Romania, Curtea de Appel Cluj, (Court of Appeal Cluj), 740/33/2013, Smaranda Bara and Others v. Casa Na?ional? de Asigur?ri de S?n?tate and Others, appellate, 14.12.2015

Deciding bodies and decisions
Romania, Curtea de Appel Cluj, (Court of Appeal Cluj), 740/33/2013, Smaranda Bara and Others v. Casa Na?ional? de Asigur?ri de S?n?tate and Others, appellate, 14.12.2015
Area of law
Data protection - lawfullness of processing
Subject matter

Whether EU law precluded a public administrative body from transferring personal data to another public administrative body for the purpose of their subsequent processing, without the data subjects being informed of that transfer and processing.

Summary Facts Of The Case
Ms Smaranda Bara and numerous other Romanian citizens are self-employed workers. The Romanian tax authority (ANAF) transferred data relating to their declared income to the National Health Insurance Fund (CNAS), which then required the payment of arrears of contributions to the health insurance regime. The persons concerned contested, before the Court of Appeal Cluj (Romania), the lawfulness of that transfer under the Data Protection Directive (Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995), which governs processing of personal data when they are contained within a filing system. They submitted that their data were used for purposes other than those for which those data had initially been communicated to the tax authority, without their prior explicit consent and without their having previously been informed.

The national court summed up the legal reasoning of the CJEU. The Charter has not been mentioned in its judgement.
Mainly, the Court of Appeal held that the tax data transferred to the CNAS by the ANAF are personal data within the meaning of Article 2(a) of Directive 95/46/EC. Both the transfer of the data by the ANAF and their subsequent processing by the CNAS therefore constitute ‘processing of personal data’ within the meaning of Article 2(b) of the Directive.
In accordance with the provisions of Chapter II of Directive 95/46/EC, entitled ‘General rules on the lawfulness of the processing of personal data’, subject to the exceptions permitted under Article 13 of that Directive, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the Directive and, secondly, with one of the criteria for making data processing legitimate listed in Article 7 of the Directive. Furthermore, the data controller or his representative is obliged to provide information in accordance with the requirements laid down in Articles 10 and 11 of Directive 95/46/EC.
As regards, Article 10 of the Directive, it says that the data controller must provide a data subject, from whom data relating to himself are collected, with the information listed in subparagraphs (a) to (c), except where he already has that information. That information concerns the identity of the data controller, the purposes of the processing and any further information necessary to guarantee fair processing of the data. The requirement to inform the data subjects about the processing of their personal data is all the more important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, set out in Article 12 of Directive 95/46/EC, and their right to object to the processing of those data, set out in Article 14 of that Directive.
However, the applicants were not informed by the ANAF of the transfer to the CNAS of personal data relating to them.
ANAF submitted that Article 315 of Law No 95/2006 provided for the transfer to the regional health insurance funds the information necessary for the determination by the CNAS as to whether persons earning income through self-employment qualify as insured persons.
Article 315 of Law No 95/2006 expressly provides that ‘the data necessary to certify that the person concerned qualifies as an insured person are to be communicated free of charge to the health insurance funds by the authorities, public institutions or other institutions in accordance with a protocol’. However, the data necessary for determining whether a person qualifies as an insured person, within the meaning of the abovementioned provision, do not include those relating to income, since the law also recognizes persons without a taxable income as qualifying as insured. Therefore, Article 315 of Law No 95/2006 cannot constitute, within the meaning of Article 10 of Directive 95/46/EC, prior information enabling the data controller to dispense with his obligation to inform the persons from whom data relating to their income are collected as to the recipients of those data. Accordingly, it cannot be held that the transfer at issue was carried out in compliance with Article 10 of Directive 95/46/EC.
As to whether Article 13 of the Directive applies to that failure to inform the data subjects, it is apparent from Article 13(1)(e) and (f) that the State may restrict the scope of the obligations and rights provided for in Article 10 of the same Directive when such a restriction constitutes a necessary measure to safeguard ‘an important economic or financial interest of a Member State […], including monetary, budgetary and taxation matters’ or ‘a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e)’. Nevertheless, Article 13 expressly requires that such restrictions are imposed by legislative measures.
However, the definition of transferable information and the detailed arrangements for transferring that information were laid down not in a legislative measure but in the 2007 Protocol agreed between the ANAF and the CNAS, which was not the subject of an official publication.
Therefore, it cannot be concluded that the conditions laid down in Article 13 of Directive 95/46/EC are complied with On the other hand, Article 11 (1) of the Directive provides that a controller of data which were not obtained from the data subject must provide the latter with the information listed in subparagraphs (a) to (c). That information concerns the identity of the data controller, the purposes of the processing, and any further information necessary to ensure the fair processing of the data. Amongst that further information, Article 11(1)(c) of the Directive refers expressly to ‘the categories of data concerned’ and ‘the existence of the right of access to and the right to rectify the data concerning him’.
However, the CNAS did not provide the applicants in the main proceedings with the information listed in Article 11(1)(a) to (c) of the Directive.
In accordance with Article 11(2) of Directive 95/46/EC, the provisions of Article 11(1) of the Directive do not apply when, in particular, the registration or communication of the data are laid down by law. However, the provisions of Law No 95/2006 and the 2007 Protocol do not establish a basis for applying either the derogation under Article 11(2) or that provided for under Article 13 of the Directive.
Therefore, Articles 10, 11 and 13 of Directive 95/46/EC must be interpreted as precluding measures such as those at issue in the proceedings, which allow a public administrative body to transfer personal data to another public administrative body and their subsequent processing, without the data subjects having been informed of that transfer or processing.

Impact on Legislation / Policy

The national courts recognize the authority of the CJEU’s judgements and this case has been widely publicised.

Sources - EU and national law
Art 8 CFR

Relevant Judicial Dialogue Techniques

 
Project implemented with financial support of the Fundamental Rights & Citizenship Programme of the European Union
© European University Institute 2019
Villa Schifanoia - Via Boccaccio 121, I-50133 Firenze - Italy