What’s this about?
In the Lithuanian preliminary reference case of OT v Vyriausioji tarnybinės etikos komisija (the Chief Official Ethics Commission), the European Court of Justice (the European Court) recently ruled, in a broad interpretation of data protection rules, that personal data capable of revealing a person’s sexual orientation constitutes so-called “special category” data (also still colloquially referred to as “sensitive” personal data). This article is a brief look at this case.
What’s the background to the case?
A Lithuania law concerning the reconciliation of public and private interests in public service required individuals in public service to publish a declaration of their private interests to disclose conflict of interests. The declaration included providing various detailed information about an individual’s “spouse, cohabitee or partner”.
The Lithuanian Chief Ethics Commission is a public authority responsible for ensuring the application of the Law on the reconciliation of interests and, for collecting and checking declarations of private interests. A certain individual, referred to in the case as “OT”, was the director of an organisation governed by Lithuanian law receiving public funds and operating in the field of environmental protection. In 2018, the Chief Ethics Commission found that, by failing to lodge a declaration of private interests, OT had infringed certain articles of the Law on the reconciliation of interests.
OT brought legal action before a court for annulment of that decision arguing that publication declaration of his private interests would adversely affect both his right to respect for private life and that of the other persons whom he would, as the case may be, be required to mention in his declaration.
The Lithuanian court was concerned about whether the regime laid down by the Law on the reconciliation of interests was compatible with, amongst others, the processing of special category personal data under EU GDPR (Article 9). The court’s view was that the personal data contained in a declaration of private interests were liable to reveal information about the private life of the declarant and his or her spouse and of the declarant’s children, with the result that their disclosure was capable of infringing the right of the data subjects to respect for their private life. Those data are liable to reveal particularly sensitive information, such as the fact that the data subject is cohabiting or is living with another person of the same sex, the disclosure of which might well result in significant nuisance in the private life of those persons.
Consequently, the Lithuanian court stayed the national legal proceedings and referred the case for interpretation under EU law to the European Court.
What did the court rule?
The European Court ruled, that, EU GDPR (and the previous EU data protection regime), are to be interpreted as meaning that the publication, on the website of the public authority responsible for collecting and checking the content of declarations of private interests, of personal data that are liable to disclose indirectly the sexual orientation of a natural person constitutes processing of special categories of personal data, under EU GDPR (and the previous EU data protection regime).
The European Court seemed to agree with the view of the referring Lithuanian court that it is possible to deduce from the name-specific data relating to the spouse, cohabitee or partner of the declarant certain information concerning the sex life or sexual orientation of the declarant and his or her spouse, cohabitee or partner.
In effect, this means, at a wider level, that personal data capable of revealing a person’s sexual orientation, either by cross-referencing or inference, constitutes special category personal data, even if the personal data does not directly express the person’s sexual orientation.
The upshot of this ruling appears to be that, in the EU, when organisations process personal data relating to the spouse, cohabitee or partner of an individual (such as an employee), like their name or maybe an image of them, organisations will have to do so on the basis that this is special category personal data and so the applicable legal premise for processing set out under EU GDPR (Article 9) will have to be complied with. This may present challenges, e.g. when publishing such data would a disclaimer stating that no inferences can be made hold up?
We write about privacy/data protection issues here https://www.corderycompliance.com/category/data-protection-privacy/.
The court’s judgement can be found here: https://curia.europa.eu/juris/document/document.jsf?text=&docid=263721&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1884161
For more information please contact André Bywater or Jonathan Armstrong who are commercial lawyers with Cordery in London where their focus is on compliance issues.
|Jonathan Armstrong, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH||André Bywater, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH|
|Office: +44 (0)207 075 1784||Office: +44 (0)207 075 1785|