CJEU, 3rd chamber, November 24, 2011, No C-468/10

THE COURT (Third Chamber),

1 These references for a preliminary ruling concern the interpretation of Article 7(f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).

2 The references have been made in two sets of proceedings between, on the one hand, Asociación Nacional de Establecimientos Financieros de Crédito (National Association of Credit Institutions) ('ASNEF'), in the first case, and Federación de Comercio Electrónico y Marketing Directo (Federation of Electronic Commerce and Direct Marketing) ('FECEMD'), in the second case, and, on the other, the Administración del Estado.

Legal context

European Union ('EU') law

Directive 95/46

3 Recitals 7, 8 and 10 in the preamble to Directive 95/46 read as follows:

'(7) ... the difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory of one Member State to that of another Member State; ... this difference may therefore constitute an obstacle to the pursuit of a number of economic activities at Community level, distort competition and impede authorities in the discharge of their responsibilities under Community law; ... this difference in levels of protection is due to the existence of a wide variety of national laws, regulations and administrative provisions;

(8) ..., in order to remove the obstacles to flows of personal data, the level of protection of the rights and freedoms of individuals with regard to the processing of such data must be equivalent in all Member States; ... this objective is vital to the internal market but cannot be achieved by the Member States alone, especially in view of the scale of the divergences which currently exist between the relevant laws in the Member States and the need to coordinate the laws of the Member States so as to ensure that the cross-border flow of personal data is regulated in a consistent manner that is in keeping with the objective of the internal market ...; ... Community action to approximate those laws is therefore needed;

...

(10) ... the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms [signed in Rome on 4 November 1950 ('the ECHR')] and in the general principles of Community law; ..., for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community'.

4 Article 1 of Directive 95/46, entitled 'Object of the Directive', is drafted in the following terms:

'1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.

2. Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection afforded under paragraph 1.'

5 Article 5 of Directive 95/46 is worded as follows:

'Member States shall, within the limits of the provisions of this Chapter, determine more precisely the conditions under which the processing of personal data is lawful.'

6 Article 7 of Directive 95/46 states:

'Member States shall provide that personal data may be processed only if:

(a) the data subject has unambiguously given his consent; or

...

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection under Article 1(1).'

7 Article 13(1) of Directive 95/46 provides:

'Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary measure to safeguard:

(a) national security;

(b) defence;

(c) public security;

(d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;

(e) an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters;

(f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e);

(g) the protection of the data subject or of the rights and freedoms of others.'

National law

Organic Law 15/1999

8 Organic Law 15/1999 on the protection of personal data (BOE no 298 of 14 December 1999, p. 43088) transposes Directive 95/46 into Spanish law.

9 Article 3(j) of Organic Law 15/1999 sets out 'public sources' in an exhaustive and restrictive list, which reads as follows:

'... those files that can be consulted by any person, unhindered by a limiting provision or by any requirement other than, where relevant, payment of a fee. Public sources are, exclusively, the electoral roll, telephone directories subject to the conditions laid down in the relevant regulations and lists of persons belonging to professional associations containing only data on the name, title, profession, activity, academic degree, address and an indication of membership of the association. Newspapers and official bulletins and the media are also public sources.'

10 Article 6(1) of Organic Law 15/1999 makes the processing of data subject to the data subject's unambiguous consent, unless otherwise provided by law. Thus, Article 6(2), in fine, of Organic Law 15/1999 provides that consent is not required, inter alia, '... when the data are included in public sources and their processing is necessary for the purposes of the legitimate interests pursued by the controller of the file or by the third party to whom the data are disclosed, except where this infringes the fundamental rights and freedoms of the data subject.'

11 Article 11(1) of Organic Law 15/1999 reiterates the need for the data subject's consent in order to disclose personal data to third parties, while Article 11(2), however, provides that that consent is not necessary, inter alia, in relation to data appearing in public sources.

Royal Decree 1720/2007

12 The Spanish Government implemented Organic Law 15/1999 by way of Royal Decree 1720/2007 (BOE No 17 of 19 January 2008, p. 4103).

13 Article 10(1) of Royal Decree 1720/2007 allows the processing and transfer of personal data in cases where the data subject has given prior consent.

