Judgment — ECLI:EU:C:2015:638
Date: 2015-10-01
Language of the case: Romanian
Court formation: Third Chamber
Subject matter: Economic and monetary policy;Approximation of laws;Data protection
Procedure: Reference for a preliminary ruling;Reference for a preliminary ruling - decision unnecessary
Origin: Romania

Summary of observations presented to the Court 31. At the hearing, the applicants in the main proceedings submitted that the referring court was essentially seeking to determine to what extent the national administrative practice, reflected in the present case by the Protocol of 26 October 2007 and consisting of an automatic and repeated transmission by the ANAF to the CNAS of personal data, including taxation data, of certain categories of taxpayers (surname, first name, categories of income and tax paid), is compatible with the procedural requirements provided for by Directive 95/46. 32. In response to questions raised by the Court, the applicants in the main proceedings maintain that it is Article 11 of Directive 95/46 that applies to the case in the main proceedings. They submit that that article defines the obligations on the primary controller (the ANAF) and the secondary controller (the CNAS) of the processing of the personal data, in this instance the obligation to inform the data subjects, inter alia, of the identity of the controller of the secondary processing, the purposes of processing the data transmitted and the categories of data transmitted. Those obligations, which must be fulfilled no later than the time when the data are first disclosed, fall principally on the controller of the secondary processing. 33. In that context, the applicants in the main proceedings maintain that there is an inconsistency in the Protocol of 26 October 2007 in that, on the one hand, Article 4 of the protocol provides for the transmission of general databases as updated periodically while, on the other hand, Article 6(1) of the protocol provides that the data must be transferred individually on the basis of a report. They maintain that, in reality, under national practice, such reports do not exist, transfers taking place automatically in breach of these procedural requirements. 34. The applicants in the main proceedings also submit that Article 13 of Directive 95/46 has no bearing on the resolution of the dispute in the main proceedings since the CNAS did not have the power to determine the contributions to the health insurance fund. The transmission of the data was therefore not necessary, except in respect of a small category of taxpayers whose obligation to contribute had been established but who had not voluntarily met that obligation. 35. However, the applicants in the main proceedings assert that, if the Court should find Article 13 of Directive 95/46 to be applicable, it would then be for the ANAF and the CNAS to justify the need to transmit the data at issue and, therefore, to establish the existence of a legislative measure authorising that transmission without the consent of the data subjects. According to the applicants in the main proceedings, such a legislative measure does not exist and the Protocol of 26 October 2007 cannot take the place of one. As the protocol was never published in the Official Journal, it does not meet the requirements of foreseeability and legal certainty and therefore cannot produce an erga omnes effect. 36. In its written observations, which were in essence shared by the CNAS, the Romanian Government submitted, firstly, that the transmission from the ANAF to the CNAS of information relating to income from independent activities was provided for by law and was necessary for the CNAS to fulfil its mission and, secondly, that the processing of that information by the CNAS was necessary to comply with a legal obligation to which it was subject for the purposes of Article 7 of Directive 95/46. As a consequence, neither the consent of the data subjects nor the provision of information to the data subjects, under Articles 10 and 11 of Directive 95/46, was required. 37. At the hearing, the Romanian Government stressed that the transmission and processing of the personal data at issue fell within the context of the obligations to collaborate imposed on public institutions by the Romanian Code of Fiscal Procedure, in particular by Articles 11 and 62 of that code. In that regard, the Protocol of 26 October 2007 does not constitute the legal basis for those obligations, but simply governs the means of transferring the data from the ANAF to the CNAS. According to the Romanian Government, those obligations to transmit fiscal information, which arise only between public institutions and the sole purpose of which is to establish the amount of tax and the contributions due, including contributions to health insurance, therefore pursue a legitimate aim of protecting financial interests under Article 13(1)(e) of Directive 95/46. Consequently, it is unnecessary to inform the data subjects. 38. The Czech Government submits principally that the transmission of the data at issue from the ANAF to the CNAS may occur without the consent of the data subjects pursuant to Article 7(e) of Directive 95/46 and without the need to inform them, because of the exceptions referred to in Article 11(2) and Article 13 of that directive. In addition, according to the Czech Government, nothing in that directive requires that the transmission of personal data between public institutions is specifically provided for by a provision of general application. 