{"id":84626,"date":"2026-01-15T11:06:50","date_gmt":"2026-01-15T10:06:50","guid":{"rendered":"https:\/\/www.lexxion.eu\/?post_type=dpi&p=84626"},"modified":"2026-01-15T11:06:50","modified_gmt":"2026-01-15T10:06:50","slug":"data-protection-insider-issue-146","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-146\/","title":{"rendered":"Data Protection Insider, Issue 146"},"content":{"rendered":"

-CJEU Dismisses Access to Personal Data Claim against EPSO-<\/em><\/strong><\/a><\/h3>\n

On 3rd<\/sup> December, the CJEU ruled that the European Personnel Selection Office (EPSO) did not infringe the right of access to the applicant\u2019s data in WS v European Commission<\/em>. As to the facts of the case, the applicant had created a profile with EPSO in order to participate in four selection procedures. He passed the test for one of them. Hence, his data was processed both in the EPSO talent system and the recruitment portal. As to the access to the data on the two portals and the logging of this access: \u2018The Talent system establishes logs of persons who have consulted an EPSO account, but does not record the precise purpose of the consultation. The recruitment portal establishes logs of persons who have accessed the portal as such, but does not record the consultation of the personal data of each of the candidates on that portal.\u2026Only the data subject and certain EPSO staff members can access that person\u2019s EPSO account in the Talent system. By contrast, staff members of other institutions who are responsible for human resources or recruitment may have access to the recruitment portal, but that access is limited to the data of a successful candidate\u2019. The applicant requested access to his data as processed by EPSO, under Article 17 EUDPR, including to information on which staff members had accessed his data. His access was gradually extended following a complaint to the EDPS and the Pannki S<\/em> judgment. However, he was not satisfied and submitted a complaint with the CJEU, claiming infringement of Articles 17(1) and (3) (right of access to one\u2019s data), Articles 4(1)(a), (d), (f) and 4(2) (the principles of accuracy, integrity and confidentiality, lawfulness, fairness and transparency, and accountability), Articles 20 and 23 (rights to restriction of processing and right to object) and Articles 14 (1)\u2013(3) (transparent information, communication and modalities for the exercise of data subject rights) EUDPR. First, with regards to Articles 17(1) and (3) EUDPR, the applicant claimed that the EPSO did not provide him with \u2018a copy of the personal data concerning him which had been deleted unlawfully but which ought to be restored, minutes of meetings which contained personal data concerning him held at the Commission or outside it as well as all internal or external communications between the Commission and third parties containing personal data concerning him and log files, complying in all respects with the requirements of Regulation 2018\/1725 in the light of the judgment of 22 June 2023, Pankki S<\/em>\u2026, containing the recipients, categories of recipients, purposes of access, etc.\u2019. The CJEU ruled that the alleged unlawful deletion of the data to which the applicant sought access was lawful and that \u2018Regulation 2018\/1725 does not confer a right to restoration of the deleted data on data subjects\u2019. <\/a>The Court also accepted EPSO\u2019s claim that no minutes of meetings in relation to the applicant were drawn up and that no data related to him were included in EPSO\u2019s internal and external communication and that his right of access included the right to access data concerning him and not to documents as such. The CJEU also repeated that the right of the data subject to know to which recipients his data have been disclosed does not extend to the identity of the employees of the EU institutions who had accessed his data. With regard to the second claim, regarding Article 4 EUDPR, the CJEU in essence repeated its arguments to the first claim, namely that the requested data was not deleted unlawfully and that the EPSO is not required to maintain certain log data for the purposes of accountability. With regards to the third claim in relation to Articles 20 and 23 EUDPR, the CJEU ruled that Articles 20(1) (b) and (d) did not apply in the present case, because the data of the applicant was neither unlawfully processed, in casu<\/em> deleted, nor could he object to the processing of his data, because the deletion was based on a legal requirement (Article 5 (1)(b) EUDPR) and not on the necessity of fulfilling public tasks or exercising official authority (Article 5(1)(a) EUDPR). With regards to the alleged infringement of Article 14 EUDPR, the Court noted that the plea was in essence similar to the foregoing complaints, which the Court had dismissed. It noted that the only new claim was that two of the contested EPSO decisions were adopted after the expiry of the deadline elaborated in Article 14 EUDPR for responding to access requests. The CJEU acknowledged the delay, but ruled that the delay \u2018does not, in itself, render them unlawful\u2019. Finally, the CJEU decided to dismiss the applicant\u2019s complaint in its entirety.<\/p>\n

-CJEU Rules that Bodycams Collect Data Directly from Data Subjects-<\/strong><\/a><\/h3>\n