14 However, Article 10(2) of Royal Decree 1720/2007 provides:

'... personal data may be processed or transferred without the data subject's consent when:

(a) it is authorised by a regulation having the force of law or under Community law and, in particular, when one of the following situations applies:

- the purpose of the processing or transfer is to satisfy a legitimate interest of the data controller or recipient guaranteed by these rules, as long as the interest or fundamental rights and liberties of the data subjects, as provided in Article 1 of Organic Law 15/1999 of 13 December, are not overriding;

- the processing or transfer of data is necessary in order for the data controller to fulfil a duty imposed upon him by one of those provisions;

(b) the data which are the subject of processing or transfer are in sources accessible to the public and the data controller, or the third party to whom data has been communicated, has a legitimate interest in their processing or knowledge, as long as the fundamental rights and liberties of the data subject are not breached.

The aforesaid notwithstanding, the public administration may communicate the data collected from sources accessible to the public to the data controllers of privately owned files pursuant to this subsection only when they are so authorised by a regulation having the force of law.'

The disputes in the main proceedings and the questions referred for a preliminary ruling

15 ASNEF, on the one hand, and FECEMD, on the other hand, have brought administrative proceedings challenging several articles of Royal Decree 1720/2007.

16 Among the contested provisions are the first indent of Article 10(2)(a) and the first subparagraph of Article 10(2)(b) of Royal Decree 1720/2007, which ASNEF and FECEMD believe are in breach of Article 7(f) of Directive 95/46.

17 In particular, ASNEF and FECEMD take the view that Spanish law adds, to the condition relating to the legitimate interest in data processing without the data subject's consent, a condition, which does not exist in Directive 95/46, to the effect that the data should appear in public sources.

18 The Tribunal Supremo (Supreme Court, Spain) considers that the merits of the actions brought by ASNEF and FECEMD respectively depend to a large extent on the interpretation by the Court of Article 7(f) of Directive 95/46. Accordingly, it states that, if the Court were to hold that Member States are not entitled to add extra conditions to those required by that provision, and if that provision were to be found to have direct effect, Article 10(2)(b) of Royal Decree 1720/2007 would have to be set aside.

19 The Tribunal Supremo explains that, in the absence of the data subject's consent, and in order to allow processing of that data subject's personal data that is necessary to pursue a legitimate interest of the data controller or of the third party or parties to whom those data are disclosed, Spanish law requires not only that the fundamental rights and freedoms of the data subject be respected, but also that the data appear in the files listed in Article 3(j) of Organic Law 15/1999. In that regard, it takes the view that Organic Law 15/1999 and Royal Decree 1720/2007 restrict the scope of Article 7(f) of Directive 95/46.

20 In the view of the Tribunal Supremo, that restriction constitutes a barrier to the free movement of personal data that is compatible with Directive 95/46 only if the interest or the fundamental rights and freedoms of the data subject so require. It concludes that the only way to avoid a contradiction between Directive 95/46 and Spanish law is to hold that the free movement of personal data appearing in files other than those listed in Article 3(j) of Organic Law 15/1999 infringes the interest or the fundamental rights and freedoms of the data subject.

21 However, the Tribunal Supremo is unsure whether such an interpretation is in accordance with the intention of the EU legislature.

22 In those circumstances, being of the view that the outcome of both the cases before it depends on the interpretation of provisions of EU law, the Tribunal Supremo decided to stay the proceedings and to refer the following questions, which are formulated in identical terms in both cases, to the Court for a preliminary ruling:

'(1) Must Article 7(f) of [Directive 95/46] be interpreted as precluding the application of national rules which, in the absence of the interested party's consent, and to allow processing of his personal data that is necessary to pursue a legitimate interest of the controller or of third parties to whom the data will be disclosed, not only require that fundamental rights and freedoms should not be prejudiced, but also require the data to appear in public sources?

(2) Are the conditions for conferring on it direct effect, set out in the case-law of the Court ... met by the abovementioned Article 7(f)?'

23 By order of the President of the Court of 26 October 2010, Cases C-468/10 and C-469/10 were joined for the purposes of the written and oral procedure and the judgment.

Consideration of the questions referred

The first question

24 By its first question, the national court asks, in essence, whether Article 7(f) of Directive 95/46 must be interpreted as precluding national rules which, in the absence of the data subject's consent, and in order to allow such processing of that data subject's personal data as is necessary to pursue a legitimate interest of the data controller or of the third party or parties to whom the data are disclosed, requires not only that the fundamental rights and freedoms of the data subject be respected, but also that the data should appear in public sources.

25 Article 1 of Directive 95/46 requires Member States to ensure the protection of the fundamental rights and freedoms of natural persons, and in particular their privacy, in relation to the handling of personal data (see, to that effect, Case C-524/06 Huber [2008] ECR I-9705, paragraph 47).

