CJEU - C-184/20 - Vyriausioji Tarnybinės Etikos Komisija: Difference between revisions

Latest revision as of 13:15, 1 June 2023

CJEU - C-184/20 - Vyriausioji Tarnybinės Etikos Komisija

Court:	CJEU
Jurisdiction:	European Union
Relevant Law:	Article 6(1) GDPR Article 6(3) GDPR Article 9(1) GDPR Decision: 2008/801/EC The Lietuvos Respublikos viešųjų ir privačių interesų derinimo valstybinėje tarnyboje įstatymas Nr. VIII-371 (Law No VIII-371 of the Republic of Lithuania on the reconciliation of public and private interests in the public service) The United Nations Convention against Corruption - Resolution 58/4 of the United Nations General Assembly of 31 October 2003
Decided:	01.08.2022
Parties:	OT Vyriausioji tarnybinės etikos komisija (Chief Official Ethics Commission) Fondas ‘Nevyriausybinių organizacijų informacijos ir paramos centras’
Case Number/Name:	C-184/20 - Vyriausioji Tarnybinės Etikos Komisija
European Case Law Identifier:	ECLI:EU:C:2022:601
Reference from:	Vilnius Regional Administrative Court (Lithuania)
Language:	24 EU Languages
Original Source:	AG Opinion Judgement
Initial Contributor:	Alexander Smith

The CJEU held that the mandatory disclosure, in the context of an online transparency publication, of personal information concerning a public officer violated the principle of data minimisation.

English Summary

Facts

The Chief Ethics Commission was a Lithuanian body checking declarations of private interests by public officers. According to Lithuanian law, public officers were asked to provide a large amount of information about themselves and their partner, including name, personal identification number, social security number, employment status, membership or undertakings with trade unions and/or political parties and details about transactions over €3,000 concluded in the last 12 months. The Chief Official Ethics Commission then published information on its website (after removing sensitive data). Notably, the published information, whilst removing what was obviously special categories of personal data, would still include the name of their spouse, cohabitant, or partner.

The data subject was a public officer who asked the annulment of a decision by the Chief Ethics Commission according to which they failed to disclose mandatory information.

The data subject claimed that this mandatory declaration violated their data protection rights under EU law. The Lithuanian court sent a preliminary reference to the CJEU to clarify whether Lithuanian law establishing the obligation violated Articles 6(1)(c) and (e), 6(3) and 9(1) GDPR.

Holding

The preliminary questions concern the issue whether the existence of a legal obligation – Article 6(1)(c) GDPR – or a public interest – Article 6(1)(e) GDPR – can authorise a mandatory disclosure of personal data of a public officer for online publication.

According to the CJEU, such mandatory declaration of private interests was a limitation of the data subject right to privacy and data protection; therefore, it shall be compliant with Article 52(1) of the European Charter of Fundamental Rights. The CJEU noticed that the mandatory declaration was based on Lithuanian law and pursued a public interest, namely the prevention of conflicts of interest and corruption. However, the measure shall also be proportionate. The Court found the declaration appropriate to achieve the public interest at issue, as an online publication of private interests pushes public officer to work impartially and increases their accountability.

However, the Court also held that an online publication was not necessary to achieve transparency, being sufficient a direct control by the Chief Ethics Commission. Also, even if the measure as such was deemed necessary by the Lithuanian authorities, data required in the mandatory declaration exceeded proportionality to the extent that made publicly available names and details of people connected to the data subject, such as their spouse, as well as other irrelevant information about the data subject. This disclosure obligation was clearly in contrast with the principle of data minimisation envisaged by the GDPR.

In addition, the Lithuanian law was at odd with Article 9(1) GDPR. The declaration of interests did not concern inherently sensitive data, but rather other information that could reveal special categories of data, such as sexual orientation, religious beliefs or political opinions. Given the broad formulation of Article 9(1) GDPR, data revealing sensitive data are covered by the special protection afforded by this provision.

Comment

Further Resources

Share blogs or news articles here!