On 18th<\/sup> December, the CJEU ruled that when bodycams are in operation, the controller should provide the concerned data subjects with information on the processing of the data according to Article 13 GDPR, and not Article 14 GDPR, in Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik<\/em>. As to the facts of the case, a dispute between the Swedish Data Protection Authority and the local traffic company arose as to the compliance of the usage of bodycams by ticket inspectors with the GDPR, including with GDPR transparency requirements. The dispute resulted in a fine issued to the traffic company. It escalated to the domestic courts, which were uncertain as to whether Article 13 or Article 14 GDPR applied to the provision of information collected by bodycams. As a background note, Article 13 GDPR applies where the data are collected directly from the data subject, whereas Article 14 GDPR applies where the data acre collected indirectly \u2013 e.g. obtained from another controller. The categories of information which must be provided, and the timing of provision, differ depending on the applicable article. In its ruling, the CJEU, referring to the EDPB transparency guidelines, first explained that \u2018Article 13 of the GDPR applies either where the data subject knowingly provides personal data to the controller or where the controller collects the data from that data subject by observation, in particular by means of cameras\u2019.<\/a> Second, the CJEU ruled that Articles 13 and 14 GDPR should be read in light of the transparency principle elaborated in Article 5, allowing individuals to be informed of the processing of their personal data at the time of its collection, e.g. via bodycams. Third, the CJEU ruled that since one of the objectives of the GDPR is to ensure a high level of data protection, this objective would not be achieved if individuals would not be informed at the time of the data collection and would risk being subject to \u2018to hidden surveillance practices\u2019. The Court recalled that a layered approach to providing information can be implemented in practice.<\/p>\n

-ECtHR Rules that Italy Does Not Protect Individuals\u2019 Banking Data-<\/strong><\/a><\/h3>\n

On 8th<\/sup> January, the ECtHR ruled that Italy\u2019s legal framework does not sufficiently protect individuals\u2019 banking data in Ferrieri and Bonassisa v Italy<\/em>.<\/a> As to the facts of the case, the two applicants received, on two different dates, a notice by their banks that \u2018the banks had received requests from the Tax Authority to provide information about their bank accounts, transaction histories, and other financial operations either related to them or traceable to them, for a specified period of time, in respect of the first applicant from 1 January to 31 December 2017 and in respect of the second applicant from 1 January 2016 to 31 December 2017. The banks informed the applicants that they were going to comply with their legal obligation to provide the requested information\u2019. The requests were based on domestic law. The applicants claimed that the measures violated their rights under Article 8 ECHR because \u2018of the excessively broad scope of the discretion conferred on the domestic authorities by the national legislation, and\u2019 because \u2018of the lack of sufficient procedural safeguards capable of protecting them against any abuse or arbitrariness, in particular the lack of ex ante and\/or ex post judicial or independent review of the contested measures\u2019. In its ruling, the ECtHR first confirmed that consulting one\u2019s bank account constitutes an interference with one\u2019s right to private life as protected by Article 8 ECHR. Then, the Court examined whether the interference was justified. It concluded that \u2018even if there could be said to be a general legal basis for the impugned measures in Italian law, that law does not meet the quality requirements imposed under the Convention. In particular, even taking into account the Contracting States\u2019 broad margin of appreciation in respect of bank data, that is to say purely financial information\u2026, and the importance of the aim of similar measures in the field of taxation\u2026, the Court considers that the domestic legal framework afforded the domestic authorities unfettered discretion with regard to both the conditions in which the contested measures could be implemented and the scope of those measures. At the same time, that framework did not provide sufficient procedural safeguards, as the contested measures were not subjected to a judicial or independent review. Therefore, the domestic legal framework did not provide the applicants with the minimum degree of protection to which they were entitled under the Convention. The Court finds that in these circumstances, it cannot be said that the interferences in question were \u201cin accordance with the law\u201d as required by\u2019 Article 8(2) \u2018of the Convention\u2019.<\/p>\n

-ECtHR Rules on the Balance between Article 8 and Article 10 in relation to Claims concerning Judge\u2019s Professional Activities-<\/em><\/strong><\/a><\/h3>\n

