Every person has the right to know the date of and the reasons for the consultation of his or her personal data (ECJ)

According to the Judgment of the European Court  of Justice (22/6/2023) in Case C-579/21 (Pankki S), every person has the right to know the date of and the reasons for the consultation of his or her personal data. The fact that the data controller is engaged in the business of banking has no effect on the scope of that right.

In 2014, an employee of the bank Pankki S who was, at the same time, a customer of that bank, learnt that his personal data had been consulted by other members of the bank’s staff, on several occasions, between 1 November and 31 December 2013. Since he had doubts as to the lawfulness of those consultations, that employee, who had in the meantime been dismissed from his post within Pankki S, on 29 May 2018 asked Pankki S to inform him of the identity of the persons who had consulted his customer data, the exact dates of the consultations and the purposes for which those data had been processed. 

In its reply of 30 August 2018, Pankki S refused to disclose the identity of the employees who had carried out the consultation operations on the ground that that information constituted the personal data of those employees. On the other hand, Pankki S provided further details of the consultation operations, carried out by its internal audit department, stating that a customer of the bank in respect of whom the applicant was the customer advisor was a creditor of a person also bearing the applicant’s surname. 

That bank had thus wished to clarify whether the applicant and the debtor in question were one and the same person and whether there could have been any impermissible conflict of interests. Pankki S added that the clarification of that issue required the processing of the data at issue, specifying that every member of the bank’s staff who had processed those data had made a statement to the internal audit department on the reasons for the processing of those data. In addition, the bank stated that those consultations had made it possible to rule out any suspicion of conflict of interests in relation to the applicant. 

The applicant applied to the Data Protection Supervisor’s Office, Finland, seeking an order that Pankki S provide him with the information requested. Since that application was rejected, the applicant brought an action before the Administrative Court of Eastern Finland, which has asked the Court of Justice to interpret Article 15 of the General Data Protection Regulation (GDPR). [1]

In its judgment, the Court observes, first, that the GDPR, which has been applicable since 25 May 2018, applies to a request made after that date where that request concerns operation for the processing of personal data carried out before the date on which the GDPR became applicable. Next, the Court holds that the GDPR must be interpreted as meaning that information relating to consultation operations carried out on a data subject’s personal data and concerning the dates and purposes of those operations constitutes information which that person has the right to obtain from the controller. 

On the other hand, the GDPR does not lay down such a right in respect of information relating to the identity of the employees who carried out those operations in accordance with the controller’s instructions, unless that information is essential in order to enable the data subject effectively to exercise the rights conferred on him or her by that regulation and provided that the rights and freedoms of those employees are taken into account. In the event of a conflict between, on the one hand, the exercise of a right of access which ensures the effectiveness of the rights conferred on the data subject by the GDPR and, on the other hand, the rights or freedoms of others, a balance will have to be struck between the rights and freedoms in question. 

Wherever possible, means of communicating personal data that do not infringe the rights or freedoms of others should be chosen. Lastly, the Court rules that the fact that the controller is engaged in the business of banking and acts within the framework of a regulated activity and that the data subject whose personal data has been processed in his capacity as a customer of the controller was also an employee of that controller has, in principle,no effect on the scope of the right conferred on that data subject. (curia.europa.eu/photo freepik.com)

Full text of decision is available here

________________

[1]  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).

Comments

Post a Comment

Editorial

Editorial
George Kazoleas, Lawyer

Top Stories

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

Daily Mail publisher wins case against ‘success fees’ paid to lawyers (ECtHR)

Image
Obligation on publisher of the Daily Mail to pay substantial “success fees" in defamation and breach of privacy cases was excessive. The case Associated Newspapers Limited v. the United Kingdom (application no. 37398/21) concerned the fact that Associated Newspapers Limited the publisher of the Daily Mail and the Mail on Sunday had been obliged to pay extensive costs incurred by claimants who had successfully sued it in privacy and/or defamation proceedings following articles it had published in print or online in 2017 and 2019.  Since one of the claimants had entered into a conditional fee arrangement (CFA) with his legal representative, and both had taken out “after-the-event” (ATE) insurance, Associated Newspapers Limited had been liable not only for their base costs, but also for fee uplifts including the “success fee” in the CFA and for their ATE insurance premiums.  In Chamber judgment (12.11.2024) in the case, the European Court of Human Rights held, unanimously, that t...
Read more

The banks Crédit agricole and Credit Suisse participated in a cartel in the sector for suprasovereign bonds, sovereign bonds and public agency bonds denominated in US dollars