26 In accordance with the provisions of Chapter II of Directive 95/46, entitled 'General rules on the lawfulness of the processing of personal data', all processing of personal data must, subject to the exceptions permitted under Article 13, comply, first, with the principles relating to data quality set out in Article 6 of Directive 95/46 and, secondly, with one of the six principles for making data processing legitimate listed in Article 7 of Directive 95/46 (see, to that effect, Joined Cases C-465/00, C-138/01 and C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989, paragraph 65, and Huber, paragraph 48).

27 According to recital 7 in the preamble to Directive 95/46, the establishment and functioning of the internal market are liable to be seriously affected by differences in national rules applicable to the processing of personal data (Case C-101/01 Lindqvist [2003] ECR I-12971, paragraph 79).

28 In that context, it must be noted that Directive 95/46 is intended, as appears from, inter alia, recital 8 in the preamble thereto, to ensure that the level of protection of the rights and freedoms of individuals with regard to the processing of personal data is equivalent in all Member States. Recital 10 adds that the approximation of the national laws applicable in this area must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the EU (see, to that effect, Lindqvist, paragraph 95, and Huber, paragraph 50).

29 Accordingly, it has been held that the harmonisation of those national laws is not limited to minimal harmonisation but amounts to harmonisation which is generally complete. It is upon that view that Directive 95/46 is intended to ensure free movement of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate (Lindqvist, paragraph 96).

30 Consequently, it follows from the objective of ensuring an equivalent level of protection in all Member States that Article 7 of Directive 95/46 sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful.

31 That interpretation is corroborated by the term 'may be processed only if' and its juxtaposition with 'or' contained in Article 7 of Directive 95/46, which demonstrate the exhaustive and restrictive nature of the list appearing in that article.

32 It follows that Member States cannot add new principles relating to the lawfulness of the processing of personal data to Article 7 of Directive 95/46 or impose additional requirements that have the effect of amending the scope of one of the six principles provided for in Article 7.

33 The foregoing interpretation is not brought into question by Article 5 of Directive 95/46. Article 5 merely authorises Member States to specify, within the limits of Chapter II of that directive and, accordingly, Article 7 thereof, the conditions under which the processing of personal data is lawful.

34 The margin of discretion which Member States have pursuant to Article 5 can therefore be used only in accordance with the objective pursued by Directive 95/46 of maintaining a balance between the free movement of personal data and the protection of private life (Lindqvist, paragraph 97).

35 Directive 95/46 includes rules with a degree of flexibility and, in many instances, leaves to the Member States the task of deciding the details or choosing between options (Lindqvist, paragraph 83). A distinction, consequently, must be made between national measures that provide for additional requirements amending the scope of a principle referred to in Article 7 of Directive 95/46, on the one hand, and national measures which provide for a mere clarification of one of those principles, on the other hand. The first type of national measure is precluded. It is only in the context of the second type of national measure that Member States have, pursuant to Article 5 of Directive 95/46, a margin of discretion.

36 It follows that, under Article 5 of Directive 95/46, Member States also cannot introduce principles relating to the lawfulness of the processing of personal data other than those listed in Article 7 thereof, nor can they amend, by additional requirements, the scope of the six principles provided for in Article 7.

37 In the present cases, Article 7(f) of Directive 95/46 provides that the processing of personal data is lawful if it is 'necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection under Article 1(1)'.

38 Article 7(f) sets out two cumulative conditions that must be fulfilled in order for the processing of personal data to be lawful: firstly, the processing of the personal data must be necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed; and, secondly, such interests must not be overridden by the fundamental rights and freedoms of the data subject.

39 It follows that, in relation to the processing of personal data, Article 7(f) of Directive 95/46 precludes any national rules which, in the absence of the data subject's consent, impose requirements that are additional to the two cumulative conditions set out in the preceding paragraph.

40 However, account must be taken of the fact that the second of those conditions necessitates a balancing of the opposing rights and interests concerned which depends, in principle, on the individual circumstances of the particular case in question and in the context of which the person or the institution which carries out the balancing must take account of the significance of the data subject's rights arising from Articles 7 and 8 of the Charter of Fundamental Rights of the European Union ('the Charter').

41 In this regard, it must be noted that Article 8(1) of the Charter states that '[e]veryone has the right to the protection of personal data concerning him or her'. That fundamental right is closely connected with the right to respect for private life expressed in Article 7 of the Charter (Joined Cases C-92/09 and C-93/09 Volker und Markus Schecke and Eifert [2010] ECR I-0000, paragraph 47).

