Judgment;Summary — ECLI:EU:C:2025:231
Date: 2025-04-03
Language of the case: Czech
Court formation: First Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Czechia

Summary C-710/23 – 1 
Case C-710/23 
 Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged:  
 22 November 2023 
Referring court:  
Nejvyšší správní soud (Czech Republic) 
Date of the decision to refer:  
1 November 2023 
Applicant: 
Mgr. L. H. 
Defendant:  
Ministerstvo zdravotnictví (Ministry of Health) 
  
Subject-matter of the main proceedings 
The main proceedings concern an appeal in cassation lodged by the Ministerstvo 
zdravotnictví (Ministry of Health) (the Defendant) against the judgment of the 
Městský soud v Praze (Prague City Court), annulling the decision of the 
Defendant, as well as the decision of the Minister of Health, concerning the right 
to information claimed by the Applicant. 
Subject-matter and legal basis of the request  
The reference for a preliminary ruling pursuant to Article 267 TFEU pertains to 
the question of whether the provision of information about the actions of a legal 
person that includes information about a natural person constitutes the processing 
of the personal data of only legal persons or also natural persons, and whether – in 
the event that it does constitute the processing of the data of natural persons – 
such provision of information can be made subject to a condition that goes beyond 
the scope of Regulation (EU) 2016/679 of the European Parliament and of the 
Council of 27 April 2016 on the protection of natural persons with regard to the 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-710/23 
 
2  
processing of personal data and on the free movement of such data[, and repealing 
Directive 95/46/EC] (OJ 2016 L 119, p. 1; ‘GDPR’). 
The questions referred  
1) Does the disclosure of the first name, surname, signature and contact 
information of a natural person as the director or responsible representative of a 
legal person, made exclusively for the purpose of identification of the (person 
authorised to represent a certain) legal person still constitute processing of 
‘personal data’ of the natural person concerned, pursuant to Article 4, point (1), 
GDPR, and thus fall within the scope of GDPR? 
2) Can national law, including settled case-law, render the application by an 
administrative authority of a directly applicable EU regulation, namely 
Article 6(1)(c) or (e) GDPR, conditional on compliance with other conditions that 
do not follow from the text of the regulation itself but which, nevertheless, 
essentially extend the level of protection of personal data subjects, namely the 
obligation of a public authority to inform the data subject in advance of the 
submission of a request for the provision of his or her personal data to a third 
party?  
Provisions of European Union law relied on 
GDPR: sentence two of recital 14, Article 4, point (1), and Article 6(1)( a), (c), 
and (e)  
Provisions of national law relied on 
Zákon č. 106/1999 Sb., o svobodném přístupu k informacím (Law No 106/1999 
on Free Access to Information) (‘Law 106/99”): Paragraph 2(1) (obliged entities), 
Paragraph 3 (the obligation to provide information); 
Paragraph 8a(1): ‘An obliged entity shall only provide information pertaining to 
the personality, expressions of a personal nature or the privacy of a natural person, 
and personal data in line with legislation governing its protection.’, and 
Paragraph 8a(2): ‘An obliged entity shall provide personal information concerning 
a publicly active person, public officer or public servant that are indicative of his 
or her public or official activities or position or job.’ 
Succinct presentation of the facts in and arguments of the parties to the main 
proceeding 
1 The Applicant sought from the Defendant, as the obliged entity, provision of the 
following information, pursuant to Law No 106/99: (i) agreements concerning the 
MINISTERSTVO ZDRAVOTNICTVÍ II 
 
