Case C-553/07

College van burgemeester en wethouders van Rotterdam

v

M.E.E. Rijkeboer

(Reference for a preliminary ruling from the Raad van State)

(Protection of individuals with regard to the processing of personal data – Directive 95/46/EC – Respect for private life – Erasure of data – Right of access to data and to information on the recipients of data – Time‑limit on the exercise of the right to access)

Summary of the Judgment

Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46

(European Parliament and Council Directive 95/46, Art. 12(a))

The right to privacy, set out in Article 1(1) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, means that the data subject may be certain that his personal data are processed in a correct and lawful manner, that is to say, in particular, that the basic data regarding him are accurate and that they are disclosed to authorised recipients. As is stated in recital 41 in the preamble to the directive, in order to carry out the necessary checks, the data subject must have a right of access to the data relating to him which are being processed.

Article 12(a) of Directive 95/46 requires Member States to ensure a right of access to information on the recipients or categories of recipient of personal data and on the content of the data disclosed not only in respect of the present but also in respect of the past. It is for Member States to fix a time-limit for storage of that information and to provide for access to that information which constitutes a fair balance between, on the one hand, the interest of the data subject in protecting his privacy, in particular by way of his rights to object and to bring legal proceedings and, on the other, the burden which the obligation to store that information represents for the controller.

Rules limiting the storage of information on the recipients or categories of recipient of personal data and on the content of the data disclosed to a period of one year and correspondingly limiting access to that information, while basic data is stored for a much longer period, do not constitute a fair balance of the interest and obligation at issue, unless it can be shown that longer storage of that information would constitute an excessive burden on the controller. It is, however, for national courts to make the determinations necessary.

(see paras 49, 70, operative part)