In its judgment of August 1, 2022, the CJEU extended the scope of application of Art. 9 GDPR to “indirectly sensitive data” following a referral from a Lithuanian Administrative Court (Case C 184-20). This ruling is being widely discussed in the data protection world, as it has the potential to have a big impact on companies and organisations that process personal data. Please also see our article in German by my colleague Felix Schneider.
Background to the CJEU decision
In Lithuania, heads of institutions receiving “finance from the budget or from funds of The State or of a local authority” are obliged to publish a variety of personal data online on the Chief Ethics Commission’s website based on anti-corruption law. This includes the disclosure of the name of the “spouse, cohabitee or partner”. The head of an environmental organisation had not fulfilled this obligation and had refrained to lodge a declaration of private interests as such disclosure would violate his right to respect for “his private life and that of the other persons who he would [ … ] be required to mention in his declaration.” (at 40) This led to the action before the Lithuanian Administrative Court, which referred two questions to the CJEU.
The CJEU extends the application scope of Art. 9 GDPR
The CJEU concluded that name-related information on spouses and partners constitutes processing of special categories of data, Art. 9 GDPR. The naming of the data allows an inference to be drawn about the sexual orientation of the person obliged to publish the data, so that this data is therefore subject to the regulation of Art. 9 GDPR:
“Indeed, those data are liable to reveal particularly sensitive information, such as the fact that the data subject is cohabiting or is living with another person of the same sex [ … ].” (at 42)
The CJEU balanced in its judgment the objective of the state of combating corruption against the rights of the affected individuals (“data subject’s right to respect for private life”). Here, the court saw that the personal data published on the website was freely available to the public and thus accessible to an unlimited number of people. Following the opinion of the Advocate General, the CJEU further weighed that the publication of personal data was “liable [ … ] to expose the persons concerned to repeated targeted advertising and commercial sales canvassing, or even to risks of criminal activity.” (at 104)
The CJEU therefore concluded that against the background of the principle of data minimisation, the data processing in this case could not be based on Art. 6 (1) c) GDPR. According to this provision, only the data strictly necessary for the fight against corruption could be collected. As a result, Art. 9 GDPR was relevant in the present case, even if it was only possible to indirectly infer sensitive data (disclosure of sexual orientation of a natural person).
Outlook
The effects of the ruling could be huge. The ruling of the CJEU significantly expands the scope of application of Art. 9 GDPR. Any information that might reveal a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, political views, trade union membership, health status or sexual orientation, falls under Art. 9 GDPR, unless there is a constellation of Art. 9 (2) GDPR.
Certain possibilities for limitation may also arise from the fact that the processing context must be taken into account when assessing and classifying whether sensitive data are being processed, Art. 9 (1) GDPR (“revealing”).
Until the open questions are clarified companies are well advised to scan their processing activities in light of this ruling. Special attention should be paid to personal data that are likely to indirectly reveal sensitive data of data subjects. Possible effects of the ruling could arise in the area of online tracking with location data that, for example, give indications of places of health care or that are used on dating portals, etc. However, the judgement did not provide clear guidelines for this, so that further legal developments will have to be observed.
We will keep you informed.