39. In its written observations, the Commission stated firstly that the data at issue in the case in the main proceedings are personal data within the meaning of Article 2(a) of Directive 95/46, that the two national institutions in question, the ANAF and the CNAS, could be classified as controllers of the processing of the data, within the meaning of Article 2(d) of that directive, and that both the collection and the transmission of those data qualify as ‘processing of personal data’ within the meaning of Article 2(b) of the directive. 40. Also in its written observations, the Commission proposed that the Court should rule that Article 6 and 7 of Directive 95/46 must be interpreted as not precluding the transmission of the data relating to income at issue in the main proceedings, provided that the transmission is carried out on the basis of clear and precise legal provisions the application of which is foreseeable by the data subjects, which is a matter for the referring court to verify. 41. Nevertheless, the Commission expanded on this conclusion in its oral observations, through its responses to the questions for the hearing raised by the Court. In essence, the Commission submitted that the conditions relating to consent from and information to be given to the data subjects, to which the collection, transmission and processing of personal data are subject by virtue of the combined provisions of Article 7, 10, 11 and 13 of Directive 95/46, are not fulfilled in the circumstances of the case in the main proceedings; in any event, the national legislation, and in particular the Protocol of 26 October 2007 concluded between the ANAF and the CNAS does not meet the requirements of Article 13 of that directive, as interpreted in the light of Articles 8 and 52 of the Charter of Fundamental Rights of the European Union (‘the Charter’) and of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950. 42. The Commission also submits that Directive 95/46 is based on the principle that, in relation to the processing of personal data about him, the data subject must have knowledge, on the basis of clear, precise and foreseeable legal provisions, of any restriction on the rights he has under Directive 95/46. According to the Commission, the transmission of the data at issue in the main proceedings occurred on the basis of a simple protocol of cooperation between the two institutions, which itself was based on a provision of Law No 95/2006, which provision, in referring to the data necessary to certify that the person concerned qualifies as an insured person, does not fulfil those requirements for clarity. 43. In considering the various questions for oral answer posed by the Court, the Commission states that both the ANAF and the CNAS should have provided the data subjects with the information required by Article 10 and 11 respectively of Directive 95/46 since the Romanian legislation did not fulfil the requirements permitting derogation from those obligations. 44. The Commission asserts, first, that the Romanian legislation does not appear to fulfil the conditions set out in Article 11(2) of Directive 95/46, which provides that Article 11(1) of the directive shall not apply where recording or disclosure is expressly laid down by national law, but would refer the matter back to the national court for examination. 45. The Commission then submits that any restriction on the data subject’s right of access to data under Articles 10 and 11 of Directive 95/46 must, in accordance with Article 13 of that directive, be contained in a legislative measure, pursue one of the public interest objectives listed in the article and be proportionate. The Romanian legislation contains nothing to permit such an exception, since the provision allowing the transmission of data from the ANAF to the CNAS cannot be regarded as clearly indicating that the data subjects will not be kept informed in that regard. 46. In that regard, the Commission maintains that the Protocol of 26 October 2007 concluded between the ANAF and the CNAS, which governs the transmission of information between the two institutions but which does not include any provisions dealing with keeping the data subjects informed, cannot be considered a legislative measure within the meaning of Article 13 of Directive 95/46. It is a simple bilateral agreement, not published in the Official Journal, which has no binding legal effect and is not valid vis-à-vis third parties. According to the Commission, in that regard Article 13 of Directive 95/46 reflects the provisions of Article 52(1) of the Charter and of Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms in the specific area of the protection of personal data and should therefore be interpreted in the light of the relevant case-law of the Court of Justice and of the European Court of Human Rights. 