OPINION OF ADVOCATE GENERAL
CRUZ VILLALÓN
delivered on 9 July 2015 (1)
Case C‑201/14
Smaranda Bara and Others
v
Președintele Casei Naționale de Asigurări de Sănătate,
Casa Naţională de Asigurări de Sănătate,
Agenţia Naţională de Administrare Fiscală (ANAF)
(Request for a preliminary ruling from the Curtea de Apel Cluj (Romania))
(Reference for a preliminary ruling — Economic and monetary policy — Article 124 TFEU — Privileged access to financial institutions — Provision inapplicable to dispute in main proceedings — Manifest inadmissibility — Approximation of laws — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data — Article 7 — Criteria for making data processing legitimate — Articles 10 and 11 — Consent from and information to be given to the data subject — Article 13 — Exemptions and restrictions — National legislation concerning qualification as an insured person — Protocol for the transfer between two public institutions of personal data relating to the income of the data subjects)
1. To what extent and in what manner are the public institutions of a Member State authorised, when exercising their state prerogatives, to share with each other the personal data of individuals whom they administer, in particular data relating to the income of those individuals, which they have collected in order to fulfil their tasks carried out in the general interest? That is, in essence, the principal question raised in the dispute in the main proceedings and which requires the Court to interpret various provisions of Directive 95/46/EC. (2)
2. More specifically, this case provides the Court with the opportunity to examine the conditions governing the transmission of personal data from one authority to another under Directive 95/46, by clarifying the obligations on the public bodies involved in that transfer and also on the national legislature required to regulate these practices, in particular in relation to the provision of information to the data subjects.
I – Legal context
A – EU law
3. The principal provisions of Directive 95/46 which seem relevant to resolving the dispute in the main proceedings are Articles 7, 10, 11 and 13. The other relevant provisions will be cited in so far as is necessary in the course of my reasoning.
4. Article 7 of Directive 95/46 provides:
‘Member States shall provide that personal data may be processed only if:
(a) the data subject has unambiguously given his consent; or
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or
(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or
(d) processing is necessary in order to protect the vital interests of the data subject; or
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; or
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1(1).’
5. Article 10 of Directive 95/46 states:
‘Member States shall provide that the controller or his representative must provide a data subject from whom data relating to himself are collected with at least the following information, except where he already has it:
(a) the identity of the controller and of his representative, if any;
(b) the purposes of the processing operation for which the data are intended;
(c) any further information such as
– the recipients or categories of recipients of the data,
– whether replies to the questions are obligatory or voluntary, as well as the possible consequences of failure to reply,
– the existence of the right of access to and the right to rectify the data concerning him
insofar as such further information is necessary, having regard to the specific circumstances in which the data are collected, to guarantee fair processing in respect of the data subject.’
6. Article 11 of Directive 95/46 provides:
‘1. Where the data have not been obtained from the data subject, Member States shall provide that the controller or his representative must at the time of undertaking the recording of personal data or if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide the data subject with at least the following information, except where he already has it:
(a) the identity of the controller and of his representative, if any;
(b) the purposes of the processing;
(c) any further information such as:
– the categories of data concerned,
– the recipients or categories of recipients,
– the existence of the right of access to and the right to rectify the data concerning him
in so far as such further information is necessary, having regard to the specific circumstances in which the data are collected, to guarantee fair processing in respect of the data subject.
2. Paragraph 1 shall not apply where, in particular for processing for statistical purposes or for the purposes of historical or scientific research, the provision of such information proves impossible or would involve a disproportionate effort or if recording or disclosure is expressly laid down by law. In these cases Member States shall provide appropriate safeguards.’
7. Article 13(1) of Directive 95/46 states:
‘1. Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary measures to safeguard:
(a) national security;
(b) defence;
(c) public security;
(d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;
(e) an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters;
(f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e);
(g) the protection of the data subject or of the rights and freedoms of others.’
B – National law
8. It is apparent from the order for reference that it is Law No 95/2006 on the reform of the health sector and Order No 617 of the Director of the National Health Insurance Fund (3) of 13 August 2007, (4) enacted in implementation of that law, that form the legal context governing the acquisition of the status of insured person for Romanian nationals resident in Romania as well as foreign nationals and stateless persons who have applied for and been granted an extension of the right to temporary residence or are habitually resident in Romania, and the obligations those persons are under to pay health insurance contributions.
