CELEX: 62010CJ0468
Language: en
Date: 2011-11-24 00:00:00
Title: Judgment of the Court (Third Chamber) of 24 November 2011.#Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) (C-468/10) and Federación de Comercio Electrónico y Marketing Directo (FECEMD) (C-469/10) v Administración del Estado.#References for a preliminary ruling: Tribunal Supremo - Spain.#Processing of personal data - Directive 95/46/EC - Article 7(f) - Direct effect.#Joined cases C-468/10 and C-469/10.

Joined Cases C-468/10 and C-469/10
      Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF)
      and
      Federación de Comercio Electrónico y Marketing Directo (FECEMD)
      v
      Administración del Estado
      (Reference for a preliminary ruling from the Tribunal Supremo)
      (Processing of personal data – Directive 95/46/EC – Article 7(f) – Direct effect)
      Summary of the Judgment
      1.        Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – Full
            harmonisation – Restrictive list of cases of lawful processing of personal data
      (European Parliament and Council Directive 95/46, Art. 7)
      2.        Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – Conditions
            for the lawfulness of the processing of personal data
      (Charter of Fundamental Rights of the European Union, Arts 7 and 8; European Parliament and Council Directive 95/46, Arts
            5 and 7(f))
      3.        Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – Member
            States’ discretion – Extent
      (European Parliament and Council Directive 95/46, Art. 5)
      4.        Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – Conditions
            for the lawfulness of the processing of personal data
      (Charter of Fundamental Rights of the European Union, Arts 7 and 8; European Parliament and Council Directive 95/46, Art.
            7(f))
      5.        Fundamental rights – Respect for private life – Protection of personal data – Limitations tolerated under the Charter of Fundamental
            Rights of the European Union
      (Charter of Fundamental Rights of the European Union, Arts 7, 8 and 52(1))
      6.        Acts of the institutions – Directives – Direct effect – Conditions
      (Art. 249(3) EC; European Parliament and Council Directive 95/46, Art. 7(f))
      1.        The harmonisation of national laws sought by Directive 95/46 on the protection of individuals with regard to the processing
         of personal data and on the free movement of such data is not limited to minimal harmonisation but amounts to harmonisation
         that is, in principle, complete. It is upon that view that the directive is intended to ensure free movement of personal data
         while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate. Consequently,
         it follows from that objective that Article 7 of the directive sets out an exhaustive, restrictive list of cases in which
         the processing of personal data may be regarded as being lawful. It follows that Member States cannot add new principles relating
         to the lawfulness of the processing of personal data to Article 7 of that directive or impose additional requirements that
         have the effect of altering the scope of one of the principles provided for in Article 7.
      
      That interpretation is not brought into question by the right of Member States under Article 5 of Directive 95/46 to specify
         the conditions under which the processing of personal data is lawful. Indeed, Member States may not, by virtue of their discretion
         under Article 5 of the directive, introduce principles relating to the lawfulness of the processing of personal data other
         than those listed in Article 7 of the directive, nor may they alter, by additional requirements, the extent of the principles
         provided for in Article 7.
      
      (see paras 29-30, 32-33, 35-36)
      2.        Article 7(f) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the
         free movement of such data must be interpreted as precluding national rules which, in the absence of the data subject’s consent,
         and in order to allow such processing of that data subject’s personal data as is necessary to pursue a legitimate interest
         of the data controller or of the third party or parties to whom those data are disclosed, require, in addition to respect
         for the fundamental rights and freedoms of the data subject, that those data should also appear in public sources, thereby
         excluding, in a categorical, generalised way, any processing of data not appearing in such sources.
      
      On the one hand, it follows from the objective of the directive of ensuring free movement of personal data while guaranteeing
         a high level of protection for the rights and interests of the individuals to whom such data relate that Article 7 thereof
         sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful.
         Consequently, Member States may not add new principles relating to the lawfulness of the processing of personal data or impose
         additional requirements that have the effect of amending the scope of one of the principles provided for in Article 7. Nor,
         under Article 5 of the directive, may Member States introduce principles relating to the lawfulness of the processing of personal
         data other than those listed in Article 7, or alter, by additional requirements, the scope of the principles provided for
         in Article 7.
      
