CELEX: 62012CC0141
Language: en
Date: 2013-12-12 00:00:00
Title: Opinion of Advocate General Sharpston delivered on 12 December 2013.#YS v Minister voor Immigratie, Integratie en Asiel and Minister voor Immigratie, Integratie en Asiel v M and S.#Requests for a preliminary ruling from the Rechtbank Middelburget and from the Raad van State.#Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Articles 2, 12 and 13 — Concept of ‘personal data’ — Scope of the right of access of a data subject — Data relating to the applicant for a residence permit and legal analysis contained in an administrative document preparatory to the decision — Charter of Fundamental Rights of the European Union — Articles 8 and 41.#Joined Cases C‑141/12 and C‑372/12.

OPINION OF ADVOCATE GENERAL
      Sharpston
      delivered on 12 December 2013 (1)
      
      Joined Cases C‑141/12 and C‑372/12
      Y.S.
      v
      Minister voor Immigratie, Integratie en Asiel
      (Request for a preliminary ruling from the Rechtbank Middelburg (Netherlands))
      and
      Minister voor Immigratie, Integratie en Asiel
      v
      M. and S.
      (Request for a preliminary ruling from the Raad van State (Netherlands))
      (Personal data and processing – Legal analysis)1.        Y.S., M. and S. are third country nationals who have applied for lawful residence in the Netherlands. Y.S.’s application was
         refused. Those of M. and S. were granted. Each relies on EU law in order to obtain access to a document (‘the minute’) (2) drafted by an official of the relevant authority and containing a legal analysis in the form of internal advice on whether
         to grant residence status. They argue that the legal analysis is personal data and thus, as a matter of EU law, they have
         the right to access the minute.
      
       EU law
       Treaty on the Functioning of the European Union
      2.        According to Article 16(1) TFEU, ‘[e]veryone has the right to the protection of personal data concerning [him or her]’.
      
       Charter of Fundamental Rights of the European Union
      3.        Article 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’), entitled ‘Protection of personal data’,
         states:
      
      ‘1.      Everyone has the right to the protection of personal data concerning him or her.
      2.      Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some
         other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him
         or her, and the right to have it rectified.
      
      3.      Compliance with these rules shall be subject to control by an independent authority.’
      4.        Article 41 concerns the ‘Right to good administration’:
      
      ‘1.      Every person has the right to have his or her affairs handled impartially, fairly and within a reasonable time by the institutions,
         bodies, offices and agencies of the Union.
      
      2.      This right includes:
      …
      (b)      the right of every person to have access to his or her file, while respecting the legitimate interests of confidentiality
         and of professional and business secrecy;
      
      (c)      the obligation of the administration to give reasons for its decisions.
      …’
      5.        In accordance with Article 47(1), ‘[e]veryone whose rights and freedoms guaranteed by the law of the Union are violated has
         the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article’.
      
      6.        Article 51(1) states: ‘[t]he provisions of this Charter are addressed to the institutions, bodies, offices and agencies of
         the Union with due regard for the principle of subsidiarity and to the Member States only when they are implementing Union
         law …’.
      
       Directive 95/46
      7.        According to Article 1(1) of Directive 95/46, (3) ‘Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy
         with respect to the processing of personal data’. (4)
      
      8.        Article 2(a) defines ‘personal data’ as ‘any information relating to an identified or identifiable natural person (“data subject”)’ (5) and ‘an identifiable person’ as ‘one who can be identified, directly or indirectly, in particular by reference to an identification
         number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity’.
      
      9.        The ‘processing of personal data’ or, simply, ‘processing’ is defined in Article 2(b) as ‘any operation or set of operations
         which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage,
         adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available,
         alignment or combination, blocking, erasure or destruction’. In accordance with Article 2(c), a ‘personal data filing system’
         or ‘filing system’ is ‘any structured set of personal data which are accessible according to specific criteria, whether centralised,
         decentralised or dispersed on a functional or geographical basis’.
      
      10.      According to Article 3(1), Directive 95/46 applies to ‘the processing of personal data wholly or partly by automatic means’,
         on the one hand, and ‘the processing otherwise than by automatic means of personal data which form part of a filing system
         or are intended to form part of a filing system’, on the other hand. (6) Article 3(2) excludes certain types of processing from the scope of Directive 95/46 and Article 7 sets out the criteria that
         determine whether or not Member States may process personal data.
      
      11.      Article 12, on the ‘Right of access’, states: (7)
      
      ‘Member States shall guarantee every data subject the right to obtain from the controller:
      (a)      without constraint at reasonable intervals and without excessive delay or expense:
      –        confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of
         the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed,
      
      –        communication to him in an intelligible form of the data undergoing processing and of any available information as to their
         source,
      
      –        knowledge of the logic involved in any automatic processing of data concerning him at least in the case of the automated decisions
         referred to in Article 15(1);
      
      (b)      as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions
         of this Directive, in particular because of the incomplete or inaccurate nature of the data;
      
      (c)      notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in
         compliance with (b), unless this proves impossible or involves a disproportionate effort.’
      
