CELEX: 62007FJ0130
Language: en
Date: 2009-09-16
Title: Judgment of the Civil Service Tribunal (Third Chamber) of 16 September 2009.#Fiorella Vinci v European Central Bank.#Case F-130/07.

JUDGMENT OF THE CIVIL SERVICE TRIBUNAL 
      (Third Chamber)
      16 September 2009 
      Case F-130/07
      Fiorella Vinci
      v
      European Central Bank (ECB)
      (Civil service – Staff of the ECB – Allegedly unlawful treatment of medical data – Medical examination imposed)
      Application: brought under Article 36.2 of the Protocol on the Statute of the European System of Central Banks and of the European Central
         Bank, annexed to the EC Treaty, in which Ms Vinci seeks, first, a finding that the inclusion in her personal file of, first,
         the letter of 5 March 2007 sent to her by the Directorate-General for Human Resources, Budget and Organisation of the ECB
         and informing her that the medical adviser of the ECB had decided to refer her for a medical examination by an independent
         expert, scheduled for 8 March 2007, and then of the letter, also of 5 March 2007, sent by the Directorate General for Human
         Resources to the independent expert, Prof. A., requesting him to conduct a medical examination of the applicant, and lastly,
         of the certificate of 24 April 2007 from the ECB’s medical adviser finding that the applicant’s fitness for work was not reduced,
         was unlawful; second, a finding that the inclusion in her medical file of the report of the medical examination conducted
         on 8 March 2007 by Prof. A’s medical team was unlawful; third, a finding that the decision of the President of the ECB of
         3 September 2007 rejecting her complaint of 2 August 2007 and refusing to remove the abovementioned documents from her personal
         and medical files in which they had been placed was unlawful; fourth, a finding that the letter of 5 March 2007 instructing
         her to attend a medical examination at Prof. A’s surgery on 8 March 2007 was unlawful; fifth, an order that the ECB pay her
         EUR 10 000 in compensation for the damage she claims to have suffered; and finally, sixth, an order that the ECB pay the costs.
      
      Held: The action is dismissed. Each party is to bear its own costs.
      
      Summary
      1.      Officials – Staff of the European Central Bank – Actions – Act adversely affecting an official – Definition – Refusal to delete
            personal data inserted by the administration in a personal file – Included
      (European Parliament and Council Regulation No 45/2001, Art. 16; Conditions of Employment for Staff of the European Central
            Bank, Art. 42)
      2.      Officials – Staff of the European Central Bank – Actions – Obligation to submit a prior request despite the absence of a decision
            open to review – None
      (Conditions of Employment for Staff of the European Central Bank, Arts 41 and 42; European Central Bank Staff Rules, Art. 8.1.0)
      3.      Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data
            by the Community institutions and bodies – Regulation No 45/2001 – Collection of medical data in order to monitor a situation
            of chronic absenteeism – Legality
      (European Parliament and Council Regulation No  45/2001, Art. 4(1)(c))
      4.      Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data
            by the Community institutions and bodies – Regulation No 45/2001 – Collection of medical data in order to check whether absence
            on sick leave is justified – Scale of checks
      (European Parliament and Council Regulation No 45/2001, Art. 10(2)(b); Conditions of Employment for Staff of the European
            Central Bank, Art. 31 ; European Central Bank Staff Rules, Art. 5.13.4)
      5.      Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data
            by the Community institutions and bodies – Regulation No 45/2001 – Processing of medical data – Legal basis
      (European Parliament and Council Regulation No 45/2001, Art. 10(2)(b))
      6.      Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data
            by the Community institutions and bodies – Regulation No 45/2001 – Measure of a Community institution or body authorising
            the processing of staff members’ data – Respect for staff members’ privacy – Conditions
      (European Parliament and Council Regulation No 45/2001)
      1.      A decision by the European Central Bank rejecting a request from a staff member seeking the deletion of personal data inserted
         by the administration in his personal file constitutes a measure which is open to review, as provided for in Article 42 of
         the Conditions of Employment for Staff of the European Central Bank. It is clear from Article 16 of Regulation No 45/2001
         on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and
         on the free movement of such data that a refusal to delete data will be unlawful if their processing and, in particular, their
         collection has been unlawful. Consequently, in considering the legality of a refusal to delete data, the court may examine
         the legality of all the processing of the data in question, particularly their recording and storage (i.e. insertion).
      
      Furthermore, while Article 16 of Regulation No 45/2001 merely refers to the ‘unlawful’ nature of that processing by mentioning
         infringement of the provisions of Sections 1, 2 and 3 of Chapter II, it cannot be interpreted as confining the review of the
         legality of that processing solely to compliance with the provisions of the sections referred to. It is consequently for the
         court to assess whether a plea in law alleging unlawful processing is capable of compromising respect for privacy which the
         regulation is designed to guarantee with regard to the processing of personal data.
      