      On the other hand, in order to carry out the necessary balancing of the opposing rights and interests, provided for in Article 7(f)
         of the directive, Member States may establish guidelines. They may take into consideration too the fact that the seriousness
         of the infringement of the data subject’s fundamental rights resulting from that processing can vary depending on whether
         or not the data in question already appear in public sources. In the latter case, the infringement will be more serious.
      
      However, it is no longer a mere clarification, but an additional requirement precluded by Article 7(f) of the directive if
         national rules exclude the possibility of processing certain categories of personal data by definitively prescribing, for
         those categories, the result of the balancing of the opposing rights and interests, without allowing a different result by
         virtue of the particular circumstances of an individual case.
      
      (see paras 29-30, 32, 36, 44-49, operative part 1)
      3.        Directive 95/46, on the protection of individuals with regard to the processing of personal data and on the free movement
         of such data, includes rules having a degree of flexibility and, in many instances, leaves to the Member States the task of
         deciding the details or choosing between options. A distinction, consequently, must be made between national measures that
         provide for additional requirements amending the scope of a principle referred to in Article 7 of the directive, on the one
         hand, and national measures which provide for a mere clarification of one of those principles, on the other hand. The first
         type of national measure is precluded. It is only in the context of the second type of national measure that Member States
         enjoy some latitude, pursuant to Article 5 of the directive.
      
      (see para. 35)
      4.        Article 7(f) Directive 95/46, on the protection of individuals with regard to the processing of personal data and on the free
         movement of such data, sets out two cumulative conditions that must be fulfilled in order for the processing of personal data
         to be lawful, namely: first, the processing of the personal data must be necessary for the purposes of the legitimate interests
         pursued by the controller or by the third party or parties to whom the data are disclosed and, secondly, such interests must
         not be overridden by the fundamental rights and freedoms of the data subject. The second of those conditions necessitates
         a balancing of the opposing rights and interests concerned which depends, in principle, on the individual circumstances of
         the particular case in question and in the context of which the person or the institution which carries out the balancing
         must take account of the significance of the data subject’s rights arising from Articles 7 and 8 of the Charter of Fundamental
         Rights of the European Union.
      
      (see paras 38, 40)
      5.        The right to respect for private life with regard to the processing of personal data, recognised by Articles 7 and 8 of the
         Charter of Fundamental Rights of the European Union, concerns any information relating to an identified or identifiable individual.
         However, it follows from Articles 8(2) and 52(1) of the Charter that, under certain conditions, limitations may be imposed
         on that right.
      
      (see para. 42)
      6.        Whenever the provisions of a directive appear, so far as their subject-matter is concerned, to be unconditional and sufficiently
         precise, they may be relied on before the national courts by individuals against the State where the latter has failed to
         implement that directive in domestic law by the end of the period prescribed or where it has failed to implement that directive
         correctly. That is the case with Article 7(f) of Directive 95/46 on the protection of individuals with regard to the processing
         of personal data and on the free movement of such data. While that directive confers on the Member States a greater or lesser
         discretion in the implementation of some of its provisions, Article 7(f) states an unconditional obligation.
      
      (see paras 51-52, 55, operative part 2)
JUDGMENT OF THE COURT (Third Chamber)
      24 November 2011 (*)
      
      (Processing of personal data – Directive 95/46/EC – Article 7(f) – Direct effect)
      In Joined Cases C‑468/10 and C‑469/10,
      REFERENCES for a preliminary ruling under Article 267 TFEU from the Tribunal Supremo (Spain), made by decisions of 15 July
         2010, received at the Court on 28 September 2010, in the proceedings
      
      Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) (C‑468/10),
      
      Federación de Comercio Electrónico y Marketing Directo (FECEMD) (C‑469/10) 
      
      v
      Administración del Estado,
      intervening parties:
      Unión General de Trabajadores (UGT) (C‑468/10 and C‑469/10),
      
      Telefónica de España SAU (C‑468/10),
      
      France Telecom España SA (C‑468/10 and C‑469/10),
      
      Telefónica Móviles de España SAU (C‑469/10),
      
      Vodafone España SA (C‑469/10),
      
      Asociación de Usuarios de la Comunicación (C‑469/10),
      
      THE COURT (Third Chamber),
      composed of K. Lenaerts (Rapporteur), President of the Chamber, R. Silva de Lapuerta, E. Juhász, T. von Danwitz and D. Šváby,
         Judges,
      