47. In any event, even supposing that the Romanian legislation could be held to contain the required legal exception, the restriction on keeping the data subjects informed needs to fulfil the criterion of necessity and needs to be in proportion. Even if it can be accepted that the functioning of the public health insurance service is an objective in the public interest for the purpose of Article 13 of Directive 95/46, and that the transmission of the data from the ANAF to the CNAS is intended to serve that objective, it is, on the other hand, difficult to see why it would be necessary to omit to inform the data subjects, since informing them would not jeopardise achievement of that objective. B – The relevant principal provisions of Directive 95/46 48. In order to be able to provide an appropriate response to the referring court, it is necessary to start by recalling the principal rules laid down by Articles 5 to 7 and Articles 10 to 13 of Directive 95/46 which, to the extent that they govern the processing and the transmission of personal data, are relevant to resolution of the dispute in the main proceedings. 49. Under Article 5 of Directive 95/46, Member States are to determine the precise conditions under which the processing of personal data is lawful, within the limits of the provisions of Articles 6 to 21 of that directive. 50. As the Court has consistently observed, subject to the exceptions permitted under Article 13 of Directive 95/46, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and, secondly, with one of the criteria for making data processing legitimate listed in Article 7 of the directive. (11) 51. As far as the present case is concerned, Articles 6 and 7 of that directive define three initial requirements for the collection and processing of personal data. 52. The controller (12) must, inter alia, ensure that personal data are collected for specified, explicit and legitimate purposes, processed fairly and lawfully and not further processed in a way incompatible with those purposes. (13) 53. Article 7 of Directive 95/46 provides that the processing of personal data is legitimate, and may therefore be carried out, only if one of the situations listed applies and, in particular, as far as the present case is concerned, only if the data subject has unambiguously given his consent in that respect (14) or if the processing is necessary for compliance with a legal obligation to which the controller is subject (15) or if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed. (16) 54. The Court has held that that article sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful. (17) The Court has also stated that, having regard to the objective of Directive 95/46 of ensuring an equivalent level of protection in all Member States, the concept of necessity laid down by Article 7(e) of that directive cannot have a meaning which varies between the Member States and is therefore a concept which has its own independent meaning in EU law. (18) 55. Articles 10 and 11 of Directive 95/46 define the information obligations on the controller of the processing of personal data, distinguishing cases where data are collected from the data subject from those where data are not collected from the data subject. 56. Article 10 of Directive 95/46, read in the light of Recital 38 of the preamble to the directive, therefore provides that, unless they already have the relevant information, the persons from whom the controller has collected the data must be provided with information concerning the existence of the processing and be given actual and complete information about the collection of the data and, in particular, for the processing to be considered as fair, information about the purposes of the processing for which the data are intended or the recipients or categories of recipients of the data, as referred to in (b) and (c) of Article 10. 57. Article 11(1) of Directive 95/46, read in the light of Recitals 39 and 40 of the directive, deals with situations in which the processing relates to data not obtained from the data subjects, in particular where the data have been legitimately disclosed to a third party but that disclosure was not anticipated at the time of the collection. (19) In such cases, unless they already have the relevant information, the data subjects must be provided with information, inter alia, about the purposes of the processing, the categories of data concerned and the recipients or categories of recipients of the data, as referred to in (b) and (c) of Article 11(1), at the time when the data are recorded or, if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed. 58. However, under Article 11(2) of the directive, the provisions of Article 11(1) shall not apply where, inter alia, recording or disclosure of the data is expressly laid down by law. In such cases, Member States are under an obligation to provide appropriate safeguards. 59. Finally, Article 13 of Directive 95/46, headed ‘Exemptions and restrictions’, provides that Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in, inter alia, Article 6(1) and Article 11(1) of that directive when such a restriction constitutes a necessary measure to safeguard superior interests and, in particular, ‘an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters’ (20) or ‘a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e)’ of Article 13(1) of that directive. (21) 60. The situation at issue in the main proceedings must now be examined in the light of all these provisions. C – Classification of the situation in the main proceedings with regard to Directive 95/46 61. First of all, the data at issue in the case in the main proceedings, transmitted from the ANAF to the CNAS, must be held to constitute personal data within the meaning of Article 2(a) of Directive 95/46. Those data, which comprise inter alia the surname and first name of the data subjects (22) and details of their income, (23) undeniably constitute ‘information relating to an identified or identifiable natural person’. Transmission of the data by the ANAF and processing of the data by the CNAS constitute the processing of personal data within the meaning of Article 2(b) of that directive. 