JUDGMENT OF THE COURT (Grand Chamber)
1 August 2022 (*)
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 52(1) – Directive 95/46/EC – Article 7(c) – Article 8(1) – Regulation (EU) 2016/679 – Point (c) of the first subparagraph of Article 6(1) and the second subparagraph of Article 6(3) – Article 9(1) – Processing necessary for compliance with a legal obligation to which the controller is subject – Objective of public interest – Proportionality – Processing of special categories of personal data – National legislation requiring publication on the internet of data contained in the declarations of private interests of natural persons working in the public service or of heads of associations or establishments receiving public funds – Prevention of conflicts of interest and of corruption in the public sector)
In Case C‑184/20,
REQUEST for a preliminary ruling under Article 267 TFEU from the Vilniaus apygardos administracinis teismas (Regional Administrative Court, Vilnius, Lithuania), made by decision of 31 March 2020, received at the Court on 28 April 2020, in the proceedings
OT
v
Vyriausioji tarnybinės etikos komisija,
third party:
Fondas ‘Nevyriausybinių organizacijų informacijos ir paramos centras’,
THE COURT (Grand Chamber),
composed of K. Lenaerts, President, L. Bay Larsen, Vice-President, A. Arabadjiev, A. Prechal, K. Jürimäe, C. Lycourgos, N. Jääskinen, I. Ziemele and J. Passer, Presidents of Chambers, M. Ilešič (Rapporteur), J.‑C. Bonichot, A. Kumin and N. Wahl, Judges,
Advocate General: P. Pikamäe,
Registrar: A. Calot Escobar,
having regard to the written procedure,
after considering the observations submitted on behalf of:
– the Lithuanian Government, by K. Dieninis and V. Vasiliauskienė, acting as Agents,
– the Italian Government, by G. Palmieri, acting as Agent, and M. Russo, avvocato dello Stato,
– the Finnish Government, by M. Pere, acting as Agent,
– the European Commission, by S.L. Kalėda, H. Kranenborg and D. Nardi, acting as Agents,
after hearing the Opinion of the Advocate General at the sitting on 9 December 2021,
gives the following
Judgment
1 This request for a preliminary ruling concerns the interpretation of point (e) of the first subparagraph of Article 6(1) and Article 9(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
2 The request has been made in proceedings between OT and the Vyriausioji tarnybinės etikos komisija (Chief Official Ethics Commission, Lithuania) (‘the Chief Ethics Commission’) concerning a decision of the latter finding that OT had failed to fulfil his obligation to lodge a declaration of private interests.
Legal context
International law
United Nations Convention against Corruption
3 The United Nations Convention against Corruption, which was adopted by resolution 58/4 of the United Nations General Assembly of 31 October 2003 and entered into force on 14 December 2005, has been ratified by all the Member States and was approved by the European Union by Council Decision 2008/801/EC of 25 September 2008 (OJ 2008 L 287, p. 1).
4 Article 1 thereof states:
‘The purposes of this Convention are:
(a) to promote and strengthen measures to prevent and combat corruption more efficiently and effectively;
…
(c) to promote integrity, accountability and proper management of public affairs and public property.’
5 Article 7(4) of the convention provides:
‘Each State Party shall, in accordance with the fundamental principles of its domestic law, endeavour to adopt, maintain and strengthen systems that promote transparency and prevent conflicts of interest.’
Criminal Law Convention on Corruption
6 The Criminal Law Convention on Corruption, which was adopted by the Council of Europe on 27 January 1999 and has been ratified by all the Member States, states in its fourth recital:
‘Emphasising that corruption threatens the rule of law, democracy and human rights, undermines good governance, fairness and social justice, distorts competition, hinders economic development and endangers the stability of democratic institutions and the moral foundations of society’.
European Union law
Convention on the fight against corruption involving officials
7 The Convention drawn up on the basis of Article K.3(2)(c) of the Treaty on European Union on the fight against corruption involving officials of the European Communities or officials of Member States of the European Union (OJ 1997 C 195, p. 2), which entered into force on 28 September 2005, provides in Article 2, headed ‘Passive corruption’:
‘1. For the purposes of this Convention, the deliberate action of an official, who, directly or through an intermediary, requests or receives advantages of any kind whatsoever, for himself or for a third party, or accepts a promise of such an advantage, to act or refrain from acting in accordance with his duty or in the exercise of his functions in breach of his official duties shall constitute passive corruption.
2. Each Member State shall take the necessary measures to ensure that conduct of the type referred to in paragraph 1 is made a criminal offence.’
8 Article 3 of that convention, headed ‘Active corruption’, is worded as follows:
‘1. For the purposes of this Convention, the deliberate action of whosoever promises or gives, directly or through an intermediary, an advantage of any kind whatsoever to an official for himself or for a third party for him to act or refrain from acting in accordance with his duty or in the exercise of his functions in breach of his official duties shall constitute active corruption.
2. Each Member State shall take the necessary measures to ensure that conduct of the type referred to in paragraph 1 is made a criminal offence.’
Directive 95/46/EC
9 Recitals 10, 30 and 33 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) stated:
‘(10) … the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of Community law; … for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;
…
(30) … in order to be lawful, the processing of personal data must in addition be carried out with the consent of the data subject or be necessary for the conclusion or performance of a contract binding on the data subject, or as a legal requirement, or for the performance of a task carried out in the public interest or in the exercise of official authority, or in the legitimate interests of a natural or legal person, provided that the interests or the rights and freedoms of the data subject are not overriding; …
…
(33) … data which are capable by their nature of infringing fundamental freedoms or privacy should not be processed unless the data subject gives his explicit consent; … however, derogations from this prohibition must be explicitly provided for in respect of specific needs, in particular where the processing of these data is carried out for certain health-related purposes by persons subject to a legal obligation of professional secrecy or in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms’.
10 The object of that directive was defined in Article 1, which stated:
‘1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.
2. Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection afforded under paragraph 1.’
11 Article 2 of the directive provided:
‘For the purposes of this Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
…’
12 Chapter II of Directive 95/46, headed ‘General rules on the lawfulness of the processing of personal data’, was divided into nine sections.
13 In Section I, headed ‘Principles relating to data quality’, Article 6 of that directive was worded as follows:
‘1. Member States shall provide that personal data must be:
(a) processed fairly and lawfully;
(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. …
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
…
2. It shall be for the controller to ensure that paragraph 1 is complied with.’
14 In Section II, headed ‘Criteria for making data processing legitimate’, Article 7 of the directive provided:
‘Member States shall provide that personal data may be processed only if:
…
(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or
…
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed; or
…’
15 In Section III, headed ‘Special categories of processing’, Article 8 of the directive, relating to ‘the processing of special categories of data’, provided:
‘1. Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of data concerning health or sex life.
…
4. Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by decision of the supervisory authority.