9. The referring court explains that the above two measures empower the State institutions to communicate to the CNAS the information necessary for determining whether such persons qualify as insured persons under the health insurance scheme. Article 315 of Law No 95/2006 provides in that regard:
‘The data necessary to certify that the person concerned qualifies as an insured person are to be communicated free of charge to the health insurance funds by the authorities, public institutions or other institutions in accordance with a protocol.’
10. By a protocol concluded on 26 October 2007 and numbered P 5282/26.10.2007/95896/30.10.2007, (5) the Agenţia Naţională de Administrare Fiscală (National Tax Administration Agency) (6) and the CNAS determined the procedure for transmission of the relevant data. Article 4 of the Protocol of 26 October 2007 provides:
‘After the entry into force of this Protocol, [the ANAF], via its subordinated specialist units, shall provide in electronic format the original database concerning:
(a) the income of persons forming part of the categories identified in Article 1(1) of this Protocol and, on a three-monthly basis, the updated version of that database, to [the CNAS], by means compatible with automated processing, in accordance with Annex I to this Protocol …’.
II – The dispute in the main proceedings
11. The applicants in the main proceedings are persons earning income through self-employment who were issued with demands from the health insurance fund for Cluj (Romania) to pay contributions to the joint national health insurance fund, those demands being based on data about their income supplied to the CNAS by the ANAF.
12. The applicants are contesting before the referring court the various administrative measures on the basis of which the ANAF transmitted to the CNAS the data necessary to formulate those demands, in particular data relating to their income. They maintain that the transfer of their personal data by the ANAF to the CNAS constitutes an infringement of Directive 95/46. According to the applicants, those data were transmitted and used for purposes other than those for which they had initially been disclosed to the CNAS, on the basis of a simple internal protocol, without the applicants’ express consent and without their prior notification.
13. The referring court states that the Romanian legislation provides in a strict and limitative way for the transmission of the data necessary to certify that a person qualifies as an insured person, that is to say, his personal identification details (surname, first name, identification number, habitual or ordinary residence in Romania) and therefore excludes data about income earned in Romania.
III – The questions referred and the procedure before the Court
14. It was in that context that, by order of 31 March 2014, the Curtea de Apel Cluj (Court of Appeal, Cluj, Romania) decided to stay proceedings and to refer the following four questions to the Court for a preliminary ruling:
‘(1) Is a national tax authority, as the body representing the competent ministry of a Member State, a financial institution within the meaning of Article 124 TFEU?
(2) Is it possible to make provision, by means of a measure akin to an administrative measure, namely a protocol concluded between the national tax authority and another State institution, for the transfer of the database relating to the income earned by the citizens of a Member State from the national tax authority to another institution of the Member State, without giving rise to a measure establishing privileged access, as defined in Article 124 TFEU?
(3) Is the transfer of the database, the purpose of which is to impose an obligation on the citizens of the Member State to pay social security contributions to the Member State institution for whose benefit the transfer is made, covered by the concept of prudential considerations within the meaning of Article 124 TFEU?
(4) May personal data be processed by authorities for which such data were not intended where such an operation gives rise, retroactively, to financial loss?’
15. Written observations were submitted to the Court by the CNAS, by the Romanian and Czech Governments and by the European Commission.
16. The Court also invited the parties entitled to present observations under Article 23 of the Statute of the Court of Justice of the European Union stating their position at the hearing on three points: the extent of the obligations imposed by Directive 95/46 on the ANAF as the supplier of the data transferred and also on the CNAS as recipient of those data; the relevance of Article 13 of Directive 95/46 for the purposes of the interpretation sought by the referring court; and the criteria on the basis of which the Protocol of 26 October 2007 between the CNAS and the ANAF could constitute a ‘legislative measure’ within the meaning of Article 13 of Directive 95/46.
17. The applicants in the main proceedings, the Romanian Government and the Commission presented oral observations and responded to questions raised by the Court at the public hearing held on 29 April 2015.
IV – Admissibility of the questions referred
18. All the parties who presented observations to the Court are in agreement that the first three questions raised by the referring court, concerning the interpretation of Article 124 TFEU, should be found inadmissible to the extent that that primary law provision has no connection with the object of the dispute in the main proceedings and therefore does not apply to the case in the main proceedings.