3 
purchase of tests used to test for the presence of the SARS-CoV-2 disease in a 
tested person, concluded by the obliged entity, and furthermore (ii) certificate of 
the product (test) purchased by the obliged entity, documenting the possibility to 
use the test in the European Union or in the Czech Republic for verifying the 
presence of the SARS-CoV-2 disease in the person tested. The applicant sought 
information to the following extent: identification and description of the persons 
who issued each of the certificates. 
2 The Defendant decided to reject the application in part. It did provide the 
requested certificates to the Applicant, but in them blacked out information of the 
natural person who signed the certificate on behalf of the legal person. 
Specifically, the following information was blacked out: first name, surname, 
signature, position within the legal person concerned; and in the case of several 
certificates, also the contact e-mail addresses, telephone number, and in some 
cases also the website of the company that issued the certificate (‘Blacked-out 
information’). The reason for blacking out that information was the protection of 
the personal data of the natural persons who were shown in the certificates 
concerned as persons representing the legal persons concerned. 
3 The Applicant filed an administrative appeal with the Minister of Health 
challenging the decision. In a decision of 15 September 2020, the Minister of 
Health upheld the Defendant’s decision. 
4 The City Court annulled both the decision of the Defendant and the decision of the 
Minister of Health. The court stated that the blacked-out information does 
constitute personal data within the meaning of Article 4, point (1), GDPR, 
whereby a natural person may be identified within the meaning of that provision 
of the GDPR, but disagreed with the Defendant’s conclusion that none of the 
scenarios for the lawfulness of the processing of the personal data of the natural 
persons concerned under Article 6(1) GDPR were met. The court noted that the 
administrative authorities did not attempt to contact the data subjects concerned in 
regard of the provision of their personal data to the Applicant. In this regard, it 
referred to the case-law of the referring court concerning the provision of 
information pursuant to Law No 166/99, from which follows (i) the obligation of 
administrative authorities to inform, without undue delay, the persons concerned 
by the personal data, about the fact that the obliged entity intends to disclose the 
information to a third party, and (ii) the right of the potentially concerned persons 
to express their opinion with respect to such disclosure. It is then up to the obliged 
entity to take the statement of the persons concerned into account and to infer 
consequences from it for its further steps. 
5 Furthermore, the City Court stated that the Defendant based its conclusion 
referred to above on an inadequate ascertainment of the facts of the case. It noted 
that the refusal by administrative authorities to provide the data concerned to the 
Applicant constitutes a procedural fault that may have an impact on the lawfulness 
of their decision. The Defendant failed to ascertain the position of any of the 
persons whose personal data it refused to disclose to the Applicant in respect of 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-710/23 
 
4  
the disclosure of their data to the Applicant, so it was unable to receive consent 
from the subject concerned pursuant to Article 6(1)(a) GDPR to such disclosure, 
and at the same time, it failed to grant those persons the position of parties to the 
proceedings pursuant to Paragraph 27(2) of the správní řád (the Administrative 
Code).  
6 The Defendant considers the opinion of the City Court regarding data subjects as 
mandatory parties to national administrative proceedings to be mistaken. In the 
defendant’s view, an administrative authority may inform the subject concerned if 
it finds it appropriate, but this does not constitute participation in proceedings 
before the administrative authority, even in an analogous sense. Hence, such a 
decision of an administrative authority that does not take advantage of the 
possibility to inform the data subject cannot constitute a procedural fault in its 
administrative decision.  
7 The Defendant adds that, in the present case, data subjects (i.e., the natural 
persons whose data was blacked out in the certificates) are persons operating in 
the territory of the People’s Republic of China and the United Kingdom of Great 
Britain and Northern Ireland where the legal persons that issued the certificates 
are incorporated, and that the Defendant does not have those natural persons’ 
contact information. Hence, according to the Defendant, the requirement to inform 
them is, in practice, essentially impossible to meet. Furthermore, if the natural 
persons concerned were also parties to the proceedings concerning the disclosure 
of personal data, whether directly or in an analogous sense, the administrative 
authority would also be obliged to serve the challenged decision to them, which is 
not practicable given their unknown residence abroad. 
8 The Applicant claims that it did not consider the blacked-out data of a natural 
person within a legal person to be personal data of a natural person, referring to 
recital 14 of the GDPR that excludes from the scope of the regulation ‘the 
processing of personal data which concerns legal persons’. The fact that a natural 
person entitled to represent a legal person signs a certificate on behalf of that legal 
person cannot be deemed to constitute an expression of personal nature by a 
natural person. 
Summary of the grounds for the request for a preliminary ruling and 
analysis of the questions referred 
9 The first question concerns the definition of the boundary between ‘personal data 
of natural persons’, i.e., data subjects pursuant to Article 4, point (1), GDPR, to 
which this regulation applies provided other conditions are met, and ‘personal data 
of legal persons’ which are, on the other hand, excluded from its scope pursuant to 
recital 14 of the GDPR. The purpose of the application for the provision of 
information was not to obtain data about a natural person but only to monitor the 
conduct of a legal entity that is represented by a certain natural person. 
MINISTERSTVO ZDRAVOTNICTVÍ II 
 
