Tag Archives: directive 95/46/EC

Advocate General Sharpston delivered her Opinion on December 12, 2013, in Joined Cases C-141/12 and C-372/12, Y.S. v. Minister voor Immigratie, in which she analyzed the content of the right to access personal data in a minute created during an administrative procedure. The case is interesting, as it interprets both Article 12 of Directive 95/46 and Article 8(2) of the Charter of Fundamental Rights of the EU.

According to the summary of the case drafted by AG Sharpston in her decision (see para 1), “Y.S., M. and S. are third country nationals who have applied for lawful residence in the Netherlands. Y.S.’s application was refused. Those of M. and S. were granted. Each relies on EU law in order to obtain access to a document (‘the minute’) drafted by an official of the relevant authority and containing a legal analysis in the form of internal advice on whether to grant residence status. They argue that the legal analysis is personal data and thus, as a matter of EU law, they have the right to access the minute.”

In the case of Y.S., following the applicant’s request for access to the minute drafted for the decision, the Minister refused to provide access, on the ground that the minute contained, apart from personal data, a legal analysis. The Minister did provide, in so far as necessary, an overview of the data contained in the minute, the origin of that data and the authorities which had access to the data. Y.S. challenged the decision, and the court of appeals referred several questions to CJEU.

In the case of M and S, the Ministry rejected their requests, but two Dutch courts annulled the decision of rejection and obliged the Ministry to give the applicants a copy of the respective minutes. The Ministry challenged these court decisions to the Raad von State court, which has sent several questions to the Court of Justice of the European Union, following the preliminary ruling procedure.

Main referred questions

The questions are relevant in the correct application of the right to access personal data.

The first question asks whether the second indent of Article 12(a) of [Directive 95/46] should be interpreted to mean that there is a right to a copy of documents in which personal data have been processed, or is it sufficient if a full summary, in an intelligible form, of the personal data that have undergone processing in the documents concerned is provided?

The second question asks whether the words “right of access” in Article 8(2) of [the Charter] should be interpreted to mean that there is a right to a copy of documents in which personal data have been processed, or is it sufficient if there is provision of a full summary, in an intelligible form, of the personal data that have undergone processing in the documents concerned within the meaning of the second indent of Article 12(a) of [Directive 95/46]?

Another question asked by the Dutch court is whether a legal analysis, as set out in a minute, could be regarded as personal data within the meaning of Article 2(a) of [Directive 95/46].

The referred questions also cover the realm of the exceptions of the right to access personal data, as enshrined in Directive 95/46. In this regard, question 6 of the Raad von State asks whether the protection of the rights and freedoms of others, within the meaning of Article 13(1)(g) of [Directive 95/46] …, also cover the interest in an internal undisturbed exchange of views within the public authority concerned. Also, if the answer to that is in the negative, can that interest then be covered by Article 13(1)(d) or (f) of that directive?

AG Sharpston: “only information relating to facts about an individual can be personal data”

AG Sharpston acknowledges that “personal data is a broad concept” (para. 44) and “It can be understood to relate to any facts regarding that person’s private life and possibly, where relevant, his professional life (which might involve a more public aspect of that private life)” (para. 45).

As such, “information included in the minute relating to facts such as the name, date of birth, nationality, gender, ethnicity, religion and language of an applicant is ‘personal data’ within the meaning of Article 2(a) of Directive 95/46″ (para. 46).

However, the Advocate General does not consider that legal analysis is personal data. And as a consequence, access should not be granted to the part of the minute which enshrines the legal analysis regarding the asylum request of the applicants, using as legal ground the right to access personal data.

To justify her view, AG Sharpston argues that “only information relating to facts about an individual can be personal data. Except for the fact that it exists, a legal analysis is not such a fact. Thus, for example, a person’s address is personal data but an analysis of his domicile for legal purposes is not” (para. 56).