19. In this instance, Article 124 TFEU, which forms part of the chapter of the treaty dealing with economic policy, prohibits any measure establishing privileged access for Member States to financial institutions. That provision, which submits public sector financing to market discipline and so makes a contribution to the strengthening of budgetary discipline, (7) together with Articles 123 and 125 TFEU, pursues an objective which is preventive in nature and which, as the Court has made clear, aims to reduce so far as possible the risk of public debt crises . (8)
20. Article 1(1) of Regulation No 3604/93 defines the concept of ‘any measure establishing privileged access’ as any law, regulation or any other binding instrument adopted in the exercise of public authority which either obliges financial institutions to acquire or to hold liabilities of, inter alia, central governments, regional, local or other public authorities, other bodies governed by public law or public undertakings of Member States, or confers tax advantages which may benefit only financial institutions or financial advantages which do not comply with the principles of a market economy, in order to encourage the acquiring or the holding by those institutions of such liabilities.
21. It is therefore obvious that the situation at issue in the main proceedings and, more particularly, access by the CNAS to the data collected by the ANAF, cannot be considered as ‘privileged access’ to ‘financial institutions’, (9) and indeed this is not even mentioned in the order for reference.
22. Thus it is clear that Article 124 TFEU is of no application to the dispute in the main proceedings and that the first three questions posed by the referring court must, therefore, be rejected as inadmissible.
23. Turning to the referring court’s fourth question, it must be noted that the question is phrased in very general terms, does not mention which provisions of EU law are required to be interpreted in order for the dispute in the main proceedings to be resolved and does not include a succinct presentation of the legal and factual background to the dispute in the main proceedings, so that it might be considered appropriate to reject this question also for inadmissibility.
24. The Romanian Government submits that it can see no link between the damage alleged by the applicants in the main proceedings, resulting from the processing of the data at issue in the main proceedings, and the annulment of the administrative measures sought under those proceedings.
25. It is certainly the case that the referring court’s reference to financial loss retrospectively caused to the data subjects by the transfer is, as becomes apparent from an examination of the substance of the fourth question, irrelevant for the purposes of examining the compatibility of the national legislation with the requirements of Directive 95/46.
26. However, it is obvious from the order for reference that the fourth question concerns the interpretation of the provisions of Directive 95/46. The referring court states that it wishes to know, first, with implicit reference to the situation covered by Article 11 of Directive 95/46, whether, when processing the personal data obtained by the ANAF, the CNAS complied with the information obligations falling upon it. The referring court states, secondly, that it wishes to know whether the transmission of the personal data on the basis of the Protocol of 26 October 2007 constitutes a breach of the obligation on a Member State to guarantee that data of a personal nature are processed in compliance with the provisions of Directive 95/46, referring, again implicitly, to Article 13 of that directive, which allows the rights guaranteed by the directive to be restricted as long as they are provided for by legislation and accompanied by legal safeguards.
27. This line of questioning set out by the referring court therefore enables the question of interpretation of Directive 95/46 arising from the dispute in the main proceedings to be sufficiently identified.
28. It should be recalled that it is settled case-law that the Court may refuse to rule on a question referred for a preliminary ruling by a national court only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the facts of the main action or its object, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it. (10)
29. Accordingly, it is my opinion that the fourth question referred by the referring court for a preliminary ruling is admissible and should be examined.
V – The fourth question
30. By its fourth question, read in the light of the explanations supplied in the order for reference and the reasoning set out above, the referring court is, in essence, asking whether Directive 95/46 must be interpreted as precluding national legislation which allows a public institution of a Member State to process personal data of which it was not the recipient, in particular data relating to the income of the data subjects, where those data subjects have neither given their consent to nor been given prior notice of that processing.
A – Summary of observations presented to the Court
31. At the hearing, the applicants in the main proceedings submitted that the referring court was essentially seeking to determine to what extent the national administrative practice, reflected in the present case by the Protocol of 26 October 2007 and consisting of an automatic and repeated transmission by the ANAF to the CNAS of personal data, including taxation data, of certain categories of taxpayers (surname, first name, categories of income and tax paid), is compatible with the procedural requirements provided for by Directive 95/46.