      Advocate General: P. Mengozzi,
      Registrar: M. Ferreira, Principal Administrator,
      having regard to the written procedure and further to the hearing on 15 September 2011,
      after considering the observations submitted on behalf of:
      –        Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF), by C. Alonso Martínez and A. Creus Carreras, abogados,
      –        Federación de Comercio Electrónico y Marketing Directo (FECEMD), by R. García del Poyo Vizcaya and M.Á. Serrano Pérez, abogados,
      –        the Spanish Government, by M. Muñoz Pérez, acting as Agent,
      –        the European Commission, by I. Martínez del Peral and B. Martenczuk, acting as Agents,
      having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,
      gives the following
      Judgment
      1        These references for a preliminary ruling concern the interpretation of Article 7(f) of Directive 95/46/EC of the European
         Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal
         data and on the free movement of such data (OJ 1995 L 281, p. 31). 
      
      2        The references have been made in two sets of proceedings between, on the one hand, Asociación Nacional de Establecimientos
         Financieros de Crédito (National Association of Credit Institutions) (‘ASNEF’), in the first case, and Federación de Comercio
         Electrónico y Marketing Directo (Federation of Electronic Commerce and Direct Marketing) (‘FECEMD’), in the second case, and,
         on the other, the Administración del Estado.
      
       Legal context
       European Union (‘EU’) law
       Directive 95/46
      3        Recitals 7, 8 and 10 in the preamble to Directive 95/46 read as follows: 
      
      ‘(7)      … the difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard
         to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory
         of one Member State to that of another Member State; … this difference may therefore constitute an obstacle to the pursuit
         of a number of economic activities at Community level, distort competition and impede authorities in the discharge of their
         responsibilities under Community law; … this difference in levels of protection is due to the existence of a wide variety
         of national laws, regulations and administrative provisions;
      
      (8)      …, in order to remove the obstacles to flows of personal data, the level of protection of the rights and freedoms of individuals
         with regard to the processing of such data must be equivalent in all Member States; … this objective is vital to the internal
         market but cannot be achieved by the Member States alone, especially in view of the scale of the divergences which currently
         exist between the relevant laws in the Member States and the need to coordinate the laws of the Member States so as to ensure
         that the cross-border flow of personal data is regulated in a consistent manner that is in keeping with the objective of the
         internal market …; … Community action to approximate those laws is therefore needed;
      
      …
      (10)      … the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably
         the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights
         and Fundamental Freedoms [signed in Rome on 4 November 1950 (‘the ECHR’)] and in the general principles of Community law;
         …, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must,
         on the contrary, seek to ensure a high level of protection in the Community’.
      
      4        Article 1 of Directive 95/46, entitled ‘Object of the Directive’, is drafted in the following terms: 
      
      ‘1.      In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and
         in particular their right to privacy with respect to the processing of personal data.
      
      2.      Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected
         with the protection afforded under paragraph 1.’
      
      5        Article 5 of Directive 95/46 is worded as follows: 
      
      ‘Member States shall, within the limits of the provisions of this Chapter, determine more precisely the conditions under which
         the processing of personal data is lawful.’
      
      6        Article 7 of Directive 95/46 states: 
      
      ‘Member States shall provide that personal data may be processed only if:
      (a)      the data subject has unambiguously given his consent; or
      …
      (f)      processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties
         to whom the data are disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms
         of the data subject which require protection under Article 1(1).’
      
      7        Article 13(1) of Directive 95/46 provides: 
      
      ‘Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles
         6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary measure to safeguard:
      
      (a)      national security;
      (b)      defence;
      (c)      public security;
      (d)      the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;
      (e)      an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and
         taxation matters;
      
      (f)      a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases
         referred to in (c), (d) and (e);
      
      (g)      the protection of the data subject or of the rights and freedoms of others.’
       National law
       Organic Law 15/1999
      8        Organic Law 15/1999 on the protection of personal data (BOE no 298 of 14 December 1999, p. 43088) transposes Directive 95/46
         into Spanish law. 
      
