Brussels, 01/10/2015 (Agence Europe) - In a ruling handed down on Thursday 1 October, the Court of Justice of the EU established that EU law precludes the transfer and processing of citizens' personal data between two public administrative bodies without prior notice being given.
A European directive, 95/46/EC, provides protection of individuals with regard to the processing of personal data and on the free movement of such data. On that basis, the Court, like the Advocate General (see EUROPE 11355), concluded that the requirement of fair processing of personal data requires a public administrative body to inform the data subjects of the fact that their data will be transferred to another public administrative body for the purpose of their processing by the latter in its capacity as recipient of those data.
The directive allows restrictions on the requirement to provide information but expressly requires that any such restrictions are imposed by legislative measures. The case at issue (C-201/14) relates to a Romanian law which provides for the free transfer of personal data to the national health insurance fund. That law does not, as it should have done, define either the transferable data or the detailed arrangements for transferring those data. These are to be found only in a bilateral protocol agreed between the tax authority and the health insurance fund.
The Court also made clear the kind of information to be provided on the subsequent processing of the data transferred. This must identify the body processing the data, the purpose of the processing, and any further information necessary to ensure the fair processing of the data, such as the categories of data concerned and the existence of the right of access to and the right to rectify the data. (Original version in French by Jan Kordys)