Processing of Personal Data – ECJ on Directive 95/46/EC in the Case “Peter Puškár”
By Maria E. Sturm
On 27 September 2017 the ECJ issued its preliminary ruling on the case Peter Puškár vs. Finančné riaditel’stvo Slovenskej republiky, Kriminálny úrad finančnej správy (C-73/16) which gives helpful guidelines on the lawfulness of the processing of personal data by public authorities.
The financial authorities of Slovakia have drawn up a list of persons which are considered to be front men for several companies. In detail, the list contains the names of the persons, their tax identification number, their national identification number, and the companies they are associated with. Peter Puškár is one of those persons and wanted to be deleted from this list. The case has several facets, touching questions regarding Data Protection Directive 95/46/EC, but also the Charter of Fundamental Rights of the EU. Therefore, the Supreme Court of the Slovak Republic requested a preliminary ruling of the ECJ under Article 267 TFEU.
The Supreme Court of the Slovak Republic posed four questions:
- The first question is a procedural one, asking if an obligatory pre-trial proceeding is admissible in cases concerning the procession of personal data.
- The second question, also of procedural nature, covers the problem of the admissibility of the list as evidence.
- The third question finally asks, if such a list is a legal form of processing personal data.
- The fourth question refers to the relation between the European Court of Human Rights and the Court of Justice in cases of differences between the case-laws. However, the ECJ regarded this questions as inadmissible because of its hypothetical nature. Therefore, it will not be further covered in this article.
- On Question n°1
Question n° 1 refers to Art. 22 of directive 95/46/EC. This articles requires Member States to provide a judicial remedy for any breach of the rights guaranteed with regard to the processing of data. So the question is: does an obligatory pre-trial proceeding harm this right to judicial remedies, as it makes the whole process more complex and more expensive? The Slovak administrative authorities argued, that a pre-trial proceeding offers the chance for a quick resolution, if the administration follows the argument of the complainant. Furthermore, unexpected lawsuits can be avoided and the ensuing lawsuit will be more efficient, because arguments of both parties are already documented. ECJ ruled, that if the pre-trial is not too long and not too expensive and there is no obvious discrepancy between the advantages and disadvantages of the pre-trial proceeding, it does not harm Art. 22.
- On Question n° 2
The Slovak financial authorities claimed, that the list cannot be admitted as evidence, because it is confidential and for internal use only. This could be a restriction of the right to an effective remedy according to Art. 47 of the Charter of Fundamental Rights of the EU. Such a restriction can only be legal, if it is regulated by law, respects the essential content of the right, is proportionate and conforms to accepted aims of the common welfare of the EU. This is highly questionable in this case, as Art. 12 of directive 95/46/EC guarantees every data subject the right of access to the processed data and Art. 10 and 11 guarantee that information about processed data is provided to data subjects. Therefore, Mr. Puškár must have access to the list, which fulfills the definition of personal data according to Art. 2a) of the directive, and the financial authorities have no reason to withhold it during the lawsuit.
- On Question n° 3
The third question finally refers to the substance of the directive and requires a definition of the legality of processing personal data in such a list. Being part of this list can harm the reputation of the person as well as the presumption of innocence. Furthermore, it can harm the entrepreneurial freedom of the companies related to this person. On the other hand, according to Art. 7e) of the directive, data can be processed, if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. The goal intended by setting up this list was to ensure tax collection and to avoid tax fraud, both legal public tasks. Furthermore, the list has been set up by those authorities who are in charge of these tasks. This is important, as Art. 6 I b) requires the explicit connection between the aim and the task. However, taking into account the disadvantages for the affected persons, the list is only admissible, if there is sufficient indication for the suspicion.
It is now up to the Slovak courts to re-examine the case and see if the financial authorities worked within these guidelines set up by the ECJ.
Directive 95/46/EC has been replaced by the General Data Protection Regulation (Reg 2016/679; see also TTLF Newsletter of February 3, 2017) which applies from May 25, 2018 on. However, the articles in question in this verdict all form part of the new regulation with regard to content:
- Remedies required in Art. 22 Directive 95/46/EC, are now required by Art. 79 I Reg 2016/679.
- The right of access and information according to Art. 10, 11, 12 Directive 95/46/EC can now be found in Art. 13, 14, 15 Reg 2016/679.
- Art 6I b) Directive 95/46/EC is now Art. 5 I b) Reg 2016/679, and Art. 7e) Directive 95/46/EC is now Art. 6 I e) Reg 2016/679.
Therefore, the guidelines for interpreting the directive, set up by the ECJ in this verdict will still be applicable to the new regulation, which enters into force in 2018.