@@ Line 1: / Line 1: @@
 {{CJEUdecisionBOX
-|Case_Number_Name=C‑184/20 - Vyriausioji Tarnybinės Etikos Komisija
+|Case_Number_Name=C-184/20 - Vyriausioji Tarnybinės Etikos Komisija
 |ECLI=ECLI:EU:C:2022:601
@@ Line 55: / Line 55: @@
 }}
-The CJEU held in its preliminary ruling that the publication of the name of civil servants' spouse, cohabitant or partner and of the subject of their transactions is likely to indirectly disclose their sexual orientation and therefore constitutes processing of special categories of personal data. National legislation requiring such online publication is consequently contrary to the GDPR.
+The CJEU held that the mandatory disclosure, in the context of an online transparency publication, of personal information concerning a public officer violated the principle of data minimisation.
 ==English Summary==
 === Facts ===
-Pursuant to the United Nations Convention against Corruption and Council Decision 2008/801/EC of 25 September 2008, Lithuania created domestic legislation to document conflicts of interests of those working in the public service or in the public interest.
+The Chief Ethics Commission was a Lithuanian body checking declarations of private interests by public officers. According to Lithuanian law, public officers were asked to provide a large amount of information about themselves and their partner, including name, personal identification number, social security number, employment status, membership or undertakings with trade unions and/or political parties and details about transactions over €3,000 concluded in the last 12 months. The Chief Official Ethics Commission then published information on its website (after removing sensitive data). Notably, the published information, whilst removing what was obviously special categories of personal data, would still include the name of their spouse, cohabitant, or partner.
-These laws required those individuals to provide details about themselves and their spouse, cohabitant, or partner to the Chief Official Ethics Commission. This included (amongst others) name, personal identification number, social security number, employment status, membership or undertakings with trade unions and/or political parties and information about transactions over EUR 3,000 concluded during the last 12 calendar months. The Chief Official Ethics Commission would then publish information on a public website (not including identification numbers, membership or undertakings with trade unions or political parties) as a 'declaration'. Notably, the published information, whilst removing what was obviously special categories of personal data, would still include the name of their spouse, cohabitant, or partner.
+The data subject was a public officer who asked the annulment of a decision by the Chief Ethics Commission according to which they failed to disclose mandatory information.
-The data subject challenged this, arguing that the publication of this information would indirectly disclose the sexual orientation of the data subject.
+The data subject claimed that this mandatory declaration violated their data protection rights under EU law. The Lithuanian court sent a preliminary reference to the CJEU to clarify whether Lithuanian law establishing the obligation violated Articles 6(1)(c) and (e), 6(3) and 9(1) GDPR.
-There were two questions referred to the CJEU:
+=== Holding ===
+The preliminary questions concern the issue whether the existence of a legal obligation – Article 6(1)(c) GDPR – or a public interest – Article 6(1)(e) GDPR – can authorise a mandatory disclosure of personal data of a public officer for online publication.
-- Should [[Article 6 GDPR#1e|Article 6(1)(e) GDPR]], with regard to [[Article 6 GDPR#3|Article 6(3) GDPR]], including the requirement that the Member State law must  be proportionate, be interpreted as meaning that national law may not require the disclosure of declarations of private interests and their publication on the website of the controller, thereby providing access to those data to all individuals who have access to the internet?
-- Should [[Article 9 GDPR#1|Article 9(1) GDPR]], considering [[Article 9 GDPR#2|Article 9(2) GDPR]] (including [[Article 9 GDPR|Article 9(2)(g) GDPR]]) and Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, be interpreted as meaning that national law may not require the disclosure of data relating to declarations of private interests which may disclose personal data, including data which make it possible to determine a person’s political views, trade union membership, sexual orientation and other personal information, and their publication on the website of the controller, providing access to those data to all individuals who have access to the internet?
-=== Advocate General Opinion ===
-The Advocate General's opinion on each question was:
-- The provisions must be interpreted as prohibiting such a national law/regulation when that measure in question is not appropriate, necessary, or proportionate.
+According to the CJEU, such mandatory declaration of private interests was a limitation of the data subject right to privacy and data protection; therefore, it shall be compliant with Article 52(1) of the European Charter of Fundamental Rights. The CJEU noticed that the mandatory declaration was based on Lithuanian law and pursued a public interest, namely the prevention of conflicts of interest and corruption. However, the measure shall also be proportionate. The Court found the declaration appropriate to achieve the public interest at issue, as an online publication of private interests pushes public officer to work impartially and increases their accountability.
-- The provisions must be interpreted in the sense that this use of special category personal data is capable of indirectly communicating sensitive data.
+However, the Court also held that an online publication was not necessary to achieve transparency, being sufficient a direct control by the Chief Ethics Commission. Also, even if the measure as such was deemed necessary by the Lithuanian authorities, data required in the mandatory declaration exceeded proportionality to the extent that made publicly available names and details of people connected to the data subject, such as their spouse, as well as other irrelevant information about the data subject. This disclosure obligation was clearly in contrast with the principle of data minimisation envisaged by the GDPR.
-=== Holding ===
-The CJEU's holding for each question was:
-- The relevant provisions must be interpreted as precluding national legislation that provides for the online publication of the declarations in so far as that publication concerns name-specific data relating to his or her spouse, cohabitant or partner, or to persons who are close relatives of the data subject [or are otherwise required to be listed under the legislation], or it concerns any transaction concluded during the last 12 calendar months the value of which exceeds EUR 3 000.
+In addition, the Lithuanian law was at odd with Article 9(1) GDPR. The declaration of interests did not concern inherently sensitive data, but rather other information that could reveal special categories of data, such as sexual orientation, religious beliefs or political opinions. Given the broad formulation of Article 9(1) GDPR, data revealing sensitive data are covered by the special protection afforded by this provision.
-- The relevant provisions must be interpreted as meaning that the publication of personal data on the website of the public authority which are liable to disclose indirectly the sexual orientation of a natural person constitutes processing of special categories of personal data.
 == Comment ==
 == Further Resources ==
 ''Share blogs or news articles here!''