Data Protection Commissioner
Data Protection Commissioner

  


Case C 201/14
Bara and others - v - Președintele Casei Naționale de Asigurări de Sănătate, Casa Naţională de Asigurări de Sănătate and Agenţia Naţională de Administrare Fiscală (ANAF)
Judgement of the European Court of Justice dated 1st October 2015
concerning a data arrangement between two public bodies

Background:


The Applicants were Romanian self employed citizens who challenged the lawfulness of the transfer of their personal data by the National Tax Authority to the National Health Insurance under the Data Protection Directive 95/46/EC. Romanian law permitted the National Tax Authority to transfer “the data necessary to certify that the person concerned qualifies as an insured person are to be communicated free of charge to the health insurance funds by the authorities, public institutions or other institutions in accordance with a protocol”. However the Applicants maintained that the transfer of their personal data relating to income was not necessary to provide this certification. Consequently the Applicant’s argued that they did not have prior notice within the meaning of Article 10 of Directive 95/46 enabling the data controller (National Tax Authority) to dispense with their obligation to inform the persons from whom data relating to their income are collected as to the recipients of those data.
The Romanian Court of Appeal asked the European Court of Justice whether the Directive must be interpreted as precluding a public sector body from transferring personal data to another public sector body for the purpose of subsequent processing without the public sector bodies informing the data subjects of that transfer and processing.

Held:

In order to satisfy the requirement of fair processing of personal data under Article 10 of Directive 95/46/EC a public sector body must inform the data subjects in advance of the transfer of their personal data to another public sector body for the purposes of the recipient body unless it has already done so. Furthermore, the recipient controller of the data, in order to satisfy the fair processing requirements under Article 11(1) of Directive 95/46/EC, must also inform the data subject in advance as to their identify, the purpose of the processing and any further information necessary for the fair processing of the data.


In order to avail of any exemption to the obligation of fair processing (i.e informing the data subjects of the data sharing arrangement) as provided under Article 13(1)(e) and (f) of Directive 95/46/EC, a Member State must ensure that those exemptions are required and imposed by legislative measures.

Commentary:

This is a welcome decision from the European Court of Justice as it provides further clarity on the obligations and arrangements required to be in place before implementing and acting upon a data sharing arrangement.
In this case the national legislation allowed the transfer of personal data to certify whether a person qualifies as an insured person. The national law did not define either the transferable data or the detailed arrangements for transferring the data. Instead those details were outlined in a bilateral protocol (a non-legislative measure) agreed between two public sector bodies. The European Court of Justice noted that the data in question (data relating to income) was not necessary to determine whether someone qualifies as an insured person. Therefore the court was satisfied that the data subjects had not been informed in advance from the general legislative measure in question of the details of the data being shared and furthermore the Member State was unable to rely on the restrictions provided by Article 13(1)(e) and (f) of the Directive as the details of the arrangement and the exemption being relied upon had been provided in a protocol which was a non legislative measure.
The judgement re-iterates the importance to inform the data subject about the processing of their personal data is as it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, set out in Article 12 of Directive 95/46/EC and their right to object to the processing of data as set out in Article 14 of that Directive.

The consequences of this judgment are significant and potentially very far reaching. The Office of the Data Commissioner recommends that all public sector bodies complete a full review of their obligations and arrangements on the basis of the findings in this judgment to ensure that those arrangements are fully compliant with the Data Protection Directive 95/46/EC. In this regard all public sector bodies should read our best practice guidelines on data sharing.

Please also note the following links:

Judgment:

Full Text of the European Court of Justice Judgement (external site)
 

AG Opinion:

Full Text of the opinion of the Advocate General (external site)