…’
The GDPR
16 As provided in Article 94(1) thereof, the GDPR repealed Directive 95/46 with effect from 25 May 2018. By virtue of Article 99(2), the GDPR applies from that date.
17 Recitals 4, 10, 26, 35, 39 and 51 of the GDPR state:
‘(4) The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the [Charter of Fundamental Rights of the European Union (Charter)] as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.
…
(10) In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. … Regarding the processing of personal data for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Member States should be allowed to maintain or introduce national provisions to further specify the application of the rules of this Regulation. … This Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the processing of special categories of personal data (“sensitive data”). To that extent, this Regulation does not exclude Member State law that sets out the circumstances for specific processing situations, including determining more precisely the conditions under which the processing of personal data is lawful.
…
(26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. … To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. …
…
(35) Personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject. …
…
(39) … The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. …
…
(51) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. … Such personal data should not be processed, unless processing is allowed in specific cases set out in this Regulation, taking into account that Member States law may lay down specific provisions on data protection in order to adapt the application of the rules of this Regulation for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In addition to the specific requirements for such processing, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms.’
18 Article 1 of the GDPR, headed ‘Subject matter and objectives’, provides in paragraph 2:
‘This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.’
19 Article 4 of the GDPR, headed ‘Definitions’, is worded as follows:
‘For the purposes of this Regulation:
(1) “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
…
(15) “data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;
…’
20 Chapter II of the GDPR, headed ‘Principles’, comprises Articles 5 to 11 of the regulation.
21 Article 5, which concerns the ‘principles relating to processing of personal data’, provides in paragraph 1:
‘Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; … (“purpose limitation”);
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);
…’
22 Article 6 of the GDPR, headed ‘Lawfulness of processing’, provides in paragraphs 1 and 3:
‘1. Processing shall be lawful only if and to the extent that at least one of the following applies:
…
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
…
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
…
3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:
(a) Union law; or
(b) Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. … The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.’
23 Article 9 of the GDPR, headed ‘Processing of special categories of personal data’, provides in paragraphs 1 and 2:
‘1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:
…
(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
…’
Lithuanian Law
24 The Lietuvos Respublikos viešųjų ir privačių interesų derinimo valstybinėje tarnyboje įstatymas Nr. VIII-371 (Law No VIII-371 of the Republic of Lithuania on the reconciliation of public and private interests in the public service) of 2 July 1997 (Žin., 1997, No 67-1659), in the version in force at the material time (‘the Law on the reconciliation of interests’), has the aim, as stated in Article 1 thereof, of reconciling the private interests of persons working in the public service and the public interests of society, of ensuring that the public interest takes precedence when decisions are taken, of guaranteeing the impartiality of the decisions taken, and of preventing corruption from emerging and spreading in the public service.
25 Pursuant to Article 2(1) of the Law on the reconciliation of interests, the term ‘persons working in the public service’ covers, amongst others, persons who work in public associations or establishments that receive finance from the budget or from funds of the State or of a local authority and who are vested with administrative powers.
26 Article 3 of the Law on the reconciliation of interests, headed ‘Obligations of persons seeking to work, working or having worked in the public service’, provides in paragraphs 2 and 3:
‘2. Persons seeking to work or working in the public service and the other persons referred to in Article 4(1) of this Law shall declare their private interests.
3. Persons who have left the public service shall be subject to the restrictions laid down in Section 5 of this Law.’
27 Article 4 of the Law on the reconciliation of interests, headed ‘Declaration of private interests’, provides in paragraph 1:
‘Any person working in the public service and any person seeking to perform duties in the public service shall declare his or her private interests by lodging a declaration of private interests (‘declaration’) in accordance with the detailed rules laid down by this Law and other acts. …’
28 As set out in Article 5 of the Law on the reconciliation of interests:
‘1. Persons declaring their private interests shall lodge their declaration electronically in accordance with the detailed rules established by the [Chief Ethics Commission] within 30 days from the date of their election, recruitment or appointment (except in the cases referred to in Article 4(2) of this Law and in paragraphs 2, 3 and 4 of this Article).
2. Persons seeking to work in the public service (with the exception of the persons referred to in Article 4(2) of this Law and persons whose data are classified as laid down by statute and/or who carry out intelligence, counter-espionage or criminal intelligence activity) shall lodge their declaration before the date of their election, recruitment or appointment, unless other legal acts otherwise provide.
3. Persons whose data are classified as laid down by statute and/or who carry out intelligence, counter-espionage or criminal intelligence activity shall lodge their declaration within 30 days from the date of their election, recruitment or appointment with the head of the institution (or legal person) within which they work or his or her authorised representative, in accordance with the detailed rules established by that institution (or legal person).
4. Members of public procurement panels, persons entrusted by the head of a contracting authority with the award of contracts under the simplified procedure and experts participating in public procurement procedures shall lodge their declaration of private interests electronically (if not already lodged) before their participation in public procurement procedures begins. A member of a public procurement panel, a person entrusted by the head of a contracting authority with the award of contracts under the simplified procedure or an expert participating in public procurement procedures who has not lodged a declaration of private interests shall not be entitled to participate in the procurement procedure and must be relieved of the duties concerned.
5. If the legal act laying down the operational arrangements of the institution (or legal person) in which the person works so provides, the declaration may be lodged not only with the head of that institution (or legal person) or his or her authorised representative, but also with the head – or his or her authorised representative – of a legal person subject or accountable to that institution (or legal person), or of another legal person.
6. The institutions authorised to have access to the declarations shall request and obtain them, in the cases and in accordance with the detailed rules laid down by legal acts, from the declarant’s place of work or the [Chief Ethics Commission].’
29 Article 6 of the Law on the reconciliation of interests, headed ‘Content of the declaration’, states:
‘1. The declarant shall set out in his or her declaration the following data concerning the declarant and his or her spouse, cohabitee or partner:
(1) forename, surname, personal identification number, social security number, employer(s) and duties;
(2) legal person of which the declarant or his or her spouse, cohabitee or partner is a member;
(3) self-employed activity, as defined in the Law on personal income tax;
(4) membership of undertakings, establishments, associations or funds and the functions carried out, with the exception of membership of political parties and trade unions;
(5) gifts (other than those from close relatives) received during the last 12 calendar months if their value is greater than EUR 150;
(6) information about transactions concluded during the last 12 calendar months and other current transactions if the value of the transaction is greater than EUR 3 000;
(7) close relatives or other persons or data known by the declarant liable to give rise to a conflict of interests.
2. The declarant may omit data relating to his or her spouse, cohabitee or partner if they are living apart, do not form a common household and the declarant is therefore not in possession of those data.’
