or independent review. Therefore, the domestic legal framework did not provide the applicants with the minimum degree of protection to which they were entitled under the Convention. The Court finds that in these circumstances, it cannot be said that the interferences in question were “in accordance with the law” as required by’ Article 8(2) ‘of the Convention’.
-ECtHR Rules on the Balance between Article 8 and Article 10 in relation to Claims concerning Judge’s Professional Activities-
On 11th December, the ECtHR ruled in the case of Roșca v. the Republic of Moldova. In terms of the facts, the case essentially concerned a judge – the applicant – who had resigned from office, following a series of internal procedures concerning their competence. In relation to these procedures, certain claims had been made about the judge’s professional activities – including claims regarding how certain cases were dealt with, and regarding regular and repeated absence from work – made by a party referred to as N.C., which had then been subsequently published in the local press, the veracity of which the applicant disputed. The applicant then brought proceedings at national level for defamation, which were not successful. In this regard, the applicant brought proceedings before the ECtHR and ‘complained that the domestic courts had failed to provide sufficient reasons and to strike a fair balance when they dismissed her claim for the protection of her reputation as part of her right to respect for her private life, provided in Article 8 of the Convention’. The Court found a violation. The Court considered the matter from the perspective of the need to balance the applicant’s Article 8 right with the Article 10 right of the party who made the claims. The Court highlighted that, in this respect, a number of factors should be taken into account in balancing the rights, including: the ‘subject of the impugned statements and their impact’; ‘the particular context of the statements; how well‑known the applicant was and the nature of her prior conduct; the status of the author and of the applicant; the content, form and consequences of the statements; and the method of obtaining the information and its veracity’. In this regard, the Court eventually concluded that ‘while the professionalism of judges in the context of judicial reform is a matter of general interest and the courts are not immune from criticism, a member of the judiciary, such as N.C., should show restraint in exercising freedom of expression in all cases where the authority of the judiciary is called into question. By implying that the applicant had been absent from work, had been untruthful about her workload and had unlawfully disposed of hundreds of cases as though these were established facts, when they were, rather, mere speculation on the part of N.C., the statements overstepped the limit of acceptable comments. Furthermore, by using disrespectful language towards the applicant personally, N.C. made no contribution to a debate on a matter of public interest and went beyond the limits of acceptable criticism. In the light of the findings above and taking into account the nature of the allegations in the present case, the Court finds that the reasons advanced by the domestic courts to protect N.C.’s right to freedom of expression were not sufficient to outweigh the applicant’s right to respect for her reputation’.
-ECtHR Rules on Lawyer-Client Communications in Relation to Devices Seized in the Context of a Criminal Investigation-
On 18th December, the ECtHR ruled in the case of Černý and Others v. the Czech Republic. In terms of the facts, the case essentially concerned the seizure of electronic devices from an individual, in the context of a criminal investigation, the extraction of information from these devices, the placing of all extracted information in the criminal case-file of the individual who was subject to the search, and the subsequent transmission of this information and a subsequently generated expert report to the prosecutor involved, and certain co-defendants and their lawyers. In particular, the case concerns the extraction and transmission of communications between the individual’s lawyers – the applicants – and that individual. Whilst proceedings at national level were initiated to obtain redress, including removal of the information from the case-file, these were not successful – although civil proceedings were successful. Accordingly, the applicants complained to the ECtHR in relation to Article 8 – the applicants also relied on Articles 6 and 13, which will not be considered here – suggesting that ‘putting their privileged correspondence with their client in the court’s criminal case file violated their right to respect for their private life and correspondence’. The Court found a violation. In this regard, the Court found an interference, highlighting that ‘the applicants did not waive their rights to privacy and protection of correspondence simply because there was a hypothetical possibility that the data they sent to their client’s device could be forwarded to others or obtained by the authorities. Rather, they had a reasonable expectation that the privacy of their communications would still be respected and protected…Indeed, the specific protection guaranteed to lawyer-client communications would be devoid of meaning if it did not extend to electronic communications stored on either the lawyer’s or the client’s devices’. The Court then considered the case on the basis of whether the interference was ‘in accordance with the law’, finding that ‘the law regulating the extraction of data from seized electronic devices was manifestly neither sufficiently clear and foreseeable to those to whom it was addressed, and nor did it contain sufficient safeguards and procedural guarantees to protect the confidentiality of lawyer-client communications’. In particular, the Court highlighted that there was ‘no domestic law regulating the treatment of privileged electronic data that was foreseeable in its effects for those to whom it was addressed’; and ‘that the lack of clear legal regulation meant that the law did not contain any specific and foreseeable procedure for sifting the data and separating privileged material held on electronic data carriers that would comply with the principles established in the Court’s case law’.