62. It is also undisputed that the situation at issue in the main proceedings falls within the scope of Directive 95/46. 63. The situation at issue in the main proceedings may also fall within the scope of Article 10 as well as that of Article 11 of Directive 95/46. It is apparent from the above reasoning that fair processing of the personal data relating to the applicants in the main proceedings would involve the ANAF informing them, in particular, of the transmission of the data to the CNAS, pursuant to Article 10(c) of Directive 95/46. In addition, processing by the CNAS of the data transmitted by the ANAF would also involve the applicants in the main proceedings being informed, at the very least, of the purposes of the processing and of the categories of data concerned, in accordance with Article 11(1)(b) and (c) of Directive 95/46. 64. Secondly, it must be noted that the question raised by the referring court (24) does not relate to the processing by the ANAF of the personal data at issue in the main proceedings, more specifically to the conditions for that processing to be lawful and legitimate for the purposes of Articles 6 and 7 of Directive 95/46. 65. The question deals only with the transmission of data from one public institution to another, more specifically with the transmission of the data collected by the ANAF to the CNAS and the processing of those data by the CNAS, operations which were apparently undertaken in the absence of any consent from the data subjects and without the data subjects being informed, carried out pursuant to national legislation which fails to meet the requirements of Directive 95/46 and specifically the obligations to inform the data subjects under Articles 10 and 11 of Directive 95/46. 66. The fourth question raised by the referring court, which must be examined as much from the point of view of the obligations on the ANAF as from that of the obligations on the CNAS, must therefore be considered with regard, first, to the provisions of Article 7, 10 and 11 of Directive 95/46 and the conditions for consent from and information given to the subjects of the data processing in question contained in those provisions. It must also be examined, if appropriate, with regard to the provisions of Article 13 of that directive, which defines the exemptions and restrictions on the extent of the obligations and rights provided, in particular, in Article 10 and Article 11(1) of that directive. D – Compliance with the requirements to inform the data subjects prescribed by Article 10 and 11 of Directive 95/46 67. It is not disputed that the applicants in the main proceedings and, more broadly speaking, the data subjects of the transmission by the ANAF of the personal data that it had collected to the CNAS and of the processing by the CNAS of those data, were not informed of that transmission by the ANAF as required by Article 10 of Directive 95/46. Neither did those persons formally consent, for the purposes of Article 7(a) of Directive 95/46, to that processing by the CNAS; nor were they informed of the processing as required by Article 11(1) of that directive. 68. In the matter of consent, it seems clear that, as the Romanian Government and the CNAS submit, the processing by the CNAS of the personal data relating to persons earning income through self-employment falls within the provisions of Article 7(e) of Directive 95/46. Consequently, the consent of those individuals was not required. (25) 69. In this instance, the CNAS has an obligation, under Law No 95/2006, to determine whether persons earning income through self-employment qualify as insured persons, recognition of that status being conditional on the payment by those persons of their contributions to the local health insurance funds. Processing by the CNAS of the personal data of persons earning income through self-employment transmitted to it by the ANAF is, therefore, necessary in order to determine whether they qualify as insured persons and, ultimately, to the entitlements arising from that status. Consequently, consent from the subjects of the processing of the personal data at issue in the main proceedings was not required. 70. However, it is for the referring court to verify that the data transmitted and processed by the CNAS fulfil the criterion of necessity provided for in that provision, by establishing that the data do not exceed what is strictly necessary in order for the CNAS to accomplish its mission. (26) 71. It is therefore essentially the question of compliance with the requirements to inform the data subjects in relation to the transmission by the ANAF of personal data, and the processing of these data by the CNAS, on the conditions laid down by Articles 10 and 11 of Directive 95/46, that requires consideration. 72. As has already been outlined above, the transmission by the ANAF to the CNAS of the personal data of persons earning income through self-employment and the processing of those data by the CNAS can be considered to fulfil the requirements of Directive 95/46 only if the data subjects have been informed of it pursuant to Article 10 and Article 11(1) of the directive. 