ASNEF – CJEU Judgment (European Union, 2011)

ASNEF and FECEMD challenged the [https://apdcat.gencat.cat/web/.content/01-autoritat/normativa/documentos/2643.pdf Spanish Royal Decree 1720/2007]. They claimed that [https://apdcat.gencat.cat/web/.content/01-autoritat/normativa/documentos/2643.pdf Article 10(2)(a) and (2)(b) of the Royal decree], allowing extra-EU data transfers without the consent of the data subject in specific instances provided by national law (i.e when the processing serves a legitimate interest of the controller, when it is necessary to fulfil a duty imposed on them, when the data is public accessible) is compatible with [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7(f) Dir.95/46], providing legal basis for data processing. Two questions were referred to the CJEU: 1. Must [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7(f) Dir.95/46] be interpreted as precluding the application of national rules which, in the absence of the interested party’s consent, and to allow processing of his personal data that is necessary to pursue a legitimate interest of the controller or of third parties to whom the data will be disclosed, not only require that fundamental rights and freedoms should not be prejudiced, but also require the data to appear in public sources? 2. Are the conditions for conferring on it direct effect met by [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7(f) Dir.95/46]? Answer to the first question The objective of ensuring an equivalent level of protection in all Member States that [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7 Dir.95/46] sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful. Thus, Member States cannot add new principles relating to the lawfulness of the processing of personal data to [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7 Dir.95/46] or impose additional requirements that have the effect of amending the scope of one of the six principles provided for in [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7 Dir.95/46]. The CJEU makes a distinction between national measures providing for additional requirements amending the scope of a principle laid out in [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7 Dir.95/46], and national measures providing for a mere classification of these principles. While the former are precluded, the latter enjoy a certain margin of discretion. In fact, the margin of discretion which Member States have pursuant to [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 5 Dir.95/46] can therefore be used only in accordance with the objective pursued by [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Directive 95/46] of maintaining a balance between the free movement of personal data and the protection of private life (C-101/01 Lindqvist, §97). In the case at hand, the CJEU held that [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7(f) Dir.95/46] precludes a Member State from excluding, in a categorical and generalised manner, the possibility of processing certain categories of personal data, without allowing the opposing rights and interests at issue to be balanced against each other in a particular case. Thus, [https://apdcat.gencat.cat/web/.content/01-autoritat/normativa/documentos/2643.pdf Article 10(2)(a) and (2)(b) of the Royal decree] is incompatible with [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7(f) Dir.95/46]. Answer to the second question The CJEU held that [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7(f) Dir.95/46] is a provision that is sufficiently precise to be relied on by an individual and applied by national courts. Thus, [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7(f) Dir.95/46] states am unconditional obligation (C-465/00 Osterreichischer Rundfunk and Others, §100) and thus has direct effect.