      9        Article 3(j) of Organic Law 15/1999 sets out ‘public sources’ in an exhaustive and restrictive list, which reads as follows:
         
      
      ‘… those files that can be consulted by any person, unhindered by a limiting provision or by any requirement other than, where
         relevant, payment of a fee. Public sources are, exclusively, the electoral roll, telephone directories subject to the conditions
         laid down in the relevant regulations and lists of persons belonging to professional associations containing only data on
         the name, title, profession, activity, academic degree, address and an indication of membership of the association. Newspapers
         and official bulletins and the media are also public sources.’ 
      
      10      Article 6(1) of Organic Law 15/1999 makes the processing of data subject to the data subject’s unambiguous consent, unless
         otherwise provided by law. Thus, Article 6(2), in fine, of Organic Law 15/1999 provides that consent is not required, inter alia, ‘… when the data are included in public sources
         and their processing is necessary for the purposes of the legitimate interests pursued by the controller of the file or by
         the third party to whom the data are disclosed, except where this infringes the fundamental rights and freedoms of the data
         subject.’ 
      
      11      Article 11(1) of Organic Law 15/1999 reiterates the need for the data subject’s consent in order to disclose personal data
         to third parties, while Article 11(2), however, provides that that consent is not necessary, inter alia, in relation to data
         appearing in public sources. 
      
       Royal Decree 1720/2007
      12      The Spanish Government implemented Organic Law 15/1999 by way of Royal Decree 1720/2007 (BOE No 17 of 19 January 2008, p. 4103).
         
      
      13      Article 10(1) of Royal Decree 1720/2007 allows the processing and transfer of personal data in cases where the data subject
         has given prior consent. 
      
      14      However, Article 10(2) of Royal Decree 1720/2007 provides:
      
      ‘… personal data may be processed or transferred without the data subject’s consent when: 
      (a)      it is authorised by a regulation having the force of law or under Community law and, in particular, when one of the following
         situations applies: 
      
      –        the purpose of the processing or transfer is to satisfy a legitimate interest of the data controller or recipient guaranteed
         by these rules, as long as the interest or fundamental rights and liberties of the data subjects, as provided in Article 1
         of Organic Law 15/1999 of 13 December, are not overriding;
      
      –        the processing or transfer of data is necessary in order for the data controller to fulfil a duty imposed upon him by one
         of those provisions; 
      
      (b)      the data which are the subject of processing or transfer are in sources accessible to the public and the data controller,
         or the third party to whom data has been communicated, has a legitimate interest in their processing or knowledge, as long
         as the fundamental rights and liberties of the data subject are not breached. 
      
      The aforesaid notwithstanding, the public administration may communicate the data collected from sources accessible to the
         public to the data controllers of privately owned files pursuant to this subsection only when they are so authorised by a
         regulation having the force of law.’ 
      
       The disputes in the main proceedings and the questions referred for a preliminary ruling
      15      ASNEF, on the one hand, and FECEMD, on the other hand, have brought administrative proceedings challenging several articles
         of Royal Decree 1720/2007. 
      
      16      Among the contested provisions are the first indent of Article 10(2)(a) and the first subparagraph of Article 10(2)(b) of
         Royal Decree 1720/2007, which ASNEF and FECEMD believe are in breach of Article 7(f) of Directive 95/46. 
      
      17      In particular, ASNEF and FECEMD take the view that Spanish law adds, to the condition relating to the legitimate interest
         in data processing without the data subject’s consent, a condition, which does not exist in Directive 95/46, to the effect
         that the data should appear in public sources. 
      
      18      The Tribunal Supremo (Supreme Court, Spain) considers that the merits of the actions brought by ASNEF and FECEMD respectively
         depend to a large extent on the interpretation by the Court of Article 7(f) of Directive 95/46. Accordingly, it states that,
         if the Court were to hold that Member States are not entitled to add extra conditions to those required by that provision,
         and if that provision were to be found to have direct effect, Article 10(2)(b) of Royal Decree 1720/2007 would have to be
         set aside. 
      
      19      The Tribunal Supremo explains that, in the absence of the data subject’s consent, and in order to allow processing of that
         data subject’s personal data that is necessary to pursue a legitimate interest of the data controller or of the third party
         or parties to whom those data are disclosed, Spanish law requires not only that the fundamental rights and freedoms of the
         data subject be respected, but also that the data appear in the files listed in Article 3(j) of Organic Law 15/1999. In that
         regard, it takes the view that Organic Law 15/1999 and Royal Decree 1720/2007 restrict the scope of Article 7(f) of Directive
         95/46. 
      