30 Article 10 of the Law on the reconciliation of interests, headed ‘Public disclosure of data relating to private interests’, provides:
‘1. Data set out in the declarations of elected representatives and persons occupying political posts, State officials, judges, heads and deputy heads of State or local authority institutions, temporary officials of political (personal) trust, State officials performing the duties of the head and deputy head of subdivisions of institutions or establishments, heads and deputy heads of undertakings and budgetary authorities of the State or of a local authority, heads and deputy heads of public establishments or associations that receive finance from the budget or from funds of the State or of a local authority, employees of the Bank of Lithuania with powers of public administration (performing functions in relation to supervision of the financial markets, to the extrajudicial settlement of disputes between consumers and financial market participants, and other public administration functions), members of the supervisory or administrative board and managers and deputy managers of public or private companies limited by shares in which the State or a local authority owns shares conferring on it more than one half of the voting rights in the general meeting of shareholders, members of the administrative board of State or local authority undertakings, presidents and vice-presidents of political parties, unpaid consultants and assistants and advisers of elected representatives and of persons occupying political posts, experts approved by the committees of the Parliament of the Republic of Lithuania, members of ministerial advisory boards, members of the Compulsory Health Insurance Council, unpaid advisers of the Compulsory Health Insurance Council, members of the National Health Council, doctors, dentists and pharmacists working in budgetary authorities or public establishments of the State or of a local authority, in State or local authority undertakings or in undertakings in which the State or a local authority owns shares conferring on it more than one half of the voting rights in the general meeting of shareholders which hold a health-care or pharmacy licence, and members of public procurement panels, persons entrusted by the head of a contracting authority with the award of contracts under the simplified procedure and experts participating in public procurement procedures (with the exception of data set out in the declarations of persons whose data are classified as laid down by statute and/or who carry out intelligence, counter-espionage or criminal intelligence activity) shall be public and be published on the website of the [Chief Ethics Commission] in accordance with the detailed rules laid down by it. Where a person whose data are public loses the status of declarant, the [Chief Ethics Commission], on application by the person concerned, shall remove the declaration from its website.
2. The following data provided in the declaration cannot be made public: the personal identification number, the social security number, special personal data, and other data disclosure of which is prohibited by statute. In addition, the data of the other party to a transaction shall not be published where that party is a natural person.’
31 As laid down in Article 22 of the Law on the reconciliation of interests, headed ‘Authorities and public servants responsible for monitoring’:
‘The way in which persons to whom this Law is applicable apply it shall be monitored by:
(1) the [Chief Ethics Commission];
(2) the heads of the State or local authority institutions or establishments concerned or their authorised representatives;
(3) the head of the contracting authority or the persons authorised by him or her (as regards members of public procurement panels, persons entrusted by the head of a contracting authority with the award of contracts under the simplified procedure and experts participating in public procurement procedures);
(4) other State bodies, in accordance with the detailed rules laid down by legal acts.
…
3. Where substantiated information has been obtained according to which a person is not complying with the requirements of this Law, the heads of the State or local authority institutions or establishments or their authorised representatives, or the collegial State or local authority institution, shall, on their own initiative or on the instruction of the [Chief Ethics Commission], investigate the official activity of the person working in the public service. The [Chief Ethics Commission] shall be informed of the outcome of the check and has the right to appraise whether the assessment of the relevant person’s conduct in the investigation report is consistent with the provisions of this Law. …’
32 Article 2(5) of the Law of the Republic of Lithuania on the reconciliation of public and private interests, in the version in force from 1 January 2020 (‘the Law on the reconciliation of interests as amended’), a provision which defines the term ‘persons working in the public service’, no longer refers, amongst such persons, to persons who work in public associations or establishments that receive finance from the budget or from funds of the State or of a local authority and who are vested with administrative powers.
33 Article 4(3) of the Law on the reconciliation of interests as amended states:
‘The provisions of this Law concerning the declaration of private interests and Articles 11 and 13 of this Law shall also be applicable:
…
(8) to the head of a contracting authority or a contracting entity (together, “a contracting entity”), members of public procurement panels of a contracting entity, persons entrusted by the head of a contracting entity with the award of contracts under the simplified procedure, experts participating in public procurement procedures, and persons initiating a concession … at a contracting entity in the procurement, waste water treatment, energy, transport or postal services sector;
…’
34 As set out in Article 2(8) of the Lietuvos Respublikos asmens duomenų teisinės apsaugos įstatymas Nr. I-1374 (Law No I-1374 of the Republic of Lithuania on the legal protection of personal data) of 11 June 1996 (Žin., 1996, No 63-1479), in the version in force until 16 July 2018:
‘“Special personal data” shall mean data relating to a natural person’s racial or ethnic origin, political, religious, philosophical or other convictions, trade union membership, health or sex life, and information concerning a criminal conviction of that person.’
The dispute in the main proceedings and the questions referred for a preliminary ruling
35 The Chief Ethics Commission is a public authority responsible inter alia for ensuring the application of the Law on the reconciliation of interests and, in particular, for collecting and checking declarations of private interests.
36 OT serves as the director of QP, an establishment governed by Lithuanian law in receipt of public funds which operates in the field of environmental protection.
37 By a decision of 7 February 2018, the Chief Ethics Commission found that, by failing to lodge a declaration of private interests, OT had infringed Article 3(2) and Article 4(1) of the Law on the reconciliation of interests.
38 On 6 March 2018, OT brought an action for annulment of that decision before the referring court.
39 In support of the action, OT submits, first, that he is not among the persons, as referred to in Article 2(1) of the Law on the reconciliation of interests, who are subject to the obligation to declare private interests. He states that, in his capacity as director of QP, he is vested with no powers of public administration and does not provide any public service to the population. Furthermore, QP, as a non-governmental organisation, carries out its activity independently of the public authorities.
40 Second, and in any event, even if he is required to lodge a declaration of private interests, OT contends that its publication would adversely affect both his right to respect for private life and that of the other persons whom he would, as the case may be, be required to mention in his declaration.
41 The Chief Ethics Commission asserts that, in so far as OT was vested with administrative powers in an establishment in receipt of financing from EU structural funds and the budget of the Lithuanian State, he was required to lodge a declaration of private interests, despite his not being an official and even if he did not exercise any powers of public administration. In addition, the Chief Ethics Commission observes that, whilst publication of such a declaration is liable to constitute an interference in the private life of OT and his spouse, that interference is provided for by the Law on the reconciliation of interests.
42 The referring court has doubts as to whether the regime laid down by the Law on the reconciliation of interests is compatible with points (c) and (e) of the first subparagraph of Article 6(1) and Article 6(3) of the GDPR and with Article 9(1) thereof. It takes the view that the personal data contained in a declaration of private interests are liable to reveal information on the private life of the declarant and his or her spouse and of the declarant’s children, with the result that their disclosure is capable of infringing the right of the data subjects to respect for their private life. Indeed, those data are liable to reveal particularly sensitive information, such as the fact that the data subject is cohabiting or is living with another person of the same sex, the disclosure of which might well result in significant nuisance in the private life of those persons. The data concerning presents received and transactions carried out, by the declarant and his or her spouse, cohabitee or partner, also reveal certain details of their private life. Moreover, the data concerning close relatives or acquaintances of the declarant who may give rise to a conflict of interests reveal information about the declarant’s family and personal relationships.
43 According to the referring court, whilst the Law on the reconciliation of interests has the objective of ensuring that the principle of transparency is observed when public functions are performed, in particular when decisions concerning implementation of the public interest are adopted, publication on the internet of matters capable of affecting the adoption of such decisions is not necessary in order to achieve that objective. Communication of the personal data to the bodies envisaged in Article 5 of that law and the monitoring task that is assigned to the organs referred to in Article 22 thereof constitute measures sufficient to ensure that that objective is achieved.
44 In those circumstances, the Vilniaus apygardos administracinis teismas (Regional Administrative Court, Vilnius, Lithuania) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Must the condition laid down in [point (e) of the first subparagraph of Article 6(1)] of the [GDPR] that processing [of the personal data] is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, with regard to the requirements laid down in Article 6(3) of [that regulation], including the requirement that the Member State law must meet an objective of public interest and be proportionate to the legitimate aim pursued, and also with regard to Articles 7 and 8 of the Charter, be interpreted as meaning that national law may not require the disclosure of declarations of private interests and their publication on the website of the controller (the [Chief Ethics Commission]), thereby providing access to those data to all individuals who have access to the internet?
(2) Must the prohibition of the processing of special categories of personal data established in Article 9(1) of the [GDPR], regard being had to the conditions established in Article 9(2) of [that regulation], including the condition established in point (g) thereof that processing [of the personal data] must be necessary for reasons of substantial public interest, on the basis of EU or Member State law which must be proportionate to the aim pursued, must respect the essence of the right to data protection and must provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject, be interpreted, also with regard to Articles 7 and 8 of the Charter, as meaning that national law may not require the disclosure of data relating to declarations of private interests which may disclose personal data, including data which make it possible to determine a person’s political views, trade union membership, sexual orientation and other personal information, and their publication on the website of the controller (the [Chief Ethics Commission]), providing access to those data to all individuals who have access to the internet?’
The admissibility of the request for a preliminary ruling
45 The Lithuanian Government and the European Commission have stated that, following the amendment of the Law on the reconciliation of interests, which entered into force on 1 January 2020, the applicant in the main proceedings is no longer a person to whom that law applies.
46 In addition, the Commission observes that, in a judgment of 20 September 2018, the Lietuvos Respublikos Konstitucinis Teismas (Constitutional Court of the Republic of Lithuania), which the referring court had requested to assess the constitutionality of certain provisions of the Law on the reconciliation of interests, found that Article 10 thereof, which requires the data relating to private interests to be published, was not at issue in the main proceedings.
47 In that regard, it should be recalled that, in accordance with settled case-law, the procedure provided for in Article 267 TFEU is an instrument of cooperation between the Court of Justice and the national courts, by means of which the Court provides the national courts with the points of interpretation of EU law which they need in order to decide the disputes before them (judgment of 12 March 1998, Djabali, C‑314/96, EU:C:1998:104, paragraph 17, and order of 3 December 2020, Fedasil, C‑67/20 to C‑69/20, not published, EU:C:2020:1024, paragraph 18).
48 In accordance with equally settled case-law, questions on the interpretation of EU law referred by a national court in the factual and legislative context which that court is responsible for defining, and the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevance. The Court may refuse to rule on a question referred for a preliminary ruling by a national court only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (judgment of 22 February 2022, Stichting Rookpreventie Jeugd and Others, C‑160/20, EU:C:2022:101, paragraph 82 and the case-law cited).
49 In the present instance, it must be pointed out that, in response to a request by the Court for information, the referring court explained, first, that the legality of the decision at issue in the main proceedings has to be assessed in the light of the national provisions in force on the date of that decision’s adoption. The Law on the reconciliation of interests included amongst the persons who had to lodge a declaration of private interests those who work in public associations or establishments that receive finance from the budget or from funds of the State or of a local authority and who are vested with administrative powers.
50 The referring court stated, furthermore, that although the applicant in the main proceedings can no longer be equated to a person working in the public service, within the meaning of the Law on the reconciliation of interests as amended, he is nevertheless capable of falling within the category of persons that is referred to in Article 4(3)(8) of that law and that, on that basis, he may be required to lodge a declaration of private interests.
51 Second, the referring court stated that the main proceedings are not affected by the judgment of the Lietuvos Respublikos Konstitucinis Teismas (Constitutional Court of the Republic of Lithuania) of 20 September 2018, by which it declared that the referring court’s request that it rule on whether Article 10(1) and (2) of the Law on the reconciliation of interests is consistent with the Constitution of the Republic of Lithuania and the constitutional principle of proportionality was inadmissible on the ground that the question to be decided in the main proceedings relates not to the public disclosure of the data provided in declarations of private interests, but to the obligation to lodge such a declaration.
52 The referring court explained that, even though the question to be decided in the main proceedings is indeed, as the Lietuvos Respublikos Konstitucinis Teismas (Constitutional Court of the Republic of Lithuania) stated, whether the applicant in the main proceedings infringed Article 3(2) and Article 4(1) of the Law on the reconciliation of interests because he failed to comply with the obligation to lodge a declaration of private interests, in order to review the legality of the decision at issue in the main proceedings it is necessary to take account of the mandatory consequences, resulting from the application of Article 10 of that law, of the lodging of such a declaration, namely the publication on the Chief Ethics Commission’s website of certain data contained in the declaration, since the applicant in the main proceedings pleads in support of his action for annulment of that decision that that publication is unlawful.
53 In the light of the information thereby provided by the referring court, the matters put forward by the Lithuanian Government and the Commission are not sufficient to rebut the presumption of relevance enjoyed by the questions referred and it cannot be considered to be quite obvious that the interpretation of provisions of EU law that is sought bears no relation to the actual facts of the main action or its purpose, or that the problem is hypothetical, as the referring court may take account of that interpretation for the purpose of adopting its decision. Furthermore, the Court has before it the factual and legal material necessary to give a useful answer to the questions submitted to it.
54 Therefore the request for a preliminary ruling is admissible.
Consideration of the questions referred
The applicable law ratione temporis
55 By its questions, the referring court requests interpretation of the GDPR. In accordance with Article 99(2) thereof, the GDPR became applicable on 25 May 2018, the date with effect from which, by virtue of Article 94(1), it repealed Directive 95/46.
56 Consequently, the decision at issue in the main proceedings, which was adopted by the Chief Ethics Commission on 7 February 2018, was governed by Directive 95/46.
57 However, it is apparent from the documents before the Court that, by that decision, the Chief Ethics Commission alleged that the applicant in the main proceedings had failed to lodge a declaration of private interests, in breach of the Law on the reconciliation of interests. That being so, in the light of the information referred to in paragraph 50 of the present judgment and in the absence of anything to indicate that the applicant in the main proceedings lodged such a declaration before 25 May 2018, that is to say, the date on which the GDPR became applicable, the possibility remains that that regulation is applicable ratione temporis to the dispute in the main proceedings, a matter which is for the referring court to determine.