-ECtHR Considers the Limits of Privacy in relation to News Media Discussions of Fundamentalism-
On 8th January, the ECtHR ruled in the case of Tafzi El Hadri and El Idrissi Mouch v. Spain. In terms of the facts, the case concerned, in essence, two individuals – the applicants – who were working at a centre for the education of minors in Spain. A large national newspaper – ABC – published ‘an article “Centres for minors, seedbeds of fundamentalism” (Los centros de menores, semilleros del integrismo) in its online edition and…its print edition’. In this article, a relationship was drawn between the work in the centres and Islamic fundamentalism, and the applicants were mentioned by name. Following this, the applicants initiated, at the national level, criminal, civil and constitutional procedures in relation to the damage the article caused to their reputations. All proceedings were unsuccessful. In this regard, the applicants complained to the ECtHR, under Article 8, that ‘by rejecting their civil claim against the ABC and the journalist, the domestic courts had failed to protect their right to their reputation, as they had not looked at the negative impact the publication had had on the applicants’ professional lives; that the journalist had not acted with the required diligence; and that the publication could have contributed to the emergence of hate speech’. The Court found no violation. The Court highlighted the need to balance the applicants’ Article 8 rights with the media’s Article 10 rights and recalled general factors to be taken into account when conducting such a balancing. In this regard, the Court considered, in particular, the following factors in the case: ‘how well known the applicants were and their prior conduct’ – recognising the applicants were not public figures; ‘the content and form of the publication and the manner in which the relevant information was obtained’ – highlighting the dangers of courts imposing overly strict requirements on journalistic expression and recognising that the journalist’s expressions had a ‘sufficiently close connection with the facts of the case’ and could not ‘be regarded as misleading or as a gratuitous attack’; and ‘the consequences of the publication’ – highlighting that the applicants continued to work in the relevant area following publication. On the basis of this consideration, the Court concluded that ‘the domestic courts acted within their margin of appreciation when seeking to establish a balance between the applicants’ rights under Article 8 and the newspaper’s opposing right to freedom of expression under Article 10’. The Court thus considered ‘that the national courts conducted the required balancing exercise between the competing rights at stake in conformity with the criteria laid down in the Court’s case‑law, and it’ discerned ‘no strong reasons to substitute its view for that of the domestic courts’. On 8th January, the ECtHR ruled in the case of Tafzi El Hadri and El Idrissi Mouch v. Spain. In terms of the facts, the case concerned, in essence, two individuals – the applicants – who were working at a centre for the education of minors in Spain. A large national newspaper – ABC – published ‘an article “Centres for minors, seedbeds of fundamentalism” (Los centros de menores, semilleros del integrismo) in its online edition and…its print edition’. In this article, a relationship was drawn between the work in the centres and Islamic fundamentalism, and the applicants were mentioned by name. Following this, the applicants initiated, at the national level, criminal, civil and constitutional procedures in relation to the damage the article caused to their reputations. All proceedings were unsuccessful. In this regard, the applicants complained to the ECtHR, under Article 8, that ‘by rejecting their civil claim against the ABC and the journalist, the domestic courts had failed to protect their right to their reputation, as they had not looked at the negative impact the publication had had on the applicants’ professional lives; that the journalist had not acted with the required diligence; and that the publication could have contributed to the emergence of hate speech’. The Court found no violation. The Court highlighted the need to balance the applicants’ Article 8 rights with the media’s Article 10 rights and recalled general factors to be taken into account when conducting such a balancing. In this regard, the Court considered, in particular, the following factors in the case: ‘how well known the applicants were and their prior conduct’ – recognising the applicants were not public figures; ‘the content and form of the publication and the manner in which the relevant information was obtained’ – highlighting the dangers of courts imposing overly strict requirements on journalistic expression and recognising that the journalist’s expressions had a ‘sufficiently close connection with the facts of the case’ and could not ‘be regarded as misleading or as a gratuitous attack’; and ‘the consequences of the publication’ – highlighting that the applicants continued to work in the relevant area following publication. On the basis of this consideration, the Court concluded that ‘the domestic courts acted within their margin of appreciation when seeking to establish a balance between the applicants’ rights under Article 8 and the newspaper’s opposing right to freedom of expression under Article 10’. The Court thus considered ‘that the national courts conducted the required balancing exercise between the competing rights at stake in conformity with the criteria laid down in the Court’s case‑law, and it’ discerned ‘no strong reasons to substitute its view for that of the domestic courts’.