      12.      Exemptions and restrictions to, inter alia, the right of access are described in Article 13(1): (8)
      
      ‘Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles
         6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary [measure] to safeguard:
      
      …
      (d)      the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;
      …
      (f)      a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases
         referred to in (c), (d) and (e);
      
      (g)      the protection of the data subject or of the rights and freedoms of others.’
       Other EU instruments
      13.      Regulation No 45/2001 (9) concerns the protection of individuals with regard to the processing of personal data by the EU institutions. It defines
         ‘personal data’ and ‘processing of personal data’ in essentially the same terms as Directive 95/46. (10) It also provides for a right of access to, in particular, an intelligible form of the data undergoing processing and of any
         available information as to its source. (11)
      
      14.      EU instruments offering access to documents, such as Regulation No 1049/2001 (12) and the decision on public access to documents of the Court, (13) contain exceptions to protect the ‘privacy and the integrity of the individual, in particular in accordance with [EU] legislation
         regarding the protection of personal data’ (14) and offer a basis for refusing access if that would undermine the protection of ‘court proceedings and legal advice’. (15)
      
       Netherlands law and procedure
      15.      The Wet bescherming persoonsgegevens (Law on the Protection of Personal Data or ‘the Wbp’) defines personal data, (16) its scope of application (17) and the right of access (18) in terms similar to those used in Directive 95/46. The applicants rely on it in seeking access to the minute used to decide
         on their application for a fixed term residence permit under the Vreemdelingenwet (Law on Foreign Nationals) 2000.
      
      16.      Such an application, filed with the Immigratie- en Naturalisatiedienst (Immigration and Naturalisation Service), is considered
         first by a case officer, who prepares a draft decision and a further document, the ‘minute’, (19) setting out, inter alia, the legal analysis underpinning the draft decision. If the case officer has no authority to sign
         the draft decision, he sends it together with the minute for assessment to a resumptor (senior case officer). That senior case officer may confirm or reject the legal analysis in the minute. However, independently
         of whether the case officer is competent to sign the decision, the minute is not part of the final decision on residence.
      
      17.      A minute typically contains: the name, telephone and room number of the case officer; boxes for the initials and names of
         the senior case officer(s); the name, date of birth, nationality, sex, ethnicity, religion and language of the applicant;
         information about the procedural history; information about declarations made by the applicant and documents submitted; the
         applicable legal provisions and an assessment of the relevant information in the light of the applicable law (‘the legal analysis’).
         According to the Raad van State, the length of the legal analysis can range from a few sentences to a few pages. At the hearing,
         the Netherlands Government confirmed that there is no template for preparing a minute. Where the legal analysis is extensive,
         the minute might contain statements regarding an assessment of the credibility of the declarations made, the reasons why an
         applicant qualifies (or not) for a residence permit and on what ground(s). A more concise analysis might result in a minute
         containing only the applicable policy line.
      
      18.      It appears also from the request for a preliminary ruling in Case C‑372/12 that the Minister voor Immigratie, Integratie en
         Asiel (‘the Minister for Immigration, Integration and Asylum’ or ‘the Minister’) has explained that minutes form part of applicants’
         files, which are organised according to a ‘v-number’ allocated to each applicant. Without that number, a file cannot be consulted
         or searched.
      
      19.      Until 14 July 2009, the policy was to make the minute (including the legal analysis) available upon request. Many such requests
         were made. According to the Minister, that policy resulted in a considerable workload and often erroneous interpretations
         of the legal analyses. Another consequence was that the legal analysis in particular cases was no longer, or to a lesser degree,
         recorded in the minute. By IND work instruction 2009/11, that policy was abandoned and access to a minute (including the legal
         analysis) was thereafter refused.
      
       Facts, questions and procedure
       Case C‑141/12 Y.S.
      20.      By decision of 9 June 2009, the Minister rejected Y.S.’s application for a fixed term residence permit ‘asiel’. That decision
         was withdrawn but then, on 6 July 2010, the application was again rejected. Y.S.’s request for access to the minute drafted
         for the decision of 6 July 2010 was refused by decision of 24 September 2010 on the ground that the minute contained, apart
         from personal data, a legal analysis. In that decision, the Minister did provide, in so far as necessary, an overview of the
         data contained in the minute, the origin of that data and the authorities which had access to the data.
      
      21.      Y.S.’s administrative challenge to the decision of 24 September 2010 was declared unfounded by decision of 22 March 2011.
         Y.S. appealed against the latter to the referring court which has asked these questions:
      
      ‘(1)      Are the data reproduced in the minute concerning the data subject and which relate to the data subject, personal data within
         the meaning of Article 2(a) of [Directive 95/46]?
      
      (2)      Does the legal analysis included in the minute constitute personal data within the meaning of the aforementioned provision?
      (3)      If the Court of Justice confirms that the data described above are personal data, should the processor/government body grant
         access to those personal data pursuant to Article 12 of [Directive 95/46] and Article 8(2) of the [Charter]?
      
      (4)      In that context, may the data subject rely directly on Article 41(2)(b) of the [Charter], and if so, must the phrase “while
         respecting the legitimate interests of confidentiality [in decision-making]” included therein be interpreted in such a way
         that the right of access to the minute may be refused on that ground?
      
      (5)      When the data subject requests access to the minute, should the processor/government body provide a copy of that document
         in order to do justice to the right of access?’
      
       Case C‑372/12 M. and S.
      22.      After being granted a fixed-term residence permit ‘asiel’, M. requested on 30 October 2009 access to the minute for that decision.
         Similarly, on 19 February 2010, S. asked for access to the minute for the decision granting him a fixed-term residence permit
         ‘regulier’. Those requests were refused on, respectively, 4 November 2009 and 31 March 2010. The Minister rejected on, respectively,
         3 December 2010 and 21 October 2010 the administrative challenges lodged by M. and S. against those decisions as being unfounded.
      
      23.      M. appealed against the decision of the Minister to the Rechtbank Middelburg which, in a judgment of 16 June 2011, held that
         the appeal was well founded, annulled the decision and ordered the Minister to adopt a new decision taking into account its
         judgment. S. appealed against the decision of the Minister to the Rechtbank Amsterdam. That court’s judgment of 4 August 2011
         was similar, in terms of outcome, to that of the Rechtbank Middelburg.
      
      24.      The Minister appealed against both judgments to the Raad van State, which has asked the following questions:
      
      ‘(1)      Should the second indent of Article 12(a) of [Directive 95/46] be interpreted to mean that there is a right to a copy of documents
         in which personal data have been processed, or is it sufficient if a full summary, in an intelligible form, of the personal
         data that have undergone processing in the documents concerned is provided?
      
      (2)      Should the words “right of access” in Article 8(2) of [the Charter] be interpreted to mean that there is a right to a copy
         of documents in which personal data have been processed, or is it sufficient if there is provision of a full summary, in an
         intelligible form, of the personal data that have undergone processing in the documents concerned within the meaning of the
         second indent of Article 12(a) of [Directive 95/46]?
      
      (3)      Is Article 41(2)(b) of [the Charter] also addressed to the Member States of the European Union in so far as they are implementing
         [EU] law within the meaning of Article 51(1) of that Charter?
      
      (4)      Does the consequence that, as a result of the granting of access to “minutes”, the reasons why a particular decision is proposed
         are no longer recorded therein, which is not in the interests of the internal undisturbed exchange of views within the public
         authority concerned and of orderly decision-making, constitute a legitimate interest of confidentiality within the meaning
         of Article 41(2)(b) of [the Charter]?
      
      (5)      Can a legal analysis, as set out in a “minute”, be regarded as personal data within the meaning of Article 2(a) of [Directive 95/46]?
      (6)      Does the protection of the rights and freedoms of others, within the meaning of Article 13(1)(g) of [Directive 95/46] …, also
         cover the interest in an internal undisturbed exchange of views within the public authority concerned? If the answer to that
         is in the negative, can that interest then be covered by Article 13(1)(d) or (f) of that directive?’
      
       Procedure
      25.      In Case C‑141/12, written observations were filed by Y.S., the Austrian, Czech, Greek and Netherlands Governments and the
         Commission. In Case C‑372/12, written observations were filed by M. and S., the French, Netherlands and Portuguese Governments
         and the Commission.
      
      26.      By decision of 30 April 2013, the Court joined the two cases for the purposes of the oral procedure and the judgment.
      
      27.      At the hearing held on 3 July 2013, Y.S., M. and S., the French and Netherlands Governments and the Commission made oral submissions.
      
       Assessment
       Preliminary remarks
      28.      It is not contested that the minute is a document containing personal data and that Y.S., M. and S. were given access to that
         personal data (save for the legal analysis) and informed as to the origin of that data and the bodies to which the data had
         been sent. Both cases are in essence about (the form of) access to the other part of the minute’s content, namely the legal
         analysis.
      
      29.      I shall consider first the questions relating to the interpretation of Directive 95/46 and then turn to the questions regarding
         the Charter. Where questions in the two references concern the same subject-matter, I shall address them together.
      
       Access to personal data, access to a file and reasoned decisions
      30.      At the hearing, it became clear that the applicants wish to understand the reasoning underlying the individual decisions on
         their residence status. It appears that reasons were given for the decision affecting Y.S. but not for those regarding M.
         and S.
      
      31.      I do not question that the applicants have a valid reason for seeking access to the information to which they claim to be
         entitled. Furthermore, the fact that they are seeking access to the minute suggests that they consider whatever information
         has been made available to them to be incomplete, thus possibly putting them in a vulnerable position.
      
      32.      However, broadening the meaning of the rules governing the protection of personal data or extending their scope to cover opinions
         and other measures taken during the preparation and investigation prior to the adoption of a final decision is no remedy for
         a possible breach of the principle that reasons for a decision must be stated in order to protect the right to effective judicial
         review.
      
      33.      Conversely, the fact that a decision is properly reasoned, enabling the applicant to be fully aware of the considerations
         underlying the decision and to make effective use of available remedies, is an insufficient basis for concluding that access
         to the full legal analysis, if that analysis does fall within the rules on the protection of personal data, is unnecessary.
      
      34.      Neither of the referring courts seeks guidance from the Court on the obligation, under either Article 47 of the Charter or
         secondary legislation, to give reasons for final decisions of executive authorities regarding residence status, on the right
         to be heard or on the right of access to a file of which an internal document such as a minute might form part. Nor (so far
         as I can ascertain) did the applicants rely on any of these bases before the referring courts.
      
      35.      It is true that the fact that the referring courts have limited their questions to EU law governing the protection of personal
         data does not preclude the Court from addressing all elements of EU law that may assist them in adjudicating the cases at
         issue. (20) However, I do not think that the Court can widen the scope of its answer here. The duty to state reasons and the right of
         access to the file have not been properly addressed before the Court. Moreover, although the applicants have shown that they
         are aware of the duty under EU law to give reasons for asylum decisions, (21) none of them appear to have made claims in that regard.
      
      36.      In Case C‑372/12, the Netherlands Government stated at the hearing that the reasons for a positive decision are available
         upon request. The fact remains that M. and S. appear not to have been informed of the reasons why they were granted residence
         permits. I cannot accept the Netherlands Government’s suggestion that applicants often have no interest in obtaining those
         reasons. As counsel for M. and S. pointed out at the hearing, the circumstances forming the basis for a favourable decision
         might change, possibly leading to a different decision at a later time. (22) Thus, knowing exactly what circumstances were relevant to the decision taken is a valid interest. General principles of EU
         law, such as the principle of effective judicial protection (now expressed in Article 47 of the Charter), (23) cover that interest. (24) By contrast, EU law governing protection of personal data does not. It has other objectives. (25)
      
      37.      In any event, even if access to the legal analysis in the minute were given on the basis that it is personal data, that might
         not remedy an authority’s failure to state reasons in the final decision or to make them otherwise available. As I understand
         it, (26) the minute, when prepared in the form of an advice to a senior case officer, might not contain all (or indeed any) of the
         reasoning underlying the final decision taken by the competent authority. Also, it appears that the legal analysis might sometimes
         be expressed in no more than a few sentences. In such circumstances, even if a senior case officer agreed with the advice,
         the legal analysis might not be a sufficient statement of reasons.
      
