In its judgment, the CJEU not only provided clarity on the definition of “processing” but also navigated the complex balance between the right of public access to official documents and the need to protecting personal data. The CJEU determined that the fundamental rights to privacy and the protection of personal data take precedence over the public’s interest in accessing official documents.

Background

The case arose after a data subject participated in a competition organized by Endemol Shine Finland. The organisation made an oral request to the Finish District Court for information on possible ongoing or completed criminal proceedings concerning the data subject, for the purpose of clarifying their criminal record. The District Court refused the request, stating that there was no legitimate reason for processing the criminal offence data under Finnish law, implementing Article 10 of the GDPR. Endemol Shine Finland brought an appeal against the judgment before the Court of Appeal, Eastern Finland, arguing that the oral disclosure of the information would not constitute processing of personal data within the meaning of Article 4(2) of the GDPR. The Court of Appeal, Eastern Finland, referred the case to the CJEU to seek clarification on whether:

1. the oral transfer of personal data should be considered as data processing;
   
2. data relating to criminal convictions of a natural person contained in a court’s filing system can be disclosed orally to any person for the purpose of ensuring public access to official documents; and
   
3. it is relevant whether the person requesting the information is a company or a private individual?

Key findings

• In relation to the first question, the CJEU concluded that the reference to ‘any operation’ in Article 4(2) of the GDPR demonstrates that “the EU legislature intended to give the concept of processing a broad scope”. It follows that the oral disclosure of information on possible ongoing or completed criminal proceedings constitutes processing of personal data, within the meaning of Article 4(2) GDPR. The CJEU held that “the possibility of circumventing the application of the GDPR by disclosing personal data orally rather than in writing would be manifestly incompatible”  with the objective pursued by the GDPR, which seeks to ensure a high level of protection of the fundamental rights and freedoms of natural persons.
  
• The CJEU further held that it was clear from the request for a preliminary ruling that the data requested was contained in ‘a court’s register of persons’,  and that this constituted a filing system within the meaning of Article 4(6) of the GDPR. As a result, the processing comes within the material scope of the GDPR.
  
• In relation to the second and third questions, the CJEU held that whilst public access to official documents constitutes a public interest capable of justifying the disclosure of personal data, that access must be balanced with the fundamental rights to respect for private life and to the protection of personal data. Given the sensitivity of data relating to criminal convictions and of the seriousness of the interference with the fundamental rights of data subjects which is caused by the disclosure of such data, the CJEU held that “those rights prevail over the public’s interest in having access to official documents”. The CJEU confirmed that it is irrelevant whether that person is a commercial company or a private individual.

This judgment is significant, in that it confirms the broad scope of ‘processing’ under the GDPR and provides a clear indication that it is not possible to side-step GDPR obligations by simply disclosing personal data orally rather than in writing.

Furthermore, the decision stipulates that personal data pertaining to an individual’s criminal convictions, recorded in a register maintained by a court, cannot be disclosed to any individual seeking public access to official documents unless the person requesting such disclosure demonstrates a particular interest in acquiring the specified information regardless of whether that person is a commercial company or a private individual.