58 Furthermore, there is no need to distinguish between the provisions of Directive 95/46 and those of the GDPR referred to in the two questions referred for a preliminary ruling, as reformulated, since the purport of those provisions must be regarded as similar for the purposes of the interpretation that the Court is required to give in the present case (see, by analogy, judgment of 21 November 2013, Dixons Retail, C‑494/12, EU:C:2013:758, paragraph 18).
59 Therefore, in order to provide useful answers to the questions submitted by the referring court, they should be examined on the basis of both Directive 95/46 and the GDPR.
The first question
60 By its first question, the referring court asks, in essence, whether Article 7(c) and (e) of Directive 95/46 and points (c) and (e) of the first subparagraph of Article 6(1) and Article 6(3) of the GDPR, read in the light of Articles 7 and 8 of the Charter, must be interpreted as precluding a national provision that provides for the placing online of personal data contained in the declaration of private interests that any head of an establishment receiving public funds is required to lodge with the national authority responsible for collecting such declarations and checking their content.
61 It should be noted at the outset that, under Article 1(1) of Directive 95/46, read in conjunction with recital 10 thereof, and Article 1(2) of the GDPR, read in conjunction with recitals 4 and 10 thereof, that directive and that regulation have the objective in particular of ensuring a high level of protection of the fundamental rights and freedoms of natural persons with respect to the processing of personal data; that right is also recognised in Article 8 of the Charter and is closely connected to the right to respect for private life, enshrined in Article 7 of the Charter.
62 To that end, Chapter II of Directive 95/46 and Chapters II and III of the GDPR set out the principles governing the processing of personal data and the rights of the data subject which the processing must observe. In particular, all processing of personal data was required, before the GDPR was applicable, to comply with the principles relating to data quality and the criteria for making data processing legitimate set out in Articles 6 and 7 of that directive and, once the GDPR was applicable, to comply with the principles relating to processing of data and the conditions governing lawfulness of processing listed in Articles 5 and 6 of that regulation (see, to that effect, judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 96, and of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes), C‑175/20, EU:C:2022:124, paragraph 50).
63 In the present instance, Article 10(1) of the Law on the reconciliation of interests provides that the Chief Ethics Commission is to publish on its website the information set out in the declarations of private interests which are submitted by the public officials referred to in that provision and the content of which is defined in Article 6(1) of that law, with the exception of the information listed in Article 10(2) thereof.
64 It should be pointed out, in that regard, that the questions referred to the Court relate solely to the publication, on the Chief Ethics Commission’s website, of the information set out in the declaration of private interests that the head of an establishment receiving public funds is required to lodge, and not to the obligation to declare in itself or to the publication of a declaration of interests in other circumstances.
65 Where information intended to be published on the Chief Ethics Commission’s website relates to natural persons identified by their forename and surname, it constitutes personal data, within the meaning of Article 2(a) of Directive 95/46 and Article 4(1) of the GDPR, and the fact that that information was provided in the context of the declarant’s professional activity does not mean that it cannot be so characterised (judgment of 9 March 2017, Manni, C‑398/15, EU:C:2017:197, paragraph 34 and the case-law cited). Furthermore, the operation of loading personal data on an internet page constitutes processing, within the meaning of Article 2(b) of Directive 95/46 and Article 4(2) of the GDPR (see, to that effect, judgment of 1 October 2015, Weltimmo, C‑230/14, EU:C:2015:639, paragraph 37), in respect of which the Chief Ethics Commission is the controller, within the meaning of Article 2(d) of Directive 95/46 and Article 4(7) of the GDPR (see, by analogy, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 101).
66 That having been explained, it should be examined whether Article 7 of Directive 95/46 and Article 6 of the GDPR, read in the light of Articles 7 and 8 of the Charter, preclude publication on the internet of part of the personal data set out in the declaration of private interests that any head of an establishment receiving public funds is required to lodge, such as the publication provided for in Article 10 of the Law on the reconciliation of interests.
67 Article 7 of Directive 95/46 and the first subparagraph of Article 6(1) of the GDPR set out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful. Thus, in order to be capable of being regarded as such, processing must fall within one of the cases provided for in those provisions (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 99 and the case-law cited).
68 Under Article 7(e) of Directive 95/46 and point (e) of the first subparagraph of Article 6(1) of the GDPR, which are mentioned by the referring court in its first question, processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is lawful. In addition, under Article 7(c) of that directive and under point (c) of the first subparagraph of Article 6(1) of that regulation, a provision to which that court referred in the grounds of its request for a preliminary ruling, processing that is necessary for compliance with a legal obligation to which the controller is subject is also lawful.
69 Article 6(3) of the GDPR specifies, in respect of those two situations where processing is lawful, that the processing must be based on EU law or on Member State law to which the controller is subject, and that that legal basis must meet an objective of public interest and be proportionate to the legitimate aim pursued. Since those requirements constitute an expression of the requirements arising from Article 52(1) of the Charter, they must be interpreted in the light of the latter provision and must apply mutatis mutandis to Article 7(c) and (e) of Directive 95/46.
70 It should indeed be borne in mind that the fundamental rights to respect for private life and to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter, are not absolute rights, but must be considered in relation to their function in society and be weighed against other fundamental rights. Limitations may therefore be imposed, so long as, in accordance with Article 52(1) of the Charter, they are provided for by law, respect the essence of the fundamental rights and observe the principle of proportionality. Under the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. They must apply only in so far as is strictly necessary and the legislation which entails the interference must lay down clear and precise rules governing the scope and application of the measure in question (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 105 and the case-law cited).
71 In the present instance, given that the publication, on the Chief Ethics Commission’s website, of part of the personal data set out in the declaration of private interests that any head of an establishment receiving public funds is required to lodge results from a legislative provision of the Member State law to which the Chief Ethics Commission is subject, that is to say, from Article 10 of the Law on the reconciliation of interests, that processing is necessary for compliance with a legal obligation which is binding on that authority as controller and, therefore, falls within the situation envisaged in Article 7(c) of Directive 95/46 and point (c) of the first subparagraph of Article 6(1) of the GDPR. That being so, it is not necessary to determine whether that processing also falls within the situation envisaged in Article 7(e) of that directive and point (e) of the first subparagraph of Article 6(1) of that regulation.
72 Furthermore, since, as is apparent from paragraph 63 of the present judgment, Article 10 of the Law on the reconciliation of interests defines the scope of the limitation on the exercise of the right to the protection of personal data, the interference that it entails must be regarded as provided for by law, within the meaning of Article 52(1) of the Charter (see, to that effect, judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes), C‑175/20, EU:C:2022:124, paragraph 54).