      38.      Finally, neither referring court has asked the Court whether EU law requires Member States, in order to guarantee transparency
         in the decision-making process of competent authorities and access to the information used in that process and/or to protect
         the right to good administration, to give access to the file in proceedings such as those involving Y.S., M. and S. (or to
         include in the file documents such as minutes containing legal analysis), or to hear applicants in relation to the internal
         processes prior to the adoption of a final decision on residence status. Nor were those questions addressed in either the
         written or oral procedure.
      
      39.      My analysis is therefore limited to access to personal data.
      
       Access to personal data under Directive 95/46
       Introduction
      40.      Directive 95/46 applies to the processing of personal data wholly or partly by automatic means and the processing by non-automatic
         means of personal data which form part of a filing system or are intended to form part of such a system. (27) Only these types of processing are covered and protected. (28) The right of access under Article 12 therefore applies only to personal data that are being or might be processed or filed
         in such a manner. In its simplest form, that right can be used to request communication of data ‘undergoing processing’ and
         information regarding their source. (29) However, it is also a basis for obtaining confirmation of whether or not data are being processed and details regarding that
         processing, knowledge of the logic involved in any automatic processing, rectification, erasure or blocking of data (if their
         processing is not in conformity with the directive) and notification thereof, where relevant, to third parties.
      
      41.      Thus, whether Y.S., M. and S. have, under Directive 95/46, a right of access to the legal analysis contained in the minute
         depends on whether that analysis is ‘personal data’ or, if not, a type of processing or filing covered by that directive.
      
       Definitions of ‘personal data’ and ‘processing’ (first and second questions in Case C‑141/12 and fifth question in Case C‑372/12)
      42.      By its first question in Case C‑141/12, I understand the Rechtbank Middelburg to ask whether facts in the minute relating
         to the data subject (as distinct from those relating to, for example, the case officer and/or senior case officer) are ‘personal
         data’ within the meaning of Article 2(a) of Directive 95/46. By its second question (which corresponds with the fifth question
         in Case C‑372/12), it asks the same question with regard to the legal analysis contained in the minute.
      
      43.      The answer to the first question is clearly ‘yes’.
      
      44.      In general, ‘personal data’ is a broad concept. (30) The Court has held that the term covers, for example, ‘the name of a person in conjunction with his telephone coordinates
         or information about his working conditions or hobbies’, (31) his address, (32) his daily work periods, rest periods and corresponding breaks and intervals, (33) monies paid by certain bodies and the recipients, (34) amounts of earned or unearned incomes and assets of natural persons. (35)
      
      45.      The actual content of that information appears to be of no consequence as long as it relates to an identified or identifiable
         natural person. It can be understood to relate to any facts regarding that person’s private life and possibly, where relevant,
         his professional life (which might involve a more public aspect of that private life). (36) It may be available in written form or be contained in, for example, a sound or image. (37)
      
      46.      Thus, information included in the minute relating to facts such as the name, date of birth, nationality, gender, ethnicity,
         religion and language of an applicant is ‘personal data’ within the meaning of Article 2(a) of Directive 95/46.
      
      47.      As regards the second question, I do not consider that legal analysis is personal data.
      
      48.      This is not the first time that a question about access to legal analysis or advice has been put to the Court. (38) In those cases, however, it would appear that access was sought on other bases. (39) The Court was not required to examine whether and why a document containing legal analysis or advice is different from one
         having a different content.
      
      49.      Whilst the Court cannot avoid that inquiry here, I do not think that it is necessary to provide an exhaustive definition of
         ‘personal data’, ‘legal analysis’ or any other form of analysis. (40) It suffices to focus on whether the legal analysis included in the minute is personal data.
      
      50.      In my view, that is not the case.
      
      51.      I would distinguish three types of legal analysis, only one of which seems to be of the type included in the minute.
      
      52.      The first type is purely abstract: it concerns the interpretation and application of the law without use of information relating
         to an identifiable or identified person or other types of fact. Thus, Directive 95/46 does not apply to a legal analysis of
         the meaning of ‘personal data’ in that directive because that analysis does not relate to an identified or identifiable person.
      
      53.      The second type is less abstract inasmuch as it uses illustrative facts. However, those facts are not related to a particular
         identified or identifiable person or event. This type of legal analysis therefore also falls outside the scope of Directive 95/46.
      
      54.      The third type involves the legal classification of facts relating to an identified or identifiable person (or event involving
         such persons) and their assessment against the background of the applicable law. The legal analysis to which Y.S., M. and
         S. seek access is of this third type.
      
      55.      I am not convinced that the phrase ‘any information relating to an identified or identifiable natural person’ in Directive 95/46
         should be read so widely as to cover all of the communicable content in which factual elements relating to a data subject
         are embedded.
      
      56.      In my opinion, only information relating to facts about an individual can be personal data. Except for the fact that it exists,
         a legal analysis is not such a fact. Thus, for example, a person’s address is personal data but an analysis of his domicile
         for legal purposes is not.
      
      57.      In that context, I do not find it helpful to distinguish between ‘objective’ facts and ‘subjective’ analysis. Facts can be
         expressed in different forms, some of which will result from assessing whatever is identifiable. For example, a person’s weight
         might be expressed objectively in kilos or in subjective terms such as ‘underweight’ or ‘obese’. Thus, I do not exclude the
         possibility that assessments and opinions may sometimes fall to be classified as data.
      
