The Court of Justice of the EU adopts a broad interpretation of the concept of special categories of personal data
On 1 August 2022, the CJEU issued a judgment in Case 184/20 (OT v. Vyriausioji tarnybinės etikos komisija), adopting a very broad interpretation of the notion of special categories of personal data under Article 9 of the General Data Protection Regulation (»GDPR« or »Regulation«). This is a landmark personal data protection decision expected to have a significant impact for personal data controllers.
Article 9 of the Regulation regulates the processing of special categories of personal data. These are personal data, which are by their nature particularly sensitive since the circumstances in which they are processed could seriously undermine the fundamental rights and freedoms of the data subject. These data include the racial or ethnic origin of the data subject, data revealing their sex life or sexual orientation, health status, trade union membership, etc. Processing such data is prohibited in principle unless one of the exceptions applies (e.g. the data subject has given explicit consent to the processing or processing is necessary for carrying out the obligations and exercising specific rights of an individual in the field of employment and social security law). Controllers must be very careful when collecting and processing, as lawful processing must be based on the legal basis set out in Article 6 of the Regulation and, in addition, one of the exceptions to the prohibition of processing under Article 9 of the Regulation must be met.
The test case originates in Lithuania, where national legislation provides that the director of a public institution must, inter alia, disclose information about the interests of his/her spouse, cohabitee, or partner in a declaration of private interests filing, which is designed to prevent corruption, and that this information must be made public. In the present case, the obliged person failed to file a declaration, as he considered that his right to privacy had been violated, and the case ended up in court.
The question referred by the Lithuanian court to the CJEU was whether Article 9 of the Regulation should be interpreted as meaning that the publication of personal data, which may indirectly disclose special categories of personal data, constitutes processing, relating to special categories of personal data within the meaning of that provision.
In this respect, the CJEU wrote that the publication of a partner’s name would not necessarily be objectionable per se but agreed with the referring court that information about an individual’s sex life or sexual orientation can be inferred from the name of the partner and that the publication of this information online involves the processing of a special category of data, which is subject to the special regime set out in Article 9 of the Regulation.
Although the circumstances of the case were quite specific, the new interpretation of the concept of special categories of personal data in Article 9 of the Regulation may be relevant for all data controllers. They will need to review the scope of their data processing activities and ensure that such processing cannot indirectly infer sensitive data. Accordingly, they will need to update their internal acts and ensure that there is a legal basis under Article 9 of the Regulation for processing these data (for example, by contacting and obtaining explicit consent from data subjects).
Author: Tina Mihalič, Senior Associate
