Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) (C-468/10) and Federación de Comercio Electrónico y Marketing Directo (FECEMD) (C-469/10) v Administración del Estado.
Date: 2011-11-24
25. Article 1 of Directive 95/46 requires Member States to ensure the protection of the fundamental rights and freedoms of natural persons, and in particular their privacy, in relation to the handling of personal data (see, to that effect, Case C‑524/06 Huber [2008] ECR I‑9705, paragraph 47).
26. In accordance with the provisions of Chapter II of Directive 95/46, entitled ‘General rules on the lawfulness of the processing of personal data’, all processing of personal data must, subject to the exceptions permitted under Article 13, comply, first, with the principles relating to data quality set out in Article 6 of Directive 95/46 and, secondly, with one of the six principles for making data processing legitimate listed in Article 7 of Directive 95/46 (see, to that effect, Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others  [2003] ECR I‑4989, paragraph 65, and Huber , paragraph 48).
27. According to recital 7 in the preamble to Directive 95/46, the establishment and functioning of the internal market are liable to be seriously affected by differences in national rules applicable to the processing of personal data (Case C‑101/01 Lindqvist [2003] ECR I‑12971, paragraph 79).
28. In that context, it must be noted that Directive 95/46 is intended, as appears from, inter alia, recital 8 in the preamble thereto, to ensure that the level of protection of the rights and freedoms of individuals with regard to the processing of personal data is equivalent in all Member States. Recital 10 adds that the approximation of the national laws applicable in this area must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the EU (see, to that effect, Lindqvist , paragraph 95, and Huber , paragraph 50).
29. Accordingly, it has been held that the harmonisation of those national laws is not limited to minimal harmonisation but amounts to harmonisation which is generally complete. It is upon that view that Directive 95/46 is intended to ensure free movement of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate ( Lindqvist , paragraph 96).
30. Consequently, it follows from the objective of ensuring an equivalent level of protection in all Member States that Article 7 of Directive 95/46 sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful.
32. It follows that Member States cannot add new principles relating to the lawfulness of the processing of personal data to Article 7 of Directive 95/46 or impose additional requirements that have the effect of amending the scope of one of the six principles provided for in Article 7.
33. The foregoing interpretation is not brought into question by Article 5 of Directive 95/46. Article 5 merely authorises Member States to specify, within the limits of Chapter II of that directive and, accordingly, Article 7 thereof, the conditions under which the processing of personal data is lawful.
34. The margin of discretion which Member States have pursuant to Article 5 can therefore be used only in accordance with the objective pursued by Directive 95/46 of maintaining a balance between the free movement of personal data and the protection of private life ( Lindqvist , paragraph 97).
35. Directive 95/46 includes rules with a degree of flexibility and, in many instances, leaves to the Member States the task of deciding the details or choosing between options ( Lindqvist , paragraph 83). A distinction, consequently, must be made between national measures that provide for additional requirements amending the scope of a principle referred to in Article 7 of Directive 95/46, on the one hand, and national measures which provide for a mere clarification of one of those principles, on the other hand. The first type of national measure is precluded. It is only in the context of the second type of national measure that Member States have, pursuant to Article 5 of Directive 95/46, a margin of discretion.
36. It follows that, under Article 5 of Directive 95/46, Member States also cannot introduce principles relating to the lawfulness of the processing of personal data other than those listed in Article 7 thereof, nor can they amend, by additional requirements, the scope of the six principles provided for in Article 7.
40. However, account must be taken of the fact that the second of those conditions necessitates a balancing of the opposing rights and interests concerned which depends, in principle, on the individual circumstances of the particular case in question and in the context of which the person or the institution which carries out the balancing must take account of the significance of the data subject’s rights arising from Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’).
41. In this regard, it must be noted that Article 8(1) of the Charter states that ‘[e]veryone has the right to the protection of personal data concerning him or her’. That fundamental right is closely connected with the right to respect for private life expressed in Article 7 of the Charter (Joined Cases C‑92/09 and C‑93/09 Volker und Markus Schecke and Eifert [2010] ECR I‑0000, paragraph 47).
42. According to the Court’s case-law, the right to respect for private life with regard to the processing of personal data, recognised by Articles 7 and 8 of the Charter, concerns any information relating to an identified or identifiable individual ( Volker und Markus Schecke and Eifert , paragraph 52). However, it follows from Articles 8(2) and 52(1) of the Charter that, under certain conditions, limitations may be imposed on that right.
43. Moreover, Member States must, when transposing Directive 95/46, take care to rely on an interpretation of that directive which allows a fair balance to be struck between the various fundamental rights and freedoms protected by the EU legal order (see, by analogy, Case C‑275/06 Promusicae  [2008] ECR I‑271, paragraph 68).
44. In relation to the balancing which is necessary pursuant to Article 7(f) of Directive 95/46, it is possible to take into consideration the fact that the seriousness of the infringement of the data subject’s fundamental rights resulting from that processing can vary depending on whether or not the data in question already appear in public sources.
45. Unlike the processing of data appearing in public sources, the processing of data appearing in non-public sources necessarily implies that information relating to the data subject’s private life will thereafter be known by the data controller and, as the case may be, by the third party or parties to whom the data are disclosed. This more serious infringement of the data subject’s rights enshrined in Articles 7 and 8 of the Charter must be properly taken into account by being balanced against the legitimate interest pursued by the data controller or by the third party or parties to whom the data are disclosed.
47. However, it is no longer a precision within the meaning of Article 5 of Directive 95/46 if national rules exclude the possibility of processing certain categories of personal data by definitively prescribing, for those categories, the result of the balancing of the opposing rights and interests, without allowing a different result by virtue of the particular circumstances of an individual case.
48. Consequently, without prejudice to Article 8 of Directive 95/46 concerning the processing of particular categories of data, a provision which is not at issue in the main proceedings, Article 7(f) of that directive precludes a Member State from excluding, in a categorical and generalised manner, the possibility of processing certain categories of personal data, without allowing the opposing rights and interests at issue to be balanced against each other in a particular case.
51. In that regard, it must be recalled that, according to settled case-law of the Court, whenever the provisions of a directive appear, so far as their subject-matter is concerned, to be unconditional and sufficiently precise, they may be relied on before the national courts by individuals against the State where the latter has failed to implement that directive in domestic law by the end of the period prescribed or where it has failed to implement that directive correctly (see Case C‑203/10 Auto Nikolovi [2011] ECR I‑0000, paragraph 61 and the case-law cited).
52. It must be stated that Article 7(f) of Directive 95/46 is a provision that is sufficiently precise to be relied on by an individual and applied by the national courts. Moreover, while that directive undoubtedly confers on the Member States a greater or lesser discretion in the implementation of some of its provisions, Article 7(f), for its part, states an unconditional obligation (see, by analogy, Österreichischer Rundfunk and Others , paragraph 100).