Freely Available British and Irish Public Legal Information
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
Court of Justice of the European Communities (including Court of First Instance Decisions)
You are here: BAILII >> Databases >> Court of Justice of the European Communities (including Court of First Instance Decisions) >> Y.S. (Advocate General's opinion) [2013] EUECJ C-141/12 (12 December 2013)
URL: http://www.bailii.org/eu/cases/EUECJ/2013/C14112_O.html
Cite as: [2013] EUECJ C-141/12
[New search] [Help]
OPINION OF ADVOCATE GENERAL
Sharpston
delivered on 12 December 2013 (1)
Joined Cases C-141/12 and C-372/12
Y.S.
v
Minister voor Immigratie, Integratie en Asiel
(Request for a preliminary ruling from the Rechtbank Middelburg (Netherlands))
and
Minister voor Immigratie, Integratie en Asiel
v
M. and S.
(Request for a preliminary ruling from the Raad van State (Netherlands))
(Personal data and processing – Legal analysis)
1. Y.S., M. and S. are third country nationals who have applied for lawful residence in the Netherlands. Y.S.’s application was refused. Those of M. and S. were granted. Each relies on EU law in order to obtain access to a document (‘the minute’) (2) drafted by an official of the relevant authority and containing a legal analysis in the form of internal advice on whether to grant residence status. They argue that the legal analysis is personal data and thus, as a matter of EU law, they have the right to access the minute.
EU law
Treaty on the Functioning of the European Union
2. According to Article 16(1) TFEU, ‘[e]veryone has the right to the protection of personal data concerning [him or her]’.
Charter of Fundamental Rights of the European Union
3. Article 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’), entitled ‘Protection of personal data’, states:
‘1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.’
4. Article 41 concerns the ‘Right to good administration’:
‘1. Every person has the right to have his or her affairs handled impartially, fairly and within a reasonable time by the institutions, bodies, offices and agencies of the Union.
2. This right includes:
…
(b) the right of every person to have access to his or her file, while respecting the legitimate interests of confidentiality and of professional and business secrecy;
(c) the obligation of the administration to give reasons for its decisions.
…’
5. In accordance with Article 47(1), ‘[e]veryone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article’.
6. Article 51(1) states: ‘[t]he provisions of this Charter are addressed to the institutions, bodies, offices and agencies of the Union with due regard for the principle of subsidiarity and to the Member States only when they are implementing Union law …’.
Directive 95/46
7. According to Article 1(1) of Directive 95/46, (3) ‘Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data’. (4)
8. Article 2(a) defines ‘personal data’ as ‘any information relating to an identified or identifiable natural person (“data subject”)’ (5) and ‘an identifiable person’ as ‘one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity’.
9. The ‘processing of personal data’ or, simply, ‘processing’ is defined in Article 2(b) as ‘any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction’. In accordance with Article 2(c), a ‘personal data filing system’ or ‘filing system’ is ‘any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis’.
10. According to Article 3(1), Directive 95/46 applies to ‘the processing of personal data wholly or partly by automatic means’, on the one hand, and ‘the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system’, on the other hand. (6) Article 3(2) excludes certain types of processing from the scope of Directive 95/46 and Article 7 sets out the criteria that determine whether or not Member States may process personal data.
11. Article 12, on the ‘Right of access’, states: (7)
‘Member States shall guarantee every data subject the right to obtain from the controller:
(a) without constraint at reasonable intervals and without excessive delay or expense:
– confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed,
– communication to him in an intelligible form of the data undergoing processing and of any available information as to their source,
– knowledge of the logic involved in any automatic processing of data concerning him at least in the case of the automated decisions referred to in Article 15(1);
(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
(c) notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort.’
12. Exemptions and restrictions to, inter alia, the right of access are described in Article 13(1): (8)
‘Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary [measure] to safeguard:
…
(d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;
…
(f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e);
(g) the protection of the data subject or of the rights and freedoms of others.’
Other EU instruments
13. Regulation No 45/2001 (9) concerns the protection of individuals with regard to the processing of personal data by the EU institutions. It defines ‘personal data’ and ‘processing of personal data’ in essentially the same terms as Directive 95/46. (10) It also provides for a right of access to, in particular, an intelligible form of the data undergoing processing and of any available information as to its source. (11)
14. EU instruments offering access to documents, such as Regulation No 1049/2001 (12) and the decision on public access to documents of the Court, (13) contain exceptions to protect the ‘privacy and the integrity of the individual, in particular in accordance with [EU] legislation regarding the protection of personal data’ (14) and offer a basis for refusing access if that would undermine the protection of ‘court proceedings and legal advice’. (15)
Netherlands law and procedure
15. The Wet bescherming persoonsgegevens (Law on the Protection of Personal Data or ‘the Wbp’) defines personal data, (16) its scope of application (17) and the right of access (18) in terms similar to those used in Directive 95/46. The applicants rely on it in seeking access to the minute used to decide on their application for a fixed term residence permit under the Vreemdelingenwet (Law on Foreign Nationals) 2000.