On 11th<\/sup> December, the ECtHR ruled in the case of Ro\u0219ca v. the Republic of Moldova<\/em>. <\/span><\/a>In terms of the facts, the case essentially concerned a judge \u2013 the applicant \u2013 who had resigned from office, following a series of internal procedures concerning their competence. In relation to these procedures, certain claims had been made about the judge\u2019s professional activities \u2013 including claims regarding how certain cases were dealt with, and regarding regular and repeated absence from work \u2013 made by a party referred to as N.C., which had then been subsequently published in the local press, the veracity of which the applicant disputed. The applicant then brought proceedings at national level for defamation, which were not successful. In this regard, the applicant brought proceedings before the ECtHR and \u2018complained that the domestic courts had failed to provide sufficient reasons and to strike a fair balance when they dismissed her claim for the protection of her reputation as part of her right to respect for her private life, provided in Article 8 of the Convention\u2019. The Court found a violation. The Court considered the matter from the perspective of the need to balance the applicant\u2019s Article 8 right with the Article 10 right of the party who made the claims. The Court highlighted that, in this respect, a number of factors should be taken into account in balancing the rights, including: the \u2018subject of the impugned statements and their impact\u2019; \u2018the particular context of the statements; how well\u2011known the applicant was and the nature of her prior conduct; the status of the author and of the applicant; the content, form and consequences of the statements; and the method of obtaining the information and its veracity\u2019. In this regard, the Court eventually concluded that \u2018while the professionalism of judges in the context of judicial reform is a matter of general interest and the courts are not immune from criticism, a member of the judiciary, such as N.C., should show restraint in exercising freedom of expression in all cases where the authority of the judiciary is called into question. By implying that the applicant had been absent from work, had been untruthful about her workload and had unlawfully disposed of hundreds of cases as though these were established facts, when they were, rather, mere speculation on the part of N.C., the statements overstepped the limit of acceptable comments. Furthermore, by using disrespectful language towards the applicant personally, N.C. made no contribution to a debate on a matter of public interest and went beyond the limits of acceptable criticism. In the light of the findings above and taking into account the nature of the allegations in the present case, the Court finds that the reasons advanced by the domestic courts to protect N.C.\u2019s right to freedom of expression were not sufficient to outweigh the applicant\u2019s right to respect for her reputation\u2019.<\/p>\n

-ECtHR Rules on Lawyer-Client Communications in Relation to Devices Seized in the Context of a Criminal Investigation-<\/strong><\/a><\/h3>\n

On 18th<\/sup> December, the ECtHR ruled in the case of \u010cern\u00fd and Others v. the Czech Republic<\/em>.<\/a> In terms of the facts, the case essentially concerned the seizure of electronic devices from an individual, in the context of a criminal investigation, the extraction of information from these devices, the placing of all extracted information in the criminal case-file of the individual who was subject to the search, and the subsequent transmission of this information and a subsequently generated expert report to the prosecutor involved, and certain co-defendants and their lawyers. In particular, the case concerns the extraction and transmission of communications between the individual\u2019s lawyers \u2013 the applicants \u2013 and that individual. Whilst proceedings at national level were initiated to obtain redress, including removal of the information from the case-file, these were not successful \u2013 although civil proceedings were successful. Accordingly, the applicants complained to the ECtHR in relation to Article 8 \u2013 the applicants also relied on Articles 6 and 13, which will not be considered here \u2013 suggesting that \u2018putting their privileged correspondence with their client in the court\u2019s criminal case file violated their right to respect for their private life and correspondence\u2019. The Court found a violation. In this regard, the Court found an interference, highlighting that \u2018the applicants did not waive their rights to privacy and protection of correspondence simply because there was a hypothetical possibility that the data they sent to their client\u2019s device could be forwarded to others or obtained by the authorities. Rather, they had a reasonable expectation that the privacy of their communications would still be respected and protected\u2026Indeed, the specific protection guaranteed to lawyer-client communications would be devoid of meaning if it did not extend to electronic communications stored on either the lawyer\u2019s or the client\u2019s devices\u2019. The Court then considered the case on the basis of whether the interference was \u2018in accordance with the law\u2019, finding that \u2018the law regulating the extraction of data from seized electronic devices was manifestly neither sufficiently clear and foreseeable to those to whom it was addressed, and nor did it contain sufficient safeguards and procedural guarantees to protect the confidentiality of lawyer-client communications\u2019. In particular, the Court highlighted that there was \u2018no domestic law regulating the treatment of privileged electronic data that was foreseeable in its effects for those to whom it was addressed\u2019; and \u2018that the lack of clear legal regulation meant that the law did not contain any specific and foreseeable procedure for sifting the data and separating privileged material held on electronic data carriers that would comply with the principles established in the Court\u2019s case law\u2019.<\/p>\n

-ECtHR Considers the Limits of Privacy in relation to News Media Discussions of Fundamentalism-<\/strong><\/a><\/h3>\n

