On 7 March 2024, the Court of Justice of the European Union (CJEU) delivered its judgement in Case C‑740/22.
With regard to the question of whether the oral communication of information relating to criminal convictions, to which a natural person has been the subject constitutes processing of personal data, the Court held, amongst others, that:
- the term of “processing” in Art. 4 para. (2) of the GDPR necessarily includes the oral communication of personal data, because otherwise the protection of the fundamental rights in the context of the data processing, sought by GDPR, would not be attained;
- since oral communication as such constitutes non-automated processing, the data that are the subject of such processing must therefore be contained or intended to be contained in a file in order for such processing to fall within the material scope of the GDPR;
- in the present case, the data requested by the company in the main proceedings are contained in a personal data file kept by a court, but it is for the national court to assess whether the said data are contained in electronic databases or in physical files or registers.
Thus, the Court answered that Art. 2 para. (1) and Art. 4 para. (2) of the GDPR must be interpreted as meaning that the oral communication of information relating to criminal convictions to which a natural person has been the subject constitutes “processing” under GDPR, if that information is contained or intended to be contained in a filing system.
On the question whether the data relating to the criminal convictions of natural persons contained in a file kept by a court may not be communicated orally to any person for the purposes of ensuring public access to official documents, without the person requesting the communication having to justify a specific interest in obtaining those data, and whether the answer to that question differs according to whether that person is a commercial company or a private individual, the Court has held, amongst others, that:
- the oral communication of data relating to a natural person’s criminal convictions may only take place if the conditions laid down in the GDPR are met whenever such data is or is to be included in a file;
- the processing of personal data at issue in the main proceedings, namely the oral communication to the public of data relating to criminal offences, is likely to fall within the scope of Art. 6 para. (1) letter e) of the GDPR, which provides that processing is lawful if and in so far as it is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”;
- neither Art. 6 para. (1) letter e) of the GDPR nor Art. 10 generally and absolutely prohibits a public authority from being authorized or even compelled to communicate personal data to persons who request it;
- while public access to official documents, to which the national court refers, constitutes a public interest capable of legitimizing the communication of personal data contained in such documents, such access must nevertheless be reconciled with the fundamental rights to privacy and the protection of personal data;
- in this specific case, having regard to the sensitivity of data relating to criminal convictions and the seriousness of the interference with the fundamental rights to respect for private life and to the protection of personal data of the data subject which the disclosure of such data causes, the aforesaid rights prevail over the public interest in having access to official documents;
- the GDPR cannot be interpreted as justifying the communication to any person who requests personal data relating to criminal convictions;
- it is irrelevant whether the person requesting access to data relating to criminal convictions is a commercial company or an individual, or whether the communication of such data is made in writing or orally.
The CJEU’s decision is available here (in French).
