# The Conciliation Of Transparency Measures with the Processing of Possibly Sensitive Data by the Administration According to the French Administrative Judge

## Alexandre Lodie

### ► To cite this version:

Alexandre Lodie. The Conciliation Of Transparency Measures with the Processing of Possibly Sensitive Data by the Administration According to the French Administrative Judge. European Review of Digital Administration & Law, In press, 3 (2), pp.233-239. 10.53136/979122180798120. hal-04299614

HAL Id: hal-04299614

https://hal.science/hal-04299614v1

Submitted on 22 Nov 2023

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# The Conciliation Of Transparency Measures with the Processing of Possibly Sensitive Data by the Administration According to the French Administrative Judge*

Alexandre Lodie

(Doctor of International Law – Research Fellow at INRIA Grenoble)

French Council of State, Decision n. 431875, 10 June 2021

The publication, on the French Ministry of Economy and Finance's website, of a Civil servant's appointment order whose legal basis lies on a decree concerning the access of disabled persons to state functions constitutes processing of data by automated means according to the Council of State. However, in judges' view, such processing cannot be seen as processing data "concerning health" pursuant to Article 9 of the GDPR.

## ABSTRACT :

In this case, the plaintiff is a civil servant who has been appointed as Inspector of Finance according to a decree concerning the access of disabled persons to state functions. As provided by French Law, the appointment order – containing the legal basis of the nomination - was published on the Ministry of Economy and Finance's website. The claimant considered that the publication infringed his right to privacy and did not comply with the GDPR. In this decision, and contrary to what the Court of Appeal claimed, the Council of State concludes that the publication of the appointment order on the administration's website constitutes processing of data by automated means and is thus subject to the GDPR. However, since the appointment order does not reveal the nature of the disability, nor its seriousness, the Conseil d'Etat considers that it does not constitute processing of data concerning health. Such a decision seems to acknowledge a restrictive view of what constitutes "sensitive" data, which would not be in line with ECJ case law. Eventually, the Judges asked the administration to delete the mention of the decree in the appointment order as the appointment decision's period of appeal was over. Maintaining this information online was no longer necessary to achieve the purpose of the processing according to the French Administrative Judge.

## 1. Introduction

The free flow of data has become a central concern for the European market, as emphasised by the European Data Protection Supervisor (EDPS), Wojciech Wiewiorowski, who stated during the G7 DPA Roundtable in September 2022 that the "free flow of data is not only necessary to our digital economies and societies but even a precondition for a world placed under the auspices of cooperation and multilateralism".<fnref n="1" /> This issue is related to the Big Data phenomenon which designates the inflation of data available online be they "generated from online transactions, emails, videos, audios, images, click streams, logs, posts, search queries, health records, social networking interactions, science data, sensors and mobile phone".<fnref n="2" />

Public administration and public bodies are no exception when it comes to processing and storing data. As such, they must be considered as a data-sharing stakeholder, hence the proposal on the European level of the Data Governance Act which aims "to address the barriers to a well-functioning data-driven economy and to create a Union-wide governance framework for data access and use, in particular regarding the re-use of certain types of data held by the public

<footnote>* Article submitted to double blind peer review.</footnote>

<footnote>This work has been supported by the ANR 22-PECY-0002 IPOP (Interdisciplinary Project on Privacy) project of the Cybersecurity PEPR and by Inria action-exploratoire DATA4US.</footnote>

<footnote n="1">¹ EDPS, *Data free flow with trust and international data spaces from an EU perspective*, G7 DPA Roundtable 2022, Bonn, 7 September 2022.</footnote>

<footnote n="2">² S. Sagiroglu and D. Sinanc, *Big Data: A Review*, in *International conference on collaboration technologies and systems (CTS)*, Institute of Electrical and Electronics Engineers, 2013, 42.</footnote>
sector”.<fnref n="3" />

Besides, States and public administration are encouraged to publish their data to improve the transparency of the public life and decision-making processes, it is what some States call “open data” policies.<fnref n="4" /> However, such a wide data disclosure might sometimes run contrary to individuals’ data protection. This issue is all the more critical when sensitive data related to health, cultural or ethnic origin, political opinions, sexual orientation are at stake.<fnref n="5" />

The French Highest Administrative Court (Conseil d'État) released in 2021 a decision on the conciliation between the publication of administrative documents on the one hand and the protection of individuals' data, including sensitive data, on the other.<fnref n="6" />

In this case, a public agent had been nominated as Inspector of Finance by virtue of a decree bearing on the access of disabled persons to state functions.<fnref n="7" /> The appointment order, mentioning the said decree, was consequently published on the website of the Ministry of Economy and Finance. The agent considered that such a publication constituted a violation of his private life and did not comply with the GDPR. He asked French administrative Courts to delete his name and date of birth from the appointment order. In front of their refusal, the case was brought to the Conseil d'État, which is the French Highest Administrative Court.

