| CJEU - C-201/14 Bara and Others | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 13(1)(e) GDPR Article 14(1)(c) GDPR Article 23(1)(e) GDPR Article 23(1)(h) GDPR Article 322 (1) Romanian Law No. 95/2006 on Healthcare Reform |
| Decided: | 01.10.2015 |
| Parties: | Smaranda Bara and Others Președintele Casei Naționale de Asigurări de Sănătate Casa Naţională de Asigurări de Sănătate |
| Case Number/Name: | C-201/14 Bara and Others |
| European Case Law Identifier: | ECLI:EU:C:2015:638 |
| Reference from: | Court of Appeals in Cluj |
| Language: | 24 EU Languages |
| Original Source: | AG Opinion Judgement |
| Initial Contributor: | Mihai Bădescu, Veronika Fuhrmann |
The CJEU held that a Romanian interinstitutional protocol cannot act as a valid legal basis for transferring personal data between public administrative bodies without informing the concerned data subjects of said transfer and subsequent processing.
English Summary
Facts
Article 315 (currently 322) of Romanian Law No 95/2006 mandated that all public authorities must transmit any data necessary to determine the insurance status of individuals to the National Health Insurance Fund (CNAS). The law also recognised persons without a taxable income qualify as insured.
The National Tax Administration Agency (ANAF) transmitted data related to several self-employed persons, the applicants, including their income, based on a common 2007 Protocol, not subject to official publication. Neither authority informed the data subjects of this transmission.
Holding
In this preliminary ruling, the Court clarified, first, that Article 124 TFEU (prohibiting privileged access by public authorities to financial institutions) is exclusively related to the Union’s economic and monetary policy, irrelevant to the proceedings and thus rejected as inadmissible. Second, since the fourth question concerned the lawfulness of data processing in a specific context, it benefited from a presumption of relevance to the dispute at hand. As a result, it was deemed admissible.
Then the Court held that the Directive 95/46 was applicable. First, because the data transferred (names, categories of income, taxes paid) constitutes personal data. Second, both the transfer of data from ANAF to CNAS and the subsequent processing performed by CNAS constitute data processing. Therefore, the rules set out in Articles 10 and 11 (information that must be communicated to the data subject) are also applicable to the processing in dispute, in the limits set in Article 13.
With regards to substance, the Court stated, first, that Article 10 sets out what information must be provided to the data subjects if their data was collected directly from them. This includes providing the identity of the “recipients of data” (Article 10(c)) in order to ensure fair processing. Thus, the Court and the Advocate General agreed that the principle of fair processing “requires a public administrative body to inform the data subjects of the transfer of those data to another public administrative body for the purpose of their processing by the latter in its capacity as recipient”. Without the transparency of such information, the exercise of other rights (e.g., to rectify, to object) would not be possible. This principle was later cited by the Belgian data protection authority in APD/GBA – 47/2022.
While the national law obliged public authorities to transfer data necessary to determine the insurance status of persons to the CNAS, the 2007 Protocol included the transfer of specific data irrelevant to the stated purpose: data relating to income. Thus, the Court concluded that Law 95/2006 cannot constitute by itself a valid prior information for the data subjects that would dispense the ANAF from its obligation to provide information.
Second, regarding Article 13, the Court found that, although the obligation of providing information concerning income-related data might have been categorised as data related to taxation matters (Article 13(1)(e)) or data related to the “monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in” (Article 13(1)(f)), the Directive requires these exemptions to be imposed by legislative measures. The transfers in the present case were based on the 2007 Protocol, a non-legislative measure which is not subject to official publication. Therefore, the Court did not find the exception in Article 13 applicable.
Lastly, Article 11 Directive 95/46 concerns the information required to be communicated if the data was not collected directly from the data subject. The Court considered that, after the data transfer took place, the CNAS was under an obligation to provide information to the subjects concerning the purpose of the processing and the categories of data concerned. Article 11(2) also provides Member States with the possibility of setting aside the obligation of information through a legislative measure. The Court reiterated that the 2007 Protocol did not meet this requirement.
The Court concluded that Articles 10, 11, and 13 Directive 95/46 preclude national measures from allowing a public administrative body to transfer personal data to another public authority without informing the data subjects concerned of the transfer and the subsequent processing.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