5 
10 The referring court states that, in view of the meaning and purpose of the request 
for information and the type of data disclosed in the present case, the view could 
be taken that the blacked-out data is data pertaining to a legal person. The GDPR 
would not apply to such a situation ratione materiae, as only data of a legal person 
is being requested, as part of an informative inquiry that concerns solely the 
activities of the legal person. The first name, surname, and position of a specific 
natural person authorised to represent the legal person should be logically seen as 
the ‘contact details’ of a legal person within the meaning of sentence two of 
recital 14 of the GDPR.  
11 Nevertheless, the referring court is aware of the circumstances described below. 
12 First: the case-law of the Court of Justice has repeatedly emphasised that the 
essence of the GDPR is to ensure effective and complete protection of the 
fundamental rights and freedoms of natural persons, and in particular their right to 
privacy, with respect to the processing of personal data. 1 Hence, the interpretation 
of key defined terms of the GDPR, such as ‘personal data”, ‘processing’, or 
‘controller’ must be very broad. 2 A reference can also be made to the judgment of 
20 December 2017, Nowak, 3 where the Court of Justice concluded that personal 
data includes the written answers submitted by a candidate at a professional 
examination and any comments made by an examiner with respect to those 
answers. The interpretation of the term ‘personal data’ for the purpose of 
determining the scope of application of the GDPR is thus obviously very broad. 
13 Second: although the second sentence of recital 14 of the GDPR seems to provide 
a negative definition of the scope of application of the regulation, apparently with 
regard to Article 4, point (1), GDPR, that recital is not specifically implemented in 
the definition of the material scope in Article 2 GDPR, or in the definitions in 
Article 4 GDPR, or in any other (legally binding) provisions thereof. It follows 
from established case-law of the Court of Justice that recitals of EU legislative 
acts may provide or adjust a certain interpretation of a binding provision of that 
act, but they do not have any normative force of their own. These are not legally 
binding provisions that could be applied independently. 4 
 
1  See judgments of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, 
paragraph 53 (‘Google’), as well as of 27 September 2017, Puškár, C-73/16, EU:C:2017:725, 
paragraph 38. 
2  See judgments Google, paragraph 34, as well as of 5 June 2018, Wirtschaftsakademie 
Schleswig-Holstein, C-210/16, EU:C:2018:388, paragraph 28. 
3  C-434/16, EU:C:2017:994, paragraph 62. 
4  E.g., judgments of 12 July 2005, Alliance for Natural Health and Others, C-154/04 and 
C-155/04, EU:C:2005:449, paragraphs 91 and 92; of 21 December 2011, Ziolkowski and Szeja, 
C-424/10 and C-425/10, EU:C:2011:866, paragraphs 42 and 43, or of 25 July 2018, 
Confédération paysanne and Others, C-528/16, EU:C:2018:583, paragraphs 44 to 46 and 51. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-710/23 
 
6  
14 Third: in its judgment of 9 March 2017, in Salvatore Manni, 5 the Court of Justice 
appears to have accepted that information relating to identifiable natural persons 
are ‘personal data’ within the meaning of the previous legislation (i.e., Directive 
95/46/EC, ‘Directive 95/46’). The context of the case cited was, however, 
different, both in terms of facts and law. 
15 Fourth: the GDPR entered into force after the Manni judgment; in recital 14, it 
excluded/confirmed the exclusion of the processing of information of legal 
persons from its scope. Hence a negative definition was added which was not 
explicitly mentioned in the recitals of Directive 95/46 and consequently was 
absent in the decision in the Manni case mentioned above. Recital 14 of the 
GDPR could also be understood as an expression of the intention of the EU 
legislature to interpret the scope of protection guaranteed by the GDPR somewhat 
more narrowly than before. In this regard, however, the question is to what extent 
GDPR regulation in this specific matter is to be identical with the previous 
Directive 95/46. 
16 Fifth: even if ‘personal data of legal persons’ were de facto an exception derived 
by interpretation, which should then be presumably reflected in the interpretation 
of Article 4, point (1), GDPR a contrario, there is established case-law of the 
Court of Justice which insists on a strict and restrictive interpretation of any 
exception from the scope of the GDPR, in particular with regard to the 
interpretation of Article 2(2) GDPR. 6 
17 In this situation, the referring court therefore still holds that information 
concerning a responsible representative of a legal person does constitute data 
concerning the legal person, rather than data of the natural person representing 
that legal person, but it also contends that this issue of interpretation of EU law 
raises questions. The answer to the question referred may have a significant 
impact beyond the scope of the present case and the individual disclosure of 
information, among other things on the keeping of a number of registers and 
records of legal persons in Member States, as well as on the public’s access to 
information about legal persons. It would be appropriate for the Court of Justice to 
set out general guidelines according to which a negative definition of the scope of 
the GDPR could be made with regard to data relating to legal persons that will 
frequently include information about natural persons who either represent the 
legal person or directly form it. 
18 In general terms, the referring court concludes that, even though it understands the 
requirement of effective protection of the personal data of natural persons, this 
interest cannot, in its opinion, unilaterally and somewhat mechanically prevail 
 