      20      In the view of the Tribunal Supremo, that restriction constitutes a barrier to the free movement of personal data that is
         compatible with Directive 95/46 only if the interest or the fundamental rights and freedoms of the data subject so require.
         It concludes that the only way to avoid a contradiction between Directive 95/46 and Spanish law is to hold that the free movement
         of personal data appearing in files other than those listed in Article 3(j) of Organic Law 15/1999 infringes the interest
         or the fundamental rights and freedoms of the data subject. 
      
      21      However, the Tribunal Supremo is unsure whether such an interpretation is in accordance with the intention of the EU legislature.
         
      
      22      In those circumstances, being of the view that the outcome of both the cases before it depends on the interpretation of provisions
         of EU law, the Tribunal Supremo decided to stay the proceedings and to refer the following questions, which are formulated
         in identical terms in both cases, to the Court for a preliminary ruling: 
      
      ‘(1)      Must Article 7(f) of [Directive 95/46] be interpreted as precluding the application of national rules which, in the absence
         of the interested party’s consent, and to allow processing of his personal data that is necessary to pursue a legitimate interest
         of the controller or of third parties to whom the data will be disclosed, not only require that fundamental rights and freedoms
         should not be prejudiced, but also require the data to appear in public sources?
      
      (2)      Are the conditions for conferring on it direct effect, set out in the case-law of the Court … met by the abovementioned Article
         7(f)?’ 
      
      23      By order of the President of the Court of 26 October 2010, Cases C‑468/10 and C‑469/10 were joined for the purposes of the
         written and oral procedure and the judgment.
      
       Consideration of the questions referred 
       The first question
      24      By its first question, the national court asks, in essence, whether Article 7(f) of Directive 95/46 must be interpreted as
         precluding national rules which, in the absence of the data subject’s consent, and in order to allow such processing of that
         data subject’s personal data as is necessary to pursue a legitimate interest of the data controller or of the third party
         or parties to whom the data are disclosed, requires not only that the fundamental rights and freedoms of the data subject
         be respected, but also that the data should appear in public sources.
      
      25      Article 1 of Directive 95/46 requires Member States to ensure the protection of the fundamental rights and freedoms of natural
         persons, and in particular their privacy, in relation to the handling of personal data (see, to that effect, Case C‑524/06
         Huber [2008] ECR I‑9705, paragraph 47). 
      
      26      In accordance with the provisions of Chapter II of Directive 95/46, entitled ‘General rules on the lawfulness of the processing
         of personal data’, all processing of personal data must, subject to the exceptions permitted under Article 13, comply, first,
         with the principles relating to data quality set out in Article 6 of Directive 95/46 and, secondly, with one of the six principles
         for making data processing legitimate listed in Article 7 of Directive 95/46 (see, to that effect, Joined Cases C‑465/00,
         C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others [2003] ECR I‑4989, paragraph 65, and Huber, paragraph 48). 
      
      27      According to recital 7 in the preamble to Directive 95/46, the establishment and functioning of the internal market are liable
         to be seriously affected by differences in national rules applicable to the processing of personal data (Case C‑101/01 Lindqvist [2003] ECR I‑12971, paragraph 79).
      
      28      In that context, it must be noted that Directive 95/46 is intended, as appears from, inter alia, recital 8 in the preamble
         thereto, to ensure that the level of protection of the rights and freedoms of individuals with regard to the processing of
         personal data is equivalent in all Member States. Recital 10 adds that the approximation of the national laws applicable in
         this area must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high
         level of protection in the EU (see, to that effect, Lindqvist, paragraph 95, and Huber, paragraph 50).
      
      29      Accordingly, it has been held that the harmonisation of those national laws is not limited to minimal harmonisation but amounts
         to harmonisation which is generally complete. It is upon that view that Directive 95/46 is intended to ensure free movement
         of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such
         data relate (Lindqvist, paragraph 96). 
      
      30      Consequently, it follows from the objective of ensuring an equivalent level of protection in all Member States that Article
         7 of Directive 95/46 sets out an exhaustive and restrictive list of cases in which the processing of personal data can be
         regarded as being lawful. 
      
      31      That interpretation is corroborated by the term ‘may be processed only if’ and its juxtaposition with ‘or’ contained in Article
         7 of Directive 95/46, which demonstrate the exhaustive and restrictive nature of the list appearing in that article. 
      
