I think the European Court of Justice (ECJ) has just issued a judgement which has the potential to be more important than Max Schrems v Facebook (due on October 6 next week).
The ECJ has just concluded that Articles 10, 11 (the fair processing requirements of Directive 95/45/EC) and Article 13 (includes the exemptions from the need to provide a fair processing notice) must be interpreted as precluding national measures which allow a public administrative body in a Member State to disclose personal data to another public administrative body for their subsequent processing, without the data subjects being informed of that disclosure and processing.
This judgment seems to imply that if a fair processing notice does not describe the purpose of the processing and there is no exemption from the fair processing obligation then a data controller should not process personal data for that purpose! Certainly, Government should not introduce data sharing legislation and ignore the fairness obligations under the Act (unless there is no applicable exemption from the fairness obligations). This is the position irrespective of an Article 7 criterion (i.e. a Schedule 2 ground in the UK Act) for the processing of personal data.
The Court agreed with the Advocate General that the requirement to inform the data subjects about the processing of their personal data is important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the personal data being processed (in Article 12 of Directive 95/46), and their right to object to the processing of those data (in Article 14 of the Directive).
According to the Court, it follows that the fair processing requirements of personal data as laid out in Article 6 of Directive 95/46/EC (i.e. the First Principle of the UK DP Act) “requires a public administrative body to inform the data subjects of the transfer of those data to another public administrative body for the purpose of their processing by the latter in its capacity as recipient of those data”.
The Court rejected the idea that because there was a law that allows the disclosure, then there was no need to provide a fair processing notice. The Court stated that only reason why one cannot provide a fair processing notice is when there is an exemption from the obligation consistent with the conditions laid down in Article 13 of Directive 95/46/EC (which permits Member States to derogate from fairness obligations flowing from Article 10).
That is why “Articles 10, 11 and 13 of Directive 95/46 must be interpreted as precluding national measures, such as those at issue in the main proceedings, which allow a public administrative body of a Member State to transfer personal data to another public administrative body and their subsequent processing, without the data subjects having been informed of that transfer or processing” (my emphasis).
Note that this judgment can be overturned if the Council of Minister’s version of Article 21 of the General Data Protection Regulation prevails. This allows Member State law to introduce an exemption from the fair processing notice with respect to “important objectives of general public interests of the Union or of a Member State”. As any government can argue that the reason for enacting any legislation is to meet “important objectives of general public interests”, then the Article 21 exception proposed by any Member State legislation can neuter this new ECJ Judgment.
This is the Third ECJ judgement that the Council of Minister’s version of the Regulation would overturn; it is yet another indication that the Directive 95/46/EC might offer better protection to data subjects than the Regulation.
References
Case C-201/14 Smaranda Bara and Others v Președintele Casei Naționale de Asigurări de Sănătate and Others: http://curia.europa.eu/juris/liste.jsf?num=C-201/14 (Sadly the English version of the Advocate General’s view is not available yet; I would really like to see what it says).
The above will be discussed at our all day UPDATE session (Oct 19th; London; £225). Also coming up are our Data Protection Practitioner courses leading to the BCS Qualification in Leeds (starting October 13th) and Edinburgh (starting 2nd Nov). All details on www.amberhawk.com.
My analysis of Article 21, and the other exemptions promoted in the Council of Minister’s version of Regulation, shows that if this text prevails the Regulation will weaken protection for data subjects. See end of http://amberhawk.typepad.com/amberhawk/2015/08/councils-exceptions-from-the-data-protection-regulation-degrade-the-privacy-protection-below-directive-9546ec.html.
The other two ECJ Judgments that are overturned by the Member State version of the Regulation: http://amberhawk.typepad.com/amberhawk/2015/07/council-of-ministers-regulation-text-negates-ecj-rulings-in-lindqvist-and-ryne%C5%A1.html.
Comments