      58.      However, the steps of reasoning by which the conclusion is reached that a person is ‘underweight’ or ‘obese’ are not facts,
         any more than legal analysis is.
      
      59.      Legal analysis is the reasoning underlying the resolution of a question of law. The resolution itself might be in the form
         of advice, an opinion or a decision (and thus may, or may not, be legally binding). Apart from the facts on which it is based
         (some of which might be personal data), that analysis contains the explanation for the resolution. The explanation itself
         is not information relating to an identified or identifiable person. At most, it can be categorised as information about the
         interpretation and application of the pertinent law with regard to which the legal position of an individual is assessed and
         (possibly) decided. Personal data and other elements of fact may very well be inputs in the process leading to answering that
         question; but that does not make the legal analysis itself personal data.
      
      60.      Moreover, a person is entitled to access his personal data because he has an interest in the protection of his fundamental
         rights and freedoms, in particular his right to privacy, when Member States process information that concerns him. (41) Denying access to the data processed or to information about that process would render ineffective other parts of Directive 95/46.
         It might not be possible to verify, for example, whether personal data are processed only if necessary to perform a task in
         the exercise of official authority vested in the controller, (42) or to obtain the rectification or erasure of that data. (43) By contrast, legal analysis as such does not fall within the sphere of an individual’s right to privacy. There is therefore
         no reason to assume that that individual is himself uniquely qualified to verify and rectify it and ask that it be erased
         or blocked. (44) Rather, it is for an independent judicial authority to review the decision for which that legal analysis was prepared.
      
      61.      For these reasons, I take the view that Directive 95/46 does not require Member States to give access to such legal analysis
         when it is included in an internal document, such as the minute, which contains personal data, because such legal analysis
         is not itself personal data.
      
      62.      Is legal analysis a form of processing or filing covered by Directive 95/46?
      
      63.      I do not think so. Rather, it is a process controlled entirely by individual human intervention through which personal data
         (in so far as they are relevant to the legal analysis) are assessed, classified in legal terms and subjected to the application
         of the law, and by which a decision is taken on a question of law. Furthermore, that process is neither automatic nor directed
         at filing data. (45)
      
      64.      Processing involves ‘any operation or set of operations’ upon that data by an entity identified in Directive 95/46. The use
         of the words ‘such as’ in Article 2(b) suggests that the list of operations is non-exhaustive; (46) but also indicates the type of operation that will constitute ‘processing’. For example, the Court has held that loading personal data on an internet
         page is covered. (47) The list also includes the ‘adaptation’ and ‘use’ of personal data, without specifying the purpose of these actions (though
         some of the exceptions to the scope of application of Directive 95/46 appear to be defined by reference to the purpose of
         the processing). (48) Processing might also involve the capture, transmission, manipulation, recording, storage or communication of sound and image
         data. (49)
      
      65.      As I see it, all of these operations involve an action taken with respect to personal data, but without the assessment of
         that data which is inevitable in legal analysis. The same applies to the concept of filing.
      
      66.      Even if it were considered to be a form of processing, a legal analysis is neither automatic nor in the form of a manual filing
         system. I add that, in any event, Article 12 of Directive 95/46 offers a basis for access to personal data as such but not
         to their processing or their processed form.
      
       Scope of the right of access under Directive 95/46 (third question in Case C‑141/12)
      67.      By its third question, the referring court in Case C‑141/12 asks whether access should be granted, pursuant to Article 12
         of Directive 95/46 and Article 8(2) of the Charter, (50) to ‘the data described above’ if it is accepted by the Court to be personal data.
      
      68.      It seems to me that the answer can only be ‘yes’, provided that such access is not restricted or exempted pursuant to Article 13
         of Directive 95/46.
      
       Form of access (fifth question in Case C‑141/12 and first and second questions in Case C‑372/12)
      69.      Both referring courts ask whether Directive 95/46 requires a copy of the minute to be given to individuals seeking access
         to it.
      
      70.      The referring court in Case C‑372/12 also invokes Article 8(2) of the Charter in this context. Whilst Article 8 of the Charter
         was drafted against the background of, inter alia, Directive 95/46, it sets out a separate right to the protection of personal
         data. (51) However, it does not articulate a separate standard governing the form in which access must be made available. When read
         together with the principle of proportionality and legal certainty, I interpret Article 8(2) of the Charter to mean that access
         need not go beyond what is necessary in order to achieve its objectives and to give the data subject full knowledge of the
         personal data that are protected under that provision. The requirement set out in Article 12 of Directive 95/46 corresponds
         to those principles. For that reason, I do not consider that a separate inquiry into the form of access under Article 8 of
         the Charter is necessary.
      
      71.      Directive 95/46 does not establish a right of access to any or every document or file in which personal data are listed or
         used. Nor does it limit the material form in which personal data, with respect to which it guarantees access, must be made
         accessible.
      
      72.      Rather, it provides that data undergoing processing and any available information as to the sources of the data must be communicated
         to the data subject ‘in an intelligible form’. (52)
      
      73.      Depending on the circumstances, a copy might be neither necessary nor sufficient.
      
      74.      Directive 95/46 does not require personal data covered by the right of access to be made available in the material form in
         which they exist or were initially recorded. In that regard, I consider that a Member State has a considerable margin of discretion
         to determine, (53) based on the individual circumstances in case, the form in which to make personal data accessible.
      
      75.      In making that assessment, a Member State should take account of, in particular: (i) the material form(s) in which that information
         exists and can be made available to the data subject, (ii) the type of personal data and (iii) the objectives of the right
         of access.
      
      76.      First, personal data might exist in different forms. For example, data recorded during an interview, and subsequently stored,
         might exist as an audiotape, an electronic file containing the recording or a written transcript. Thus, if personal data originate
         from an interview, Article 12 of Directive 95/46 does not prescribe whether that data must be made available in the form of
         the audiotape, the file containing the recording, the transcript or some other medium. Whatever form is chosen, however, it
         must be made available in a physical form that will endure and that is capable of presenting a complete set of personal data.
      
      77.      Second, Article 12 of Directive 95/46 guarantees a data subject access to his/her personal data that are being processed but
         not to any other information, including that relating to another data subject. For that reason, a compilation of the personal
         data listed (for example) in a separate document or a copy of the minute within which all content that is not personal data
         is erased or made inaccessible must both be valid forms of providing access. But a document listing no more than dates and
         times of phone calls made from an individual’s mobile number might need to be made accessible in full because other forms
         of presenting that information might not be practicable or imaginable.
      
      78.      Third, the data communicated must enable the data subject to know and understand their content and, where necessary, to exercise
         the rights set out in Article 12(b) and (c) of Directive 95/46 as well as, for example, his right to object to his personal
         data being processed (Article 14) and his right of action where he suffers damage (Articles 22 and 23). (54) Thus, the data must be in a form that allows the data subject, for example, to consult and understand them, verify their
         accuracy and the lawfulness of the processing, request corrections and possibly object to (further) processing. (55) The form of access is thus a function also of the rights that the data subject seeks to exercise.
      
      79.      Thus, the fact that personal data are contained in a document such as a minute does not imply that the data subject automatically
         has the right to that material form, that is to say, a copy or extract of that document.
      
       Restrictions and exceptions (sixth question in Case C‑372/12)
      80.      I have taken the view that Directive 95/46 does not provide a basis for claiming access to legal analysis contained in a minute.
         It follows that there is no need to justify a refusal to grant access under Article 13 of that directive.
      
      81.      If the Court disagrees and holds that Directive 95/46 (and in particular Article 12) applies, does the interest of guaranteeing
         an undisturbed exchange of views within an authority fall within the scope of the phrase ‘the protection … of the rights and
         freedoms of others’ in Article 13(1)(g)? In the alternative, can that interest fall within the scope of Article 13(1)(d) or (f)?
      
      82.      In my view, the answer to both questions is ‘no’.
      
      83.      Article 13(1) contains an exhaustive list of bases that may justify a legislative measure restricting the scope of the obligations
         and rights set out in a limited set of provisions of Directive 95/46, including Article 12. Justifications must be based on
         the public interest or on striking an appropriate balance between rights and freedoms of the data subject and of other persons.
      
      84.      With respect to subparagraph (g), the protection of rights and freedoms of others (that is, other than the data subject) cannot be read as including rights and freedoms of the authority processing personal
         data. If a legal analysis is to be categorised as personal data, that must be because it is related to the private interests
         of an identified or identifiable person. Whilst the public interest in protecting internal advice in order to safeguard the
         administration’s ability to exercise its functions may indeed compete with the public interest in transparency, access to
         such advice cannot be restricted on the basis of the first of those two interests, because access covers only what falls within
         the private interest.
      
      85.      With regard to Article 13(1)(d) and (f), I find no reason to disagree with the Netherlands Government’s acceptance that there
         is no link between its restrictions of access and the interests protected there.
      
       Access to personal data under Article 41 of the Charter (fourth question in Case C‑141/12 and third and fourth questions in
            Case C‑372/12)
      86.      In accordance with Article 51(1) of the Charter, the Charter is addressed to Member States only when they implement EU law.
         Put differently, if EU law applies, the Charter applies. (56) That limitation applies irrespective of any further limitation embedded in a particular provision of the Charter.
      
      87.      In the present cases, the Charter applies because the relevant decisions were taken after its entry into force on 1 December
         2009 and, as was confirmed by the Netherlands Government at the hearing, pursuant to a national law implementing EU law.
      
      88.      Despite that conclusion, I consider that Article 41 of the Charter cannot apply in the context of the cases at issue, because
         it sets out rights to be invoked against EU institutions (and thus concerns the latter’s corresponding obligations) whilst
         the cases at issue concern personal data and other information held by a Member State.
      
      89.      The Court in Cicala has confirmed this reading with respect to Article 41(2)(c) of the Charter, which sets out the duty to state reasons. (57) Whilst Article 41(2) does not in terms refer to the EU institutions, it defines, through the use of the introductory phrase
         ‘[t]his right includes’, the addressees of the obligations it lays down. That phrase contains an unambiguous renvoi to the
         right in Article 41(1) which is to be invoked against ‘the institutions, bodies, offices and agencies of the Union’.
      
      90.      The Court’s statement in M.M. (58) that Article 41(2) is of general application does not contradict Cicala. Paragraphs 82 to 84 of the judgment in M.M., when read together, suggest to me rather that the Court was focussing on the substance of the right to be heard and who
         can invoke it; (59) and in so doing the Court emphasised both the very broad scope of that right and the place that it has long held in the EU
         legal order.
      
      91.      The answer to the third question in Case C‑372/12 must thus be ‘no’; and it is therefore no longer necessary to answer the
         fourth question in that case.
      
      92.      Finally, I have already explained why I consider that it would not be appropriate for the Court to expand the scope of the
         present reference so as to answer questions regarding the right of access to the file and the duty to state reasons, where
         secondary legislation or other provisions of the Charter, notably Article 47, might apply. Such questions might or might not
         be pertinent to situations such as those giving rise to the present references. The absence of any indication that those matters
         were duly raised before the national court, coupled with the lack of argument before this Court, make it essential to confine
         the answers given by the Court to the issue of access to personal data. (60)
      
       Conclusion
      93.      In the light of all of the foregoing considerations, I am of the opinion that the Court should answer the questions raised
         by the Rechtbank Middelburg and the Raad van State to the following effect:
      
      (1)      Facts relating to an identified or identifiable natural person are ‘personal data’ within the meaning of Article 2(a) of Directive
         95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to
         the processing of personal data and on the free movement of such data. However, the reasoning underlying the resolution of
         a question of law – which involves the legal classification of facts relating to an identified or identifiable person and
         their assessment against the background of the applicable law – is not covered by the definition of ‘personal data’ in that
         directive. Directive 95/46 does not therefore require Member States to give access to such legal analysis when it is included
         in an internal document which also contains personal data.
      