42 According to the Court's case-law, the right to respect for private life with regard to the processing of personal data, recognised by Articles 7 and 8 of the Charter, concerns any information relating to an identified or identifiable individual (Volker und Markus Schecke and Eifert, paragraph 52). However, it follows from Articles 8(2) and 52(1) of the Charter that, under certain conditions, limitations may be imposed on that right.

43 Moreover, Member States must, when transposing Directive 95/46, take care to rely on an interpretation of that directive which allows a fair balance to be struck between the various fundamental rights and freedoms protected by the EU legal order (see, by analogy, Case C-275/06 Promusicae [2008] ECR I-271, paragraph 68).

44 In relation to the balancing which is necessary pursuant to Article 7(f) of Directive 95/46, it is possible to take into consideration the fact that the seriousness of the infringement of the data subject's fundamental rights resulting from that processing can vary depending on whether or not the data in question already appear in public sources.

45 Unlike the processing of data appearing in public sources, the processing of data appearing in non-public sources necessarily implies that information relating to the data subject's private life will thereafter be known by the data controller and, as the case may be, by the third party or parties to whom the data are disclosed. This more serious infringement of the data subject's rights enshrined in Articles 7 and 8 of the Charter must be properly taken into account by being balanced against the legitimate interest pursued by the data controller or by the third party or parties to whom the data are disclosed.

46 In that regard, it must be noted that there is nothing to preclude Member States, in the exercise of their discretion laid down in Article 5 of Directive 95/46, from establishing guidelines in respect of that balancing.

47 However, it is no longer a precision within the meaning of Article 5 of Directive 95/46 if national rules exclude the possibility of processing certain categories of personal data by definitively prescribing, for those categories, the result of the balancing of the opposing rights and interests, without allowing a different result by virtue of the particular circumstances of an individual case.

48 Consequently, without prejudice to Article 8 of Directive 95/46 concerning the processing of particular categories of data, a provision which is not at issue in the main proceedings, Article 7(f) of that directive precludes a Member State from excluding, in a categorical and generalised manner, the possibility of processing certain categories of personal data, without allowing the opposing rights and interests at issue to be balanced against each other in a particular case.

49 In light of those considerations, the answer to the first question is that Article 7(f) of Directive 95/46 must be interpreted as precluding national rules which, in the absence of the data subject's consent, and in order to allow such processing of that data subject's personal data as is necessary to pursue a legitimate interest of the data controller or of the third party or parties to whom those data are disclosed, require not only that the fundamental rights and freedoms of the data subject be respected, but also that those data should appear in public sources, thereby excluding, in a categorical and generalised way, any processing of data not appearing in such sources.

The second question

50 By its second question, the national court asks, in essence, whether Article 7(f) of Directive 95/46 has direct effect.

51 In that regard, it must be recalled that, according to settled case-law of the Court, whenever the provisions of a directive appear, so far as their subject-matter is concerned, to be unconditional and sufficiently precise, they may be relied on before the national courts by individuals against the State where the latter has failed to implement that directive in domestic law by the end of the period prescribed or where it has failed to implement that directive correctly (see Case C-203/10 Auto Nikolovi [2011] ECR I-0000, paragraph 61 and the case-law cited).

52 It must be stated that Article 7(f) of Directive 95/46 is a provision that is sufficiently precise to be relied on by an individual and applied by the national courts. Moreover, while that directive undoubtedly confers on the Member States a greater or lesser discretion in the implementation of some of its provisions, Article 7(f), for its part, states an unconditional obligation (see, by analogy, Österreichischer Rundfunk and Others, paragraph 100).

53 The use of the expression 'except where' in the actual text of Article 7(f) of Directive 95/46 is not such, by itself, as to cast doubt on the unconditional nature of that provision, within the meaning of that case-law.

54 That expression is intended to establish one of the two cumulative elements provided for in Article 7(f) of Directive 95/46 to which the possibility of processing personal data without the data subject's consent is subject. As that element is defined, it does not deprive Article 7(f) of its precise and unconditional nature.

55 The answer to the second question is therefore that Article 7(f) of Directive 95/46 has direct effect.

Costs

56 Since these proceedings are, for the parties to the main proceedings, a step in the actions pending before the national court, the decisions on costs are a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Third Chamber) hereby rules:

1. Article 7(f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as precluding national rules which, in the absence of the data subject's consent, and in order to allow such processing of that data subject's personal data as is necessary to pursue a legitimate interest of the data controller or of the third party or parties to whom those data are disclosed, require not only that the fundamental rights and freedoms of the data subject be respected, but also that the data should appear in public sources, thereby excluding, in a categorical and generalised way, any processing of data not appearing in such sources.

2. Article 7(f) of Directive 95/46 has direct effect.