The European Court of Justice (CJEU) has found that a Lithuanian law requiring public sector workers to disclose personal information which is then published online is not compatible with Articles 6 and 9 GDPR. According to the CJEU, the legislation in question did not strike a sufficient balance between the objectives of tackling corruption and preventing conflicts of interests on the one hand and ensuring respect for the fundamental rights of data subjects. Therefore, it was held the legislation could not be justified on the basis of Article 6(1)(c) GDPR.

The aspect of the judgment that will be of interest to most readers is the fact that the Court found that data which may indirectly reveal sensitive information - in this case information about a person’s spouse or cohabitant - also falls within the definition of special category data under Article 9(1) GDPR. The judgment is significant as it will make it more difficult for controllers to take a narrow reading of what constitutes special category data under GDPR.

Facts

The applicant in this case, OT, was a director of an entity concerned with environmental protection which received funding from the Lithuanian government. The Chief Official Ethics Commission (VTEK) in Lithuania found that OT had infringed a law requiring public sector workers to submit personal information about themselves and their spouse or co-habitant. The information would then be published online.

OT challenged the VTEK’s decision on two grounds:

• That the law did not meet the balancing test between privacy rights and the public interest pursued; and
• Whether publishing the names of the declarant’s spouse could constitute special category data which is prohibited under Article 9 GDPR except in tightly defined circumstances

Judgment

Legal basis

The Court conducted a balancing test to consider whether the publication requirement was a proportionate restriction on the fundamental privacy rights of public sector workers in pursuing the general aims of (i) tackling corruption; (ii) guaranteeing impartial decision making; and (iii) preventing conflicts of interest. It stated such objectives of general interest cannot be pursued without first being balanced against fundamental rights. In this case, the fundamental rights in question were right to respect for private life and the right to protection of personal data.

VTEK tried to justify the publication by arguing that it was not sufficiently resourced to check all the declarations that it received. The CJEU stated in response that a lack of resources was not a sufficient ground to justify interference with fundamental rights. Instead, regard must be had to the principle of data minimisation contained in Article 5(1)(c) GDPR. The Court held that publishing the information to a limited audience would have also met the objectives sought. Publishing certain categories of information like names of spouses and transactions over €3000 was found to be unnecessary.

Special category data

The Court then considered whether although not inherently sensitive, name-specific data related to a person’s spouse, cohabitee or partner could reveal sexual orientation “by means of an intellectual operation involving comparison or deduction” thereby constituting special category data under GDPR.

Disagreeing with the Advocate General’s Opinion, the CJEU concluded that the name of a declarant’s spouse may indirectly reveal sensitive data about the data subject and therefore fell within the scope of protection. The Court took a purposive approach in its analysis, pointing to the objective of the GDPR to ensure a high level of protection of personal data and the purpose of Article 9 GDPR to provide an enhanced protection for sensitive data.

Conclusion

This decision offers some insight into how controllers are expected to balance the rights of data subjects with objectives of public importance. However, for most controllers the more relevant aspect of the decision is the broad interpretation given to special category data. The determination that information which indirectly reveals special category data will itself be treated as special category data is important. It may significantly broaden the types of data that is considered special category and which accordingly can only be lawfully processed if one of the conditions under Article 9(2) GDPR is met.

For more information, please contact a member of our Privacy & Data Security team

The content of this article is provided for information purposes only and does not constitute legal or other advice.