      (2)      Pursuant to Article 12 of Directive 95/46, access must be given to data that are covered by the definition of ‘personal data’
         in that directive, unless such access is restricted or exempted by Article 13 of that directive.
      
      (3)      Directive 95/46 does not establish a right of access to any specific document or file in which personal data are listed or
         used. Nor does it specify the material form in which personal data must be made accessible. Under Article 12 of Directive
         95/46, Member States enjoy a considerable margin of discretion to determine the form in which to make personal data accessible.
         In making that assessment, Member States should take account of, in particular, (i) the material form(s) in which that information
         exists and can be made available to the data subject, (ii) the type of personal data and (iii) the objectives of the right
         of access.
      
      (4)      The protection of rights and freedoms of others in Article 13(1)(g) of Directive 95/46 does not encompass the rights and freedoms
         of the authority processing personal data. Nor is there any link between the interest in an internal undisturbed exchange
         of views within the public authority and the interests protected under Article 13(1)(d) or (f) of that directive.
      
      (5)      Article 41 of the Charter of Fundamental Rights of the European Union sets out rights that may be invoked against institutions,
         bodies, offices and agencies of the Union and therefore cannot apply to personal data and other information held by a Member
         State.
      
      1 –	Original language: English.
      
      2 –	See point 17 below.
      
      3 –	Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with
         regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), as amended in certain
         respects by Regulation (EC) No 1882/2003 of the European Parliament and of the Council of 29 September 2003 (OJ 2003 L 284,
         p. 1). Separate rules on the processing of personal data in the framework of police and judicial cooperation in criminal matters
         are found in Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the
         framework of policy and judicial cooperation in criminal matters (OJ 2008 L 350, p. 60). Work is on-going on a new General
         Data Protection Regulation (see COM(2012) 11 final).
      
      4 –	See also recital 10 in the preamble to Directive 95/46.
      
      5 –	That definition appears to be taken from the identical definition in Article 2(a) of the 1981 Convention for the Protection
         of Individuals with regard to Automatic Processing of Personal Data (ETS 108), to which all Member States are party.
      
      6 –	See also recital 15 in the preamble to Directive 95/46.
      
      7 –	See also recital 41 in the preamble to Directive 95/46.
      
      8 –	See also recital 42 in the preamble to Directive 95/46.
      
      9 –	Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals
         with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data
         (OJ 2001 L 8, p. 1).
      
      10 –	See Article 2(a) and (b) of Regulation No 45/2001.
      
      11 –	See Article 13(c) of Regulation No 45/2001.
      
      12 –	Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European
         Parliament, Council and Commission documents (OJ 2001 L 145, p. 43).
      
      13 –	Decision of the Court of Justice of the European Union of 11 December 2012 concerning public access to documents held by
         the Court of Justice in the exercise of its administrative functions (OJ 2013 C 38, p. 2).
      
      14 –	Article 4(1)(b) of Regulation No 1049/2001; Article 3(1)(b) of the Court of Justice’s decision.
      
      15 –	Article 4(2), second indent, of Regulation No 1049/2001; Article 3(2), second indent, of the Court of Justice’s decision.
      
      16 –	Article 1(a) of the Wbp.
      
      17 –	Article 2(1) of the Wbp.
      
      18 –	Article 35 of the Wbp.
      
      19 –	Examples of minutes were submitted to the Court in the course of the written procedure in Case C‑141/12.
      
      20 –	See, for example, Case C‑365/02 Lindfors [2004] ECR I‑7183, paragraph 32 and the case-law cited, and Case C‑86/12 Alokpa and Others [2013] ECR I‑0000, paragraph 20 and the case-law cited.
      
      21 –	In their written observations, Y.S. and M. and S. explicitly referred to Council Directive 2005/85/EC of 1 December 2005
         on minimum standards on procedures in Member States for granting and withdrawing refugee status (OJ 2005 L 326, p. 13) of
         which the first subparagraph of Article 9(2) provides: ‘Member States shall also ensure that, where an application [for asylum]
         is rejected, the reasons in fact and in law are stated in the decision and information on how to challenge a negative decision
         is given in writing’. The second subparagraph of this provision states that, in circumstances where a person is not granted
         refugee status but is granted the same rights and benefits under national and EU law by virtue of Council Directive 2004/83/EC
         of 29 April 2004 on minimum standards for the qualification and status of third country nationals or stateless persons as
         refugees or as persons who otherwise need international protection and the content of the protection granted (OJ 2004 L 304,
         p. 2), a Member State need not state the reasons for that decision but must ‘ensure that the reasons for not granting refugee
         status are stated in the applicant’s file and that the applicant has, upon request, access to his/her file’.
      
      22 –	For example, changing circumstances might determine whether or not a decision will be renewed or withdrawn.
      
      23 –	See Case C‑69/10 Samba Diouf [2011] ECR I‑7151, paragraph 49 and the case-law cited.
      
      24 –	See Case C‑300/11 ZZ [2013] ECR I‑0000, paragraph 53.
      
      25 –	See point 60 below.
      
      26 –	See point 17 above.
      
      27 –	Article 3(1) of Directive 95/46.
      