16. Such an application, filed with the Immigratie- en Naturalisatiedienst (Immigration and Naturalisation Service), is considered first by a case officer, who prepares a draft decision and a further document, the ‘minute’, (19) setting out, inter alia, the legal analysis underpinning the draft decision. If the case officer has no authority to sign the draft decision, he sends it together with the minute for assessment to a resumptor (senior case officer). That senior case officer may confirm or reject the legal analysis in the minute. However, independently of whether the case officer is competent to sign the decision, the minute is not part of the final decision on residence.
17. A minute typically contains: the name, telephone and room number of the case officer; boxes for the initials and names of the senior case officer(s); the name, date of birth, nationality, sex, ethnicity, religion and language of the applicant; information about the procedural history; information about declarations made by the applicant and documents submitted; the applicable legal provisions and an assessment of the relevant information in the light of the applicable law (‘the legal analysis’). According to the Raad van State, the length of the legal analysis can range from a few sentences to a few pages. At the hearing, the Netherlands Government confirmed that there is no template for preparing a minute. Where the legal analysis is extensive, the minute might contain statements regarding an assessment of the credibility of the declarations made, the reasons why an applicant qualifies (or not) for a residence permit and on what ground(s). A more concise analysis might result in a minute containing only the applicable policy line.
18. It appears also from the request for a preliminary ruling in Case C-372/12 that the Minister voor Immigratie, Integratie en Asiel (‘the Minister for Immigration, Integration and Asylum’ or ‘the Minister’) has explained that minutes form part of applicants’ files, which are organised according to a ‘v-number’ allocated to each applicant. Without that number, a file cannot be consulted or searched.
19. Until 14 July 2009, the policy was to make the minute (including the legal analysis) available upon request. Many such requests were made. According to the Minister, that policy resulted in a considerable workload and often erroneous interpretations of the legal analyses. Another consequence was that the legal analysis in particular cases was no longer, or to a lesser degree, recorded in the minute. By IND work instruction 2009/11, that policy was abandoned and access to a minute (including the legal analysis) was thereafter refused.
Facts, questions and procedure
Case C-141/12 Y.S.
20. By decision of 9 June 2009, the Minister rejected Y.S.’s application for a fixed term residence permit ‘asiel’. That decision was withdrawn but then, on 6 July 2010, the application was again rejected. Y.S.’s request for access to the minute drafted for the decision of 6 July 2010 was refused by decision of 24 September 2010 on the ground that the minute contained, apart from personal data, a legal analysis. In that decision, the Minister did provide, in so far as necessary, an overview of the data contained in the minute, the origin of that data and the authorities which had access to the data.
21. Y.S.’s administrative challenge to the decision of 24 September 2010 was declared unfounded by decision of 22 March 2011. Y.S. appealed against the latter to the referring court which has asked these questions:
‘(1) Are the data reproduced in the minute concerning the data subject and which relate to the data subject, personal data within the meaning of Article 2(a) of [Directive 95/46]?
(2) Does the legal analysis included in the minute constitute personal data within the meaning of the aforementioned provision?
(3) If the Court of Justice confirms that the data described above are personal data, should the processor/government body grant access to those personal data pursuant to Article 12 of [Directive 95/46] and Article 8(2) of the [Charter]?
(4) In that context, may the data subject rely directly on Article 41(2)(b) of the [Charter], and if so, must the phrase “while respecting the legitimate interests of confidentiality [in decision-making]” included therein be interpreted in such a way that the right of access to the minute may be refused on that ground?
(5) When the data subject requests access to the minute, should the processor/government body provide a copy of that document in order to do justice to the right of access?’
Case C-372/12 M. and S.
22. After being granted a fixed-term residence permit ‘asiel’, M. requested on 30 October 2009 access to the minute for that decision. Similarly, on 19 February 2010, S. asked for access to the minute for the decision granting him a fixed-term residence permit ‘regulier’. Those requests were refused on, respectively, 4 November 2009 and 31 March 2010. The Minister rejected on, respectively, 3 December 2010 and 21 October 2010 the administrative challenges lodged by M. and S. against those decisions as being unfounded.
23. M. appealed against the decision of the Minister to the Rechtbank Middelburg which, in a judgment of 16 June 2011, held that the appeal was well founded, annulled the decision and ordered the Minister to adopt a new decision taking into account its judgment. S. appealed against the decision of the Minister to the Rechtbank Amsterdam. That court’s judgment of 4 August 2011 was similar, in terms of outcome, to that of the Rechtbank Middelburg.
24. The Minister appealed against both judgments to the Raad van State, which has asked the following questions:
‘(1) Should the second indent of Article 12(a) of [Directive 95/46] be interpreted to mean that there is a right to a copy of documents in which personal data have been processed, or is it sufficient if a full summary, in an intelligible form, of the personal data that have undergone processing in the documents concerned is provided?
(2) Should the words “right of access” in Article 8(2) of [the Charter] be interpreted to mean that there is a right to a copy of documents in which personal data have been processed, or is it sufficient if there is provision of a full summary, in an intelligible form, of the personal data that have undergone processing in the documents concerned within the meaning of the second indent of Article 12(a) of [Directive 95/46]?