32. In response to questions raised by the Court, the applicants in the main proceedings maintain that it is Article 11 of Directive 95/46 that applies to the case in the main proceedings. They submit that that article defines the obligations on the primary controller (the ANAF) and the secondary controller (the CNAS) of the processing of the personal data, in this instance the obligation to inform the data subjects, inter alia, of the identity of the controller of the secondary processing, the purposes of processing the data transmitted and the categories of data transmitted. Those obligations, which must be fulfilled no later than the time when the data are first disclosed, fall principally on the controller of the secondary processing.
33. In that context, the applicants in the main proceedings maintain that there is an inconsistency in the Protocol of 26 October 2007 in that, on the one hand, Article 4 of the protocol provides for the transmission of general databases as updated periodically while, on the other hand, Article 6(1) of the protocol provides that the data must be transferred individually on the basis of a report. They maintain that, in reality, under national practice, such reports do not exist, transfers taking place automatically in breach of these procedural requirements.
34. The applicants in the main proceedings also submit that Article 13 of Directive 95/46 has no bearing on the resolution of the dispute in the main proceedings since the CNAS did not have the power to determine the contributions to the health insurance fund. The transmission of the data was therefore not necessary, except in respect of a small category of taxpayers whose obligation to contribute had been established but who had not voluntarily met that obligation.
35. However, the applicants in the main proceedings assert that, if the Court should find Article 13 of Directive 95/46 to be applicable, it would then be for the ANAF and the CNAS to justify the need to transmit the data at issue and, therefore, to establish the existence of a legislative measure authorising that transmission without the consent of the data subjects. According to the applicants in the main proceedings, such a legislative measure does not exist and the Protocol of 26 October 2007 cannot take the place of one. As the protocol was never published in the Official Journal, it does not meet the requirements of foreseeability and legal certainty and therefore cannot produce an erga omnes effect.
36. In its written observations, which were in essence shared by the CNAS, the Romanian Government submitted, firstly, that the transmission from the ANAF to the CNAS of information relating to income from independent activities was provided for by law and was necessary for the CNAS to fulfil its mission and, secondly, that the processing of that information by the CNAS was necessary to comply with a legal obligation to which it was subject for the purposes of Article 7 of Directive 95/46. As a consequence, neither the consent of the data subjects nor the provision of information to the data subjects, under Articles 10 and 11 of Directive 95/46, was required.
37. At the hearing, the Romanian Government stressed that the transmission and processing of the personal data at issue fell within the context of the obligations to collaborate imposed on public institutions by the Romanian Code of Fiscal Procedure, in particular by Articles 11 and 62 of that code. In that regard, the Protocol of 26 October 2007 does not constitute the legal basis for those obligations, but simply governs the means of transferring the data from the ANAF to the CNAS. According to the Romanian Government, those obligations to transmit fiscal information, which arise only between public institutions and the sole purpose of which is to establish the amount of tax and the contributions due, including contributions to health insurance, therefore pursue a legitimate aim of protecting financial interests under Article 13(1)(e) of Directive 95/46. Consequently, it is unnecessary to inform the data subjects.
38. The Czech Government submits principally that the transmission of the data at issue from the ANAF to the CNAS may occur without the consent of the data subjects pursuant to Article 7(e) of Directive 95/46 and without the need to inform them, because of the exceptions referred to in Article 11(2) and Article 13 of that directive. In addition, according to the Czech Government, nothing in that directive requires that the transmission of personal data between public institutions is specifically provided for by a provision of general application.
39. In its written observations, the Commission stated firstly that the data at issue in the case in the main proceedings are personal data within the meaning of Article 2(a) of Directive 95/46, that the two national institutions in question, the ANAF and the CNAS, could be classified as controllers of the processing of the data, within the meaning of Article 2(d) of that directive, and that both the collection and the transmission of those data qualify as ‘processing of personal data’ within the meaning of Article 2(b) of the directive.
40. Also in its written observations, the Commission proposed that the Court should rule that Article 6 and 7 of Directive 95/46 must be interpreted as not precluding the transmission of the data relating to income at issue in the main proceedings, provided that the transmission is carried out on the basis of clear and precise legal provisions the application of which is foreseeable by the data subjects, which is a matter for the referring court to verify.
