JUDGMENT OF THE CIVIL SERVICE TRIBUNAL
(Third Chamber)
16 September 2009
Case F-130/07
Fiorella Vinci
v
European Central Bank (ECB)
(Civil service – Staff of the ECB – Allegedly unlawful treatment of medical data – Medical examination imposed)
Application: brought under Article 36.2 of the Protocol on the Statute of the European System of Central Banks and of the European Central
Bank, annexed to the EC Treaty, in which Ms Vinci seeks, first, a finding that the inclusion in her personal file of, first,
the letter of 5 March 2007 sent to her by the Directorate-General for Human Resources, Budget and Organisation of the ECB
and informing her that the medical adviser of the ECB had decided to refer her for a medical examination by an independent
expert, scheduled for 8 March 2007, and then of the letter, also of 5 March 2007, sent by the Directorate General for Human
Resources to the independent expert, Prof. A., requesting him to conduct a medical examination of the applicant, and lastly,
of the certificate of 24 April 2007 from the ECB’s medical adviser finding that the applicant’s fitness for work was not reduced,
was unlawful; second, a finding that the inclusion in her medical file of the report of the medical examination conducted
on 8 March 2007 by Prof. A’s medical team was unlawful; third, a finding that the decision of the President of the ECB of
3 September 2007 rejecting her complaint of 2 August 2007 and refusing to remove the abovementioned documents from her personal
and medical files in which they had been placed was unlawful; fourth, a finding that the letter of 5 March 2007 instructing
her to attend a medical examination at Prof. A’s surgery on 8 March 2007 was unlawful; fifth, an order that the ECB pay her
EUR 10 000 in compensation for the damage she claims to have suffered; and finally, sixth, an order that the ECB pay the costs.
Held: The action is dismissed. Each party is to bear its own costs.
Summary
1.      Officials – Staff of the European Central Bank – Actions – Act adversely affecting an official – Definition – Refusal to delete
personal data inserted by the administration in a personal file – Included
(European Parliament and Council Regulation No 45/2001, Art. 16; Conditions of Employment for Staff of the European Central
Bank, Art. 42)
2.      Officials – Staff of the European Central Bank – Actions – Obligation to submit a prior request despite the absence of a decision
open to review – None
(Conditions of Employment for Staff of the European Central Bank, Arts 41 and 42; European Central Bank Staff Rules, Art. 8.1.0)
3.      Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data
by the Community institutions and bodies – Regulation No 45/2001 – Collection of medical data in order to monitor a situation
of chronic absenteeism – Legality
(European Parliament and Council Regulation No  45/2001, Art. 4(1)(c))
4.      Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data
by the Community institutions and bodies – Regulation No 45/2001 – Collection of medical data in order to check whether absence
on sick leave is justified – Scale of checks
(European Parliament and Council Regulation No 45/2001, Art. 10(2)(b); Conditions of Employment for Staff of the European
Central Bank, Art. 31 ; European Central Bank Staff Rules, Art. 5.13.4)
5.      Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data
by the Community institutions and bodies – Regulation No 45/2001 – Processing of medical data – Legal basis
(European Parliament and Council Regulation No 45/2001, Art. 10(2)(b))
6.      Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data
by the Community institutions and bodies – Regulation No 45/2001 – Measure of a Community institution or body authorising
the processing of staff members’ data – Respect for staff members’ privacy – Conditions
(European Parliament and Council Regulation No 45/2001)
1.      A decision by the European Central Bank rejecting a request from a staff member seeking the deletion of personal data inserted
by the administration in his personal file constitutes a measure which is open to review, as provided for in Article 42 of
the Conditions of Employment for Staff of the European Central Bank. It is clear from Article 16 of Regulation No 45/2001
on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and
on the free movement of such data that a refusal to delete data will be unlawful if their processing and, in particular, their
collection has been unlawful. Consequently, in considering the legality of a refusal to delete data, the court may examine
the legality of all the processing of the data in question, particularly their recording and storage (i.e. insertion).
Furthermore, while Article 16 of Regulation No 45/2001 merely refers to the ‘unlawful’ nature of that processing by mentioning
infringement of the provisions of Sections 1, 2 and 3 of Chapter II, it cannot be interpreted as confining the review of the
legality of that processing solely to compliance with the provisions of the sections referred to. It is consequently for the
court to assess whether a plea in law alleging unlawful processing is capable of compromising respect for privacy which the
regulation is designed to guarantee with regard to the processing of personal data.
(see paras 46-48, 66-67)
2.      Since the European Central Bank Staff Rules do not lay down a specific prior request procedure in circumstances where the
Bank has not previously taken a decision open to review, an applicant cannot be criticised for having requested an administrative
review without the Bank having first adopted a decision open to review.
Furthermore, since it necessarily presupposes that a prior decision exists, the two-month period which starts to run from
the notification of the contested decision, as provided for in Article 8.1.0 of the Staff Rules, does not apply where it is
in the course of an administrative review procedure that a decision arises which may subsequently be contested in a complaint
and then in court proceedings.
(see paras 51, 53, 55)
3.      Where a Community institution or body is authorised to undertake a potentially invasive collection of its staff’s medical
data which could compromise their privacy, the use of that collection must not go beyond what is strictly necessary, taking
account of the factual circumstances in which the institution or body exercises that power. It must therefore observe the
principle of proportionality, particularly as prescribed concerning protection with regard to the processing of personal data
by Article 4(1)(c) of Regulation No 45/2001 on the protection of individuals with regard to the processing of personal data
by the Community institutions and bodies and on the free movement of such data. It is also the duty of the Community judicature
to monitor compliance with that principle.
The collection of medical data by a Community institution or body in the form of a full examination of a staff member’s general
state of health for the purpose, first, of checking whether his repeated absences are justified and, second, of assessing
whether it is necessary to adapt his working conditions on account of possible problems he might have in performing his duties
as a result of his state of health cannot be regarded as excessive. In such circumstances the administration may legitimately
consider that a full examination of the staff member’s state of health is necessary to end a situation of chronic absenteeism
which it regards as unsatisfactory for both itself and the person concerned. Furthermore, in such a situation, an institution
is entitled, if not obliged as a result of its duties towards its staff, to assess the need to adapt a staff member’s working
conditions in the light of any problems he might have in performing his duties as a result of his state of health.
(see paras 87, 89, 90, 102, 139)
4.      Although the provisions of Article 10(2)(b) of Regulation No 45/2001 on the protection of individuals with regard to the processing
of personal data by the Community institutions and bodies and on the free movement of such data require that the processing
of data falling within the scope of those provisions must be necessary for the purposes of complying with the specific rights
and obligations of the controller in the field of employment law, it does not follow from those provisions that any text providing
for the processing of ‘special categories of data’ within the meaning of the title of Article 10 of the regulation must itself
explicitly state the precise purpose of that processing and thus prove that it is necessary.
In any event, although Article 5.13.4 of the European Central Bank Staff Rules does not expressly identify which objectives
might justify the use of the collection of medical data provided for, those objectives may be clearly inferred from the context
in which that article is found. The purpose of all the provisions of Article 5.13 is to define the conditions for the application
of Article 31 of the Conditions of Employment for Staff of the European Central Bank, which provides that ‘members of staff
who provide evidence of incapacity to perform their duties because of illness or accident shall be granted paid sick leave’.
The measures laid down in Article 5.13.4 are thus intended to be applied where a staff member is absent on sick leave in order
to check whether that absence is justified, and the extent of those checks may legitimately vary depending, in particular,
on the frequency of the absences.
(see paras 100-101, 138)
5.      It does not follow from the provisions of Article 10(2)(b) of Regulation No 45/2001 on the protection of individuals with
regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data that
those provisions require that any processing of special categories of data as defined in paragraph 1 of that article must
be authorised by a text directly provided for in the Treaties establishing the European Communities. Such an interpretation
is not consistent with the wording of the text and in particular the use of the expression ‘on the basis thereof’ which, while
it implies a link between the text providing for the processing of data and the Treaties, does not imply that that link must
be direct.
Furthermore, while it is true that the French version of Article 10(2)(b) of Regulation No 45/2001 provides that processing
of, in particular, medical data must be authorised by the Treaties or other ‘actes législatifs’ adopted on the basis of those
Treaties, the expression ‘actes législatifs’ must be interpreted as referring to the concept of a ‘measure of legislative
scope’, as is the case with other language versions which use a more general expression not referring to the necessity for
processing to be authorised by a measure of a particular body.
(see paras 115-116, 118-119)
6.      With regard to a measure of a Community institution or body authorising the processing of its staff’s personal data and falling
within the scope of Regulation No 45/2001 on the protection of individuals with regard to the processing of personal data
by the Community institutions and bodies and on the free movement of such data, the protection of staff members’ privacy is
sufficiently guaranteed where the text authorising the processing of data is a measure of legislative scope which has been
adequately advertised, and where the processing in question is foreseeable.
(see para. 122)