Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.
On 1 August 2022, the Court of Justice of the European Union (“CJEU“) in the case of OT v Vyriausioji tarnybines etikos komisija (Chief Official Ethics Commission) (Case C-184/20) ruled that the publication of personal data indirectly disclosing the sexual orientation of a natural person constitutes processing of special categories of personal data for the purposes of Article 9(1) of the General Data Protection Regulation ((EU) 2016/679) (“GDPR“).
The case primarily emerged from a Lithuanian anti-corruption law which requires natural persons working in the public service, or establishments receiving public funds to fill in a declaration of interests which would be published on the Chief Ethics Commission's website, as the controller, making such information publicly and widely accessible online. Such disclosure is designed to favour transparency and prevent conflict of interests in the public sector. OT, a director of an establishment under Lithuanian law in receipt of public funds, did not comply with this requirement. OT argued that as a non-governmental organisation they do not fall under this category as the activities that they carry out are independent from public authorities. More importantly, they also argued that it would adversely affect the right to respect for private life of the persons whom they would be required to mention in the declaration.
The Regional Administrative Court in Vilnius, Lithuania decided to stay proceedings and refer the following questions to the CJEU for a preliminary ruling:
The main objective of Directive 95/46 (the “Directive“) is that of ensuring a high level of protection of the fundamental rights and freedoms of natural persons with respect to the processing of personal data, primarily when read in conjunction to the GDPR and in recognition of Article 7 and 8 of the Charter. Within the meaning of Article 2(a) of the Directive and Article 4(1) of the GDPR, information on natural persons which can be identified by their forename and surname and is intended to be published on the Chief Ethics Commission's website, constitutes personal data. Furthermore, the operation of loading personal data on an internet page constitutes processing, within the meaning of Article 2(b) of the Directive and Article 4(2) of the GDPR.
Under Article 7(e) of the Directive and point (e) of the first subparagraph of Article 6(1) of the GDPR, processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is lawful. However, the legal basis must meet an objective of public interest and be proportionate to the legitimate aim pursued such that the CJEU highlighted how the fundamental rights to respect for private life and to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter, are not absolute rights, but must be considered in relation to their function in society and be weighed against other fundamental rights.
Additionally, seriousness of that interference must be weighed against the importance of the objectives of preventing conflicts of interest and corruption in the public sector. The nature of the personal data at issue, in particular any sensitive information in those data, as well as the nature and specific methods of processing the data, in particular the number of people with access to those data and the methods of accessing them, must all be taken into consideration in determining how serious that interference is.
The rationale behind the CJEU's ruling was determined after examining whether name-specific data could reveal the sexual orientation of a natural person by means of an intellectual operation involving comparison, inference, or deduction. The Advocate General in his Opinion has made a distinction between 'revealing' and 'concerning', such that he believes that the former implies “an intellectual exercise involving deduction or cross-referencing” but the latter “strikes a more direct and more immediate link”. However, the CJEU did not adopt the Advocate General's view as this would result in distinctions being drawn according to the type of sensitive data at issue, thus diminishing the standard of protection which is intended to be afforded to special categories of personal data.
Through this ruling, the CJEU has adopted its general view of widening concepts in such a way that personal data about one person, like the name or gender, can also reveal personal data about another person. Therefore, the abovementioned personal data factors can emerge not only from the data subject himself, but also from people connected to such person.
The CJEU's judgement can also be broadened to influence other forms of online processing in any context where Article 9 of the GDPR is applicable, as it extends the concept of 'revealing'. This includes, for example, location data indicating places of worship, or dating apps where sensitive inferences can be made about individuals.
Thus, it can be concluded that the concept of sensitive data has progressed both de jure and de facto; and with the development of Internet of Things and the ever-increasing degree of interconnectivity, more personal data being viewed as sensitive in nature is a concrete possibility. The wide interpretation given to special categories of data could mean that an ample amount of data can be categorised as 'sensitive' in such a way that the CJEU, through this judgement, has set a formal bar that in practice, could potentially be difficult to manage.
This article was first published in the Malta Independent (21 September 2022).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
© Mondaq® Ltd 1994 – 2022. All Rights Reserved.
Forgot your password?
Free, unlimited access to more than half a million articles (one-article limit removed) from the diverse perspectives of 5,000 leading law, accountancy and advisory firms
Articles tailored to your interests and optional alerts about important changes
Receive priority invitations to relevant webinars and events
You’ll only need to do it once, and readership information is just for authors and is never sold to third parties.
We need this to enable us to match you with other users from the same organisation. It is also part of the information that we share to our content providers (“Contributors”) who contribute Content for free for your use.