Further, the Advocate General explains that “facts can be expressed in different forms, some of which will result from assessing whatever is identifiable. For example, a person’s weight might be expressed objectively in kilos or in subjective terms such as ‘underweight’ or ‘obese’. Thus, I do not exclude the possibility that assessments and opinions may sometimes fall to be classified as data” (para. 57). “However, the steps of reasoning by which the conclusion is reached that a person is ‘underweight’ or ‘obese’ are not facts, any more than legal analysis is” (para. 58).

In my opinion, the most convincing legal argument which could justify that legal analysis regarding facts about an identified person is not personal data, is the one stating that “legal analysis as such does not fall within the sphere of an individual’s right to privacy. There is therefore no reason to assume that that individual is himself uniquely qualified to verify and rectify it and ask that it be erased or blocked. Rather, it is for an independent judicial authority to review the decision for which that legal analysis was prepared” (para. 60).

In other words, access to legal analysis would not serve the purpose of exercising the other rights of the data subject: the right to erasure, the right to rectification etc. So perhaps another question one could ask is whether the only purpose of the right to access personal data is the possibility for the data subject to exercise the other rights she has regarding the processing of her data.

The other question one could ask is how can a person require an independent judicial authority to review the decision for which that legal analysis was prepared, if she doesn’t know the content of the decision? Nevertheless, the answer to this last question is more substantially linked to the right to an effective judicial remedy.

The form in which access should be granted to personal data

AG Sharpston also addresses in her Opinion the question of the form in which access to personal data must be granted, having regard to the fact that the referring courts asked whether a copy of the minute has to be provided to the applicants.

First, the Advocate General establishes that the right to access as provided in Article 8(2) of the EU Charter “does not articulate a separate standard governing the form in which access must be made available” (para. 70) than Article 12 of Directive 95/46.

“When read together with the principle of proportionality and legal certainty, I interpret Article 8(2) of the Charter to mean that access need not go beyond what is necessary in order to achieve its objectives and to give the data subject full knowledge of the personal data that are protected under that provision. The requirement set out in Article 12 of Directive 95/46 corresponds to those principles. For that reason, I do not consider that a separate inquiry into the form of access under Article 8 of the Charter is necessary” (para. 70).

AG Sharpston further considers that “Depending on the circumstances, a copy might be neither necessary nor sufficient” (para 73). She explains that “Directive 95/46 does not require personal data covered by the right of access to be made available in the material form in which they exist or were initially recorded. In that regard, I consider that a Member State has a considerable margin of discretion to determine, based on the individual circumstances in case, the form in which to make personal data accessible” (para 74).

The Advocate General adds that “In making that assessment, a Member State should take account of, in particular:

(i) the material form(s) in which that information exists and can be made available to the data subject,

(ii) the type of personal data and

(iii) the objectives of the right of access.” (para. 75).

The conclusion is that “the fact that personal data are contained in a document such as a minute does not imply that the data subject automatically has the right to that material form, that is to say, a copy or extract of that document” (para 79).

The second indent of Article 12(a) of Directive 95/46 states that the data subject has the right to obtain from the controller “- communication to him in an intelligible form of the data undergoing processing and of any available information as to their source”. Hence, all the data undergoing processing must be communicated to the data subject “in an intelligible form”.

In my view, there are two possible variations of personal data undergoing processing that can be the object of an access request: 1. data processed in an intelligible form for the data subject and 2. data processed in a non-intelligible form for the data subject (such as binary language, code, foreign alphabet etc.). Whenever data is processed in a language (understood lato sensu) which is accessible to the data subject,  she is entitled to receive a copy of that data – be it an extract of a larger material form in which the data is processed. If the data is processed in a non-intelligible form for the data subject, she is entitled to receive the processed data, in a specific material form, translated into an intelligible language for the data subject.

In fact, as the online Oxford dictionary reveals, the origin of the noun “copy” ultimately rests in Latin: copia ‘abundance’ (in medieval Latin ‘transcript’, from such phrases as copiam describendi facere – ‘give permission to transcribe’). So a copy of personal data can be understood not only as an identical specimen to the original data, but also as a transcription of the original data.

