Protection of sensitive data under the ruling of the European Court of Justice

Protection of sensitive data under the ruling of the European Court of Justice
Photo via flickr

11-08-2022

Agori Michopoulou

International Justice and Human Rights Researcher

Global Human Rights Defence

On the 1st of August 2022, the Grand Chamber of the European Court of Justice (CJEU) released its decision in case C- 184/20 Vyriausioji tarnybinės etikos komisija, which is related to the protection of personal data. More specifically, the subject matter of the case is the legislation of Lithuania which requires the declaration of private interests of people that work in the public sector. This declaration is required for the avoidance of corruption. 

According to the European Court of Justice, the public officials in Lithuania by giving their spouses’ names, which were published online, were revealing their sensitive data. Under the European Union’s General Data Protection Regulation, sensitive data are considered any information about health, religion, political views and sexual orientation. In addition, the Court included as sensitive data any data that may be used to infer a sensitive piece of information. As far as the companies are concerned, they can use sensitive data in few situations, i.e when a person gives explicit consent, as it is regulated by the GDPR. Although, as Dr. Gabriela Zanfir- Fortuna, vice president for global privacy at the Future of Privacy Forum pointed out, the ruling of the court creates difficulties for companies to recognise which of the data that they possess are sensitive or not. 

Even if there are difficulties for companies to implement the court's ruling, the significance of this judgment is very important for two reasons. The first one is that companies will be under strict pressure to apply special protections to data that previously were not considered sensitive, mainly because they were disclosing indirectly the sexual orientation of a natural person or other sensitive information. The second reason is that the national regulation even when it targets to combat a crime has to be proportionate with the legitimate aim pursued.

Sources and Further Reading: 

European Court of Justice, Case C-184/20 Vyriausioji tarnybinės etikos komisija, (2022, August 1). Retrieved on August 11, 2022, from https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62020CJ0184.

Catherine Stupp. (2022, August 10). EU Court expands definition of sensitive data, prompting legal concerns for companies. The Wall Street Journal. Rertrieved on August 11, 2022,from https://www-wsj-com.cdn.ampproject.org/c/s/www.wsj.com/amp/articles/eu-court-expands-definition-of-sensitive-data-prompting-legal-concerns-for-companies-11660123800?fbclid=IwAR1wRFeRsTWcSewnoCeochvDRSr28GAYVBMNg9ZyEWRKpAdg0_6rZ2oag4M.

Ellen Timmer. (2022, August 05). New GDPR judgment ECJ on transparency of personal data in the context of combating crime and on indirect disclosure of sensitive data. Ellen Timmer- legal articles and messages. Retrieved on August 11, 2022, from https://ellentimmer.com/2022/08/05/transparantie-6/ .