5  C-398/15, EU:C:2017:197, paragraph 34 (‘Manni’). 
6  See e.g., judgments of 9 July 2020, Land Hessen, C-272/19, EU:C:2020:535, paragraph 68; of 
20 May 2003, Österreichischer Rundfunk, and Others, C-465/00, C-138/01 and C-139/01, 
EU:C:2003:294, paragraphs 39 to 47; of 22 June 2021, B, C-439/19, EU:C:2021:504, 
paragraphs 61 to 72. 
MINISTERSTVO ZDRAVOTNICTVÍ II 
 
7 
over any other legitimate interests, such as transparency and public access to 
information, which primary EU law itself recognises as constitutional values so 
far as concerns EU bodies (Article 15(3) TFEU). According to the referring court, 
the interpretation of the definitions in Article 4 GDPR should not be done in the 
abstract, in isolation, and without a link to a specific personal data processing 
operation, but in context, and with a view to the object of the specific processing, 
as was, after all, accepted by the Court of Justice in its judgment of 29 July 2019, 
Fashion ID GmbH, 7 as concerns the definition of ‘controller’ in Article 4, point 
(7), GDPR. A contrary approach would result in the GDPR being interpreted in an 
absolute manner, to then cover any and all human communication consisting, by 
definition, in an exchange of information, regardless of what it concerns. 
19 If we accept the above-mentioned view of the specificity of processing, it would 
then be obvious in the referred case that the request for information was not aimed 
at obtaining the data of natural persons but concerned exclusively the provision of 
information about legal persons. Information about who is authorised to represent 
the legal person and sign a certificate on its behalf constitutes information about 
the legal person concerned, within the meaning of recital 14 of the GDPR in 
conjunction with a reasonable and contextually understood interpretation of 
Article 4, point (1), GDPR. 
20 The second question referred concerns the obligation of national administrative 
bodies to inquire, prior to the disclosure of information, with the data subjects 
concerned about whom information may be disclosed, whether they agree to that 
disclosure, and to give them an opportunity to express their opinion in that regard.  
21 This obligation arises from the referring court’s case-law formed pursuant to Law 
No 106/99 prior to the adoption of the GDPR. Subsequently, the relevant 
provisions of the GDPR, namely Article 6, were, de facto, incorporated in the 
national legislation cited in the following manner. 
22 In Paragraph 8a(1), Law No 106/99 links the disclosure of a natural person’s 
personal data to the compliance of the processing of that data with legislation 
governing the protection of that data, i.e., currently, to the GDPR. In practice, that 
means that in order for an obliged entity to be able to disclose personal data or 
other information pertaining to the personality of a specific natural person, that 
processing of personal data by it must be in line with the reasons for personal data 
processing pursuant to Article 6 GDPR and any other provisions of the GDPR. 
Consequently, one of the scenarios for the lawfulness of processing must be 
fulfilled, in accordance with Article 6(1)(a) to (f) GDPR. Paragraph 8a(2) of Law 
No 106/99 features an exception from that requirement, but that provision will, 
however, not apply to the present case. 
23 However, older case-law of national administrative courts requires, for any form 
of processing, with the exception Article 6(1)(a) GDPR (processing with the 
 