41. Nevertheless, the Commission expanded on this conclusion in its oral observations, through its responses to the questions for the hearing raised by the Court. In essence, the Commission submitted that the conditions relating to consent from and information to be given to the data subjects, to which the collection, transmission and processing of personal data are subject by virtue of the combined provisions of Article 7, 10, 11 and 13 of Directive 95/46, are not fulfilled in the circumstances of the case in the main proceedings; in any event, the national legislation, and in particular the Protocol of 26 October 2007 concluded between the ANAF and the CNAS does not meet the requirements of Article 13 of that directive, as interpreted in the light of Articles 8 and 52 of the Charter of Fundamental Rights of the European Union (‘the Charter’) and of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950.
42. The Commission also submits that Directive 95/46 is based on the principle that, in relation to the processing of personal data about him, the data subject must have knowledge, on the basis of clear, precise and foreseeable legal provisions, of any restriction on the rights he has under Directive 95/46. According to the Commission, the transmission of the data at issue in the main proceedings occurred on the basis of a simple protocol of cooperation between the two institutions, which itself was based on a provision of Law No 95/2006, which provision, in referring to the data necessary to certify that the person concerned qualifies as an insured person, does not fulfil those requirements for clarity.
43. In considering the various questions for oral answer posed by the Court, the Commission states that both the ANAF and the CNAS should have provided the data subjects with the information required by Article 10 and 11 respectively of Directive 95/46 since the Romanian legislation did not fulfil the requirements permitting derogation from those obligations.
44. The Commission asserts, first, that the Romanian legislation does not appear to fulfil the conditions set out in Article 11(2) of Directive 95/46, which provides that Article 11(1) of the directive shall not apply where recording or disclosure is expressly laid down by national law, but would refer the matter back to the national court for examination.
45. The Commission then submits that any restriction on the data subject’s right of access to data under Articles 10 and 11 of Directive 95/46 must, in accordance with Article 13 of that directive, be contained in a legislative measure, pursue one of the public interest objectives listed in the article and be proportionate. The Romanian legislation contains nothing to permit such an exception, since the provision allowing the transmission of data from the ANAF to the CNAS cannot be regarded as clearly indicating that the data subjects will not be kept informed in that regard.
46. In that regard, the Commission maintains that the Protocol of 26 October 2007 concluded between the ANAF and the CNAS, which governs the transmission of information between the two institutions but which does not include any provisions dealing with keeping the data subjects informed, cannot be considered a legislative measure within the meaning of Article 13 of Directive 95/46. It is a simple bilateral agreement, not published in the Official Journal, which has no binding legal effect and is not valid vis-à-vis third parties. According to the Commission, in that regard Article 13 of Directive 95/46 reflects the provisions of Article 52(1) of the Charter and of Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms in the specific area of the protection of personal data and should therefore be interpreted in the light of the relevant case-law of the Court of Justice and of the European Court of Human Rights.
47. In any event, even supposing that the Romanian legislation could be held to contain the required legal exception, the restriction on keeping the data subjects informed needs to fulfil the criterion of necessity and needs to be in proportion. Even if it can be accepted that the functioning of the public health insurance service is an objective in the public interest for the purpose of Article 13 of Directive 95/46, and that the transmission of the data from the ANAF to the CNAS is intended to serve that objective, it is, on the other hand, difficult to see why it would be necessary to omit to inform the data subjects, since informing them would not jeopardise achievement of that objective.
B – The relevant principal provisions of Directive 95/46
48. In order to be able to provide an appropriate response to the referring court, it is necessary to start by recalling the principal rules laid down by Articles 5 to 7 and Articles 10 to 13 of Directive 95/46 which, to the extent that they govern the processing and the transmission of personal data, are relevant to resolution of the dispute in the main proceedings.
49. Under Article 5 of Directive 95/46, Member States are to determine the precise conditions under which the processing of personal data is lawful, within the limits of the provisions of Articles 6 to 21 of that directive.
50. As the Court has consistently observed, subject to the exceptions permitted under Article 13 of Directive 95/46, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and, secondly, with one of the criteria for making data processing legitimate listed in Article 7 of the directive. (11)
51. As far as the present case is concerned, Articles 6 and 7 of that directive define three initial requirements for the collection and processing of personal data.