      28 –	See, for example, recital 15 in the preamble to Directive 95/46 and Article 3(2) thereof, which provides for two exceptions
         to the scope of that directive.
      
      29 –	Second indent of Article 12(a) of Directive 95/46.
      
      30 –	See, for example, Case C‑101/01 Lindqvist [2003] ECR I‑12971, paragraph 24; Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I‑4989, paragraph 64; Case C‑73/07 Satakunnan Markkinapörssi and Satamedia [2008] ECR I‑9831, paragraphs 35 and 37; Case C‑524/06 Huber [2008] ECR I‑9705, paragraph 43; and Case C‑553/07 Rijkeboer [2009] ECR I‑3889, paragraph 62.
      
      31 –	Lindqvist, cited in footnote 30 above, paragraph 24.
      
      32 –	Rijkeboer, cited in footnote 30 above, paragraph 42.
      
      33 –	Case C‑342/12 Worten [2013] ECR I‑0000, paragraphs 19 and 22.
      
      34 –	Österreichischer Rundfunk and Others, cited in footnote 30 above, paragraph 64. See also the types of data at issue in Huber, cited in footnote 30 above, paragraphs 20 and 43.
      
      35 –      Satakunnan Markkinapörssi and Satamedia, cited in footnote 30 above, paragraphs 35 and 37.
      
      36 –	See, for example, Joined Cases C‑92/09 and C‑93/09 Volker und Markus Schecke and Eifert [2010] ECR I‑11063, paragraph 59 and the case-law cited; see also, more recently, point 118 of Advocate General Jääskinen’s
         Opinion in Case C‑131/12 Google Spain and Google, pending before the Court.
      
      37 –	See recitals 14 to 17 in the preamble to Directive 95/46.
      
      38 –	See, for example, point 24 of Advocate General Poiares Maduro’s Opinion in Joined Cases C‑39/05 P and C‑52/05 P SwedenandTurco v Council [2008] ECR I‑4723, endorsing the General Court’s observation at first instance that ‘the reference to “legal advice” [in
         Article 4(2) of Regulation No 1049/2001] does not raise any difficulty of interpretation’. Other cases where access was sought
         to legal opinions of the legal services of the EU institutions or to legal documents submitted to the Court include, for example,
         Joined Cases C‑514/07 P, C‑528/07 P and C‑523/07 P Sweden and Others v APIand Commission [2010] ECR I‑8533. See also points 13 and 14 above.
      
      39 –	In particular, Article 4(2), second indent, of Regulation No 1049/2001. See point 14 above.
      
      40 –	The applicants compared legal analysis with the treatment of medical analysis as personal data in the Article 29 Data Protection
         Working Party’s Opinion 4/2007 on the concept of personal data (01248/07/EN WP 136). That Opinion, which is not binding on
         the Court, treats the results of a medical analysis as personal data. It does not take a position on the medical analysis itself.
      
      41 –	See recital 1 in the preamble to and Article 1(1) of Directive 95/46.
      
      42 –	See Article 7(e) of Directive 95/46.
      
      43 –	See Article 12(c) of Directive 95/46.
      
      44 –	See, for example, Article 12(b) of Directive 95/46.
      
      45 –	See also point 146 of my Opinion in Case C‑28/08 P Commission v Bavarian Lager [2010] ECR I‑6055, in which I suggested (in the context of Article 3(2) of Regulation No 45/2001) that ‘a sequence of operations,
         in which the individual human element plays such a preponderant part and retains control throughout, should not be considered
         to be “the processing of personal data … partly by automatic means”’.
      
      46 –	The ‘processing’ of personal data consists of ‘any operation or set of operations which is performed upon personal data,
         whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval,
         consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking,
         erasure or destruction’ (Article 2(b) of Directive 95/46).
      
      47 –	Lindqvist, cited in footnote 30 above, paragraph 25.
      
      48 –	See Article 3(2) of Directive 95/46.
      
      49 –	See recital 14 in the preamble to Directive 95/46; see also the examples at paragraph 37 of Satakunnan Markkinapörssi and Satamedia, cited in footnote 30 above.
      
      50 –	See also point 70 below.
      
      51 –	See the explanation to Article 8 of the Charter in OJ 2007 C 303, p. 17, which refers also to Regulation No 45/2001. According
         to their preamble, these explanations are not law but ‘are a valuable tool of interpretation intended to clarify the provisions
         of the Charter’; and Article 52(7) of the Charter states that they ‘shall be given due regard’ by the courts of the Union
         and of the Member States. The Court has held that they ‘have to be taken into consideration for the interpretation of the
         Charter’: see Case C‑283/11 Sky Österreich [2013] ECR I‑0000, paragraph 42 and the case-law cited.
      
      52 –	Second indent of Article 12(a) of Directive 95/46.
      
      53 –	See Lindqvist, cited in footnote 30 above, paragraph 84, stating that ‘in many respects, the Member States have a margin of manoeuvre in
         implementing Directive 95/46’.
      
      54 –	Rijkeboer, cited in footnote 30 above, paragraphs 51 and 52.
      
      55 –	See also recitals 25 and 41 in the preamble to Directive 95/46.
      
      56 –	Case C‑617/10 Åkerberg Fransson [2013] ECR I‑0000, paragraphs 20 and 21, as recently confirmed in Case C‑418/11 TEXDATA Software [2013] ECR I‑0000, paragraph 73.
      
      57 –	Case C‑482/10 [2011] ECR I‑0000, paragraph 28.
      
      58 –	Case C‑277/11 [2012] ECR I‑0000, paragraph 84.
      
      59 –	See also point 32 of Advocate General Bot’s Opinion in M.M., cited in footnote 58 above.
      
      60 –	See points 34 to 38 above.