7  EU:C:2019:629, ‘Fashion ID’. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-710/23 
 
8  
consent of the data subject), that the data subject be informed that the controller 
has received a request for the disclosure of data, and to request the subject’s 
opinion. Here, it must be emphasised that the case-law does not require the 
subject’s ‘consent’ but the communication of information that an inquiry has been 
received and ‘requesting the opinion’ of the data subject. Hence, the process 
required by that case-law applies to scenarios under (c) and (e) of Article 6(1) 
GDPR, which would be relevant in the present case, and therefore also to 
situations in which no consent of the data subject is required according to the 
GDPR. 
24 In cases outside of Article 6(1)(a) GDPR, the decision to disclose or not disclose 
the requested personal data is within the exclusive competence and responsibility 
of the data controller. Article 6(1) GDPR does not generally foresee (but neither 
rules out) that the data controller should also inquire with and inform the data 
subject that it is planning to disclose his or her personal data to a third party, 
thereby entering into a kind of preliminary and informative dialogue with the data 
subject. 
25 In noting that obligation, the referring court took heed of the right of the subjects 
to informational self-determination and of the need to minimise interventions in 
the private sphere of the persons concerned. The GDPR builds on the same 
premises in recital 4 as does the case-law of the Court of Justice cited above, 
concerning the interpretation of the regulation (paragraph 12 of this order for 
reference). Similarly, it could be argued that the obligation to inform the data 
subject about a request for information pertaining to him or her fulfils some of the 
principles of personal data processing set out in Article 5 GDPR. In this regard, 
the referring court states (i) the principle of transparency in the processing of 
personal data pursuant to Article 5(1)(a) GDPR and (ii) on the factual level, due to 
the real difficulty in duly informing the persons concerned and to receive a 
potential statement from them – the principle of data minimisation pursuant to 
Article 5(1)(c) GDPR. It could therefore be argued that although the obligation of 
the obliged entity to inform the data subject goes beyond what the GDPR sets out 
in these cases, it follows its spirit and purpose to provide a high level of protection 
to data subjects.  
26 Nevertheless, the extension of that obligation to all cases of processing pursuant to 
Article 6(1) GDPR, and hence also to situations when an administrative authority 
is to assess the entire situation independently, is problematic. Since the GDPR 
came into force and the entire field was regulated by a directly applicable EU 
regulation taking precedence (rather than by a directive, as before), the approach 
taken by administrative authorities throughout the EU should be substantially 
identical and should be subject to identical conditions. After all, an identical scope 
of personal data protection throughout the EU should ensure the free movement of 
that data within a single legal framework (also see recital 2 of the GDPR). 
MINISTERSTVO ZDRAVOTNICTVÍ II 
 
9 
27 Instead of – albeit maximal – harmonisation in the case of Directive 95/46, 8 the 
sphere of law on the EU level is now unified by a regulation. That way, a Member 
State can no longer link the national application of a directly applicable EU 
regulation to additional terms and conditions that do not arise from the EU act 
itself and that, by definition, will be different in each Member State. By doing so 
it would set up a regime where personal data processing and access to it will be 
potentially more difficult than in other Member States. 
28 Finally, the referring court comments on the difficulty or impossibility of making 
data subjects parties by analogy to every national proceedings potentially leading 
to the disclosure of any personal data. The provisions of Article 1(1) GDPR in 
conjunction with Article 4, point (1), GDPR, interpreted in light of the first 
sentence of recital 14 of the GDPR, indeed mean that the protection granted by the 
GDPR applies to the processing of the personal data of all natural persons 
regardless of their nationality or place of residence. It is, however, difficult or 
impossible to automatically apply the obligation to inform and preliminarily 
consult the data subject concerned on the global level, both geographically and 
purely quantitatively. The data requested in the present case pertains to legal 
entities incorporated in only a few countries around the world outside of the 
European Union. Nevertheless, many data files with personal data can concern 
hundreds or thousands of persons from various countries. Making inquiries and 
preliminary consultations of a similar nature is impossible in such a case. 
29 In concluding, it adds that, in the event of a negative answer of the Court of 
Justice to the first question concerning the ratione materiae scope of the GDPR, 
the second question becomes devoid of purpose in the present case. 
 
8  See judgment in Fashion ID, paragraph 54.