73 However, as has been stated in paragraph 69 of the present judgment, Article 10 of the Law on the reconciliation of interests, as the legal basis for the processing at issue in the main proceedings, must also fulfil the other requirements arising from Article 52(1) of the Charter and Article 6(3) of the GDPR, and in particular must meet an objective of public interest and be proportionate to the legitimate aim pursued.
74 In the present instance, it is apparent from Article 1 of the Law on the reconciliation of interests that, in adopting the principle of transparency of declarations of interest, that law seeks to ensure that the public interest takes precedence when decisions are taken by persons working in the public service, to guarantee the impartiality of those decisions, and to prevent situations of conflict of interests and the emergence and spread of corruption in the public service.
75 Such objectives, in that they seek to strengthen the safeguards for probity and impartiality of public sector decision makers, to prevent conflicts of interest and to combat corruption in the public sector, are undeniably objectives of public interest and, accordingly, legitimate.
76 Indeed, ensuring that public sector decision makers perform their duties impartially and objectively and preventing them from being influenced by considerations relating to private interests have the aim of guaranteeing the proper management of public affairs and public property.
77 Furthermore, combating corruption is an objective that the Member States have endorsed at both international and EU level.
78 In particular, at EU level, the Member States have acceded to the Convention on the fight against corruption involving officials of the European Communities or officials of Member States of the European Union, under which each Member State is required to adopt the necessary measures to ensure that both active and passive corruption involving officials is a criminal offence.
79 At international level, Article 1 of the United Nations Convention against Corruption states that the purposes of that convention are, inter alia, to promote and strengthen measures to prevent and combat corruption more efficiently and effectively, and to promote integrity, accountability and proper management of public affairs and public property. To that end, Article 7(4) of the convention provides that ‘each State Party shall, in accordance with the fundamental principles of its domestic law, endeavour to adopt, maintain and strengthen systems that promote transparency and prevent conflicts of interest’.
80 It follows from the foregoing considerations that the processing of personal data pursuant to the Law on the reconciliation of interests is intended to meet objectives of general interest recognised by the European Union, within the meaning of Article 52(1) of the Charter, and objectives that are of public interest and therefore legitimate, within the meaning of Article 6(3) of the GDPR.
81 Consequently, in accordance with those provisions, the objectives referred to in paragraphs 74 and 75 of the present judgment authorise limitations on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter, provided in particular that the limitations genuinely meet those objectives and are proportionate to them.
82 That being so, it must be ascertained whether the placing online, on the Chief Ethics Commission’s website, of part of the personal data contained in the declaration of private interests that any head of an establishment receiving public funds is required to lodge with that authority is appropriate for achieving the objectives of general interest defined in Article 1 of the Law on the reconciliation of interests and does not go beyond what is necessary in order to achieve those objectives (see, by analogy, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 109).
83 So far as concerns, first of all, the question whether publication on the Chief Ethics Commission’s website of personal data contained in declarations of private interest is appropriate for achieving the objective of general interest defined in Article 1 of the Law on the reconciliation of interests, it should be pointed out that the placing online of some of the personal data contained in the declarations of private interests of public sector decision makers, in that it enables the existence of possible conflicts of interest liable to influence the performance of their duties to be revealed, is such as to induce them to act impartially. Thus, such implementation of the principle of transparency is capable of preventing conflicts of interest and corruption, of increasing the accountability of public sector actors and, therefore, of strengthening citizens’ trust in their actions.
84 Accordingly, the measure at issue in the main proceedings appears appropriate for contributing to the achievement of the objectives of general interest that it pursues.
85 As regards, next, the requirement of necessity, it is apparent from recital 39 of the GDPR that that requirement is met where the objective of general interest pursued cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter, since derogations and limitations in relation to the principle of protection of such data must apply only in so far as is strictly necessary (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 110 and the case-law cited). Consequently, it should be ascertained in the present instance whether the objective of preventing conflicts of interest and corruption in the public sector by reinforcing the probity and impartiality of public officials might reasonably be achieved just as effectively by other measures less restrictive of the rights to respect for private life and to the protection of personal data of heads of establishments receiving public funds.
86 That assessment must be carried out in the light of all the matters of fact and law specific to the Member State concerned – such as the existence of other measures designed to prevent conflicts of interest and combat corruption, and the scale of such conflicts and of the phenomenon of corruption within the public service – and of the nature of the information at issue and the importance of the duties carried out by the declarant, in particular his or her hierarchical position, the extent of the powers of public administration with which he or she may be vested and the powers that he or she has in relation to the commitment and management of public funds.
87 In the present instance, first, it should be noted that, as can be gathered from paragraph 43 of the present judgment, the referring court seems to take the view that the obligation to declare private interests to the organs referred to in Articles 5 and 22 of the Law on the reconciliation of interests and the checking by those organs of compliance with that obligation and of the declaration’s content would enable the objectives pursued by that law, namely preventing conflicts of interest and combating corruption in the public sector, to be achieved just as effectively.
88 According to the explanations provided by the referring court, one of the main arguments put forward by the Chief Ethics Commission in the main proceedings to justify publication of the declarations of private interest is the fact that it does not have sufficient human resources to check effectively all the declarations that are submitted to it.
89 However, it must be pointed out that a lack of resources allocated to the public authorities cannot in any event constitute a legitimate ground justifying interference with the fundamental rights guaranteed by the Charter.
90 The question also arises as to whether it is strictly necessary, in order to achieve the objectives of general interest referred to in Article 1 of the Law on the reconciliation of interests, that heads of establishments receiving public funds be, like the other categories of functions covered by the list in Article 10(1) of that law, subject to the public disclosure that that law prescribes.
91 In that regard, the Lithuanian Government has stated before the Court that the obligation to provide a declaration of impartiality, to which those heads are subject under national law, is sufficient to achieve the objectives of the Law on the reconciliation of interests and that, therefore, application of Article 10 of that law to them, which was required until the Law on the reconciliation of interests as amended entered into force on 1 January 2020, went beyond what is strictly necessary in the light of those objectives.
92 Second, even if publication of the private data at issue in the main proceedings were to prove necessary in order to achieve the objectives pursued by the Law on the reconciliation of interests, it is to be noted that a potentially unlimited number of persons may consult the personal data at issue. However, it is not apparent from the documents before the Court that the Lithuanian legislature, when adopting that provision, examined whether publication of those data on the internet without any restriction of access is strictly necessary or whether the objectives pursued by the Law on the reconciliation of interests might be achieved just as effectively if the number of persons able to consult those data is limited.
93 Third, in any event, it is to be borne in mind that the condition relating to the necessity of processing must be examined in conjunction with the ‘data minimisation’ principle, enshrined in Article 6(1)(c) of Directive 95/46 and Article 5(1)(c) of the GDPR, under which personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (see, to that effect, judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A‑ScaraA, C‑708/18, EU:C:2019:1064, paragraph 48).
94 Therefore, only data the publication of which is actually capable of strengthening the safeguards for probity and impartiality of public officials, preventing conflicts of interest and combating corruption in the public sector may be subject to processing of the kind provided for in Article 10(1) of the Law on the reconciliation of interests.
