fundamental rights, rule of law

Data protection; automated decision making

Curtea de Apel Cluj - Curtea de Justiție a Uniunii Europene

Cluj Court of Appeal - Court of Justice of the European Union

C‑201/14

1 October 2015

ECLI:EU:C:2015:638

N/A

N/A

Directive 95/46/EC; Processing of personal data; Data subjects’ information Transfer by a public administrative body of a Member State of personal tax data for processing by another public administrative body

Transfer by a public administrative body of a Member State of personal tax data for processing by another public administrative body

No

Not interim relief was requested

Articles 215 and 315 of Law No 95/2006 concerning reform in the field of health (Legea nr. 95/2006 privind reforma în domeniul sănătății); Order No 617/2007 of the Director of the CNAS (National Health Insurance Fund)

The main proceedings were initiated by several self-eomplyed persons, including Mrs. Smaranda Bara, whose tax data (relating to their declared income) was trasnsferred by ANAF („Agenția Națională de Administrare Fiscală” - the National Tax Administration Agency) to the CNAS („Casa Națională de Asigurări de Sănătate” - the National Health Insurance Fund). The transfer of data between the two public authorities had been made under Law No 95/2006, which allowed tax authorities to transfer personal data to the health insurance funds so that the latter may determine whether an individual qualifies as an insured person, as well as based on an internal protocol (the 2007 Protocol) between the authorities. The data concerned the identification of persons (surname, first name, personal identity card number, address) but did not include data relating to income. On the basis of the transfer, the CNAS required the applicants to pay arrears of contributions to the health insurance regime.

The applicants brought an appeal before the Curtea de Apel Cluj (the Cluj Court of Appeal), challenging the lawfulness of the transfer of tax data relating to their income in the light of Directive 95/46. Before the referring court, they argued that their personal data were transferred and used for purposes other than those for which it had initially been communicated to the ANAF, without their prior explicit consent and without their having previously been informed. 

The Cluj Court of Appeal submitted to the CJEU several questions for a preliminary ruling, including a reference seeking to determine whether the processing of the data by the CNAS required prior information to be given to the data subjects as to the identity of the data controller and the purpose for which the data was transferred, as well as whether the transfer of the data on the basis of the 2007 Protocol was contrary to Directive 95/46.

In responding to the preliminary question, the ECJ begun by recalling that the tax data transferred to the CNAS by the ANAF were personal data within the meaning of Article 2(a) of Directive 95/46, since they were ‘information relating to an identified or identifiable natural person’. Consequently, subject to the exceptions permitted under Article 13 of that directive, the processing of such personal data was required to comply with the principles relating to data quality set out in Article 6 and with one of the criteria for making data processing legitimate, as listed in Article 7 of the directive. Additionally, the data controller or his representative was obliged to provide information in accordance with the requirements in Articles 10 and 11 of Directive 95/46, which varied depending on what data were collected from the data subject, and subject to the exceptions permitted under Article 13 of the directive.

Pointing out that the requirement of fair processing of personal data required public administrative bodies to inform the data subjects of the transfer of those data to another public administrative body for the purpose of their processing by the latter, the ECJ subsequently observed that the applicants in the main proceedings had not been informed by ANAF of the transfer to the CNAS of personal data relating to them. It also found that the provisions of Article 315 of Law No 95/2006, which authorised the transfer of data to the health insurance funds in order "to certify that the person concerned qualified as an insured person" could not constitute, within the meaning of Article 10 of Directive 95/46, prior information enabling the data controller to dispense with his obligation to inform the persons from whom data relating to their income are collected as to the recipients of those data. It therefore found that the transfer at issue had not been carried out in compliance with Article 10 of Directive 95/46 and therefore, the individual's rights and obligations flowing from that provision had not been observed.

In respect of Article 11 of the directive, concerning information on the identity of the data controller, the purposes of the processing, and any further information necessary to ensure the fair processing of the data, the ECJ stated that, in the circumstances of the case in the main proceedings, the processing by the CNAS of data transferred by the ANAF required that the subjects of the data be informed of the purposes of that processing and the categories of data concerned. However, the CNAS had not provided the applicants  with the information listed in Article 11(1)(a) to (c) of the directive. Consequently, the ECJ found that Articles 10, 11 and 13 of Directive 95/46 "must be interpreted as precluding national measures, such as those at issue in the main proceedings, which allow a public administrative body of a Member State to transfer personal data to another public administrative body and their subsequent processing, without the data subjects having been informed of that transfer or processing".

The decision did not refer explicitly to the EU Charter.

No reference to the ECHR.

Preliminary reference, consistent interpretation

The ECJ makes reference to some of its previous case-law on processing of personal data.

Preliminary ruling - Cluj Court of Appeal engaged in dialogue with the ECJ.

Solving a conflict between existing national norms in the field of taxation and data protection rules.

N/A

National decision could not be identified

References to other case-law of the ECJ (preliminary rulings) concerning data protection