CJEU case C-740/22 Endemol Shine Finland – CJEU Judgment (European Union, 2024)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
A data subject participated in a competition organized by Endemol Shine Finland. The latter made an oral request to the Etelä-Savon käräjäoikeus (District Court, South Savo, Finland) for information on possible ongoing or completed criminal proceedings concerning the data subject, for the purpose of clarifying their criminal record. The district court refused the request. Following this, Endemol Shine Finland brought an appeal against the judgement before the Itä-Suomen hovioikeus (Court of Appeal, Eastern Finland, Finland). The latter stayed the proceedings and referred three questions to the CJEU: # Does an oral transfer of personal data constitute processing of personal data within the meaning of Article 2(1) and 4(2) GDPR # Can public access to official documents allow information on criminal convictions or offences to be obtained from a court’s register without restriction when the request is made orally? # Is it relevant whether the person requesting the information is a company or a private individual? On the first question: Article 4(2) GDPR defines “processing” as: any operation or set of operations which is performed on the personal data or on sets of personal data, whether or not by automated means. The Court determined that the use of “any operation” in this definition is intended to give the concept of “processing” a broad scope, which is corroborated by the non-exhaustive nature, expressed by the phrase “such as”. The Court added that Article 4(2) GDPR does not lay down any condition as to the form of processing meaning that the concept of processing covers the oral disclosure of personal data. The question still arose as to whether the oral disclosure of personal data falls within the material scope of the GDPR. Article 2(1) GDPR provides that the GDPR applies to the processing wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part
GDPR Articles Cited
A data subject participated in a competition organized by Endemol Shine Finland. The latter made an oral request to the Etelä-Savon käräjäoikeus (District Court, South Savo, Finland) for information on possible ongoing or completed criminal proceedings concerning the data subject, for the purpose of clarifying their criminal record. The district court refused the request. Following this, Endemol Shine Finland brought an appeal against the judgement before the Itä-Suomen hovioikeus (Court of Appeal, Eastern Finland, Finland). The latter stayed the proceedings and referred three questions to the CJEU: # Does an oral transfer of personal data constitute processing of personal data within the meaning of Article 2(1) and 4(2) GDPR # Can public access to official documents allow information on criminal convictions or offences to be obtained from a court’s register without restriction when the request is made orally? # Is it relevant whether the person requesting the information is a company or a private individual? On the first question: Article 4(2) GDPR defines “processing” as: any operation or set of operations which is performed on the personal data or on sets of personal data, whether or not by automated means. The Court determined that the use of “any operation” in this definition is intended to give the concept of “processing” a broad scope, which is corroborated by the non-exhaustive nature, expressed by the phrase “such as”. The Court added that Article 4(2) GDPR does not lay down any condition as to the form of processing meaning that the concept of processing covers the oral disclosure of personal data. The question still arose as to whether the oral disclosure of personal data falls within the material scope of the GDPR. Article 2(1) GDPR provides that the GDPR applies to the processing wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for CJEU case C-740/22 Endemol Shine Finland in EU
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. CJEU case C-740/22 Endemol Shine Finland - European Union (2024). Retrieved from cookiefines.eu
Last updated: