Court of Justice of the European Union: Judgment in Case C-201/14 / Bara and Others
October 01, 2015
Persons whose personal data are subject to transfer and processing between two public administrative bodies must be informed in advance
The Data Protection Directive1 governs processing of personal data when they are contained within a filing system.
Ms Smaranda Bara and numerous other Romanian citizens are self-employed workers. The Romanian tax authority transferred data relating to their declared income to the National Health Insurance Fund, which then required the payment of arrears of contributions to the health insurance regime.
The persons concerned (data subjects) contested, before the Curtea de Apel Cluj (Court of Appeal, Cluj, Romania), the lawfulness of that transfer under the Directive. They submit that their data were used for purposes other than those for which those data had initially been communicated to the tax authority, without their prior explicit consent and without their having previously been informed.
Romanian law empowers public bodies to transfer personal data to the health insurance funds so that the latter may determine whether an individual qualifies as an insured person. The data concern the identification of persons (surname, first name, personal identity card number, address) but does not include data relating to income received.
In those circumstances, the Court of Appeal, Cluj, asks the Court of Justice, in essence, whether EU law precludes a public administrative body from transferring personal data to another public administrative body for the purpose of their subsequent processing, without the data subjects being informed of that transfer and processing.
In today’s judgment, the Court of Justice holds that the requirement of fair processing of personal data requires a public administrative body to inform the data subjects of the fact that their data will be transferred to another public administrative body for the purpose of their processing by the latter in its capacity as recipient of those data. The directive expressly requires that any restrictions on the requirement to provide information are imposed by legislative measures.
The Romanian law that provides for the free transfer of personal data to the National Health Insurance Fund does not constitute prior information that would allow the data controller to dispense with his obligation to provide prior information to the persons from whom data are collected. That law does not define either the transferable data or the detailed arrangements for transferring those data, which are to be found only in a bilateral protocol agreed between the tax authority and the Health Insurance Fund.
As regards the subsequent processing of the data transferred, the directive provides that a controller of data must inform the data subjects as to his own identity, the purpose of the processing, and any further information necessary to ensure the fair processing of the data. That further information includes the categories of data concerned and the existence of the right of access to and the right to rectify the data concerning him.
The Court observes that the National Health Insurance Fund’s processing of data transferred by the tax authority required informing the data subjects of the purposes of that processing and the categories of data concerned. In this case, the Health Insurance Fund had not provided that information.
The Court holds that EU law precludes the transfer and processing of personal data between two public administrative bodies without the persons concerned (data subjects) having been informed in advance.
1 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of European Union law or the validity of a European Union act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.
Source: Press release No. 110/15 - 01.10.2015 - http://curia.europa.eu/jcms/upload/docs/application/pdf/2015-10/cp150110en.pdf
