Understanding Data Protection and Privacy Rights Training

EJTN Training on Data Protection and Privacy Rights 29-30 June 2022 Processing and public access to official documents Tiago Fidalgo de Freitas With financial support from the Justice Programme of the European Union

Session plan I. The broader normative context II. III. The ECtHR case-law IV. The CJEU case-law The right of access to information V. The elements of article 86 VI. The effects of article 86 2

The broader normative context a) Article 15 TFEU: rules on transparency b) Articles 41(2)(b) and 42 Charter: right of access to documents c) Regulation 1049/2001: European Parliament, Council, and Commission documents extended to the institutions, bodies, offices and agencies of the Union by the article 15(3) TFEU and article 42 Charter; d) Directive 2003/4/EC (and the Aarhus Convention) e) National rules on public access to documents 3

The broader normative context f) Recital 72 DPD: this Directive allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Directive g) Article 9(3) EUDPR: Union institutions and bodies shall reconcile the right to the protection of personal data with the right of access to documents in accordance with Union law h) CoE Modernised Convention 108 preamble: this Convention permits account to be taken, in the implementation of the rules laid down therein, of the principle of the right of access to official documents i) Article 3(1)(f) Convention on Access to Official Documents: Each Party may limit the right of access to official documents. Limitations shall be set down precisely in law, be necessary in a democratic society and be proportionate to the aim of protecting: [ ] privacy and other legitimate interests 4

The broader normative context j) Article 86 GDPR: Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation 5

The right of access to information Right of access to individual information Right of access to information Legal basis (EU Charter) Article 41(1)(b) Article 42 Open and transparent administration Supervision and evaluation of the public administration by the citizens Everyone the community as a whole All administrative information Foundation Due process of law Administrative participation and judicial review Objective Beneficiaries Direct and personal interest Object One s file 6

The ECtHR case-law a) Article 10 ECHR: the right to freedom of expression shall include the freedom to hold opinions and to receive and impart information and ideas without interference by a public authority b) Early case-law: 1. In horizontal relationships: it prevents the government from interfering in the exchange of information between individuals The Sunday Times case 2. In vertical relationships: discussed under other articles, such as the right to privacy (article 8) if the individual had a personal interest in the disclosure Leander v Sweden case 3. The State had no duty to collect and disseminate information of its own motion Guerra v. Italy case 4. But it had already collected information, it could be under an obligation to disseminate it upon request Sdru en Jiho esk Matky case 5. Indirect censorship if a request made by a watchdog (press or associations involved in human rights litigation) in matters of public interest were denied T rsas g a Szabads gjogok rt case 7

The ECtHR case-law c) The Magyar Helsinki Bizotts g case: 1. The right of access is not necessarily restricted to public watchdogs but can be invoked by any individual in circumstances where the information is instrumental for the their exercise of the right to freedom of expression and where its denial constitutes an interference with that right 2. Criteria to assess to what extent a denial of access to information constitutes an interference with the applicant s rights 3. Relationship with the right to privacy (article 8): i) Information related to the conduct of professional activities in the context of public proceedings these professional activities are not private matters ii) The disclosure would not have exposed the public defenders to a degree surpassing what they could have foreseen when registering as public defenders 8

The CJEU case-law a) Active disclosure 1. Cases C-92/09 and C-93/09, Schecke i) An EU law act required the publication of personal data of farmers who received money from EU funds ii) The aim of increasing the transparency of Union funds pursued an objective of general interest iii) However, since the EU legislator had not considered whether the same objective could be achieved with less intrusive means concerning privacy and data protection, the CJEU declared the Union law invalid on this point 2. Cases C-465/00, C-138/01, and C-139-01, Rechnungshof v sterrischischer Rundfunk and Others i) An EU law act required a state body to collect and transmit data on income for publishing the name and income of employees of public entities in an annual report ii) The aim of keeping salaries of public employees within reasonable limits constituted an objective of general interest iii) The CJEU left the solution to the national court, but drew its attention to whether such aim could not have been achieved equally effectively by less intrusive means, eg, the transmission of the personal data only to the monitoring public bodies and not to the general public 9

The CJEU case-law b) Passive disclosure case C-28/08 P, Bavarian Lager 1. Article 4(1)(b) of Regulation 1049/ 2001: institutions shall refuse access to a document where disclosure would undermine the protection of [ ] privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data i) The Commission s renvoi interpretation ii) The EDPS s and the European Ombudsman threshold interpretation 2. CJEU overturned the General Court s interpretation and applied i) 3. Article 8(b) of Regulation 45/2001: personal data shall only be transferred to recipients [ ] if the recipient establishes the necessity of having the data transferred and if there is no reason to assume that the data subject's legitimate interests might be prejudiced . 10

The CJEU case-law b) Subsequent case-law 1. Having access to the participation of MEPs in an additional pension scheme was necessary to bring light to potential conflicts of interest, but not necessary for informing the public and enabling it to take part in a debate on the legitimacy of the scheme case T-115/13, Dennekamp 2. Disclosing a draft version of a document with remarks of appointed experts was necessary to ensure transparency of the process of adoption of a measure likely to have impact on the activities of economic operators in particular, in order to appreciate how the form of participation by each expert in that process might, through that expert s own scientific opinion, have influenced the context of that measure case C-615/13 P, ClientEarth 3. Cases T-639/15 to T-666/15 and T-94/16, Psara 4. Case T-727/19, Basaglia v Commission 11

The elements of article 86 a) Official document i) Broad interpretation: any content whatever its medium (paper or electronic form or as a sound, visual or audiovisual recording) article 2(6)(a) Directive (EU) 2019/1024 b) Public authority i) government or other public administration, including public advisory bodies, at national, regional or local level ii) any natural or legal person performing public administrative functions under national law, including specific duties, activities or services in relation to the environment article 2(2)(a) and (b) Directive 2003/4/CE c) Private bodies performing tasks carried out in the public interest i) any natural or legal person having public responsibilities or functions, or providing public services, relating to the environment under the control of a public authority article 2(2)(c) Directive 2003/4/CE 12

The effects of article 86 a) Comparison with article 85 GDPR 1. Neither regulates the matter on substance 2. But article 85 requires MS to adopt laws which provide for exemptions and derogations to reconcile the right to protection of personal data with the freedom of expression and information, and requires MS to notify them to the European Commission 3. Whereas article 86 foresees no exemptions or derogations 4. Aimed at confirming it is a legitimate objective pursued by a legal obligation, or a necessary processing activity for the performance of a task in the public interest? 5. GPDR Recital 154: Public access to official documents may be considered to be in the public interest 6. The solution must be in the national law on access to documents 7. No further guidance is given on how to actually reconcile both interests 13

The effects of article 86 b) Absence of concrete guidance c) The interest of reconciliation is acknowledged d) No exemptions or derogations from the GDPR e) No further conditions f) Case by case analysis 14

The effects of article 86 g) The limitations of an open clause 1. No obligation for MS to foresee specific rules to address the conflict of rights ii) Article 86 is of doubtful legality because the EU lacks competence in the field of access to information, except for environmental information iii) The lack of limitations for the action of MS would risk imploding the GDPR in this field iv) Declarative clause: 1. This article still requires the fulfilment of the conditions set forth in article 6(2) and (3) 2. The fact that it is grounded on a public interest reason does not necessarily make access to information prevail 3. MS are charged with the duty to find balanced and reasonable solutions so as not to hinder the European Data Protection Law i) 15

Thank you! tff@fd.ulisboa.pt With financial support from the Justice Programme of the European Union