Case C‑184/20
OT
v
Vyriausioji tarnybinės etikos komisija
(Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas)
Judgment of the Court (Grand Chamber), 1 August 2022
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 52(1) – Directive 95/46/EC – Article 7(c) – Article 8(1) – Regulation (EU) 2016/679 – Point (c) of the first subparagraph of Article 6(1) and the second subparagraph of Article 6(3) – Article 9(1) – Processing necessary for compliance with a legal obligation to which the controller is subject – Objective of public interest – Proportionality – Processing of special categories of personal data – National legislation requiring publication on the internet of data contained in the declarations of private interests of natural persons working in the public service or of heads of associations or establishments receiving public funds – Prevention of conflicts of interest and of corruption in the public sector)
1. Approximation of laws – Protection of natural persons with regard to the processing of personal data – Directive 95/46 – Regulation 2016/679 – Scope ratione temporis – Concomitant interpretation of provisions having a similar purport
(European Parliament and Council Regulation 2016/679; European Parliament and Council Directive 95/46)
(see paragraphs 57-59)
2. Approximation of laws – Protection of natural persons with regard to the processing of personal data – Directive 95/46 – Regulation 2016/679 – Conditions governing the lawfulness of processing of personal data – National legislation requiring publication on the internet of data contained in the declaration of private interests of a natural person who is the head of an establishment receiving public funds – Processing necessary for compliance with a legal obligation incumbent on the controller – Objective of general interest of preventing conflicts of interest and corruption in the public sector – Publication not necessary of part of the data contained in the declaration of private interests – Unlawful
(Charter of Fundamental Rights of the European Union, Arts 7, 8 and 52(1); European Parliament and Council Regulation 2016/679, Art. 6(1), subpara. 1, point (c), and (3); European Parliament and Council Directive 95/46, Art. 7(c))
(see paragraphs 67-70, 75-77, 80-89, 93, 96, 97, 100-103, 106, 109-112, 114-116, operative part 1)
3. Approximation of laws – Protection of natural persons with regard to the processing of personal data – Directive 95/46 – Regulation 2016/679 – Processing of special categories of personal data – Definition – Publication, on the website of the national authority responsible for collecting and checking declarations of private interests, of data that are liable to disclose a person’s sexual orientation indirectly – Included
(European Parliament and Council Regulation 2016/679, Art. 9(1); European Parliament and Council Directive 95/46, Art. 8(1))
(see paragraphs 127, 128, operative part 2)
Résumé
By decision of 7 February 2018, the Vyriausioji tarnybinės etikos komisija (Chief Official Ethics Commission, Lithuania; ‘the Chief Ethics Commission’) found that the director of an establishment governed by Lithuanian law in receipt of public funds had failed to fulfil his obligation to lodge a declaration of private interests. (1)
That person challenged the decision of the Chief Ethics Commission before the Vilniaus apygardos administracinis teismas (Regional Administrative Court, Vilnius, Lithuania). He contended in particular that, even if he were required to submit a declaration of private interests, which he disputes, its publication on the Chief Ethics Commission’s website pursuant to the Law on the reconciliation of interests would adversely affect both his right to respect for private life and that of the other persons who would, as the case may be, be mentioned in his declaration. Since the Regional Administrative Court, Vilnius, had doubts as to whether the regime, established by the Law on the reconciliation of interests, governing the publication of information set out in the declaration of private interests was compatible with the GDPR, (2) it made a reference to the Court of Justice for a preliminary ruling.
In its judgment, delivered by the Grand Chamber, the Court holds, in essence, that EU law (3) precludes national legislation that provides for the publication online of the declaration of private interests that any head of an establishment receiving public funds is required to lodge, in so far as, in particular, that publication concerns certain data, that is to say, name-specific data relating to other persons mentioned, as the case may be, in the declaration, or concerns any transaction of the declarant exceeding a certain value.