(3) Is Article 41(2)(b) of [the Charter] also addressed to the Member States of the European Union in so far as they are implementing [EU] law within the meaning of Article 51(1) of that Charter?
(4) Does the consequence that, as a result of the granting of access to “minutes”, the reasons why a particular decision is proposed are no longer recorded therein, which is not in the interests of the internal undisturbed exchange of views within the public authority concerned and of orderly decision-making, constitute a legitimate interest of confidentiality within the meaning of Article 41(2)(b) of [the Charter]?
(5) Can a legal analysis, as set out in a “minute”, be regarded as personal data within the meaning of Article 2(a) of [Directive 95/46]?
(6) Does the protection of the rights and freedoms of others, within the meaning of Article 13(1)(g) of [Directive 95/46] …, also cover the interest in an internal undisturbed exchange of views within the public authority concerned? If the answer to that is in the negative, can that interest then be covered by Article 13(1)(d) or (f) of that directive?’
Procedure
25. In Case C-141/12, written observations were filed by Y.S., the Austrian, Czech, Greek and Netherlands Governments and the Commission. In Case C-372/12, written observations were filed by M. and S., the French, Netherlands and Portuguese Governments and the Commission.
26. By decision of 30 April 2013, the Court joined the two cases for the purposes of the oral procedure and the judgment.
27. At the hearing held on 3 July 2013, Y.S., M. and S., the French and Netherlands Governments and the Commission made oral submissions.
Assessment
Preliminary remarks
28. It is not contested that the minute is a document containing personal data and that Y.S., M. and S. were given access to that personal data (save for the legal analysis) and informed as to the origin of that data and the bodies to which the data had been sent. Both cases are in essence about (the form of) access to the other part of the minute’s content, namely the legal analysis.
29. I shall consider first the questions relating to the interpretation of Directive 95/46 and then turn to the questions regarding the Charter. Where questions in the two references concern the same subject-matter, I shall address them together.
Access to personal data, access to a file and reasoned decisions
30. At the hearing, it became clear that the applicants wish to understand the reasoning underlying the individual decisions on their residence status. It appears that reasons were given for the decision affecting Y.S. but not for those regarding M. and S.
31. I do not question that the applicants have a valid reason for seeking access to the information to which they claim to be entitled. Furthermore, the fact that they are seeking access to the minute suggests that they consider whatever information has been made available to them to be incomplete, thus possibly putting them in a vulnerable position.
32. However, broadening the meaning of the rules governing the protection of personal data or extending their scope to cover opinions and other measures taken during the preparation and investigation prior to the adoption of a final decision is no remedy for a possible breach of the principle that reasons for a decision must be stated in order to protect the right to effective judicial review.
33. Conversely, the fact that a decision is properly reasoned, enabling the applicant to be fully aware of the considerations underlying the decision and to make effective use of available remedies, is an insufficient basis for concluding that access to the full legal analysis, if that analysis does fall within the rules on the protection of personal data, is unnecessary.
34. Neither of the referring courts seeks guidance from the Court on the obligation, under either Article 47 of the Charter or secondary legislation, to give reasons for final decisions of executive authorities regarding residence status, on the right to be heard or on the right of access to a file of which an internal document such as a minute might form part. Nor (so far as I can ascertain) did the applicants rely on any of these bases before the referring courts.
35. It is true that the fact that the referring courts have limited their questions to EU law governing the protection of personal data does not preclude the Court from addressing all elements of EU law that may assist them in adjudicating the cases at issue. (20) However, I do not think that the Court can widen the scope of its answer here. The duty to state reasons and the right of access to the file have not been properly addressed before the Court. Moreover, although the applicants have shown that they are aware of the duty under EU law to give reasons for asylum decisions, (21) none of them appear to have made claims in that regard.
36. In Case C-372/12, the Netherlands Government stated at the hearing that the reasons for a positive decision are available upon request. The fact remains that M. and S. appear not to have been informed of the reasons why they were granted residence permits. I cannot accept the Netherlands Government’s suggestion that applicants often have no interest in obtaining those reasons. As counsel for M. and S. pointed out at the hearing, the circumstances forming the basis for a favourable decision might change, possibly leading to a different decision at a later time. (22) Thus, knowing exactly what circumstances were relevant to the decision taken is a valid interest. General principles of EU law, such as the principle of effective judicial protection (now expressed in Article 47 of the Charter), (23) cover that interest. (24) By contrast, EU law governing protection of personal data does not. It has other objectives. (25)
37. In any event, even if access to the legal analysis in the minute were given on the basis that it is personal data, that might not remedy an authority’s failure to state reasons in the final decision or to make them otherwise available. As I understand it, (26) the minute, when prepared in the form of an advice to a senior case officer, might not contain all (or indeed any) of the reasoning underlying the final decision taken by the competent authority. Also, it appears that the legal analysis might sometimes be expressed in no more than a few sentences. In such circumstances, even if a senior case officer agreed with the advice, the legal analysis might not be a sufficient statement of reasons.