From this background the Conseil d'État had to settle several issues such as whether the publication of said appointment order constituted data processing by automated means subject to the GDPR. Then the Conseil d'État had to determine whether such processing could be seen as "data processing concerning health" as regards Article 9 of the GDPR.

This decision thus questions in a broader manner what can be considered as data processing by automated means, what sensitive data really are and how to conciliate the duty of the administration to publish administrative documents on the one hand with individuals' right to data protection on the other.

## 2. A broad conception of “data processing” in accordance with the ECJ view

One of the arguments put forward by the claimant was that the publication of the appointment order infringed European data protection law, including the GDPR. The problem was that the Appellate Court dismissed the application of the GDPR to the case since it claimed that “neither the publication by computerised means of a decree appointing public servants containing only the names of the persons concerned and an indication of the legal basis for their appointment, nor the decision refusing to put an end to this publication, could be regarded as relating to the processing of personal data by electronic means”.<fnref n="8" /> In other words, the Appellate Court considered that the publication of the appointment order did not constitute data processing, within the meaning of the GDPR.

The Conseil d'État however disapproved such a view, and repealed this decision by stating that "in rejecting the application of these rules, when the mere publication of personal data on

<footnote n="3">³ Proposal for a Regulation of the European Parliament and of the Council on European data governance (Data Governance Act), COM (2020) 767 final, 25 November 2020.</footnote>

<footnote n="4">⁴ See Commission Nationale de l'Informatique et des Liberté (CNIL), *Publication en ligne et réutilisation des données publiques* (« open data »), available at: www.cnil.fr/fr/publication-en-ligne-et-reutilisation-des-donnees-publiques-open-data.</footnote>

<footnote n="5">⁵ See Article 9 of the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and the free movement of such data (General Data Protection Regulation).</footnote>

<footnote n="6">⁶ Conseil d'État, 10ème - 9ème chambres réunies, 10 June 2021, no. 431875.</footnote>

<footnote n="7">⁷ See Decree no. 95-979 of 25 August 1995, on the recruitment of disabled workers in the civil service, in application of article 27 of law no. 84-16 of 11 January 1984 on statutory provisions relating to the civil service.</footnote>

<footnote n="8">⁸ Conseil d'État, 10ème - 9ème chambres réunies, 10 June 2021, no. 431875 (Our translation)</footnote>
### 3.1. A narrow interpretation of health data

Once the Conseil d'État acknowledged that the GDPR applied, it had to determine whether such processing – which was indirectly revealing<fnref n="16" /> the health status of the data subject – constituted processing concerning health data.<fnref n="17" />

Health data is a category of data which is defined pretty broadly by EU data protection law as “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status”.<fnref n="18" /> For instance, in the Lindqvist case cited previously the ECJ claimed that “the expression data concerning health [...] must be given a wide interpretation so as to include information concerning all aspects, both physical and mental, of the health of an individual”<fnref n="19" /> and that “reference to the fact that an individual has injured her foot and is on half-time on medical grounds constitutes personal data concerning health”.<fnref n="20" />

A semantic clarification must be made as a preamble: Article 9 makes a distinction between “processing of personal data revealing racial or ethnic origin, political opinions [...]”<fnref n="21" /> on the one hand and “data concerning health”,<fnref n="22" /> on the other. This distinction suggests that while an indirect connection between the processing and the nature of the data is enough to consider certain processing as processing of special categories of data, the connection must be direct when considering health data. However, this interpretation has been rejected by the ECJ which considered that “personal data concerning health should include all data pertaining to the health status of a data subject which “reveal” information relating to the past, current or future physical or mental health status of the data subject”.<fnref n="23" />

Interestingly, the Conseil d'État does not reach the same conclusion at all, as it claims that “although the posting of such information online indirectly reveals that the persons recruited in this capacity suffer from a disability, it does not directly provide any information on the nature or seriousness of this disability and cannot therefore be regarded as processing data relating to the health of the persons concerned”.<fnref n="24" /> The degree of seriousness of a disability or an injury or the specificity of a disability are not relevant criteria as regards Article 9 of the GDPR, so such a statement by the Court can be a bit surprising.

The Court's reasoning does not seem to be consistent, in the sense that it acknowledges that the processing involved indirectly reveals that the data subject suffers from a disability, but at the same time, it refuses to draw the right conclusion from this statement and to consider such processing as processing of “special categories of data” while the latter encompasses processing of data “pertaining to the health status”<fnref n="25" /> of a data subject.

It is worth recalling that it is not the first time that the Conseil d'État makes the connection between the seriousness or nature of an injury or disability and the qualification of data as “data concerning health”. For instance, in a decision which dates back from 2014, the Court stated that “the mention of the permanent incapacity rate or the disability rate of the "spouse or partner" and of the staff member's dependents is not data "relating to health" [...] since it is

<footnote n="16">¹⁶ S. Wachter and B. Mittelstadt, *A Right to Reasonable Inferences: Re-Thinking Data Protection Law in the Age of Big Data and AI*, in *Columbia Business Law Review*, no. 2, 2019, 563.</footnote>

<footnote n="17">¹⁷ See Article 9 of the GDPR.</footnote>

<footnote n="18">¹⁸ See Article 4 (15) of the GDPR.</footnote>

<footnote n="19">¹⁹ See ECJ, *Bodil Lindqvist*, note 10 above, § 50.</footnote>

<footnote n="20">²⁰ *Ibidem*, § 51.</footnote>

<footnote n="21">²¹ See Article 9 of the GDPR.</footnote>

<footnote n="22">²² *Ibidem*.</footnote>

<footnote n="23">²³ ECJ, Grand Chamber, 1 August 2022, case C-184/20, *OT v Vyriausioji tarnybinės etikos komisija*, § 124.</footnote>

<footnote n="24">²⁴ Conseil d'État, 10ème - 9ème chambres réunies, 10 June 2021, no. 431875 (Our translation).</footnote>

<footnote n="25">²⁵ See Recital 35 of the GDPR.</footnote>
not even alleged that it would provide information on the nature of the disability”.<fnref n="26" /> The Court concluded in the same manner in relation to a file on education facilities which contained also information relating to care facilities where pupils can be enrolled.<fnref n="27" />

From a broader perspective this decision questions how to determine when data processing must be considered as processing bearing on “special categories of data”.

### 3.2. A decision in conflict with the European view on what constitutes “special categories of data”

As mentioned previously the Conseil d'État adopted a quite narrow definition of what “health data” are while this category refers to “special categories” of data which benefit from additional protections under the GDPR.<fnref n="28" />

Very few case law are related to the specific issue of which data can be considered as “indirectly revealing” sensitive characteristics and thus as “special categories” of data. Furthermore, none of them – to our knowledge – refers to data revealing the health status of a data subject. However, it is worth analysing what the ECJ and data protection authorities throughout the EU have stated as regards data revealing sensitive characteristics, although such case law do not bear on health data.

The ECJ got referred lately for a preliminary ruling, in a case involving transparency measures required by the administration on the one hand and sensitive data protection issues on the other. The question that the Court had to settle was thus pretty similar to the Conseil d'État's, although not bearing on health data but on other sensitive data provided for by Article 9 of the GDPR.

In this case, the director of a Lithuanian public body had to release a declaration of interest containing several personal information about him and his partner, which was likely to reveal at least some sensitive characteristics, such as his sexual orientation.<fnref n="29" /> Said declaration of interest was intended to be published, as required by Lithuanian Law. The ECJ was therefore asked to determine whether such data processing could be considered as processing sensitive data.

The ECJ concluded that “the publication, on the website of the public authority responsible for collecting and checking the content of declarations of private interests, of personal data that are liable to disclose indirectly the sexual orientation of a natural person constitutes processing of special categories of personal data”.<fnref n="30" /> Even though the processing was not directly related to the sexual orientation of the data subjects the ECJ considered that it was processing of special categories of data.

The ECJ, in its decision, does not make any relationship between the nature or specificity of sensitive characteristics and the nature of the data processing as “sensitive”, lying in the scope of Article 9 of the GDPR. It is also possible to consider that the ECJ, in the above-mentioned Lithuanian use case<fnref n="31" /> reached this conclusion because the information contained in the declaration of interest was revealing a specific sexual orientation, but such an interpretation would be far-fetched since the Court does not say anything on this specific point.

The decision of the Conseil d'État was released one year earlier, so it could not foresee

<footnote n="26">²⁶ Conseil d'État, 10ème / 9ème sous-sections réunies, 28 March 2014, no. 36104 (Our translation).</footnote>

<footnote n="27">²⁷ Conseil d'État, 10ème et 9ème sous-sections réunies, 19 July 2010, no. 334014.</footnote>

<footnote n="28">²⁸ See Article 9 of the GDPR.</footnote>

<footnote n="29">²⁹ ECJ, Grand Chamber, 1 August 2022, case C-184/20, *OT v Vyriausioji tarnybinės etikos komisija*.</footnote>

<footnote n="30">³⁰ *Ibidem*.</footnote>

<footnote n="31">³¹ *Ibidem*.</footnote>
what the ECJ would have stated in such a situation. However, one could have expected the Conseil d'État to follow a similar reasoning to that of the ECJ even though the nature of the data concerned was not exactly the same.

In any case, the view expressed by the Conseil d'État is likely to limit strongly the scope of Article 9 of the GDPR and the protection of individuals' sensitive characteristics. Such a restrictive view is all the more surprising that, in any case, the administration could have relied upon the "substantial public interest"<fnref n="32" /> exception. In other words, even if the Conseil d'État had acknowledged that the online publication of an appointment order containing sensitive information constituted processing of "special categories of data", French administration would have possibly been able to carry out such processing since the publication of civil servants' appointment orders is mandatory under French Law and possibly serves a substantial public interest. The judges interestingly mention the exception of substantial public interest by citing the GDPR, without further explanation. It suggests that the administration could possibly rely on this exception.

To summarise, the Conseil d'État adopts a restrictive view of what constitutes processing of data concerning health, claiming that the sensitive nature of the data (and consequent processing) depends on the specificity and seriousness of the disability.

It is worth noting that the Norwegian DPA also had to address a similar issue and adopted a view which can be considered as the opposite of the Conseil d'État's reasoning on whether data need to be precise to be considered as data of a sensitive nature.

In this case the data protection authority had to determine whether a dating app for LGBTQI+ people processes data of a sensitive nature by revealing data subjects' sexual orientation. The Norwegian Datatilsynet claimed that "being a Grindr user strongly indicates, and appears in most cases to accurately reflect, that the data subject belongs to a sexual minority. [...] As established above, the wording of Article 9 does not require a revealing of a particular "sexual orientation", and the purpose behind Article 9 discourages a narrow interpretation".<fnref n="33" />

Even though this use case does not deal with data concerning health, it bears on the interpretation of what processing of "special categories of data" actually is. According to the Norwegian DPA, Article 9 of the GDPR must be interpreted in a broad manner, which indicates that the processing does not need to reveal a specific sexual orientation to be considered as processing of sensitive data.<fnref n="34" /> In particular the company argued for its defense that everyone can subscribe to its services and not only LGBTQI+ people, so that the fact of being a Grindr user is not an indication of the user's specific sexual orientation. Despite this argument, the DPA concluded that the use of Grindr was a strong indication of one's sexual orientation, which means that it is reasonable to think that a Grindr's user belongs to a sexual minority.<fnref n="35" /> In this case the sensitive characteristic is deduced and not specific, but the Datatilsynet still claimed that this was sufficient to consider the processing as processing of "special categories of data".

The debate on how specific data must be to qualify their processing as processing of sensitive data remains open. For instance, the EDPB claims, considering the relation between video devices and sensitive data, that "video footage showing a data subject wearing glasses

<footnote n="32">³² See Article 9 of the GDPR.</footnote>

<footnote n="33">³³ See Datatilsynet, 13 December 2021, 20/02136-18, Administrative fine - Grindr LLC.</footnote>

<footnote n="34">³⁴ *Ibidem*.</footnote>

<footnote n="35">³⁵ *Ibidem*.</footnote>
or using a wheel chair are not per se considered to be special categories of personal data".<fnref n="36" />
However, the processing of a video stream showing individuals who suffer from a disability
would logically be seen as data concerning their health status. On the other hand, it would be
impossible to acknowledge such an extreme view since almost every data processing would
be qualified as processing of sensitive data.

Whereas the Conseil d'État stated that the seriousness and the nature of an injury were
decisive factors to consider whether data are of sensitive nature, the Norwegian DPA claimed
that a piece of information does not need to reveal a specific sexual orientation to be qualified
as “sensitive”. From this background it can be concluded that it can be hard to set the bar as
whether data reveal sensitive features and thus, whether their processing should be considered
as prohibited according to Article 9 of the GDPR.

Eventually, the processing was deemed unlawful by the Conseil d'État on other grounds
such as non-compliance with proportionality and data minimisation principles.

4. The unlawfulness of such processing under necessity, proportionality and data minimisation principles

Even though the Conseil d'État concluded that the publication of an appointment order
mentioning a decree on the access of disabled persons to state functions could not be seen as
processing data concerning health, it eventually claims that such processing was unlawful
because of the way the processing was carried out. In particular, judges consider that “the
permanent display of these personal data on the Ministry's website exceeds what is necessary
in view of the purposes of the processing in question, which are to guarantee the rights of third
parties and respect for the principle of equal access to public employment as set out in Article
6 of the 1789 Declaration of Human and Citizens' rights”.<fnref n="37" /> The proposed solution was to
delete the legal basis of the appointment order once the latter's period of appeal expired.<fnref n="38" />
This dictum is meant to strike a balance between data subjects' data protection rights and
privacy on the one hand and the administration's duty to publish appointment orders on the
other.

This view is in line with the ECJ's case law. Indeed, in the Lithuanian case cited above<fnref n="39" />
the ECJ considered that “it must be found that the online publication of the majority of the
personal data contained in the declaration of private interests of any head of an establishment
receiving public funds, such as that at issue in the main proceedings, does not meet the
requirements of a proper balance”.<fnref n="40" />

In other words, the existence of a legal requirement concerning the data processing and the
narrow definition of the concept of “data concerning health” would have implied that the
individuals’ protection was reduced, but these factors are not sufficient to consider that data
processing is lawful. Indeed, the Conseil d’État concludes in this case that although the
administration did not carry out processing of sensitive data, it was not necessary to keep data
online after the period of appeal was over.

<footnote n="36">³⁶ EDPB, Guidelines 3/2019 on processing of personal data through video devices, 29 January 2020, 17, available at: https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201903mes_en_0.pdf.</footnote>

<footnote n="37">³⁷ Conseil d'État, 10ème - 9ème chambres réunies, 10 June 2021, no. 431875 (Our translation).</footnote>

<footnote n="38">³⁸ *Ibidem*.</footnote>

<footnote n="39">³⁹ See ECJ, Grand Chamber, 1 August 2022, case C-184/20, *OT v Vyriausioji tarnybinės etikos komisija*.</footnote>

<footnote n="40">⁴⁰ *Ibidem*.</footnote>
**5. Conclusion**

In view of the above, it is worth noting that there is a pressing need to determine what constitutes processing of special categories of data, pursuant to Article 9 of the GDPR. There is indeed a wide array of data processing which can indirectly reveal some sensitive characteristics of a data subject. The question as to whether these processing must be considered as processing of sensitive data is largely debated, as the decision of French Conseil d'État illustrates. Indeed, the Conseil d'État seems to consider that only processing revealing the seriousness or the nature of a disability must be considered as processing of data concerning health. This view can be problematic since it runs contrary to the way the ECJ interprets the processing of health data and more broadly, to the way some DPAs interpret the processing of data likely to reveal sensitive characteristics.41 This question is very critical since the development of machine learning technology enables the inference of sensitive characteristics from data which are not inherently sensitive.42 One of the most relevant criteria to consider whether processing of personal data can be considered as unlawful processing of sensitive data is the purpose criterion. In other words, while the processing of data likely to reveal in an indirect fashion some sensitive data can be deemed lawful, the processing of said data with the intent to reveal sensitive characteristics should be deemed unlawful in whatever circumstances. For instance, the Information Commissioner's Office (ICO) claimed in the Cambridge Analytica use case that "since CA used the information collected to make predictions about data subjects' political affiliations and opinions, it is clear that the data should be considered sensitive personal data".43 The link is thus drawn between the intent (purpose) and the qualification of processing as revealing sensitive data. Further research should be undertaken on the topic of data processing indirectly revealing sensitive data through inferences.

<footnote n="41">41 See Datatilsynet, 13 December 2021, 20/02136-18, *Administrative fine - Grindr LLC*.</footnote>

<footnote n="42">⁴² Article 29 Data Protection Working Party, *Advice paper on special categories of data (“sensitive data”)*, Ref. Ares (2011) 444105, 20 April 2011, 6.</footnote>

<footnote n="43">⁴³ ICO, *Investigation into the use of data analytics in political campaigns. A report to Parliament*, 6 November 2018, 36.</footnote>