On 27 September 2017, the European Court of Justice (“ECJ”) handed down its preliminary ruling to the Supreme Court of the Slovak Republic (“Supreme Court”) regarding the interpretation of “a task carried out in the public interest” as a legitimate basis for processing personal data under Article 7(e) of the Data Protection Directive (95/46/EC) (“Directive”) (Puskar v Finance Directorate of the Slovak Republic, Case C-73/16, 27 September 2017).
The ECJ ruling also considered: (i) an individual’s right to an effective remedy before a court, and (ii) the admissibility of evidence obtained unlawfully, under Article 47 of the Charter of Fundamental Rights of the European Union. In this blog, however, we will look at the ECJ’s interpretation of Article 7(e) of the Directive.
The request for a preliminary ruling of the ECJ was made by the Supreme Court following a dispute between Mr. Puškár and the Slovakian tax authorities.
Mr. Puškár sought a decision to prevent the tax authorities from including his personal information in a confidential list of so-called ‘front-men,’ prepared by the tax authorities for the purpose of collecting taxes and combatting fraud (“Contested List”), and to delete any reference to him in such lists. ‘Front-men’ are individuals who purport to act as ‘fronts’ in company director roles. Mr. Puškár argued that the Contested List was drawn up without a legal basis and that his personal data was processed without his consent.
The Supreme Court referred several questions to the ECJ, including whether the provisions of Article 7(e) of the Directive permits a Member State to process personal data (i.e. creating the Contested List) for the purpose of collecting tax and combatting tax fraud without the consent of the individuals concerned.
The ECJ held that “tasks carried out in the public interest” set out in Article 7(e) of the Directive does not preclude tax authorities from processing personal data for the purpose of collecting tax and combatting tax fraud, provided that the following conditions are met:
– The tax authorities must be required by national law to carry out such tasks in the public interest (within the meaning of Article 7(e));
– The drawing up of the Contested List and including names on it must be adequate and necessary to achieve the stated objectives and therefore must be sufficient indications to assume that individuals’ names are rightly included in that list; and
– All of the conditions for the lawfulness of processing, as set out in the Directive, must be satisfied.
The ECJ stressed the importance of respecting the principle of proportionality when determining whether the establishment of the Contested List is necessary to achieve the stated objectives. It further stated that “the protection of the fundamental right to respect for private life at the European Union level requires that derogations from the protection of personal data and its limitations be carried out within the limits of what is strictly necessary.” It therefore considered that it was the responsibility of the Supreme Court to determine whether this was adequate and necessary, and that there was no alternative, less restrictive way in which this aim could be achieved.
The ECJ also noted that given the fact that an individual is included in the Contested List is likely to infringe some of his rights, such infringement can only be proportionate if there are sufficient grounds to suspect the individual of an offence which warrants their inclusion on the Contested List.
The ECJ’s preliminary ruling is a useful reminder to organisations that even where they have a legitimate basis for processing personal data – such as tasks carried out in the public interest – they need to ensure that any processing is necessary and proportionate to achieve their stated purpose.
The ruling does not address the extent to which a private organisation might be able to rely Article 7(e) of the Directive, but we may see further guidance on how this applies under Article 6(e) of the General Data Protection Regulation (GDPR), or indeed clause 7 of the UK’s draft Data Protection Bill, as we move closer to May 2018.