38. Finally, neither referring court has asked the Court whether EU law requires Member States, in order to guarantee transparency in the decision-making process of competent authorities and access to the information used in that process and/or to protect the right to good administration, to give access to the file in proceedings such as those involving Y.S., M. and S. (or to include in the file documents such as minutes containing legal analysis), or to hear applicants in relation to the internal processes prior to the adoption of a final decision on residence status. Nor were those questions addressed in either the written or oral procedure.
39. My analysis is therefore limited to access to personal data.
Access to personal data under Directive 95/46
Introduction
40. Directive 95/46 applies to the processing of personal data wholly or partly by automatic means and the processing by non-automatic means of personal data which form part of a filing system or are intended to form part of such a system. (27) Only these types of processing are covered and protected. (28) The right of access under Article 12 therefore applies only to personal data that are being or might be processed or filed in such a manner. In its simplest form, that right can be used to request communication of data ‘undergoing processing’ and information regarding their source. (29) However, it is also a basis for obtaining confirmation of whether or not data are being processed and details regarding that processing, knowledge of the logic involved in any automatic processing, rectification, erasure or blocking of data (if their processing is not in conformity with the directive) and notification thereof, where relevant, to third parties.
41. Thus, whether Y.S., M. and S. have, under Directive 95/46, a right of access to the legal analysis contained in the minute depends on whether that analysis is ‘personal data’ or, if not, a type of processing or filing covered by that directive.
Definitions of ‘personal data’ and ‘processing’ (first and second questions in Case C-141/12 and fifth question in Case C-372/12)
42. By its first question in Case C-141/12, I understand the Rechtbank Middelburg to ask whether facts in the minute relating to the data subject (as distinct from those relating to, for example, the case officer and/or senior case officer) are ‘personal data’ within the meaning of Article 2(a) of Directive 95/46. By its second question (which corresponds with the fifth question in Case C-372/12), it asks the same question with regard to the legal analysis contained in the minute.
43. The answer to the first question is clearly ‘yes’.
44. In general, ‘personal data’ is a broad concept. (30) The Court has held that the term covers, for example, ‘the name of a person in conjunction with his telephone coordinates or information about his working conditions or hobbies’, (31) his address, (32) his daily work periods, rest periods and corresponding breaks and intervals, (33) monies paid by certain bodies and the recipients, (34) amounts of earned or unearned incomes and assets of natural persons. (35)
45. The actual content of that information appears to be of no consequence as long as it relates to an identified or identifiable natural person. It can be understood to relate to any facts regarding that person’s private life and possibly, where relevant, his professional life (which might involve a more public aspect of that private life). (36) It may be available in written form or be contained in, for example, a sound or image. (37)
46. Thus, information included in the minute relating to facts such as the name, date of birth, nationality, gender, ethnicity, religion and language of an applicant is ‘personal data’ within the meaning of Article 2(a) of Directive 95/46.
47. As regards the second question, I do not consider that legal analysis is personal data.
48. This is not the first time that a question about access to legal analysis or advice has been put to the Court. (38) In those cases, however, it would appear that access was sought on other bases. (39) The Court was not required to examine whether and why a document containing legal analysis or advice is different from one having a different content.
49. Whilst the Court cannot avoid that inquiry here, I do not think that it is necessary to provide an exhaustive definition of ‘personal data’, ‘legal analysis’ or any other form of analysis. (40) It suffices to focus on whether the legal analysis included in the minute is personal data.
50. In my view, that is not the case.
51. I would distinguish three types of legal analysis, only one of which seems to be of the type included in the minute.
52. The first type is purely abstract: it concerns the interpretation and application of the law without use of information relating to an identifiable or identified person or other types of fact. Thus, Directive 95/46 does not apply to a legal analysis of the meaning of ‘personal data’ in that directive because that analysis does not relate to an identified or identifiable person.
53. The second type is less abstract inasmuch as it uses illustrative facts. However, those facts are not related to a particular identified or identifiable person or event. This type of legal analysis therefore also falls outside the scope of Directive 95/46.
54. The third type involves the legal classification of facts relating to an identified or identifiable person (or event involving such persons) and their assessment against the background of the applicable law. The legal analysis to which Y.S., M. and S. seek access is of this third type.
55. I am not convinced that the phrase ‘any information relating to an identified or identifiable natural person’ in Directive 95/46 should be read so widely as to cover all of the communicable content in which factual elements relating to a data subject are embedded.
56. In my opinion, only information relating to facts about an individual can be personal data. Except for the fact that it exists, a legal analysis is not such a fact. Thus, for example, a person’s address is personal data but an analysis of his domicile for legal purposes is not.
57. In that context, I do not find it helpful to distinguish between ‘objective’ facts and ‘subjective’ analysis. Facts can be expressed in different forms, some of which will result from assessing whatever is identifiable. For example, a person’s weight might be expressed objectively in kilos or in subjective terms such as ‘underweight’ or ‘obese’. Thus, I do not exclude the possibility that assessments and opinions may sometimes fall to be classified as data.
58. However, the steps of reasoning by which the conclusion is reached that a person is ‘underweight’ or ‘obese’ are not facts, any more than legal analysis is.
