Judgment — ECLI:EU:C:2011:777
Date: 2011-11-24
Language of the case: Spanish
Court formation: Third Chamber
Subject matter: Approximation of laws;Fundamental rights;Data protection;Charter of Fundamental Rights
Procedure: Reference for a preliminary ruling
Origin: Spain

Summary of the Judgment 1. Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – Full harmonisation – Restrictive list of cases of lawful processing of personal data (European Parliament and Council Directive 95/46, Art. 7) 2. Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – Conditions for the lawfulness of the processing of personal data (Charter of Fundamental Rights of the European Union, Arts 7 and 8; European Parliament and Council Directive 95/46, Arts 5 and 7(f)) 3. Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – Member States’ discretion – Extent (European Parliament and Council Directive 95/46, Art. 5) 4. Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – Conditions for the lawfulness of the processing of personal data (Charter of Fundamental Rights of the European Union, Arts 7 and 8; European Parliament and Council Directive 95/46, Art. 7(f)) 5. Fundamental rights – Respect for private life – Protection of personal data – Limitations tolerated under the Charter of Fundamental Rights of the European Union (Charter of Fundamental Rights of the European Union, Arts 7, 8 and 52(1)) 6. Acts of the institutions – Directives – Direct effect – Conditions (Art. 249(3) EC; European Parliament and Council Directive 95/46, Art. 7(f)) 1. The harmonisation of national laws sought by Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data is not limited to minimal harmonisation but amounts to harmonisation that is, in principle, complete. It is upon that view that the directive is intended to ensure free movement of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate. Consequently, it follows from that objective that Article 7 of the directive sets out an exhaustive, restrictive list of cases in which the processing of personal data may be regarded as being lawful. It follows that Member States cannot add new principles relating to the lawfulness of the processing of personal data to Article 7 of that directive or impose additional requirements that have the effect of altering the scope of one of the principles provided for in Article 7. That interpretation is not brought into question by the right of Member States under Article 5 of Directive 95/46 to specify the conditions under which the processing of personal data is lawful. Indeed, Member States may not, by virtue of their discretion under Article 5 of the directive, introduce principles relating to the lawfulness of the processing of personal data other than those listed in Article 7 of the directive, nor may they alter, by additional requirements, the extent of the principles provided for in Article 7. (see paras 29-30, 32-33, 35-36) 2. Article 7(f) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as precluding national rules which, in the absence of the data subject’s consent, and in order to allow such processing of that data subject’s personal data as is necessary to pursue a legitimate interest of the data controller or of the third party or parties to whom those data are disclosed, require, in addition to respect for the fundamental rights and freedoms of the data subject, that those data should also appear in public sources, thereby excluding, in a categorical, generalised way, any processing of data not appearing in such sources. On the one hand, it follows from the objective of the directive of ensuring free movement of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate that Article 7 thereof sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful. Consequently, Member States may not add new principles relating to the lawfulness of the processing of personal data or impose additional requirements that have the effect of amending the scope of one of the principles provided for in Article 7. Nor, under Article 5 of the directive, may Member States introduce principles relating to the lawfulness of the processing of personal data other than those listed in Article 7, or alter, by additional requirements, the scope of the principles provided for in Article 7. On the other hand, in order to carry out the necessary balancing of the opposing rights and interests, provided for in Article 7(f) of the directive, Member States may establish guidelines. They may take into consideration too the fact that the seriousness of the infringement of the data subject’s fundamental rights resulting from that processing can vary depending on whether or not the data in question already appear in public sources. In the latter case, the infringement will be more serious. However, it is no longer a mere clarification, but an additional requirement precluded by Article 7(f) of the directive if national rules exclude the possibility of processing certain categories of personal data by definitively prescribing, for those categories, the result of the balancing of the opposing rights and interests, without allowing a different result by virtue of the particular circumstances of an individual case. (see paras 29-30, 32, 36, 44-49, operative part 1) 3. Directive 95/46, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, includes rules having a degree of flexibility and, in many instances, leaves to the Member States the task of deciding the details or choosing between options. A distinction, consequently, must be made between national measures that provide for additional requirements amending the scope of a principle referred to in Article 7 of the directive, on the one hand, and national measures which provide for a mere clarification of one of those principles, on the other hand. The first type of national measure is precluded. It is only in the context of the second type of national measure that Member States enjoy some latitude, pursuant to Article 5 of the directive. (see para. 35) 4. Article 7(f) Directive 95/46, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, sets out two cumulative conditions that must be fulfilled in order for the processing of personal data to be lawful, namely: first, the processing of the personal data must be necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed and, secondly, such interests must not be overridden by the fundamental rights and freedoms of the data subject. The second of those conditions necessitates a balancing of the opposing rights and interests concerned which depends, in principle, on the individual circumstances of the particular case in question and in the context of which the person or the institution which carries out the balancing must take account of the significance of the data subject’s rights arising from Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. (see paras 38, 40) 5. The right to respect for private life with regard to the processing of personal data, recognised by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, concerns any information relating to an identified or identifiable individual. However, it follows from Articles 8(2) and 52(1) of the Charter that, under certain conditions, limitations may be imposed on that right. (see para. 42) 6. Whenever the provisions of a directive appear, so far as their subject-matter is concerned, to be unconditional and sufficiently precise, they may be relied on before the national courts by individuals against the State where the latter has failed to implement that directive in domestic law by the end of the period prescribed or where it has failed to implement that directive correctly. That is the case with Article 7(f) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. While that directive confers on the Member States a greater or lesser discretion in the implementation of some of its provisions, Article 7(f) states an unconditional obligation. (see paras 51-52, 55, operative part 2)