95 In the present instance, it is clear from Article 10(2) of the Law on the reconciliation of interests, and from the explanations provided by the referring court in response to the request by the Court for information, that the majority of the data that have to be set out in the declaration of private interests, pursuant to Article 6(1) of that law, are intended to be published on the Chief Ethics Commission’s website, with the exception, inter alia, of the data subjects’ personal identification number.
96 Whilst, with a view to preventing conflicts of interest and corruption in the public sector, it may be appropriate to require information enabling the declarant to be identified and information relating to the activities of the declarant’s spouse, cohabitee or partner to be set out in the declarations of private interests, the public disclosure, online, of name-specific data relating to the spouse, cohabitee or partner of a head of an establishment receiving public funds, and to close relatives, or other persons known by the declarant, liable to give rise to a conflict of interests, seems to go beyond what is strictly necessary. As the Advocate General has observed in point 66 of his Opinion, it does not appear that the objectives of public interest pursued could not be achieved if, for the purposes of publication, reference were solely made generically to a spouse, cohabitee or partner, as the case may be, together with the relevant indication of the interests held by those persons in relation to their activities.
97 Nor does it appear that the systematic publication, online, of the list of the declarant’s transactions the value of which is greater than EUR 3 000 is strictly necessary in the light of the objectives pursued.
98 Finally, it must be borne in mind that an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective of general interest against the rights at issue (judgment of 5 April 2022, Commissioner of An Garda Síochána and Others, C‑140/20, EU:C:2022:258, paragraph 52). Consequently, for the purpose of assessing the proportionality of the processing at issue in the main proceedings, it is necessary to measure the seriousness of the interference with the fundamental rights to respect for private life and to the protection of personal data that that processing involves and to determine whether the importance of the objective of general interest pursued by the processing is proportionate to the seriousness of the interference.
99 In order to assess the seriousness of that interference, account must be taken, inter alia, of the nature of the personal data at issue, in particular of any sensitivity of those data, and of the nature of, and specific methods for, the processing of the data at issue, in particular of the number of persons having access to those data and the methods of accessing them (judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A‑ScaraA, C‑708/18, EU:C:2019:1064, paragraph 57).
100 In the present instance, first, the public disclosure, online, of name-specific data relating to the declarant’s spouse, partner or cohabitee, or to persons who are close relatives of the declarant, or are known by him or her, liable to give rise to a conflict of interests, and mention of the subject of transactions the value of which is greater than EUR 3 000 are liable to reveal information on certain sensitive aspects of the data subjects’ private life, including, for example, their sexual orientation. Furthermore, since it envisages such public disclosure of name-specific data relating to persons other than the declarant in his or her capacity as a public sector decision maker, the processing of personal data that is provided for in Article 10 of the Law on the reconciliation of interests also concerns persons who do not have that capacity and in respect of whom the objectives pursued by that law are not imperative in the same way as for the declarant.
101 The seriousness of such an infringement may still be increased by the cumulative effect of the personal data that are published as in the main proceedings, since combining them enables a particularly detailed picture of the data subjects’ private lives to be built up (see, to that effect, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 128).
102 Second, it is not in dispute that that processing has the effect of making those personal data freely accessible on the internet to the whole of the general public and, accordingly, to a potentially unlimited number of persons.
103 Consequently, that processing is liable to enable those data to be freely accessed by persons who, for reasons unrelated to the objective of general interest of preventing conflicts of interest and corruption in the public sector, seek to find out about the personal, material and financial situation of the declarant and the members of his or her family (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2021:504, paragraph 118).
104 Thus, as the Advocate General has observed in point 78 of his Opinion, publication of those data is liable, for example, to expose the persons concerned to repeated targeted advertising and commercial sales canvassing, or even to risks of criminal activity.
105 Therefore, processing, such as that at issue in the main proceedings, of the personal data referred to in paragraph 100 of the present judgment must be regarded as constituting a serious interference with the fundamental rights of data subjects to respect for private life and to the protection of personal data.
106 The seriousness of that interference must be weighed against the importance of the objectives of preventing conflicts of interest and corruption in the public sector.
107 In that regard, the Court considers it useful, for the purpose of pointing out the importance within the European Union of the objective of combating corruption, to take into consideration the content of the report of the Commission to the Council and the European Parliament of 3 February 2014 entitled ‘EU Anti-Corruption Report’ (COM(2014) 38 final), according to which corruption – which impinges on good governance, sound management of public money, and competitive markets – hampers economic development, undermines democracy and damages social justice and the rule of law, and is capable of undermining the trust of citizens in democratic institutions and processes. The report states that the whole of the European Union is affected by that phenomenon, to a greater or lesser extent depending on the Member State.
108 Similarly, the Criminal Law Convention on Corruption adopted by the Council of Europe refers to corruption in its fourth recital as a ‘[threat to] the rule of law, democracy and human rights [which] undermines good governance, fairness and social justice, distorts competition, hinders economic development and endangers the stability of democratic institutions and the moral foundations of society’.
109 In the light of the foregoing, it is undeniable that combating corruption is of great importance within the European Union.
110 In that context, the weighing of the interference resulting from the publication of personal data contained in the declarations of private interest against the objectives of general interest of preventing conflicts of interest and corruption in the public sector involves taking into consideration, inter alia, the fact and the extent of the phenomenon of corruption within the public service of the Member State concerned, so that the result of the weighing up to be carried out of those objectives, on the one hand, and a data subject’s rights to respect for private life and to the protection of personal data, on the other, is not necessarily the same for all the Member States (see, by analogy, judgment of 24 September 2019, Google (Territorial scope of de-referencing), C‑507/17, EU:C:2019:772, paragraph 67).
111 Furthermore, as follows from paragraph 86 of the present judgment, for the purpose of that balancing exercise, account must be taken inter alia of the fact that the general interest in personal data being published may vary according to the importance of the duties carried out by the declarant, in particular his or her hierarchical position, the extent of the powers of public administration with which he or she may be vested and the powers that he or she has in relation to the commitment and management of public funds (see, by analogy, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 81).
112 That having been explained, it must be found that the publication online of the majority of the personal data contained in the declaration of private interests of any head of an establishment receiving public funds, such as that at issue in the main proceedings, does not meet the requirements of a proper balance. In comparison with an obligation to declare coupled with a check of the declaration’s content by the Chief Ethics Commission the effectiveness of which it is for the Member State concerned to ensure by endowing that body with the means necessary for that purpose, such publication amounts to a considerably more serious interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter, without that increased interference being capable of being offset by any benefits which might result from publication of all those data for the purpose of preventing conflicts of interest and combating corruption.
113 Nor is there anything in the documents before the Court to indicate that safeguards against the risks of abuse, such as the risks referred to in paragraphs 103 and 104 of the present judgment, are provided for by the national legislation applicable to the dispute in the main proceedings.