52. The controller (12) must, inter alia, ensure that personal data are collected for specified, explicit and legitimate purposes, processed fairly and lawfully and not further processed in a way incompatible with those purposes. (13)
53. Article 7 of Directive 95/46 provides that the processing of personal data is legitimate, and may therefore be carried out, only if one of the situations listed applies and, in particular, as far as the present case is concerned, only if the data subject has unambiguously given his consent in that respect (14) or if the processing is necessary for compliance with a legal obligation to which the controller is subject (15) or if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed. (16)
54. The Court has held that that article sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful. (17) The Court has also stated that, having regard to the objective of Directive 95/46 of ensuring an equivalent level of protection in all Member States, the concept of necessity laid down by Article 7(e) of that directive cannot have a meaning which varies between the Member States and is therefore a concept which has its own independent meaning in EU law. (18)
55. Articles 10 and 11 of Directive 95/46 define the information obligations on the controller of the processing of personal data, distinguishing cases where data are collected from the data subject from those where data are not collected from the data subject.
56. Article 10 of Directive 95/46, read in the light of Recital 38 of the preamble to the directive, therefore provides that, unless they already have the relevant information, the persons from whom the controller has collected the data must be provided with information concerning the existence of the processing and be given actual and complete information about the collection of the data and, in particular, for the processing to be considered as fair, information about the purposes of the processing for which the data are intended or the recipients or categories of recipients of the data, as referred to in (b) and (c) of Article 10.
57. Article 11(1) of Directive 95/46, read in the light of Recitals 39 and 40 of the directive, deals with situations in which the processing relates to data not obtained from the data subjects, in particular where the data have been legitimately disclosed to a third party but that disclosure was not anticipated at the time of the collection. (19) In such cases, unless they already have the relevant information, the data subjects must be provided with information, inter alia, about the purposes of the processing, the categories of data concerned and the recipients or categories of recipients of the data, as referred to in (b) and (c) of Article 11(1), at the time when the data are recorded or, if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed.
58. However, under Article 11(2) of the directive, the provisions of Article 11(1) shall not apply where, inter alia, recording or disclosure of the data is expressly laid down by law. In such cases, Member States are under an obligation to provide appropriate safeguards.
59. Finally, Article 13 of Directive 95/46, headed ‘Exemptions and restrictions’, provides that Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in, inter alia, Article 6(1) and Article 11(1) of that directive when such a restriction constitutes a necessary measure to safeguard superior interests and, in particular, ‘an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters’ (20) or ‘a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e)’ of Article 13(1) of that directive. (21)
60. The situation at issue in the main proceedings must now be examined in the light of all these provisions.
C – Classification of the situation in the main proceedings with regard to Directive 95/46
61. First of all, the data at issue in the case in the main proceedings, transmitted from the ANAF to the CNAS, must be held to constitute personal data within the meaning of Article 2(a) of Directive 95/46. Those data, which comprise inter alia the surname and first name of the data subjects (22) and details of their income, (23) undeniably constitute ‘information relating to an identified or identifiable natural person’. Transmission of the data by the ANAF and processing of the data by the CNAS constitute the processing of personal data within the meaning of Article 2(b) of that directive.
62. It is also undisputed that the situation at issue in the main proceedings falls within the scope of Directive 95/46.
63. The situation at issue in the main proceedings may also fall within the scope of Article 10 as well as that of Article 11 of Directive 95/46. It is apparent from the above reasoning that fair processing of the personal data relating to the applicants in the main proceedings would involve the ANAF informing them, in particular, of the transmission of the data to the CNAS, pursuant to Article 10(c) of Directive 95/46. In addition, processing by the CNAS of the data transmitted by the ANAF would also involve the applicants in the main proceedings being informed, at the very least, of the purposes of the processing and of the categories of data concerned, in accordance with Article 11(1)(b) and (c) of Directive 95/46.
64. Secondly, it must be noted that the question raised by the referring court (24) does not relate to the processing by the ANAF of the personal data at issue in the main proceedings, more specifically to the conditions for that processing to be lawful and legitimate for the purposes of Articles 6 and 7 of Directive 95/46.
65. The question deals only with the transmission of data from one public institution to another, more specifically with the transmission of the data collected by the ANAF to the CNAS and the processing of those data by the CNAS, operations which were apparently undertaken in the absence of any consent from the data subjects and without the data subjects being informed, carried out pursuant to national legislation which fails to meet the requirements of Directive 95/46 and specifically the obligations to inform the data subjects under Articles 10 and 11 of Directive 95/46.
