Latest

Tech Law Blog

Court of Justice Rules on the Definition of Personal Data

25 September 2014

Mason Hayes & Curran Technology Law Blog

The Court of Justice of the European Union (“CJEU”) recently provided further guidance on what constitutes personal data for the purpose of EU law. The CJEU ruled in the joined cases of YS, M, and S v Minister for Immigratie, Integratie en Asiel that the legal analysis contained in an internal document as part of an internal process is not personal data. The decision came following a request for a preliminary ruling by the Dutch courts. The decision is also notable as it clarifies the form in which personal data may be provided to a person pursuant to a subject access request.

Background

This case involved applications from third country nationals for residency in the Netherlands. Applications of this kind are made to the Dutch Immigration and Naturalisation Service (“INS”). In this instance, individual applications for lawful residence were made by YS, M and S. Both M and S were granted residence permits. However, YS’ application failed and was ultimately rejected.

data protection cjeuThe Decision Making Process 

When the INS processes these applications, the application is initially reviewed by a case officer. As part of the internal process, the case officer completed an internal administrative document in which s/he outlines the reasons for a particular decision or draft decision. This document is referred to as “the minute”.

The minute generally contains a variety of information including data relating to the applicant, details of the statements made by the applicant and the documents submitted in the application. It also contains an assessment of this information in the light of the relevant legal provisions (the “legal analysis”). The length of the legal analysis can range from a few sentences to a few pages. The case officer addresses the credibility of the statements made by the applicant and outlines why s/he thinks that the application should succeed or not. It may otherwise be as concise as a reference to the application of a particular line of policy.

Subject Access Request