      32      It follows that Member States cannot add new principles relating to the lawfulness of the processing of personal data to Article
         7 of Directive 95/46 or impose additional requirements that have the effect of amending the scope of one of the six principles
         provided for in Article 7. 
      
      33      The foregoing interpretation is not brought into question by Article 5 of Directive 95/46. Article 5 merely authorises Member
         States to specify, within the limits of Chapter II of that directive and, accordingly, Article 7 thereof, the conditions under
         which the processing of personal data is lawful.
      
      34      The margin of discretion which Member States have pursuant to Article 5 can therefore be used only in accordance with the
         objective pursued by Directive 95/46 of maintaining a balance between the free movement of personal data and the protection
         of private life (Lindqvist, paragraph 97). 
      
      35      Directive 95/46 includes rules with a degree of flexibility and, in many instances, leaves to the Member States the task of
         deciding the details or choosing between options (Lindqvist, paragraph 83). A distinction, consequently, must be made between national measures that provide for additional requirements
         amending the scope of a principle referred to in Article 7 of Directive 95/46, on the one hand, and national measures which
         provide for a mere clarification of one of those principles, on the other hand. The first type of national measure is precluded.
         It is only in the context of the second type of national measure that Member States have, pursuant to Article 5 of Directive
         95/46, a margin of discretion. 
      
      36      It follows that, under Article 5 of Directive 95/46, Member States also cannot introduce principles relating to the lawfulness
         of the processing of personal data other than those listed in Article 7 thereof, nor can they amend, by additional requirements,
         the scope of the six principles provided for in Article 7. 
      
      37      In the present cases, Article 7(f) of Directive 95/46 provides that the processing of personal data is lawful if it is ‘necessary
         for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are
         disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject
         which require protection under Article 1(1)’.
      
      38      Article 7(f) sets out two cumulative conditions that must be fulfilled in order for the processing of personal data to be
         lawful: firstly, the processing of the personal data must be necessary for the purposes of the legitimate interests pursued
         by the controller or by the third party or parties to whom the data are disclosed; and, secondly, such interests must not
         be overridden by the fundamental rights and freedoms of the data subject. 
      
      39      It follows that, in relation to the processing of personal data, Article 7(f) of Directive 95/46 precludes any national rules
         which, in the absence of the data subject’s consent, impose requirements that are additional to the two cumulative conditions
         set out in the preceding paragraph. 
      
      40      However, account must be taken of the fact that the second of those conditions necessitates a balancing of the opposing rights
         and interests concerned which depends, in principle, on the individual circumstances of the particular case in question and
         in the context of which the person or the institution which carries out the balancing must take account of the significance
         of the data subject’s rights arising from Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the
         Charter’). 
      
      41      In this regard, it must be noted that Article 8(1) of the Charter states that ‘[e]veryone has the right to the protection
         of personal data concerning him or her’. That fundamental right is closely connected with the right to respect for private
         life expressed in Article 7 of the Charter (Joined Cases C‑92/09 and C‑93/09 Volker und Markus Schecke and Eifert [2010] ECR I‑0000, paragraph 47).
      
      42      According to the Court’s case-law, the right to respect for private life with regard to the processing of personal data, recognised
         by Articles 7 and 8 of the Charter, concerns any information relating to an identified or identifiable individual (Volker und Markus Schecke and Eifert, paragraph 52). However, it follows from Articles 8(2) and 52(1) of the Charter that, under certain conditions, limitations
         may be imposed on that right. 
      
      43      Moreover, Member States must, when transposing Directive 95/46, take care to rely on an interpretation of that directive which
         allows a fair balance to be struck between the various fundamental rights and freedoms protected by the EU legal order (see,
         by analogy, Case C‑275/06 Promusicae [2008] ECR I‑271, paragraph 68). 
      
      44      In relation to the balancing which is necessary pursuant to Article 7(f) of Directive 95/46, it is possible to take into consideration
         the fact that the seriousness of the infringement of the data subject’s fundamental rights resulting from that processing
         can vary depending on whether or not the data in question already appear in public sources.
      