73. More specifically, it is up to the Member State to provide for the necessary measures so that the required information is communicated to the data subjects by one or other of the two institutions who are both responsible for the processing of the personal data at issue in the main proceedings, namely the ANAF under Article 10 of Directive 95/46 and the CNAS under Article 11 of that directive, unless, in the latter case, registration or disclosure of the data have been provided for by law. 74. In that context, it should be pointed out that, as the Commission observed at the hearing, the requirement to inform the data subjects about the processing of their personal data, which guarantees transparency of all processing, is all the more important since it affects the exercise by the data subjects of their right of access to the data being processed, referred to in Article 12 of Directive 95/46, and their right to object to the processing of those data, set out in Article 14 of that directive. 75. In this instance, it is not disputed that the applicants in the main proceedings were not formally or individually notified by the ANAF of the transmission of their personal data to the CNAS, and in particular of the data relating to their income, as required by Article 10 of Directive 95/46. Neither is it disputed that, at the time of registration of the data transmitted by the ANAF, the CNAS did not supply them with the information listed in (a) to (c) of Article 11(1) of Directive 95/46. 76. However, the Romanian Government submits that, in accordance with various provisions of the Code of Fiscal Procedure and Article 315 of Law No 95/2006, the ANAF has an obligation to transmit to the local health insurance funds the information necessary for the CNAS to determine whether persons earning income through self-employment qualify as ‘insured persons’ and that the amount of contributions due from those persons can only be established on the basis of the information about that income held by the ANAF, with whom they have to file an annual declaration of income. 77. The Romanian Government maintains that the law therefore provides an obligation on the CNAS to process the personal data of persons earning income through self-employment, especially in order to initiate any forced recovery procedures for unpaid contributions, and that the ANAF has a corresponding obligation to supply information about the income of those persons necessary for that purpose, the actual manner of transmitting the information in question between the two institutions being governed by the Protocol of 26 October 2007 entered into by the two institutions, expressly provided for in Article 315 of Law No 95/2006. 78. In that regard, it must firstly be observed that the fact that the transmission of the data at issue takes place between public institutions in the performance of general duties of collaboration under the general provisions of Law No 95/2006 or the Code of Fiscal Procedure cannot, of itself, exempt the Member State or the institutions in question from the information obligations incumbent upon them under Directive 95/46. 79. In any event, Article 315 of Law No 95/2006 cannot be regarded as serving to inform the data subjects in advance for the purposes of Article 10 of Directive 95/46. Article 315 of Law No 95/2006 refers to information relating to qualifying as an insured person and makes no mention of the income of the persons concerned, who therefore cannot be regarded as informed about the transmission of the data relating to their income for the purposes of Article 10 of the directive. 80. The data relating to the income of the persons concerned are of sufficient significance as to warrant a specific notification of their transmission by the public institution collecting them to another public institution, pursuant to Article 10(b) and (c) of Directive 95/46. This did not occur in the case in the main proceedings. E – Compliance with the restrictions in Article 13 of Directive 95/46 81. At this stage of the analysis of the situation in the main proceedings, all that remains is to examine whether failure to inform the data subjects could, alternatively, fall within the requirements of Article 13 of Directive 95/46, which gives Member States the possibility of establishing exemptions to and restrictions on the scope of the rights and obligations provided for in, inter alia, Article 10 and Article 11(1) of that directive while respecting guarantees corresponding to those in Article 52(1) of the Charter. (27) As a result of that provision, any restriction on the obligation to inform the data subjects must be provided for by a legislative measure, (28) be justified by one of the objectives of general interest referred to in that provision and be strictly in proportion to the objective pursued. 82. In this instance, it is not contested that the transmission by the ANAF of the data necessary for the CNAS to establish whether persons earning income through self-employment qualify as ‘insured persons’, together with the processing by the CNAS of the data thus transmitted, might prove necessary in order to safeguard an important economic or financial interest of a Member State within the field of taxation in the Member State in question, within the meaning of Article 13(1)(e) of Directive 95/46. 