59. Legal analysis is the reasoning underlying the resolution of a question of law. The resolution itself might be in the form of advice, an opinion or a decision (and thus may, or may not, be legally binding). Apart from the facts on which it is based (some of which might be personal data), that analysis contains the explanation for the resolution. The explanation itself is not information relating to an identified or identifiable person. At most, it can be categorised as information about the interpretation and application of the pertinent law with regard to which the legal position of an individual is assessed and (possibly) decided. Personal data and other elements of fact may very well be inputs in the process leading to answering that question; but that does not make the legal analysis itself personal data.
60. Moreover, a person is entitled to access his personal data because he has an interest in the protection of his fundamental rights and freedoms, in particular his right to privacy, when Member States process information that concerns him. (41) Denying access to the data processed or to information about that process would render ineffective other parts of Directive 95/46. It might not be possible to verify, for example, whether personal data are processed only if necessary to perform a task in the exercise of official authority vested in the controller, (42) or to obtain the rectification or erasure of that data. (43) By contrast, legal analysis as such does not fall within the sphere of an individual’s right to privacy. There is therefore no reason to assume that that individual is himself uniquely qualified to verify and rectify it and ask that it be erased or blocked. (44) Rather, it is for an independent judicial authority to review the decision for which that legal analysis was prepared.
61. For these reasons, I take the view that Directive 95/46 does not require Member States to give access to such legal analysis when it is included in an internal document, such as the minute, which contains personal data, because such legal analysis is not itself personal data.
62. Is legal analysis a form of processing or filing covered by Directive 95/46?
63. I do not think so. Rather, it is a process controlled entirely by individual human intervention through which personal data (in so far as they are relevant to the legal analysis) are assessed, classified in legal terms and subjected to the application of the law, and by which a decision is taken on a question of law. Furthermore, that process is neither automatic nor directed at filing data. (45)
64. Processing involves ‘any operation or set of operations’ upon that data by an entity identified in Directive 95/46. The use of the words ‘such as’ in Article 2(b) suggests that the list of operations is non-exhaustive; (46) but also indicates the type of operation that will constitute ‘processing’. For example, the Court has held that loading personal data on an internet page is covered. (47) The list also includes the ‘adaptation’ and ‘use’ of personal data, without specifying the purpose of these actions (though some of the exceptions to the scope of application of Directive 95/46 appear to be defined by reference to the purpose of the processing). (48) Processing might also involve the capture, transmission, manipulation, recording, storage or communication of sound and image data. (49)
65. As I see it, all of these operations involve an action taken with respect to personal data, but without the assessment of that data which is inevitable in legal analysis. The same applies to the concept of filing.
66. Even if it were considered to be a form of processing, a legal analysis is neither automatic nor in the form of a manual filing system. I add that, in any event, Article 12 of Directive 95/46 offers a basis for access to personal data as such but not to their processing or their processed form.
Scope of the right of access under Directive 95/46 (third question in Case C-141/12)
67. By its third question, the referring court in Case C-141/12 asks whether access should be granted, pursuant to Article 12 of Directive 95/46 and Article 8(2) of the Charter, (50) to ‘the data described above’ if it is accepted by the Court to be personal data.
68. It seems to me that the answer can only be ‘yes’, provided that such access is not restricted or exempted pursuant to Article 13 of Directive 95/46.
Form of access (fifth question in Case C-141/12 and first and second questions in Case C-372/12)
69. Both referring courts ask whether Directive 95/46 requires a copy of the minute to be given to individuals seeking access to it.
70. The referring court in Case C-372/12 also invokes Article 8(2) of the Charter in this context. Whilst Article 8 of the Charter was drafted against the background of, inter alia, Directive 95/46, it sets out a separate right to the protection of personal data. (51) However, it does not articulate a separate standard governing the form in which access must be made available. When read together with the principle of proportionality and legal certainty, I interpret Article 8(2) of the Charter to mean that access need not go beyond what is necessary in order to achieve its objectives and to give the data subject full knowledge of the personal data that are protected under that provision. The requirement set out in Article 12 of Directive 95/46 corresponds to those principles. For that reason, I do not consider that a separate inquiry into the form of access under Article 8 of the Charter is necessary.
71. Directive 95/46 does not establish a right of access to any or every document or file in which personal data are listed or used. Nor does it limit the material form in which personal data, with respect to which it guarantees access, must be made accessible.
72. Rather, it provides that data undergoing processing and any available information as to the sources of the data must be communicated to the data subject ‘in an intelligible form’. (52)
73. Depending on the circumstances, a copy might be neither necessary nor sufficient.
74. Directive 95/46 does not require personal data covered by the right of access to be made available in the material form in which they exist or were initially recorded. In that regard, I consider that a Member State has a considerable margin of discretion to determine, (53) based on the individual circumstances in case, the form in which to make personal data accessible.
75. In making that assessment, a Member State should take account of, in particular: (i) the material form(s) in which that information exists and can be made available to the data subject, (ii) the type of personal data and (iii) the objectives of the right of access.
76. First, personal data might exist in different forms. For example, data recorded during an interview, and subsequently stored, might exist as an audiotape, an electronic file containing the recording or a written transcript. Thus, if personal data originate from an interview, Article 12 of Directive 95/46 does not prescribe whether that data must be made available in the form of the audiotape, the file containing the recording, the transcript or some other medium. Whatever form is chosen, however, it must be made available in a physical form that will endure and that is capable of presenting a complete set of personal data.