      45      Unlike the processing of data appearing in public sources, the processing of data appearing in non-public sources necessarily
         implies that information relating to the data subject’s private life will thereafter be known by the data controller and,
         as the case may be, by the third party or parties to whom the data are disclosed. This more serious infringement of the data
         subject’s rights enshrined in Articles 7 and 8 of the Charter must be properly taken into account by being balanced against
         the legitimate interest pursued by the data controller or by the third party or parties to whom the data are disclosed. 
      
      46      In that regard, it must be noted that there is nothing to preclude Member States, in the exercise of their discretion laid
         down in Article 5 of Directive 95/46, from establishing guidelines in respect of that balancing. 
      
      47      However, it is no longer a precision within the meaning of Article 5 of Directive 95/46 if national rules exclude the possibility
         of processing certain categories of personal data by definitively prescribing, for those categories, the result of the balancing
         of the opposing rights and interests, without allowing a different result by virtue of the particular circumstances of an
         individual case. 
      
      48      Consequently, without prejudice to Article 8 of Directive 95/46 concerning the processing of particular categories of data,
         a provision which is not at issue in the main proceedings, Article 7(f) of that directive precludes a Member State from excluding,
         in a categorical and generalised manner, the possibility of processing certain categories of personal data, without allowing
         the opposing rights and interests at issue to be balanced against each other in a particular case. 
      
      49      In light of those considerations, the answer to the first question is that Article 7(f) of Directive 95/46 must be interpreted
         as precluding national rules which, in the absence of the data subject’s consent, and in order to allow such processing of
         that data subject’s personal data as is necessary to pursue a legitimate interest of the data controller or of the third party
         or parties to whom those data are disclosed, require not only that the fundamental rights and freedoms of the data subject
         be respected, but also that those data should appear in public sources, thereby excluding, in a categorical and generalised
         way, any processing of data not appearing in such sources.
      
       The second question
      50      By its second question, the national court asks, in essence, whether Article 7(f) of Directive 95/46 has direct effect.
      
      51      In that regard, it must be recalled that, according to settled case-law of the Court, whenever the provisions of a directive
         appear, so far as their subject-matter is concerned, to be unconditional and sufficiently precise, they may be relied on before
         the national courts by individuals against the State where the latter has failed to implement that directive in domestic law
         by the end of the period prescribed or where it has failed to implement that directive correctly (see Case C‑203/10 Auto Nikolovi [2011] ECR I‑0000, paragraph 61 and the case-law cited). 
      
      52      It must be stated that Article 7(f) of Directive 95/46 is a provision that is sufficiently precise to be relied on by an individual
         and applied by the national courts. Moreover, while that directive undoubtedly confers on the Member States a greater or lesser
         discretion in the implementation of some of its provisions, Article 7(f), for its part, states an unconditional obligation
         (see, by analogy, Österreichischer Rundfunk and Others, paragraph 100).
      
      53      The use of the expression ‘except where’ in the actual text of Article 7(f) of Directive 95/46 is not such, by itself, as
         to cast doubt on the unconditional nature of that provision, within the meaning of that case-law.
      
      54      That expression is intended to establish one of the two cumulative elements provided for in Article 7(f) of Directive 95/46
         to which the possibility of processing personal data without the data subject’s consent is subject. As that element is defined,
         it does not deprive Article 7(f) of its precise and unconditional nature.
      
      55      The answer to the second question is therefore that Article 7(f) of Directive 95/46 has direct effect. 
      
       Costs
      56      Since these proceedings are, for the parties to the main proceedings, a step in the actions pending before the national court,
         the decisions on costs are a matter for that court. Costs incurred in submitting observations to the Court, other than the
         costs of those parties, are not recoverable. 
      
      On those grounds, the Court (Third Chamber) hereby rules:
      1.      Article 7(f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals
            with regard to the processing of personal data and on the free movement of such data must be interpreted as precluding national
            rules which, in the absence of the data subject’s consent, and in order to allow such processing of that data subject’s personal
            data as is necessary to pursue a legitimate interest of the data controller or of the third party or parties to whom those
            data are disclosed, require not only that the fundamental rights and freedoms of the data subject be respected, but also that
            the data should appear in public sources, thereby excluding, in a categorical and generalised way, any processing of data
            not appearing in such sources.
      2.      Article 7(f) of Directive 95/46 has direct effect. 
      [Signatures]
      * Language of the cases: Spanish.