The ECJ has ruled on the interpretation and scope of Article 12(a) of the Data Protection Directive (the Directive).
Member States must ensure a right of access for data subjects to information about who their personal data has been disclosed to and exactly what has been disclosed not only in respect of the present but also in respect of the past (Disclosure Data).
It is for Member States to fix time limits for storage of that Disclosure Data and to provide access to that Disclosure Data balancing the interest of the data subject in protecting his privacy against the burden of storing that Disclosure Data on the data controller.
Article 12 of the Data Protection Directive covers the right of access to Disclosure Data and states: “Member States shall guarantee every data subject the right to obtain from the controller:
(a) without constraint at reasonable intervals and without excessive delay or expense:
- confirmation as to whether or not data relating to him are being processed and information at least as to the purpose of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed;”
Article 6(1)(e) of the Directive requires Member States to ensure that personal data is kept no longer than is necessary for the purposes for which the data was collected or for which it is further processed.
In a recent Dutch case, Mr Rijkeboer requested from the upper council of Rotterdam all instances in which data relating to him from local authority personnel records had, in the two years preceding the request, been disclosed to third parties. He wished to know the identity of those third parties and the content of the data disclosed to them. The council responded to his request but only provided information in relation to one year preceding his request. The reason for this was that the council, in accordance with Dutch law, had automatically erased the Disclosure Data requested by Mr Rijkeboer which was dated more then one year prior to his request.
The Dutch court made a reference to the ECJ asking whether the law permitting erasure of Disclosure Data which had the effect of restricting data subjects to information relating only to the preceding year and prohibiting access to information for years prior to that was compatible with Article 12 and Article 6(1)(e) of the Directive.
The ECJ decided that the right given in Article 12(a) must, by necessity, relate to the past as the opposite conclusion would hamper a data subject’s ability to exercise the rights given to him under the Directive. Therefore, Member States in implementing the Directive must ensure that data subjects are able to access Disclosure Data relating to the past as well as the present. The ECJ said that the following factors would be relevant in assessing how far back into the past Member States were obliged to allow data subjects to go when requesting Disclosure Data:
- the relevant provisions of national law on the time limits of bringing an action;
- the sensitivity of the basic data;
- the length of time for which data was to be stored; and
- the number of recipients of the data.
Member States must strike a fair balance between, on the one hand, the interest of the data subject in protecting his privacy and, on the other hand, the burden which the obligation to store the Disclosure Data represented for the data controller.
In this particular case the ECJ found that the Dutch law limiting storage of Disclosure Data to a period of one year and correspondingly limiting the data subject’s access to that data, while storing personal data about the data subject for a much longer period, did not constitute a fair balance. However, it was for national courts to make relevant determinations.
Although this ruling places an obligation on the national courts to consider and apply Article 12(a) on a case by case basis, it has confirmed that the right of access to Disclosure Data applies both in the past and in the present. The national courts must determine what is the appropriate cut off point. Data controllers should note this ruling and ensure that they retain Disclosure Data for a reasonable period to avoid falling foul of the Directive.