77. Second, Article 12 of Directive 95/46 guarantees a data subject access to his/her personal data that are being processed but not to any other information, including that relating to another data subject. For that reason, a compilation of the personal data listed (for example) in a separate document or a copy of the minute within which all content that is not personal data is erased or made inaccessible must both be valid forms of providing access. But a document listing no more than dates and times of phone calls made from an individual’s mobile number might need to be made accessible in full because other forms of presenting that information might not be practicable or imaginable.
78. Third, the data communicated must enable the data subject to know and understand their content and, where necessary, to exercise the rights set out in Article 12(b) and (c) of Directive 95/46 as well as, for example, his right to object to his personal data being processed (Article 14) and his right of action where he suffers damage (Articles 22 and 23). (54) Thus, the data must be in a form that allows the data subject, for example, to consult and understand them, verify their accuracy and the lawfulness of the processing, request corrections and possibly object to (further) processing. (55) The form of access is thus a function also of the rights that the data subject seeks to exercise.
79. Thus, the fact that personal data are contained in a document such as a minute does not imply that the data subject automatically has the right to that material form, that is to say, a copy or extract of that document.
Restrictions and exceptions (sixth question in Case C-372/12)
80. I have taken the view that Directive 95/46 does not provide a basis for claiming access to legal analysis contained in a minute. It follows that there is no need to justify a refusal to grant access under Article 13 of that directive.
81. If the Court disagrees and holds that Directive 95/46 (and in particular Article 12) applies, does the interest of guaranteeing an undisturbed exchange of views within an authority fall within the scope of the phrase ‘the protection … of the rights and freedoms of others’ in Article 13(1)(g)? In the alternative, can that interest fall within the scope of Article 13(1)(d) or (f)?
82. In my view, the answer to both questions is ‘no’.
83. Article 13(1) contains an exhaustive list of bases that may justify a legislative measure restricting the scope of the obligations and rights set out in a limited set of provisions of Directive 95/46, including Article 12. Justifications must be based on the public interest or on striking an appropriate balance between rights and freedoms of the data subject and of other persons.
84. With respect to subparagraph (g), the protection of rights and freedoms of others (that is, other than the data subject) cannot be read as including rights and freedoms of the authority processing personal data. If a legal analysis is to be categorised as personal data, that must be because it is related to the private interests of an identified or identifiable person. Whilst the public interest in protecting internal advice in order to safeguard the administration’s ability to exercise its functions may indeed compete with the public interest in transparency, access to such advice cannot be restricted on the basis of the first of those two interests, because access covers only what falls within the private interest.
85. With regard to Article 13(1)(d) and (f), I find no reason to disagree with the Netherlands Government’s acceptance that there is no link between its restrictions of access and the interests protected there.
Access to personal data under Article 41 of the Charter (fourth question in Case C-141/12 and third and fourth questions in Case C-372/12)
86. In accordance with Article 51(1) of the Charter, the Charter is addressed to Member States only when they implement EU law. Put differently, if EU law applies, the Charter applies. (56) That limitation applies irrespective of any further limitation embedded in a particular provision of the Charter.
87. In the present cases, the Charter applies because the relevant decisions were taken after its entry into force on 1 December 2009 and, as was confirmed by the Netherlands Government at the hearing, pursuant to a national law implementing EU law.
88. Despite that conclusion, I consider that Article 41 of the Charter cannot apply in the context of the cases at issue, because it sets out rights to be invoked against EU institutions (and thus concerns the latter’s corresponding obligations) whilst the cases at issue concern personal data and other information held by a Member State.
89. The Court in Cicala has confirmed this reading with respect to Article 41(2)(c) of the Charter, which sets out the duty to state reasons. (57) Whilst Article 41(2) does not in terms refer to the EU institutions, it defines, through the use of the introductory phrase ‘[t]his right includes’, the addressees of the obligations it lays down. That phrase contains an unambiguous renvoi to the right in Article 41(1) which is to be invoked against ‘the institutions, bodies, offices and agencies of the Union’.
90. The Court’s statement in M.M. (58) that Article 41(2) is of general application does not contradict Cicala. Paragraphs 82 to 84 of the judgment in M.M., when read together, suggest to me rather that the Court was focussing on the substance of the right to be heard and who can invoke it; (59) and in so doing the Court emphasised both the very broad scope of that right and the place that it has long held in the EU legal order.
91. The answer to the third question in Case C-372/12 must thus be ‘no’; and it is therefore no longer necessary to answer the fourth question in that case.