On 8th January, the ECtHR ruled in the case of Tafzi El Hadri and El Idrissi Mouch v. Spain<\/em><\/a>. In terms of the facts, the case concerned, in essence, two individuals \u2013 the applicants \u2013 who were working at a centre for the education of minors in Spain. A large national newspaper \u2013 ABC \u2013 published \u2018an article \u201cCentres for minors, seedbeds of fundamentalism\u201d (Los centros de menores, semilleros del integrismo) in its online edition and\u2026its print edition\u2019. In this article, a relationship was drawn between the work in the centres and Islamic fundamentalism, and the applicants were mentioned by name. Following this, the applicants initiated, at the national level, criminal, civil and constitutional procedures in relation to the damage the article caused to their reputations. All proceedings were unsuccessful. In this regard, the applicants complained to the ECtHR, under Article 8, that \u2018by rejecting their civil claim against the ABC and the journalist, the domestic courts had failed to protect their right to their reputation, as they had not looked at the negative impact the publication had had on the applicants\u2019 professional lives; that the journalist had not acted with the required diligence; and that the publication could have contributed to the emergence of hate speech\u2019. The Court found no violation. The Court highlighted the need to balance the applicants\u2019 Article 8 rights with the media\u2019s Article 10 rights and recalled general factors to be taken into account when conducting such a balancing. In this regard, the Court considered, in particular, the following factors in the case: \u2018how well known the applicants were and their prior conduct\u2019 \u2013 recognising the applicants were not public figures; \u2018the content and form of the publication and the manner in which the relevant information was obtained\u2019 \u2013 highlighting the dangers of courts imposing overly strict requirements on journalistic expression and recognising that the journalist\u2019s expressions had a \u2018sufficiently close connection with the facts of the case\u2019 and could not \u2018be regarded as misleading or as a gratuitous attack\u2019; and \u2018the consequences of the publication\u2019 \u2013 highlighting that the applicants continued to work in the relevant area following publication. On the basis of this consideration, the Court concluded that \u2018the domestic courts acted within their margin of appreciation when seeking to establish a balance between the applicants\u2019 rights under Article 8 and the newspaper\u2019s opposing right to freedom of expression under Article 10\u2019. The Court thus considered \u2018that the national courts conducted the required balancing exercise between the competing rights at stake in conformity with the criteria laid down in the Court\u2019s case\u2011law, and it\u2019 discerned \u2018no strong reasons to substitute its view for that of the domestic courts\u2019. On 8th January, the ECtHR ruled in the case of Tafzi El Hadri and El Idrissi Mouch v. Spain. In terms of the facts, the case concerned, in essence, two individuals \u2013 the applicants \u2013 who were working at a centre for the education of minors in Spain. A large national newspaper \u2013 ABC \u2013 published \u2018an article \u201cCentres for minors, seedbeds of fundamentalism\u201d (Los centros de menores, semilleros del integrismo) in its online edition and\u2026its print edition\u2019. In this article, a relationship was drawn between the work in the centres and Islamic fundamentalism, and the applicants were mentioned by name. Following this, the applicants initiated, at the national level, criminal, civil and constitutional procedures in relation to the damage the article caused to their reputations. All proceedings were unsuccessful. In this regard, the applicants complained to the ECtHR, under Article 8, that \u2018by rejecting their civil claim against the ABC and the journalist, the domestic courts had failed to protect their right to their reputation, as they had not looked at the negative impact the publication had had on the applicants\u2019 professional lives; that the journalist had not acted with the required diligence; and that the publication could have contributed to the emergence of hate speech\u2019. The Court found no violation. The Court highlighted the need to balance the applicants\u2019 Article 8 rights with the media\u2019s Article 10 rights and recalled general factors to be taken into account when conducting such a balancing. In this regard, the Court considered, in particular, the following factors in the case: \u2018how well known the applicants were and their prior conduct\u2019 \u2013 recognising the applicants were not public figures; \u2018the content and form of the publication and the manner in which the relevant information was obtained\u2019 \u2013 highlighting the dangers of courts imposing overly strict requirements on journalistic expression and recognising that the journalist\u2019s expressions had a \u2018sufficiently close connection with the facts of the case\u2019 and could not \u2018be regarded as misleading or as a gratuitous attack\u2019; and \u2018the consequences of the publication\u2019 \u2013 highlighting that the applicants continued to work in the relevant area following publication. On the basis of this consideration, the Court concluded that \u2018the domestic courts acted within their margin of appreciation when seeking to establish a balance between the applicants\u2019 rights under Article 8 and the newspaper\u2019s opposing right to freedom of expression under Article 10\u2019. The Court thus considered \u2018that the national courts conducted the required balancing exercise between the competing rights at stake in conformity with the criteria laid down in the Court\u2019s case\u2011law, and it\u2019 discerned \u2018no strong reasons to substitute its view for that of the domestic courts\u2019.<\/p>\n","protected":false},"excerpt":{"rendered":"

-CJEU Dismisses Access to Personal Data Claim against EPSO- On 3rd December, the CJEU ruled […]<\/p>\n","protected":false},"author":144,"featured_media":84640,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[],"class_list":["post-84626","dpi","type-dpi","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/84626","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=84626"}],"version-history":[{"count":1,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/84626\/revisions"}],"predecessor-version":[{"id":84637,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/84626\/revisions\/84637"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media\/84640"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=84626"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=84626"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=84626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}