Findings of the Court
First of all, the Court notes that the relevant EU legislation sets out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful, one of which is processing that is necessary for compliance with a legal obligation to which the controller is subject. Since the processing at issue – namely the publication, on the Chief Ethics Commission’s website, of part of the personal data set out in the declaration of private interests – is required by the Law on the reconciliation of interests, to which that authority is subject, it does fall within that case. The Court adds that, under the GDPR, such processing must be based either on EU law or on Member State law to which the controller is subject, and that that legal basis must meet an objective of general interest and be proportionate to the legitimate aim pursued, as is indeed required by the Charter. (4) In that context, first, the Court observes that the processing of personal data provided for by the Law on the reconciliation of interests is genuinely intended to meet the objective of general interest of preventing conflicts of interest and combating corruption in the public sector. Second, it points out that, in such a case, limitations on the exercise of the rights to respect for private life and to the protection of personal data, guaranteed respectively by Articles 7 and 8 of the Charter, may be allowed, provided in particular that they genuinely meet the objective of general interest pursued and are proportionate to it.
Next, the Court considers whether the measure at issue is appropriate for achieving the objective of general interest pursued. In that regard, it finds that that measure appears appropriate for contributing to the achievement of such an objective. The placing online of some of the personal data contained in the declarations of private interests of public sector decision makers, in that it enables the existence of possible conflicts of interest liable to influence the performance of their duties to be revealed, is such as to induce them to act impartially. Thus, such implementation of the principle of transparency is capable of preventing conflicts of interest and corruption, of increasing the accountability of public sector actors and, therefore, of strengthening citizens’ trust in their actions.
As regards the requirement of necessity, in other words whether the objective pursued might not reasonably be achieved just as effectively by other measures less restrictive of the rights to respect for private life and to the protection of personal data, the Court states that that must be assessed in the light of all the matters of fact and law specific to the Member State concerned. In that context, it also points out that the lack of human resources available to the Chief Ethics Commission for checking all the declarations of private interests that are submitted to it, upon which the Chief Ethics Commission relies in order to justify their being placed online, cannot in any event constitute a legitimate ground justifying interference with the fundamental rights guaranteed by the Charter.
Furthermore, the requirement of necessity of the processing must be examined in the light of the ‘data minimisation’ principle. In that regard, the Court accepts that, with a view to preventing conflicts of interest and corruption in the public sector, it may be appropriate to require information enabling the declarant to be identified and information relating to the activities of the declarant’s spouse, cohabitee or partner to be set out in the declarations of private interests. However, the public disclosure, online, of name-specific data relating to the spouse, cohabitee or partner of a head of an establishment receiving public funds, and to close relatives, or other persons known by the declarant, liable to give rise to a conflict of interests, seems to go beyond what is strictly necessary. It does not appear that the objective of general interest pursued could not be achieved if reference were solely made generically to a spouse, cohabitee or partner, as the case may be, together with the relevant indication of the interests held by those persons in relation to their activities. Nor does it appear that the systematic publication, online, of the list of the declarant’s transactions the value of which is greater than EUR 3 000 is strictly necessary in the light of the objectives pursued.
In the present instance, the Court concludes that there is a serious interference with the fundamental rights of data subjects to respect for private life and to the protection of personal data. Indeed, the public disclosure of the abovementioned data and information is liable to reveal information on certain sensitive aspects of the data subjects’ private life and to enable a particularly detailed picture of it to be built up. In addition, that public disclosure has the effect of making those data freely accessible on the internet to a potentially unlimited number of persons. Consequently, they may be freely accessed by persons seeking simply to find out about the personal, material and financial situation of the declarant and his or her close relatives.
So far as concerns the weighing of the seriousness of that interference against the importance of the objective of general interest pursued, the Court states that in the present instance the publication online of the majority of the personal data does not meet the requirements of a proper balance. However, the publication of certain data contained in the declaration of private interests may be justified by the benefits which such transparency brings in pursuing the objective sought. That is true in particular of the data relating to the membership of the declarant – or, without being name-specific, to the membership of the declarant’s spouse, cohabitee or partner – of various entities, to their activities as self-employed persons or to gifts from third parties exceeding a certain value.
Finally, the Court states that the processing of personal data that are liable indirectly to reveal sensitive information concerning a natural person is not excluded from the strengthened protection regime, (5) since such exclusion might well compromise the effectiveness of that regime and the protection of the fundamental rights and freedoms of natural persons that it is intended to ensure. Thus, the publication on the Chief Ethics Commission’s website of personal data that are liable to disclose indirectly the data subjects’ sexual orientation constitutes processing of sensitive data.