In its judgment of August 1, 2022, the CJEU extended the scope of application of Art. 9 GDPR to “indirectly sensitive data” following a referral from a Lithuanian Administrative Court ( Case C 184-20 ). This ruling is being widely discussed in the data protection world, as it has the potential to have a big impact on companies and organizations that process personal data. Please also see our article in German by my colleague Felix Schneider of personal data.
Background to the CJEU decision of personal data
In Lithuania, heads of institutions receiving “finance from the budget or from funds of The State or of a local authority” are obliged to publish a variety of personal data online on the Chief Ethics Commission’s website based on anti-corruption law . This includes the disclosure of the name of the “spouse, belgium business fax list cohabitee or partner”. The head of an environmental organization had not fulfilled this obligation and had refrained to lodge a declaration of private interests as such disclosure would violate his right to respect for “his private life and that of the other persons who he would [ … ] be required to mention in his declaration.” (at 40) This led to the action before the Lithuanian Administrative Court , which referred two questions to the CJEU.
The CJEU extends the application scope of Art. 9 GDPR
The CJEU concluded that name-related information on spouses and partners constitutes processing of special categories of data , Art. 9 GDPR. The naming of the data allows an inference to be drawn about the sexual orientation . The person oblig to publish the data, make targeting decisions so that this data is therefore subject to the regulation of Art. 9 GDPR:
“Indeed, those data are liable to reveal particularly sensitive information, such as the fact that the data subject is cohabiting or is living with another person of the same sex [ … ].” (at 42)
The CJEU balanced in its judgment the objective of the state of combating corruption against the rights of the affected individuals (“data subject’s right to respect for private life”). Here, the court saw that the personal data published on the website was available to the public and thus accessible to an unlimited number of people.
Outlook
The effects of the ruling could be huge. The ruling of the CJEU significantly expands the scope of application of Art. 9 GDPR. Any information that might reveal a person’s racial or ethnic. Origin, email datapolitical opinions, religious or philosophical beliefs, political views. Trade union membership, health status or sexual orientation, if under Art. 9 GDPR, unless there is a constellation of Art. 9 (2) GDPR.
Certain possibilities for limitation may also arise from the fact that. The processing context must be taken into account when assessing and classifying whether sensitive data are being processed, Art. 9 (1) GDPR (“revealing”).