92. Finally, I have already explained why I consider that it would not be appropriate for the Court to expand the scope of the present reference so as to answer questions regarding the right of access to the file and the duty to state reasons, where secondary legislation or other provisions of the Charter, notably Article 47, might apply. Such questions might or might not be pertinent to situations such as those giving rise to the present references. The absence of any indication that those matters were duly raised before the national court, coupled with the lack of argument before this Court, make it essential to confine the answers given by the Court to the issue of access to personal data. (60)
Conclusion
93. In the light of all of the foregoing considerations, I am of the opinion that the Court should answer the questions raised by the Rechtbank Middelburg and the Raad van State to the following effect:
(1) Facts relating to an identified or identifiable natural person are ‘personal data’ within the meaning of Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. However, the reasoning underlying the resolution of a question of law – which involves the legal classification of facts relating to an identified or identifiable person and their assessment against the background of the applicable law – is not covered by the definition of ‘personal data’ in that directive. Directive 95/46 does not therefore require Member States to give access to such legal analysis when it is included in an internal document which also contains personal data.
(2) Pursuant to Article 12 of Directive 95/46, access must be given to data that are covered by the definition of ‘personal data’ in that directive, unless such access is restricted or exempted by Article 13 of that directive.
(3) Directive 95/46 does not establish a right of access to any specific document or file in which personal data are listed or used. Nor does it specify the material form in which personal data must be made accessible. Under Article 12 of Directive 95/46, Member States enjoy a considerable margin of discretion to determine the form in which to make personal data accessible. In making that assessment, Member States should take account of, in particular, (i) the material form(s) in which that information exists and can be made available to the data subject, (ii) the type of personal data and (iii) the objectives of the right of access.
(4) The protection of rights and freedoms of others in Article 13(1)(g) of Directive 95/46 does not encompass the rights and freedoms of the authority processing personal data. Nor is there any link between the interest in an internal undisturbed exchange of views within the public authority and the interests protected under Article 13(1)(d) or (f) of that directive.
(5) Article 41 of the Charter of Fundamental Rights of the European Union sets out rights that may be invoked against institutions, bodies, offices and agencies of the Union and therefore cannot apply to personal data and other information held by a Member State.
1 – Original language: English.
2 – See point 17 below.
3 – Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), as amended in certain respects by Regulation (EC) No 1882/2003 of the European Parliament and of the Council of 29 September 2003 (OJ 2003 L 284, p. 1). Separate rules on the processing of personal data in the framework of police and judicial cooperation in criminal matters are found in Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of policy and judicial cooperation in criminal matters (OJ 2008 L 350, p. 60). Work is on-going on a new General Data Protection Regulation (see COM(2012) 11 final).
4 – See also recital 10 in the preamble to Directive 95/46.
5 – That definition appears to be taken from the identical definition in Article 2(a) of the 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS 108), to which all Member States are party.
6 – See also recital 15 in the preamble to Directive 95/46.
7 – See also recital 41 in the preamble to Directive 95/46.
8 – See also recital 42 in the preamble to Directive 95/46.
9 – Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1).
10 – See Article 2(a) and (b) of Regulation No 45/2001.
11 – See Article 13(c) of Regulation No 45/2001.
12 – Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43).
13 – Decision of the Court of Justice of the European Union of 11 December 2012 concerning public access to documents held by the Court of Justice in the exercise of its administrative functions (OJ 2013 C 38, p. 2).
14 – Article 4(1)(b) of Regulation No 1049/2001; Article 3(1)(b) of the Court of Justice’s decision.
15 – Article 4(2), second indent, of Regulation No 1049/2001; Article 3(2), second indent, of the Court of Justice’s decision.
16 – Article 1(a) of the Wbp.
17 – Article 2(1) of the Wbp.
18 – Article 35 of the Wbp.
19 – Examples of minutes were submitted to the Court in the course of the written procedure in Case C-141/12.
20 – See, for example, Case C-365/02 Lindfors [2004] ECR I-7183, paragraph 32 and the case-law cited, and Case C-86/12 Alokpa and Others [2013] ECR I-0000, paragraph 20 and the case-law cited.
21 – In their written observations, Y.S. and M. and S. explicitly referred to Council Directive 2005/85/EC of 1 December 2005 on minimum standards on procedures in Member States for granting and withdrawing refugee status (OJ 2005 L 326, p. 13) of which the first subparagraph of Article 9(2) provides: ‘Member States shall also ensure that, where an application [for asylum] is rejected, the reasons in fact and in law are stated in the decision and information on how to challenge a negative decision is given in writing’. The second subparagraph of this provision states that, in circumstances where a person is not granted refugee status but is granted the same rights and benefits under national and EU law by virtue of Council Directive 2004/83/EC of 29 April 2004 on minimum standards for the qualification and status of third country nationals or stateless persons as refugees or as persons who otherwise need international protection and the content of the protection granted (OJ 2004 L 304, p. 2), a Member State need not state the reasons for that decision but must ‘ensure that the reasons for not granting refugee status are stated in the applicant’s file and that the applicant has, upon request, access to his/her file’.
22 – For example, changing circumstances might determine whether or not a decision will be renewed or withdrawn.
23 – See Case C-69/10 Samba Diouf [2011] ECR I-7151, paragraph 49 and the case-law cited.
24 – See Case C-300/11 ZZ [2013] ECR I-0000, paragraph 53.
25 – See point 60 below.
26 – See point 17 above.
27 – Article 3(1) of Directive 95/46.
28 – See, for example, recital 15 in the preamble to Directive 95/46 and Article 3(2) thereof, which provides for two exceptions to the scope of that directive.