66. The fourth question raised by the referring court, which must be examined as much from the point of view of the obligations on the ANAF as from that of the obligations on the CNAS, must therefore be considered with regard, first, to the provisions of Article 7, 10 and 11 of Directive 95/46 and the conditions for consent from and information given to the subjects of the data processing in question contained in those provisions. It must also be examined, if appropriate, with regard to the provisions of Article 13 of that directive, which defines the exemptions and restrictions on the extent of the obligations and rights provided, in particular, in Article 10 and Article 11(1) of that directive.
D – Compliance with the requirements to inform the data subjects prescribed by Article 10 and 11 of Directive 95/46
67. It is not disputed that the applicants in the main proceedings and, more broadly speaking, the data subjects of the transmission by the ANAF of the personal data that it had collected to the CNAS and of the processing by the CNAS of those data, were not informed of that transmission by the ANAF as required by Article 10 of Directive 95/46. Neither did those persons formally consent, for the purposes of Article 7(a) of Directive 95/46, to that processing by the CNAS; nor were they informed of the processing as required by Article 11(1) of that directive.
68. In the matter of consent, it seems clear that, as the Romanian Government and the CNAS submit, the processing by the CNAS of the personal data relating to persons earning income through self-employment falls within the provisions of Article 7(e) of Directive 95/46. Consequently, the consent of those individuals was not required. (25)
69. In this instance, the CNAS has an obligation, under Law No 95/2006, to determine whether persons earning income through self-employment qualify as insured persons, recognition of that status being conditional on the payment by those persons of their contributions to the local health insurance funds. Processing by the CNAS of the personal data of persons earning income through self-employment transmitted to it by the ANAF is, therefore, necessary in order to determine whether they qualify as insured persons and, ultimately, to the entitlements arising from that status. Consequently, consent from the subjects of the processing of the personal data at issue in the main proceedings was not required.
70. However, it is for the referring court to verify that the data transmitted and processed by the CNAS fulfil the criterion of necessity provided for in that provision, by establishing that the data do not exceed what is strictly necessary in order for the CNAS to accomplish its mission. (26)
71. It is therefore essentially the question of compliance with the requirements to inform the data subjects in relation to the transmission by the ANAF of personal data, and the processing of these data by the CNAS, on the conditions laid down by Articles 10 and 11 of Directive 95/46, that requires consideration.
72. As has already been outlined above, the transmission by the ANAF to the CNAS of the personal data of persons earning income through self-employment and the processing of those data by the CNAS can be considered to fulfil the requirements of Directive 95/46 only if the data subjects have been informed of it pursuant to Article 10 and Article 11(1) of the directive.
73. More specifically, it is up to the Member State to provide for the necessary measures so that the required information is communicated to the data subjects by one or other of the two institutions who are both responsible for the processing of the personal data at issue in the main proceedings, namely the ANAF under Article 10 of Directive 95/46 and the CNAS under Article 11 of that directive, unless, in the latter case, registration or disclosure of the data have been provided for by law.
74. In that context, it should be pointed out that, as the Commission observed at the hearing, the requirement to inform the data subjects about the processing of their personal data, which guarantees transparency of all processing, is all the more important since it affects the exercise by the data subjects of their right of access to the data being processed, referred to in Article 12 of Directive 95/46, and their right to object to the processing of those data, set out in Article 14 of that directive.
75. In this instance, it is not disputed that the applicants in the main proceedings were not formally or individually notified by the ANAF of the transmission of their personal data to the CNAS, and in particular of the data relating to their income, as required by Article 10 of Directive 95/46. Neither is it disputed that, at the time of registration of the data transmitted by the ANAF, the CNAS did not supply them with the information listed in (a) to (c) of Article 11(1) of Directive 95/46.
76. However, the Romanian Government submits that, in accordance with various provisions of the Code of Fiscal Procedure and Article 315 of Law No 95/2006, the ANAF has an obligation to transmit to the local health insurance funds the information necessary for the CNAS to determine whether persons earning income through self-employment qualify as ‘insured persons’ and that the amount of contributions due from those persons can only be established on the basis of the information about that income held by the ANAF, with whom they have to file an annual declaration of income.