      (see paras 46-48, 66-67)
      2.      Since the European Central Bank Staff Rules do not lay down a specific prior request procedure in circumstances where the
         Bank has not previously taken a decision open to review, an applicant cannot be criticised for having requested an administrative
         review without the Bank having first adopted a decision open to review.
      
      Furthermore, since it necessarily presupposes that a prior decision exists, the two-month period which starts to run from
         the notification of the contested decision, as provided for in Article 8.1.0 of the Staff Rules, does not apply where it is
         in the course of an administrative review procedure that a decision arises which may subsequently be contested in a complaint
         and then in court proceedings.
      
      (see paras 51, 53, 55)
      3.      Where a Community institution or body is authorised to undertake a potentially invasive collection of its staff’s medical
         data which could compromise their privacy, the use of that collection must not go beyond what is strictly necessary, taking
         account of the factual circumstances in which the institution or body exercises that power. It must therefore observe the
         principle of proportionality, particularly as prescribed concerning protection with regard to the processing of personal data
         by Article 4(1)(c) of Regulation No 45/2001 on the protection of individuals with regard to the processing of personal data
         by the Community institutions and bodies and on the free movement of such data. It is also the duty of the Community judicature
         to monitor compliance with that principle.
      
      The collection of medical data by a Community institution or body in the form of a full examination of a staff member’s general
         state of health for the purpose, first, of checking whether his repeated absences are justified and, second, of assessing
         whether it is necessary to adapt his working conditions on account of possible problems he might have in performing his duties
         as a result of his state of health cannot be regarded as excessive. In such circumstances the administration may legitimately
         consider that a full examination of the staff member’s state of health is necessary to end a situation of chronic absenteeism
         which it regards as unsatisfactory for both itself and the person concerned. Furthermore, in such a situation, an institution
         is entitled, if not obliged as a result of its duties towards its staff, to assess the need to adapt a staff member’s working
         conditions in the light of any problems he might have in performing his duties as a result of his state of health.
      
      (see paras 87, 89, 90, 102, 139)
      4.      Although the provisions of Article 10(2)(b) of Regulation No 45/2001 on the protection of individuals with regard to the processing
         of personal data by the Community institutions and bodies and on the free movement of such data require that the processing
         of data falling within the scope of those provisions must be necessary for the purposes of complying with the specific rights
         and obligations of the controller in the field of employment law, it does not follow from those provisions that any text providing
         for the processing of ‘special categories of data’ within the meaning of the title of Article 10 of the regulation must itself
         explicitly state the precise purpose of that processing and thus prove that it is necessary.
      
      In any event, although Article 5.13.4 of the European Central Bank Staff Rules does not expressly identify which objectives
         might justify the use of the collection of medical data provided for, those objectives may be clearly inferred from the context
         in which that article is found. The purpose of all the provisions of Article 5.13 is to define the conditions for the application
         of Article 31 of the Conditions of Employment for Staff of the European Central Bank, which provides that ‘members of staff
         who provide evidence of incapacity to perform their duties because of illness or accident shall be granted paid sick leave’.
         The measures laid down in Article 5.13.4 are thus intended to be applied where a staff member is absent on sick leave in order
         to check whether that absence is justified, and the extent of those checks may legitimately vary depending, in particular,
         on the frequency of the absences.
      
      (see paras 100-101, 138)
      5.      It does not follow from the provisions of Article 10(2)(b) of Regulation No 45/2001 on the protection of individuals with
         regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data that
         those provisions require that any processing of special categories of data as defined in paragraph 1 of that article must
         be authorised by a text directly provided for in the Treaties establishing the European Communities. Such an interpretation
         is not consistent with the wording of the text and in particular the use of the expression ‘on the basis thereof’ which, while
         it implies a link between the text providing for the processing of data and the Treaties, does not imply that that link must
         be direct.
      
      Furthermore, while it is true that the French version of Article 10(2)(b) of Regulation No 45/2001 provides that processing
         of, in particular, medical data must be authorised by the Treaties or other ‘actes législatifs’ adopted on the basis of those
         Treaties, the expression ‘actes législatifs’ must be interpreted as referring to the concept of a ‘measure of legislative
         scope’, as is the case with other language versions which use a more general expression not referring to the necessity for
         processing to be authorised by a measure of a particular body.
      
      (see paras 115-116, 118-119)
      6.      With regard to a measure of a Community institution or body authorising the processing of its staff’s personal data and falling
         within the scope of Regulation No 45/2001 on the protection of individuals with regard to the processing of personal data
         by the Community institutions and bodies and on the free movement of such data, the protection of staff members’ privacy is
         sufficiently guaranteed where the text authorising the processing of data is a measure of legislative scope which has been
         adequately advertised, and where the processing in question is foreseeable.
      
      (see para. 122)