CJEU case C-710/23 Ministerstvo zdravotnictví – CJEU Judgment (Czech Republic, 2025)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
L.H. lodged a request with the Ministry of Health (the controller) for information concerning the identification of persons (the data subjects) who had signed contracts for the purchase of COVID-19 screening tests concluded by the controller, as well as certificates relating to those tests and demonstrating that they may be used on the territory of the EU. The controller partially granted L.H.’s request redacting the forename, surname, signature and position relating to the data subjects who had signed certificates on behalf of the legal persons concerned and, in some cases, the email address, telephone number and website of those legal persons. The reason to justify the redaction was the protection of the personal data of the data subjects referred to in those certificates, in accordance with the requirements of the GDPR. According to the controller, the data subjects operate from China and the United Kingdom, where the legal persons issuing the certificates are registered, and that the domicile of those is unknown to it. It is therefore impossible for the controller to inform and consult them on that subject. Czech case law provides for an obligation to inform or obtain the opinion of data subjects concerned by a disclosure request. L.H. brought an action for annulment of the controller’s decision to disclose only redacted information before the Prague City Court. The court upheld that action, holding that the controller could not refuse, as a matter of principle, to disclose information constituting personal data because it cannot first inform or obtain the opinion of the data subjects. The controller brought an appeal on a point of law against the decision before the Czech Supreme Administrative Court, which is the referring court. In that context, the that court stayed the proceedings referred in essence the following questions to the Court of Justice for a preliminary ruling: # Must Article 4(1) and (2) GDPR be interpreted as meaning that the disclosure
GDPR Articles Cited
L.H. lodged a request with the Ministry of Health (the controller) for information concerning the identification of persons (the data subjects) who had signed contracts for the purchase of COVID-19 screening tests concluded by the controller, as well as certificates relating to those tests and demonstrating that they may be used on the territory of the EU. The controller partially granted L.H.’s request redacting the forename, surname, signature and position relating to the data subjects who had signed certificates on behalf of the legal persons concerned and, in some cases, the email address, telephone number and website of those legal persons. The reason to justify the redaction was the protection of the personal data of the data subjects referred to in those certificates, in accordance with the requirements of the GDPR. According to the controller, the data subjects operate from China and the United Kingdom, where the legal persons issuing the certificates are registered, and that the domicile of those is unknown to it. It is therefore impossible for the controller to inform and consult them on that subject. Czech case law provides for an obligation to inform or obtain the opinion of data subjects concerned by a disclosure request. L.H. brought an action for annulment of the controller’s decision to disclose only redacted information before the Prague City Court. The court upheld that action, holding that the controller could not refuse, as a matter of principle, to disclose information constituting personal data because it cannot first inform or obtain the opinion of the data subjects. The controller brought an appeal on a point of law against the decision before the Czech Supreme Administrative Court, which is the referring court. In that context, the that court stayed the proceedings referred in essence the following questions to the Court of Justice for a preliminary ruling: # Must Article 4(1) and (2) GDPR be interpreted as meaning that the disclosure
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for CJEU case C-710/23 Ministerstvo zdravotnictví in CZ
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. CJEU case C-710/23 Ministerstvo zdravotnictví - Czech Republic (2025). Retrieved from cookiefines.eu
Last updated: