Judgment — ECLI:EU:C:2009:293
Date: 2009-05-07
Language of the case: Dutch
Court formation: Third Chamber
Based on: Treaty establishing the European Economic Community (1957)
Subject matter: Approximation of laws;Fundamental rights;Data protection
Concepts: Protection of personal data
Procedure: Reference for a preliminary ruling
Origin: Netherlands

summary, the wording of the articles leads me to reject a reductionist appraisal of the right of access. Those arguments do not support the view that there is a single time-limit, since, according to the internal hierarchy of Directive 95/46, the right of access takes precedence over the obligation to delete data. Thus, the erasure of a file constitutes a restriction of access which is lawful only when certain guarantees are fulfilled. In other words, it is appropriate to make the exercise of the right subject to certain conditions (for example, by the adoption of a time-limit), provided that the data subject has not been protected by other means. If that were not the case, there would be time-limits for deletion which are unlawful on the grounds that they restrict the right of access, but that does not mean that it is necessary to differentiate between the types of information and require controllers to keep data relating to processing forever. On the contrary, it means that the time-limit for deletion must be extended so that access may be guaranteed. 54. Accordingly, it is my view that the time-limit for deletion also constitutes a restriction of the right laid down in Article 12 of Directive 95/46. However, that time-limit is liable to infringe the directive where it renders the aims pursued by the article excessively difficult. B – An exception to the rule: information provided to the data subject 55. For the reasons set out, I maintain that the time-limit for deletion acts to restrict the exercise of the right of access, although there are circumstances where an imbalance is created between the time-limit for deletion and the time-limit for access. By using the word imbalance, I refer to the possibility of the time-limit being proportionate for deletion but disproportionate for access or vice-versa. I am aware of the practical difficulties of that approach, but a similar outcome may arise in a very specific situation, namely, where a data subject has not been sufficiently informed of his rights. 56. That outcome is reached when, in line with the argument put forward by the Hellenic Republic and the Commission, there is evidence of a lack of information, to the detriment of the data subject. To illustrate that point, it must be recalled that Articles 10 and 11 of Directive 95/46 lay down the obligation to communicate to and require from the person concerned a number of pieces of information and/or authorisations, including details of any disclosure of data to third parties. That obligation is couched in vague terms and each Member State is afforded considerable latitude. The reply in a case such as the one before the Court depends on the manner in which each national legislature has implemented those obligations. There is nothing to prevent an individual who has not been informed, prior to disclosure, of the identity of the recipient, or of the time-limits for exercising the right of access, from being afforded a higher level of protection. (44) That corollary is compatible with the primacy which Directive 95/46 attaches to the subjective right of the individual to whom the data relate, the restriction of which must arise in such a way that, even where deletion has occurred, the exercise of the right is guaranteed. 57. In some cases, through the application of that doctrine, proceedings may lead to a judgment which it is impossible to execute. If the College has destroyed on its own initiative all data relating to Mr Rijkeboer which are more than one year old, the applicant’s claim is liable to be fruitless. It is clear that the Municipal Council of Rotterdam is not in a position to give what it no longer has. It is likely that the same difficulty affects other national systems, albeit only for the period until the amendment of legislation which is incompatible with Community law. However, in the meantime, the applicant still has one remedy at his disposal, which is to bring an action for financial liability against the State for an infringement of the Community provisions. In the absence of enforcement to the full satisfaction of the individual concerned, those provisions at least provide for financial reparation which the national courts are involved in upholding. (45) 58. In short, the present proceedings must be resolved, to use the United States term, by a ‘hard look’ review of proportionality, (46) if the Raad van State finds a lack of information in the main proceedings. In such cases, it is essential that the time-limit for deletion does not operate automatically as a barrier to the right of access. The review of proportionality must be performed at its highest protective level, and it would be unlikely to endorse a time-limit as short as one year. 59. In those circumstances, I agree with those who argue that deletion and access are elements of a single reality and must therefore be treated as one for the purpose of setting the time-limits applicable to them. Deletion under Article 6 of Directive 95/46 covers all aspects of information, including information about disclosure to third parties. As a result, the time-limit for deletion also acts, indirectly, as a time-limit restricting the duration of the right of access. Distinguishing one type of data from the other for the purposes of access is tantamount to imposing a distinction which is not found in Directive 95/46, and which, moreover, does not have any obvious effect. (47) 60. There are exceptions to that position when there is a lack of transparency at the time an individual is notified of his rights. In those circumstances, the time-limit for deletion must be extended in order to preserve the right of access. C – The time-limit of one year and the principle of proportionality 61. The Netherlands legislation lays down special rules for the processing of personal data by local authorities, of which, for the purposes of the present case, attention must be drawn to the general time-limit of one year for deletion. I have already explained the reasons why it is appropriate to consider that period in accordance with both Article 6 and Article 12 of Directive 95/46. At this juncture, it is necessary to establish whether that time-limit is compatible with the principle of proportionality, the applicability of which is a requirement of Articles 6 and 12, since both give substance to a fundamental right. 62. The United Kingdom, Spanish and Czech Governments have made every endeavour to in explain the difficulties of guaranteeing the right of access when data have been deleted. On that premiss, those Governments have paid little attention to the time-limit under discussion. However, in their observations, the Greek Government and the College examine the implications of the Netherlands time-limit in the light of Directive 95/46 and the principle of proportionality. In the opinion of the Greek Government and the Commission, that period is excessively short and, therefore, incompatible with Community law. The College claims that the time-limit is lawful, invoking the special features of the Netherlands system which compensates for the shortness of the period by means of other safeguards designed to protect data subjects. 63. It is appropriate to offer some preliminary guidance in connection with the review of the proportionality of the national time-limit, since the Court has examined similar time-limits on other occasions. It is clear from case-law that the approach should vary according to the context of each case, and that the level of thoroughness of the review depends on the circumstances. (48) Where there is a possibility that fundamental rights are affected, there must be a scrupulous examination of the time-limit for the exercise of those rights. (49) Nevertheless, that examination depends on a number of factors. 64. As I argue in paragraphs 55 to 60 of this Opinion, it is necessary to assess the amount of information received by the data subject while his data are processed, and, in that regard, the following criteria may be set out. 65. In accordance with Articles 10 and 11 of the directive, the data subject is entitled to be notified of a number of facts, including in particular, the identity of ‘the recipients or categories of recipients of the data ... in so far as such further information is necessary, having regard to the specific circumstances in which the data are collected, to guarantee fair processing’. The two articles differentiate between information collected from the data subject and information collected from another source, although information about disclosure of data to third parties must be furnished in both cases. 66. National legislatures have considerable latitude when it comes to implementing the obligation imposed in Articles 10 and 11, but the aim pursued by those articles is to inform an individual that his data have been disclosed and to provide him with the opportunity, should he so wish, to access data relating to processing and to ensure that processing is carried out in observance of the principles of Article 6 of Directive 95/46. However, the information varies according to the circumstances and it is for the referring court to establish whether Netherlands law, and the corresponding practices of the Municipal Council, observe the requirements of Articles 10 and 11. It would be useful to know whether Mr Rijkeboer was notified of any disclosure of his data and informed of the one-year period granted to him for exercising the right of access. The Member States are not required to communicate the time-limit, since Articles 10 and 11 do not call upon them to do so. (50) However, when assessing the length of the time-limit, it is extremely important to ascertain whether that information was communicated to the individual concerned. Otherwise, in the absence of further information from the controller, it would be difficult to find a period as short as one year to be compatible with the principle of proportionality and, accordingly, with Directive 95/46. 67. Also of particular importance is the type of information disclosed, since, as the directive provides, the information to be notified includes the identities of the recipients and also the ‘categories of recipients’. That second alternative means that the details provided do not always reveal who has had access to the files and leaves the data subject in a disadvantageous position when exercising the right of access. It falls to the national court to determine the extent to which Mr Rijkeboer was informed of the recipients of the data and the parameters within which that took place. When that analysis is carried out, there must be a more stringent review of the time-limit in cases where the identities of third parties were not provided, since the individual to whom the data relate may be concerned that the data have not been processed in accordance with the principles of Article 6. 68. Finally, it is necessary to set out a number of rules relating to the burden of proof. As the holder of a fundamental right, Mr Rijkeboer has had to bring legal proceedings in order to ascertain how his personal data have been processed. (51) Compatibility with Directive 95/46 depends on a number of factors which vary according to the circumstances and which are inherent in national law and in the practices of the municipal authority. Mr Rijkeboer has brought the proceedings in order to assert his fundamental right but he ought not to be obliged to prove the shortcomings of the law of his own Member State in that connection, for the wording of Directive 95/46 indicates, in line with the considerations set out in paragraphs 29 to 35 of this Opinion, that the right of access is paramount and any exceptions to it must be assessed with extreme caution. Therefore, since the subjective dimension of Community provisions on data protection takes precedence, it is for the controller to prove that the legal context of, and practices prevailing in, the processing of data provide guarantees which justify a time-limit as short as one year for the exercise of the right laid down in Article 12 of Directive 95/46. 69. The College has adduced some evidence in that regard in the observations submitted in these preliminary-ruling proceedings. The national legislation establishes a system of checks and balances (as graphically stated by the College) which harmonises the right of access with certain safeguards, such as restrictions on recipients, the linking of certain cases to specific purposes, prior authorisation by the data subject, and a monitoring system entrusted to an independent authority. Further, the College contends that the data subject is informed of the one-year time-limit both individually and collectively (on the internet and in leaflets made available to residents). (52) 70. I am aware of the repercussions this case may have for controllers of data governed by the directive. However, the overriding importance of protecting individuals leads me to conclude that the effective manipulation of data must be compatible with the principle of protection of rights. Accordingly, Articles 6 and 12 of Directive 95/46 must be interpreted as meaning that the time-limit of one year for exercising the right of access to data relating to processing is unlawful, if: – the data subject was not notified of the disclosure of his data, or – the data subject was notified but was not informed of the length of the period fixed, or – the data subject was notified but was not given sufficient details about the identities of the recipients. 71. A fundamental right being at stake, the College must prove that the national provisions and administrative practices provide for an adequate level of information to be supplied to the data subject, so that he is able to exercise his right of access without constraint. 72. It is for the Raad van State to apply Articles 6 and 12 of Directive 95/46 in the light of the criteria put forward and the legal and factual evidence adduced in both the preliminary-ruling proceedings and the main proceedings, as explained in paragraphs 70 and 71 of this Opinion. X – Conclusion 73. In the light of all of the foregoing considerations, I propose that the Court of Justice should reply to the questions referred for a preliminary ruling by the Raad van State, declaring that: Data relating to processing, including data concerning disclosure to third parties, are personal data for the purposes of Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. In order to ensure the effectiveness of Directive 95/46, the time-limit for deletion applicable to data relating to processing is the same as that laid down for personal data, without prejudice to the rights and obligations which the directive confers on third parties to whom the data is disclosed. The time-limit of one year for exercising the right of access to data relating to processing is incompatible with Articles 6 and 12 of Directive 95/46 if: – the data subject was not notified of the disclosure of his data, or – the data subject was notified but was not informed of the length of the period fixed, or – the data subject was notified but was not given sufficient details about the identities of the recipients. It is for the controller to prove that the national provisions and administrative practices provide for an adequate level of information to be supplied to the data subject, so that he is able to exercise his right of access without constraint. 1 – Original language: Spanish. 2 – Directive of the European Parliament and of the Council of 24 October 1995 (OJ 1995 L 281, p. 31). 3 – The recovery of memory, like the protection of lawfully and unlawfully processed data, is a delicate task. The removal of traces of the past must be approached with caution, as Proust asserted when he defended the evocative power of memory, since ‘[t]he places we have known do not belong only to the world of space on which we map them for our own convenience. They were only a thin slice, held between the contiguous impressions that composed our life at that time; the memory of a particular image is but regret for a particular moment; and houses, roads, avenues are as fugitive, alas, as the years.’ Proust, M., In Search of Lost Time. Volume I. Swann’s Way, translated by Scott Moncrieff, C.K. and Kilmartin, T., Vintage, London, 2002, p. 513. 4 – Case 294/83 Les Verts v Parliament [1986] ECR 1339, paragraph 23, and Case C‑402/05 P Kadi v Council and Commission [2008] ECR I‑00000, paragraph 281. 5 – Case 29/69 Stauder [1969] ECR 419, paragraph 7. 6 – Cited in the previous footnote. 7 – Case 11/70 Internationale Handelsgesellschaft [1970] ECR 1125. 8 – Case 4/73 Nold v Commission [1974] ECR 491, and Case 222/84 Johnston [1986] ECR 1651, paragraph 18. 9 – Cited in footnote 5. 10 – Case 145/83 Adams v Commission [1984] ECR 3539, paragraph 34. 11 – Case 140/86 Strack v Commission [1987] ECR 3939, paragraphs 9 to 11. 12 – Case C‑62/90 Commission v Germany [1992] ECR I‑2575, paragraph 23. 13 – Case C‑404/92 P X v Commission [1994] ECR I‑4737, paragraphs 17 and 18. 14 – Joined Cases 46/87 and 227/88 Hoechst v Commission [1989] ECR 2859, and Case C‑94/00 Roquette Frères [2002] ECR I‑9011. 15 – Case C‑60/00 Carpenter [2002] ECR I‑6279, paragraph 38, and Case C‑459/99 MRAX [2002] ECR I‑6591, paragraph 53. 16 – Articles 1 to 3 of Directive 95/46. 17 – Article 2 of Directive 95/46. 18 – Articles 10 to 24 of Directive 95/46. 19 – ‘Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community.’ 20 – Judgment in Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and others [2003] ECR I‑4989, paragraph 70. In that connection, Advocate General Tizzano argued in his Opinion that the principal aim of Directive 95/46 is the free movement of personal data and not the protection of fundamental rights. The Court did not agree with that argument and took a protective approach vis-à-vis the data subject. That view was later upheld in the judgment in Case C‑101/01 Lindqvist [2003] ECR I‑12971, paragraph 96 of which stated that Directive 95/46 is intended to ensure free movement of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate. 21 – Guichot, E., Datos personales y Administración Pública, Civitas, Madrid, 2005, pp. 43 to 47. 22 – Instrument solemnly proclaimed on 7 December 2000 by the European Parliament, the Council and the Commission (OJ 2000 C 364, p. 1 et seq.). 23 – A document which, although it does not form part of the current Community legal order, undoubtedly displays its effects as a provision of soft law. On the Charter and its legal consequences, I refer to my Opinion in Case C‑303/05 Advocaten voor de Wereld [2007] ECR I‑3633, paragraphs 78 and 79. 24 – Alonso García, R., The General Provisions of the Charter of Fundamental Rights of the European Union, Harvard Jean Monnet Working Paper no 4/02, pp. 22 and 23. 25 – The Communication from the Commission to the European Parliament and the Council on the follow-up of the Work Programme for better implementation of the Data Protection Directive, adopted by the Commission on 7 March 2007 (COM, 2007 87 final, p. 5), confirms that all the Member States have transposed Directive 95/46. 26 – The practice of balancing principles and interests is used often by the Court when resolving cases concerning fundamental rights. In the sphere of data protection, the judgments in Lindqvist, paragraph 82, and Case C‑275/06 Promusicae [2008] ECR I‑271, paragraph 66, are illustrative. Groussot, X., ‘Comentario a la sentencia Promusicae’, Common Market Law Review, number 6, vol. 45, 2008, analyses that balancing exercise. 27 – Cited in footnote 20. 28 – Cited in footnote 27. 29 – In addition to the judgments in Lindqvist and Promusicae, I refer to the Opinion of Advocate General Kokott delivered on 8 May 2008 in Case C‑73/07 Tietosuojavaltuutettu, pending judgment, where she explains, in paragraphs 99 to 105, the manner in which the Court undertakes the balancing exercise in the field with which I am concerned in the present Opinion. 30 – In line with Article 6, Article 12 of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ 2002 L 201, p. 37) also refers to the deletion of data, albeit in less stringent terms and making it conditional on a request from the data subject. 31 – Emphasis added. 32 – Adjectives used in Article 6(1) of Directive 95/46. 33 – The New Enyclopedia Britannica, vol. 12, Chicago, London, Toronto, Geneva, Sydney, Tokyo, Manila, Seoul, 1973, p. 24. 34 – Hawking, S., A Brief History of Time, Bantam, New York, 1988, p. 193, argues in favour of the egg. That decision entails obvious teleological consequences which, naturally, it is not appropriate to discuss here. 35 – That point is made by Herrán Ortiz, A.I., El derecho a la intimidad en la nueva Ley Orgánica de protección de datos personales, Dykinson, Madrid, 2002, p. 153, and Arenas Ramiro, M., El derecho fundamental a la protección de datos personales en Europa, Tirant lo Blanch, Valencia, 2006, p. 305. 36 – Directive 95/46 aims to go further than Council of Europe Convention No 108 of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data. Recital 11 in the preamble to the Directive confirms that by stating: ‘the principles of the protection of the rights and freedoms of individuals, notably the right to privacy, which are contained in this Directive, give substance to and amplify those contained in the Council of Europe Convention of 28 January 1981 ...’ (emphasis added). Sound evidence of that is the subject-matter of the Community legislation which is broader in a number of respects than Convention No 108, including, particularly significantly, with regard to the definition of the right of access. Directive 95/46 provides that the right must be exercised ‘without constraint’ whereas Article 8 of Convention No 108 merely provides that access must be enabled ‘at reasonable intervals’. The Community legislation seeks to extend the right and therefore enshrines it in substantially broader terms than those used in the Council of Europe instrument, emphasising that the intention of Directive 95/46 is to protect individuals. 37 – Case C‑540/03 Parliament v Council [2006] ECR I‑5769, paragraph 38; Case C‑432/05 Unibet [2007] ECR I‑2271, paragraph 37; Advocaten voor de Wereld, cited in footnote 23, paragraph 46; and Kadi v Council and Commission, paragraph 335. 38 – The Commission maintains that such a differentiation may be made in its observations (paragraphs 31 and 32). 39 – Although Article 12 of Directive 95/46 refers to matters relating to access, it concerns other matters connected to processing rather than personal data. That assertion helps to lead to the conclusion that, with regard to personal data, the right of access is unrestricted. However, processing is a different matter and that demonstrates that Directive 95/46 has taken account of the difficulties inherent in an all-inclusive interpretation of Article 12. 40 – Article 6(1)(e) qualifies the obligation to delete data, as follows: ‘Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.’ Although it is not explicitly framed as an exception to the obligation to delete, the Directive provides that those who carry out the activities in the general interest referred to are exempt from the obligations laid down but it does not provide that the Community provisions are inapplicable because those activities must satisfy the special features of historical, statistical or scientific research. 41 – The French- (‘sont traitées’ and ‘sont communiquées’) and German- (‘an die Daten übermittelt werden’) language versions are equivalent to the English-language version. 42 – Unlike the College in its submissions, I do not take the view that Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1), which lays down an obligation to set a time-limit for keeping data, provides guidance as to the correct interpretation of Articles 6 and 12. The regulation is the statutory translation of Directive 95/46 in its application to the Community institutions. It is logical that its subject-matter should be more detailed than that of an instrument of harmonisation addressed to the Member States. The reference to the time-limit, set out in Articles 11 and 12 of the regulation, is not an indication that Directive 95/46 seeks an adverse effect or that it imposes that effect on the Member States. Taken in the round, the silence of the Directive is merely evidence of the organisational discretion prevailing in each national legal system, which does not amount to an acceptance of any time-limit or of its capacity to restrict the right of access. 43 – Observations of the Kingdom of Spain (paragraph 25). 44 – That interpretation of Articles 10 and 11 is favoured by Bainbridge, D., EC Data Protection Directive, Butterworths, London-Dublin-Edinburgh, 1996, p. 139. 45 – It is appropriate to recall that Article 23 of Directive 95/46, which concerns liability for infringement of the provisions of the Directive, provides, in paragraph (1): ‘Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.’ 46 – According to that doctrine, a court carries out a more intensive review of decisions of the public authorities where there appears to be no solid foundation justifying those decisions. The doctrine originated in the judgment of the United States Supreme Court in SEC v. Chenery Corp., (318 U.S. 80 (1943)), and was subsequently developed in Citizens to Preserve Overton Park v. Volpe (401 U.S. 402 (1971)). See also Breyer, S.G., Stewart, R.B., Sunstein, C.R. and Vermeule, A., Administrative Law and Regulatory Policy, Aspen, New York, 2006, pp. 349 to 368. On the ‘hard look’ review at Community level, in the sphere of both Community and national law, see Craig, P., EU Administrative Law, Oxford University Press, 2006, pp. 477 to 481. 47 – Notwithstanding those technical complexities, the United Kingdom pointed out at the hearing that its national law explicitly provides for measures which guarantee the right of access to data relating to processing, even after the deletion of personal data. However, the agent of the United Kingdom Government did not elaborate on that point but did assert that the practice is exceptional in nature, and I am therefore minded to be cautious. Furthermore, it is my view that if Directive 95/46 had provided for that situation, it would have done so explicitly. 48 – Case 286/85 McDermott and Cotter [1987] ECR 1453, paragraph 15; Case C‑208/90 Emmott [1991] ECR I‑4269, paragraph 18; Case C‑338/91 Steenhorst-Neerings [1993] ECR I‑5475, paragraph 19; Case C‑410/92 Johnson [1994] ECR I‑5483, paragraph 26; Case C‑260/96 Spac [1998] ECR I‑4997, paragraph 32; Joined Cases C‑279/96, C‑280/96 and C‑281/96 Ansaldo Energia and others [1998] ECR I‑5025, paragraphs 19 to 21; and Case C‑255/00 Grundig Italiana [2002] ECR I‑8003, paragraph 37. 49 – In the following judgments, the Court ruled on the review of national rules in the light of fundamental Community rights: Case 5/88 Wachauf [1989] ECR 2609, paragraphs 17 to 22; Joined Cases C‑20/00 and C‑64/00 Booker Aquaculture [2003] ECR I‑7411, paragraphs 88 to 93; and Case C‑144/04 Mangold [2005] ECR I‑9981, paragraph 75. 50 – Unlike Regulation (EC) No 45/2001, Articles 11(1)(f)(ii) and 12(1)(f)(ii) of which provide that the institutions must notify the data subject of the time-limits for storing the data. 51 – Although Directive 95/46 is silent in that regard, in contrast with the situation in other provisions of secondary legislation (such as Council Directive 2000/78/EC of 27 November 2000 establishing a general framework for equal treatment in employment and occupation (OJ 2000 L 303, p. 16)), I believe that, when fundamental rights are in issue, any qualification of the obligations relating to evidence must comply with general principles of Community law. 52 – Observations of the College (paragraphs 65 to 70).