29 – Second indent of Article 12(a) of Directive 95/46.
30 – See, for example, Case C-101/01 Lindqvist [2003] ECR I-12971, paragraph 24; Joined Cases C-465/00, C-138/01 and C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989, paragraph 64; Case C-73/07 Satakunnan Markkinapörssi and Satamedia [2008] ECR I-9831, paragraphs 35 and 37; Case C-524/06 Huber [2008] ECR I-9705, paragraph 43; and Case C-553/07 Rijkeboer [2009] ECR I-3889, paragraph 62.
31 – Lindqvist, cited in footnote 30 above, paragraph 24.
32 – Rijkeboer, cited in footnote 30 above, paragraph 42.
33 – Case C-342/12 Worten [2013] ECR I-0000, paragraphs 19 and 22.
34 – Österreichischer Rundfunk and Others, cited in footnote 30 above, paragraph 64. See also the types of data at issue in Huber, cited in footnote 30 above, paragraphs 20 and 43.
35 – Satakunnan Markkinapörssi and Satamedia, cited in footnote 30 above, paragraphs 35 and 37.
36 – See, for example, Joined Cases C-92/09 and C-93/09 Volker und Markus Schecke and Eifert [2010] ECR I-11063, paragraph 59 and the case-law cited; see also, more recently, point 118 of Advocate General Jääskinen’s Opinion in Case C-131/12 Google Spain and Google, pending before the Court.
37 – See recitals 14 to 17 in the preamble to Directive 95/46.
38 – See, for example, point 24 of Advocate General Poiares Maduro’s Opinion in Joined Cases C-39/05 P and C-52/05 P SwedenandTurco v Council [2008] ECR I-4723, endorsing the General Court’s observation at first instance that ‘the reference to “legal advice” [in Article 4(2) of Regulation No 1049/2001] does not raise any difficulty of interpretation’. Other cases where access was sought to legal opinions of the legal services of the EU institutions or to legal documents submitted to the Court include, for example, Joined Cases C-514/07 P, C-528/07 P and C-523/07 P Sweden and Others v APIand Commission [2010] ECR I-8533. See also points 13 and 14 above.
39 – In particular, Article 4(2), second indent, of Regulation No 1049/2001. See point 14 above.
40 – The applicants compared legal analysis with the treatment of medical analysis as personal data in the Article 29 Data Protection Working Party’s Opinion 4/2007 on the concept of personal data (01248/07/EN WP 136). That Opinion, which is not binding on the Court, treats the results of a medical analysis as personal data. It does not take a position on the medical analysis itself.
41 – See recital 1 in the preamble to and Article 1(1) of Directive 95/46.
42 – See Article 7(e) of Directive 95/46.
43 – See Article 12(c) of Directive 95/46.
44 – See, for example, Article 12(b) of Directive 95/46.
45 – See also point 146 of my Opinion in Case C-28/08 P Commission v Bavarian Lager [2010] ECR I-6055, in which I suggested (in the context of Article 3(2) of Regulation No 45/2001) that ‘a sequence of operations, in which the individual human element plays such a preponderant part and retains control throughout, should not be considered to be “the processing of personal data … partly by automatic means”’.
46 – The ‘processing’ of personal data consists of ‘any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction’ (Article 2(b) of Directive 95/46).
47 – Lindqvist, cited in footnote 30 above, paragraph 25.
48 – See Article 3(2) of Directive 95/46.
49 – See recital 14 in the preamble to Directive 95/46; see also the examples at paragraph 37 of Satakunnan Markkinapörssi and Satamedia, cited in footnote 30 above.
50 – See also point 70 below.
51 – See the explanation to Article 8 of the Charter in OJ 2007 C 303, p. 17, which refers also to Regulation No 45/2001. According to their preamble, these explanations are not law but ‘are a valuable tool of interpretation intended to clarify the provisions of the Charter’; and Article 52(7) of the Charter states that they ‘shall be given due regard’ by the courts of the Union and of the Member States. The Court has held that they ‘have to be taken into consideration for the interpretation of the Charter’: see Case C-283/11 Sky Österreich [2013] ECR I-0000, paragraph 42 and the case-law cited.
52 – Second indent of Article 12(a) of Directive 95/46.
53 – See Lindqvist, cited in footnote 30 above, paragraph 84, stating that ‘in many respects, the Member States have a margin of manoeuvre in implementing Directive 95/46’.
54 – Rijkeboer, cited in footnote 30 above, paragraphs 51 and 52.
55 – See also recitals 25 and 41 in the preamble to Directive 95/46.
56 – Case C-617/10 Åkerberg Fransson [2013] ECR I-0000, paragraphs 20 and 21, as recently confirmed in Case C-418/11 TEXDATA Software [2013] ECR I-0000, paragraph 73.
57 – Case C-482/10 [2011] ECR I-0000, paragraph 28.
58 – Case C-277/11 [2012] ECR I-0000, paragraph 84.
59 – See also point 32 of Advocate General Bot’s Opinion in M.M., cited in footnote 58 above.
60 – See points 34 to 38 above.