Regarding the case at hand, I consider that as long as the facts of the case of the applicants are considered “personal data”, the applicants are entitled to receive a copy of the personal data enshrined in the minute, in the form of a photocopy of the minute in which all the information which is not considered to be personal data can be erased/covered with a black/blank line etc. I do not see why would it be disproportionate to communicate the personal data contained in the minute in this manner. Moreover, I consider that such a copy is the only one which ensures the effectiveness of the exercise of the other rights of the data subject – especially the right to rectification.

Exceptions of the right to access – “the protection of rights and freedoms of others cannot be read as including rights and freedoms of the authority processing personal data” 

Finally, AG Sharpston argues that, if the legal analysis could be considered personal data, then the data controller cannot invoke Article 13 subparagraph g as a justification for not offering access to the processed data: “the protection of rights and freedoms of others (that is, other than the data subject) cannot be read as including rights and freedoms of the authority processing personal data. If a legal analysis is to be categorised as personal data, that must be because it is related to the private interests of an identified or identifiable person. Whilst the public interest in protecting internal advice in order to safeguard the administration’s ability to exercise its functions may indeed compete with the public interest in transparency, access to such advice cannot be restricted on the basis of the first of those two interests, because access covers only what falls within the private interest” (para. 84.)

One last observation: what would the ECHR say?

In 2012 (22 May), the European Court of Human Rights gave its decision in a case which presents certain similarities with the case at hand – Trăilescu v. Romania (5666/04 and 14664/05; only available in French and Romanian). The applicant considered his right to private life, as enshrined in Article 8 of the European Convention of Human Rights was breached because the Ministry of Justice refused him access to his evaluation file – which was created in a decision process with regard to his admission in the body of magistrates. The applicant passed the exam to become a magistrate, but he was informed by the procureur général that he would not be appointed as a magistrate because he does not have a good reputation, a condition imposed by Law no. 92/1992. According to the Court, “pour rendre cette décision, le ministère public se fonda sur plusieurs faits, tels qu’ils résultaient du dossier « personnel » (dosarul de personal) établi par le parquet près le tribunal départemental de Mehedinţi à la suite des recherches effectuées quant à la personne du requérant en 2000 et 2001. Il ressort de la décision du ministère que le dossier « personnel » était constitué de renseignements fournis par les anciens employeurs du requérant, par ses connaissances et par la police d’Orşova, des recommandations et d’autres documents.”

The applicant contested that decision in court and during the proceedings he also asked to be granted access to his file. However, he did so by invoking the right to access information of public interest. His request was rejected by the national courts, which argued that the information contained in the file is personal and not of public interest.

The ECHR considered in its decision that the applicant did not exhaust all the remedies in the national judicial system, because he did not ask for access to his file pursuant to Law 677/2001 for the protection of individuals with regard to the processing of personal data (which transposes Directive 95/46 in Romania).

ECHR stated in its decision that “La loi no 677/2001 décrit également la procédure à suivre par toute personne intéressée pour avoir accès aux données à caractère personnel classifiées et l’accès au tribunal est prévu par l’article 18 de cette loi (paragraphe 39 ci-dessus). Rien n’indique que le contrôle exercé par le tribunal est limité d’une quelconque manière, pour pouvoir douter d’emblée de l’efficacité d’un tel recours. Dans ces circonstances, la Cour considère que rien ne permet de penser que les dispositions de la loi no 677/2001 n’offraient pas au requérant la possibilité de faire redresser son grief, ou qu’il ne présentait aucune perspective raisonnable de succès” (para. 70).

In other words, the Court in Strasbourg expressed its expectation that a request as the one in the main proceedings grounded in the right to access personal data presents “a reasonable perspective of success.”

NOTES:

‘ I would like to thank Mihaela Mazilu-Babel for pointing out this AG Opinion.

” CJEU is expected to deliver its decision in 2014.