Image
According to the Judgment of the General Court in Cases T-386/21 (Crédit agricole and Crédit agricole Corporate and Investment Bank v Commission) and T-406/21 (UBS Group and Credit Suisse Securities (Europe) v Commission), the banks Crédit agricole and Credit Suisse participated in a cartel in the sector for suprasovereign bonds, sovereign bonds and public agency bonds denominated in US dollars (‘SSA Bonds’).  The General Court of the European Union confirms the Commission’s finding of an infringement and maintains the amount of the fines imposed in 2021. In 2018, the European Commission initiated proceedings for infringement of the competition rules involving Deutsche Bank, Bank of America, Crédit agricole and Credit Suisse (now UBS Group [1] ).  In 2021, the Commission found that those banks had entered into an agreement on the secondary market for suprasovereign, sovereign and agency bonds denominated in dollars (SSA bonds). According to the Commission, traders employed by ...
Read more

ECtHR elects a new Vice-President of the Court and two new Section Presidents

Image
The European Court of Human Rights has elected on 23.9.2024 a new Vice-President of the Court – Judge Ivana Jelić (elected in respect of Montenegro). She will take up her duties on 1 November 2024.  The Court has also elected at the same date two new Section Presidents – Judges Lado Chanturia (elected in respect of Georgia) and Ioannis Ktistakis (elected in respect of Greece). They will also take up their duties on 1 November 2024. Ivana Jelić was born on 17 March 1975 in Podgorica, Montenegro and was elected Judge of the European Court of Human Rights on 12 July 2018. Lado Chanturia was born on 14 April 1963 in Tsalenjikha, Georgia, was elected Judge of the European Court of Human Rights on 8 January 2018 and is Vice-President of Section since 18 May 2023. Ioannis Ktistakis was born on 3 January 1971 in Thebes, Greece and was elected Judge of the European Court of Human Rights on 8 March 2021. (source/photo: echr.coe.int) Read more here
Read more

A notary does not breach the sanctions against Russia when he or she authenticates the sale of a property owned by an unlisted Russian company (ECJ)

Image
In tis Judgment in Case C-109/23 (Jemerak) [1] the Court of Justice ruled that a notary does not breach the sanctions against Russia when he or she authenticates the sale of a property owned by an unlisted Russian company.  By authentication, a notary does not provide legal advisory services, but acts independently and impartially in the context of a function entrusted to him or her by the State.  A notary in Berlin (Germany) refused to authenticate a contract for the sale of an apartment situated in Berlin and owned by a Russian company. According to that notary, it cannot be ruled out that that authentication infringes the prohibition on the provision of legal advisory services to legal persons established in Russia. The European Union introduced that general prohibition [2] in 2022 with a view to increase pressure on Russia to end its war of aggression against Ukraine [3] . The Berlin Regional Court referred questions to the Court of Justice on this matter. The Court replie...
Read more

A national court is not required to apply a decision of its constitutional court that infringes EU law (ECJ)

Image
In its Judgment of 26.9.2024 in Case C-792/22 (Energotehnica) the Court of Justice ruled as regards the right to an effective remedy that a national court is not required to apply a decision of its constitutional court that infringes EU law. In such a case, the national court may not be penalised.  Following the death of an electrician by electrocution during a maintenance operation, an administrative procedure was initiated against his employer. At the same time, criminal proceedings for negligence and manslaughter were initiated against the supervisor. The victim’s next of kin also became civil parties to the criminal proceedings.  The administrative court hearing the dispute concluded that the present case did not involve an ‘accident at work’. It annulled the administrative penalties imposed on the employer. According to national legislation, as interpreted by the Romanian Constitutional Court, that administrative decision prevents the criminal court from reconsidering whe...
Read more

Ethics committee opinions on commissioners’ intended new jobs should be made public, says Ombudsman

Image
The European Ombudsman has suggested the European Commission make public all future opinions adopted by the independent ethics committee concerning former commissioners’ post-mandate jobs. Former commissioners are required to give the Commission two months’ notice when they intend to pursue a professional activity during the two years following their departure. The Commission then examines whether the intended activity is compatible with the commissioner’s post service obligations. If the activity is related to the former commissioner’s portfolio, the Commission consults with the Independent Ethical Committee before taking a decision. Under the Commission’s current practices, if a commissioner withdraws an approval request following a negative opinion from the ethics committee, the Commission does not publish the committee’s opinion. The Ombudsman noted that publishing these opinions would improve transparency and public scrutiny around the Commission’s ability to ensure...
Read more