114 As regards, however, the data relating to the membership of the declarant – or, without being name-specific, to the membership of the declarant’s spouse, cohabitee or partner – of undertakings, establishments, associations or funds, to their activities as self-employed persons and to the legal persons of which they are members, it must be held that transparency as to whether or not such interests exist enables citizens and economic operators to have an accurate picture of the financial independence of the persons who are vested with decision-making power in the management of public funds. Furthermore, the data concerning gifts received, other than from close relatives, the value of which exceeds EUR 150 are capable of revealing the existence of acts of corruption.
115 Subject to the requirement to strike a fair balance in the light of the extent of the declarant’s decision-making power, and provided that the principle of data minimisation is observed, the publication of such data contained in the declaration of interests may be justified by the benefits which, by strengthening the safeguards for probity and impartiality of public officials, such transparency brings in respect of the prevention of conflicts of interest and the combating of corruption.
116 In the light of all the foregoing considerations, the answer to the first question is that Article 7(c) of Directive 95/46 and point (c) of the first subparagraph of Article 6(1) and Article 6(3) of the GDPR, read in the light of Articles 7, 8 and 52(1) of the Charter, must be interpreted as precluding national legislation that provides for the publication online of the declaration of private interests that any head of an establishment receiving public funds is required to lodge, in so far as, in particular, that publication concerns name-specific data relating to his or her spouse, cohabitee or partner, or to persons who are close relatives of the declarant, or are known by him or her, liable to give rise to a conflict of interests, or concerns any transaction concluded during the last 12 calendar months the value of which exceeds EUR 3 000.
The second question
117 By its second question, the referring court asks, in essence, whether Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR must be interpreted as meaning that the publication, on the website of the public authority responsible for collecting and checking the content of declarations of private interests, of personal data that are liable to disclose indirectly the political opinions, trade union membership or sexual orientation of a natural person constitutes processing of special categories of personal data, for the purpose of those provisions.
118 Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR provide for the prohibition, inter alia, of processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of data concerning a natural person’s sex life or sexual orientation. According to the heading of those articles, these are special categories of personal data, and such data are also categorised as ‘sensitive data’ in recital 34 of that directive and recital 10 of that regulation.
119 In the present instance, although the personal data the publication of which is mandatory pursuant to Article 10(1) of the Law on the reconciliation of interests are not, inherently, sensitive data for the purpose of Directive 95/46 and the GDPR, the referring court takes the view that it is possible to deduce from the name-specific data relating to the spouse, cohabitee or partner of the declarant certain information concerning the sex life or sexual orientation of the declarant and his or her spouse, cohabitee or partner.
120 That being so, it should be determined whether data that are capable of revealing the sexual orientation of a natural person by means of an intellectual operation involving comparison or deduction fall within the special categories of personal data, for the purpose of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR.
121 According to settled case-law, for the purpose of interpreting a provision of EU law it is necessary to consider not only its wording but also its context and the objectives of the legislation of which it forms part (judgment of 21 December 2021, Bank Melli Iran, C‑124/20, EU:C:2021:1035, paragraph 43 and the case-law cited).
122 Article 8(1) of Directive 95/46 states that Member States are to prohibit the processing of personal data ‘revealing’ racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of data ‘concerning’ health or sex life. Article 9(1) of the GDPR provides that, inter alia, processing of personal data ‘revealing’ racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of data ‘concerning’ health or data ‘concerning’ a natural person’s sex life or sexual orientation, are to be prohibited.
123 As the Advocate General has observed, in essence, in point 85 of his Opinion, whilst the use, in those provisions, of the verb ‘reveal’ is consistent with the taking into account of processing not only of inherently sensitive data, but also of data revealing information of that nature indirectly, following an intellectual operation involving deduction or cross-referencing, the preposition ‘concerning’ seems, on the other hand, to signify the existence of a more direct and immediate link between the processing and the data concerned, viewed inherently.
124 Such an interpretation, which would result in a distinction being drawn according to the type of sensitive data at issue, would not, however, be consistent with a contextual analysis of those provisions, in particular with Article 4(15) of the GDPR, according to which ‘data concerning health’ are personal data related to the physical or mental health of a natural person, including the provision of health care services, which ‘reveal’ information about his or her health status, and with recital 35 of that regulation, which states that personal data concerning health should include all data pertaining to the health status of a data subject which ‘reveal’ information relating to the past, current or future physical or mental health status of the data subject.
125 Furthermore, a wide interpretation of the terms ‘special categories of personal data’ and ‘sensitive data’ is confirmed by the objective of Directive 95/46 and the GDPR, noted in paragraph 61 of the present judgment, which is to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular of their private life, with respect to the processing of personal data concerning them (see, to that effect, judgment of 6 November 2003, Lindqvist, C‑101/01, EU:C:2003:596, paragraph 50).
126 The contrary interpretation would, moreover, run counter to the purpose of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, namely to ensure enhanced protection as regards processing which, because of the particular sensitivity of the data processed, is liable to constitute, as follows from recital 33 of Directive 95/46 and recital 51 of the GDPR, a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter (see, to that effect, judgment of 24 September 2019, GC and Others (De-referencing of sensitive data), C‑136/17, EU:C:2019:773, paragraph 44).
127 Consequently, those provisions cannot be interpreted as meaning that the processing of personal data that are liable indirectly to reveal sensitive information concerning a natural person is excluded from the strengthened protection regime prescribed by those provisions, if the effectiveness of that regime and the protection of the fundamental rights and freedoms of natural persons that it is intended to ensure are not to be compromised.
128 In the light of all the foregoing considerations, the answer to the second question is that Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR must be interpreted as meaning that the publication, on the website of the public authority responsible for collecting and checking the content of declarations of private interests, of personal data that are liable to disclose indirectly the sexual orientation of a natural person constitutes processing of special categories of personal data, for the purpose of those provisions.
Costs
129 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules:
1. Article 7(c) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and point (c) of the first subparagraph of Article 6(1) and Article 6(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in the light of Articles 7, 8 and 52(1) of the Charter of Fundamental Rights of the European Union, must be interpreted as precluding national legislation that provides for the publication online of the declaration of private interests that any head of an establishment receiving public funds is required to lodge, in so far as, in particular, that publication concerns name-specific data relating to his or her spouse, cohabitee or partner, or to persons who are close relatives of the declarant, or are known by him or her, liable to give rise to a conflict of interests, or concerns any transaction concluded during the last 12 calendar months the value of which exceeds EUR 3 000.
2. Article 8(1) of Directive 95/46 and Article 9(1) of Regulation 2016/679 must be interpreted as meaning that the publication, on the website of the public authority responsible for collecting and checking the content of declarations of private interests, of personal data that are liable to disclose indirectly the sexual orientation of a natural person constitutes processing of special categories of personal data, for the purpose of those provisions.
[Signatures]