In a judgment of 24 November 2011, the Court of Justice of the EU (the “ECJ”) interpreted Article 7 (f) of Directive 95/46 of 24 October 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data (the “Data Protection Directive”). Under this provision, the processing of personal data is permitted if it is necessary to pursue a legitimate interest of the data controller or a third party, except where such an interest is overridden by the fundamental rights and freedoms of the data subject. The ECJ basically held that Article 7 (f) of the Data Protection Directive precludes national rules that limit the scope of this provision to data in public sources.
The ECJ judgment provides guidance to the Spanish Tribunal Supremo (“Supreme Court”). The Supreme Court had referred two preliminary questions to the ECJ in two sets of proceedings brought against the Spanish administration by, in the first case, Asociación Nacional de Establecimientos Financieros de Crédito (National Association of Credit Institutions – “ASNEF’”) and, in the second case, Federación de Comercio Electrónico y Marketing Directo (Federation of Electronic Commerce and Direct Marketing – “FECEMD”).
Both cases relate to the Spanish law implementing Article 7 (f) of the Data Protection Directive, which sets out the cases in which processing of personal data can be regarded as being lawful. Pursuant to Article 7 (f) of the Data Protection Directive, Member States will provide that personal data may be processed if: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interest are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1)”. In other words, Article 7 (f) of the Data Protection Directive permits the processing of personal data to pursue a legitimate interest. However, this legitimate interest must be balanced against the need to protect the fundamental rights (including the right to privacy) of the individuals concerned.
Under the Spanish law implementing Article 7 (f) of the Data Protection Directive and in the absence of the data subject’s consent, the processing of personal data to pursue a legitimate interest is only permitted if the data are included in public sources. ASNEF and FECEMD claimed that this condition does not feature in the Data Protection Directive
The ECJ observed that the Data Protection Directive seeks to ensure that the level of protection of rights and freedoms of individuals with regard to the processing of personal data is equivalent in all Member States. Accordingly, it held that the harmonisation of national laws is not limited to minimal harmonisation but amounts to harmonisation that is generally complete.
In this regard, the ECJ clarified that Article 7 of the Data Protection Directive sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful. Member States cannot therefore add new principles relating to the lawfulness of the processing of personal data to Article 7 of the Data Protection Directive or impose additional requirements that have the effect of amending the scope of one of the principles referred to in this Article. On the other hand, national measures which provide for a mere clarification of one of those principles are permitted.
In the case at hand, the ECJ held that it would not be a mere clarification if national rules excluded in a categorical and generalised way any processing of data not appearing in public sources. With respect to the second question that was referred to it, the ECJ held that Article 7 (f) of the Data Protection Directive has direct effect and can be relied upon by an individual and applied by national courts.
This judgment clearly limits the margin of discretion that Member States have in implementing Article 7 of the Data Protection Directive. In particular they must not overstep the thin line between clarification on the one hand and providing for additional requirements amending the scope of the principles on the other hand.