83. However, it is not apparent either from the order for reference or from the written and oral observations presented to the Court by the Romanian Government that the national legislation applicable in the case in the main proceedings contains legislative provisions that would exempt the ANAF and/or the CNAS clearly and explicitly from their obligations to provide information. 84. In that context, it is not possible to accept the argument put forward by the Romanian Government that the legal provisions obliging the ANAF to transmit to the CNAS the data necessary to fulfil its mission and the Protocol of 26 October 2007 entered into by the two institutions organising that transmission constitute the ‘legislative measure’ required by Article 13(1) of Directive 95/46 in order to create an exception to the obligation to provide information incumbent on the controller of the personal data. 85. The Protocol of 26 October 2007 quoted by the Romanian Government evidently does not, as the Commission points out, meet the first of those requirements, since it is not at all akin to a legislative measure of general scope, duly published and enforceable in relation to those persons who are the subjects of the transmission of the data at issue. 86. Consequently, I consider that the fourth question referred by the referring court for a preliminary ruling should be answered by finding that Directive 95/46 should be interpreted as precluding national legislation such as that at issue in the main proceedings that allows a public institution of a Member State to process personal data that have been transmitted to it by another public institution, in particular data relating to the income of the data subjects, without those data subjects being informed in advance of either the transmission or the data processing. VI – Conclusion 87. In the light of all the above reasoning, I propose that the Court should respond to the questions referred by the Curtea de Apel Cluj as follows: (1) The first three questions referred for a preliminary ruling concerning the interpretation of Article 124 TFEU are inadmissible. (2) Directive 95/46 EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as precluding national legislation such as that at issue in the main proceedings that allows a public institution of a Member State to process personal data that have been transmitted to it by another public institution, in particular data relating to the income of the data subjects, without those data subjects being informed in advance of either the transmission or of the data processing. 1 Original language: French. 2 Directive of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31). 3 Casa Naţională de Asigurări de Sănătate (‘the CNAS’). 4 Order approving the methodological rules identifying the documentary evidence required for the purpose of qualifying as an insured person or as an insured person who is not required to make contributions and applying measures for the recovery of sums owing to the joint national social security fund. 5 (‘the Protocol of 26 October 2007’). 6 (‘the ANAF’). 7 See the first recital in the preamble to Council Regulation (EC) No 3604/93 of 13 December 1993 specifying definitions for the application of the prohibition of privileged access referred to in Article [124 TFEU] (OJ 1993 L 332, p. 4). 8 See judgments in Pringle (C‑370/12, EU:C:2012:756, paragraph 59) and Gauweiler and Others (C‑62/14, EU:C:2015:400, paragraph 93 et seq.). 9 See, in that regard, the definition of financial institutions set out in Article 4 of Regulation No 3604/93. 10 See, in that regard, my Opinion in Delvigne (C‑650/13, EU:C:2015:363, point 54). 11 See judgments in Österreichischer Rundfunk and Others (C‑465/00, C‑138/01 and C‑139/01, EU:C:2003:294, paragraph 65); Huber (C‑524/06, EU:C:2008:724, paragraph 48); ASNEF and FECEMD (C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 26), and Worten (C‑342/12, EU:C:2013:355, paragraph 33). 12 See Article 6(2) of Directive 95/46. 13 See Article 6(1)(a) and (b) of Directive 95/46. 14 See Article 7(a) of Directive 95/46. 15 See Article 7(c) of Directive 95/46. 16 See Article 7(e) of Directive 95/46. 17 See judgment in ASNEF and FECEMD (C‑468/10 and C‑469/10, EU:C:2011:777). 18 See judgment in Huber (C‑524/06, EU:C:2008:724, paragraph 52). 19 In relation to that provision, see, in particular judgments in Rijkeboer (C‑553/07, EU:C:2009:293, paragraphs 67 and 68); IPI (C‑473/12, EU:C:2013:715, paragraphs 23, 24, 45 and 46), and Ryneš (C‑212/13, EU:C:2014:2428, point 34). 20 Article 13(1)(e) of Directive 95/46. 21 Article 13(1)(f) of Directive 95/46. 22 See, in particular, judgment in Österreichischer Rundfunk and Others (C‑465/00, C‑138/01 and C‑139/01, EU:C:2003:294, paragraph 64). 23 See, in particular, judgment in Satakunnan Markkinapörssi and Satamedia (C‑73/07, EU:C:2008:727, paragraph 35). 24 The same goes for the arguments of the applicants in the main proceedings. 25 In relation to this aspect, see, in particular, the document entitled ‘Article 29 Data Protection Working Party (WP29), Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, 9 April 2014’ (http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf). 26 See, in particular, judgment in Huber (C‑524/06, EU:C:2008:724). 27 See judgment in Volker und Markus Schecke and Eifert (C‑92/09 and C‑93/09, EU:C:2010:662, paragraph 65). 28 In that regard, see my Opinions in Scarlet Extended (C‑70/10, EU:C:2011:255, point 88 et seq.) and Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2013:845, point 108 et seq).