College van burgemeester en wethouders van Rotterdam v M. E. E. Rijkeboer.
Date: 2009-05-07
30. It should be recalled at the outset that, under the system of judicial cooperation established by Article 234 EC, it is for the Court of Justice to interpret provisions of Community law. As far as concerns national provisions, under that system their interpretation is a matter for the national courts (see Case C‑449/06 Gysen  [2008] ECR I‑553, paragraph 17).
42. The first concerns personal data kept by the local authority on a person, such as his name and address, which constitute, in the present case, the basic data. It is apparent from the oral observations submitted by the College and the Netherlands Government that those data may be stored for a long time. They constitute ‘personal data’ within the meaning of Article 2(a) of the Directive, because they represent information relating to an identified or identifiable natural person (see, to that effect, Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others  [2003] ECR I‑4989, paragraph 64; Case C‑101/01 Lindqvist  [2003] ECR I‑12971, paragraph 24; and Case C‑524/06 Huber  [2008] ECR I‑0000, paragraph 43).
47. The importance of protecting privacy is highlighted in recitals 2 and 10 in the preamble to the Directive and emphasised in the case-law of the Court (see, to that effect, Österreichischer Rundfunk and Others , paragraph 70; Lindqvist , paragraphs 97 and 99; Case C‑275/06 Promusicae  [2008] ECR I‑271, paragraph 63; and Case C‑73/07 Satakunnan Markkinapörssi and Satamedia  [2008] ECR I‑0000, paragraph 52).
49. That right to privacy means that the data subject may be certain that his personal data are processed in a correct and lawful manner, that is to say, in particular, that the basic data regarding him are accurate and that they are disclosed to authorised recipients. As is stated in recital 41 in the preamble to the Directive, in order to carry out the necessary checks, the data subject must have a right of access to the data relating to him which are being processed.
51. That right of access is necessary to enable the data subject to exercise the rights set out in Article 12(b) and (c) of the Directive, that is to say, where the processing of his data does not comply with the provisions of the Directive, the right to have the controller rectify, erase or block his data, (paragraph (b)), or notify third parties to whom the data have been disclosed of that rectification, erasure or blocking, unless this proves impossible or involves a disproportionate effort (paragraph (c)).
52. That right of access is also necessary to enable the data subject to exercise his right referred to in Article 14 of the Directive to object to his personal data being processed or his right of action where he suffers damage, laid down in Articles 22 and 23 thereof.
56. The Court has already held that the provisions of the Directive are necessarily relatively general since it has to be applied to a large number of very different situations and that the Directive includes rules with a degree of flexibility, in many instances leaving to the Member States the task of deciding the details or choosing between options (see Lindqvist , paragraph 83). Thus, the Court has recognised that, in many respects, the Member States have some freedom of action in implementing the Directive (see Lindqvist , paragraph 84). That freedom, which becomes apparent with regard to the transposition of Article 12(a) of the Directive, is not, however, unlimited.
59. The scope of the Directive is very wide, as the Court has already held (see Österreichischer Rundfunk and Others , paragraph 43, and Lindqvist , paragraph 88), and the personal data covered by the Directive are varied. The length of time such data are to be stored, defined in Article 6(1)(e) of the Directive according to the purposes for which the data were collected or for which they are further processed, can therefore differ. Where the length of time for which basic data are to be stored is very long, the data subject’s interest in exercising the rights to object and to remedies referred to in paragraph 57 of the present judgment may diminish in certain cases. If, for example, the relevant recipients are numerous or there is a high frequency of disclosure to a more restricted number of recipients, the obligation to keep the information on the recipients or categories of recipient of personal data and on the content of the data disclosed for such a long period could represent an excessive burden on the controller.
62. In accordance with other sections of the Directive, account may be taken of the disproportionate nature of other possible measures. With regard to the obligation to inform the data subject, recital 40 in the preamble to the Directive states that the number of data subjects and the age of the data may be taken into consideration. Furthermore, in accordance with Article 17 of the Directive concerning security of processing, Member States are to provide that the controller must implement appropriate technical and organisational measures which, having regard to the state of the art and the cost of their implementation, are to ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected.
64. Thus it is for the Member States to fix a time-limit for storage of information on the recipients or categories of recipient of personal data and on the content of the data disclosed and to provide for access to that information which constitutes a fair balance between, on the one hand, the interest of the data subject in protecting his privacy, in particular by way of his rights to rectification, erasure and blocking of the data in the event that the processing of the data does not comply with the Directive, and rights to object and to bring legal proceedings and, on the other, the burden which the obligation to store that information represents for the controller.
68. Articles 10 and 11 impose obligations on the controller or his representative to inform the data subject, in certain circumstances, in particular of the recipients or categories of recipient of the data. The controller or his representative must communicate that information to the data subject of their own accord, inter alia when the data are collected or, if the data are not collected directly from the data subject, when the data are registered or, possibly, when the data are disclosed to a third party.