In its ruling of 1 August 2022, the Court of Justice of the EU answered two preliminary questions raised by the Regional Administrative Court of Vilnius (the referring court). These questions concerned the balance between the right to protection of personal data on the one hand and the prevention of corruption in the public service on the other (case C-184/20).
The case began when a director of a Lithuanian establishment receiving public funds refused to lodge a declaration of private interests in accordance with Lithuanian law. The aim of such a declaration by public officials is to ensure that the public interest takes precedence when decisions are taken, to guarantee the impartiality of decisions taken and to prevent corruption. The Chief Official Ethics Commission, the public authority responsible for collecting and checking these declarations of private interests, found that the director’s failure to lodge such declaration was in breach of the law. The director appealed that decision before the referring court, stating that the legal obligation was clearly in breach with the right to privacy and protection of personal data enshrined in the GDPR.
The referring court questioned the lawfulness of the processing of personal data and the publication on the website of the Chief Official Ethics Commission of the declaration of private interests (or a part of the latter). Such publication contains personal information not only about the public official but also about his or her family, such as the name of his or her partner.
Firstly, the Court of Justice considered whether the online publication of the personal data by the Chief Official Ethics Commission could be regarded as lawful under Article 6(1)(c) of the GDPR (processing is necessary for compliance with a legal obligation to which the controller is subject) and Article 6(3) of the GDPR (requirement to meet an objective of public interest and to be proportionate to the legitimate aim pursued).
Despite the fact that the processing by the Chief Official Ethics Commission is necessary in view of the relevant Lithuanian law and complies with Article 6(1)(c) of the GDPR, the Court held that the publication of personal data such as the name of the partner of public officials or data relating to all transactions, the value of which is greater than EUR 3,000, was not proportionate/strictly necessary to meet the public interest pursued. The Court ascertained that the objective of preventing conflicts of interest and corruption in the public sector by reinforcing the probity and impartiality of public officials could be achieved just as effectively by other measures less restrictive of the rights to privacy and to the protection of personal data. The Court also pointed out that a lack of resources allocated to the public authorities (the Chief Official Ethics Commission stated that it published the declarations because it does not have sufficient resources to check effectively all the declarations that are submitted to it) cannot constitute a legitimate ground justifying an interference with the fundamental rights guaranteed by the EU Charter of Fundamental Rights.
Secondly, the Court of Justice held, referring to the context and the objectives of the GDPR, that “sensitive data” - the processing of which is subject to stricter rules - also comprise personal data that are liable to disclose indirectly the political opinions, trade union membership or sexual orientation of a natural person. In the present case, the requirement to include the name of the public official’s partner indirectly revealed his sexual orientation.
By this decision, and in particular by the broad interpretation of special categories of personal data, the Court of Justice again highlights its ambition to ensure a high level of protection of the right to privacy and protection of personal data.
Please contact Karel Janssens for further information about this topic and/or for general advice relating to privacy and data protection.