77. The Romanian Government maintains that the law therefore provides an obligation on the CNAS to process the personal data of persons earning income through self-employment, especially in order to initiate any forced recovery procedures for unpaid contributions, and that the ANAF has a corresponding obligation to supply information about the income of those persons necessary for that purpose, the actual manner of transmitting the information in question between the two institutions being governed by the Protocol of 26 October 2007 entered into by the two institutions, expressly provided for in Article 315 of Law No 95/2006.
78. In that regard, it must firstly be observed that the fact that the transmission of the data at issue takes place between public institutions in the performance of general duties of collaboration under the general provisions of Law No 95/2006 or the Code of Fiscal Procedure cannot, of itself, exempt the Member State or the institutions in question from the information obligations incumbent upon them under Directive 95/46.
79. In any event, Article 315 of Law No 95/2006 cannot be regarded as serving to inform the data subjects in advance for the purposes of Article 10 of Directive 95/46. Article 315 of Law No 95/2006 refers to information relating to qualifying as an insured person and makes no mention of the income of the persons concerned, who therefore cannot be regarded as informed about the transmission of the data relating to their income for the purposes of Article 10 of the directive.
80. The data relating to the income of the persons concerned are of sufficient significance as to warrant a specific notification of their transmission by the public institution collecting them to another public institution, pursuant to Article 10(b) and (c) of Directive 95/46. This did not occur in the case in the main proceedings.
E – Compliance with the restrictions in Article 13 of Directive 95/46
81. At this stage of the analysis of the situation in the main proceedings, all that remains is to examine whether failure to inform the data subjects could, alternatively, fall within the requirements of Article 13 of Directive 95/46, which gives Member States the possibility of establishing exemptions to and restrictions on the scope of the rights and obligations provided for in, inter alia, Article 10 and Article 11(1) of that directive while respecting guarantees corresponding to those in Article 52(1) of the Charter. (27) As a result of that provision, any restriction on the obligation to inform the data subjects must be provided for by a legislative measure, (28) be justified by one of the objectives of general interest referred to in that provision and be strictly in proportion to the objective pursued.
82. In this instance, it is not contested that the transmission by the ANAF of the data necessary for the CNAS to establish whether persons earning income through self-employment qualify as ‘insured persons’, together with the processing by the CNAS of the data thus transmitted, might prove necessary in order to safeguard an important economic or financial interest of a Member State within the field of taxation in the Member State in question, within the meaning of Article 13(1)(e) of Directive 95/46.
83. However, it is not apparent either from the order for reference or from the written and oral observations presented to the Court by the Romanian Government that the national legislation applicable in the case in the main proceedings contains legislative provisions that would exempt the ANAF and/or the CNAS clearly and explicitly from their obligations to provide information.
84. In that context, it is not possible to accept the argument put forward by the Romanian Government that the legal provisions obliging the ANAF to transmit to the CNAS the data necessary to fulfil its mission and the Protocol of 26 October 2007 entered into by the two institutions organising that transmission constitute the ‘legislative measure’ required by Article 13(1) of Directive 95/46 in order to create an exception to the obligation to provide information incumbent on the controller of the personal data.
85. The Protocol of 26 October 2007 quoted by the Romanian Government evidently does not, as the Commission points out, meet the first of those requirements, since it is not at all akin to a legislative measure of general scope, duly published and enforceable in relation to those persons who are the subjects of the transmission of the data at issue.
86. Consequently, I consider that the fourth question referred by the referring court for a preliminary ruling should be answered by finding that Directive 95/46 should be interpreted as precluding national legislation such as that at issue in the main proceedings that allows a public institution of a Member State to process personal data that have been transmitted to it by another public institution, in particular data relating to the income of the data subjects, without those data subjects being informed in advance of either the transmission or the data processing.
VI – Conclusion
87. In the light of all the above reasoning, I propose that the Court should respond to the questions referred by the Curtea de Apel Cluj as follows:
(1) The first three questions referred for a preliminary ruling concerning the interpretation of Article 124 TFEU are inadmissible.
(2) Directive 95/46 EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as precluding national legislation such as that at issue in the main proceedings that allows a public institution of a Member State to process personal data that have been transmitted to it by another public institution, in particular data relating to the income of the data subjects, without those data subjects being informed in advance of either the transmission or of the data processing.