knowledge 9 January 2015 |

Legal Analysis Not Personal Data

Facts

The case concerned applications by third country nationals (YS, M and S) for residence permits in the Netherlands. YS’s residency application was rejected and he made a request for a copy of an internal document that was prepared by the Dutch Immigration and Naturalisation Services (the “DINS”) in respect of this application. This internal document is known as a “minute” and generally contains personal information relating to the applicant (eg name, date of birth, nationality, gender, ethnicity, religion, languages spoken, documents submitted by the applicant and procedural history of the applicant), together with an assessment of this information in light of the applicable legal provisions (the “legal analysis”).

In line with existing policy, the Minister for Immigration, Integration and Asylum, (the “Minister”) refused to disclose a copy of the minute but instead provided YS with a summary of the personal data contained in the minute, the origin of such data and the bodies to which the data had been disclosed. YS initiated proceedings before the District Court claiming that he could not lawfully be refused access to the minute. The District Court stayed the proceedings and referred a number of questions to the CJEU, the most pertinent of which sought to clarify whether the legal analysis constituted personal data and the manner in which personal data could be disclosed in response to a subject access request.

Judgment on Personal Data

In relation to the legal analysis, the CJEU held that it does not in itself constitute personal data. The CJEU found that the legal analysis could be viewed as information about the assessment of YS’s residency application and the application of the relevant law to this residency application. As such, the CJEU considered the legal analysis as information relating to the internal processes of DINS rather than to the applicant himself.

The CJEU explained that it reached the above decision having considered the definition of personal data under the Data Protection Directive 95/46 (the “Directive”) and the general objective of the Directive to protect the fundamental rights and freedoms of data subjects, in particular the right to privacy. The Directive gives each data subject numerous rights in relation to their personal data, and so as to ensure that certain of these rights (eg the right to consult the relevant data and to request that it be corrected or object to its processing in certain circumstances) can be effectively exercised, the Directive also grants a right of access. However, the CJEU found that extending the right of access to the legal analysis would not serve the Directive’s general objective. Instead, this would effectively result in an extension of the right of access to administrative documents, which was not intended under the Directive.

Judgment on Form of Communication

In considering the form of communication that may be used to satisfy YS’s right of access to his personal data in the minute, the CJEU highlighted that the right of access under the Directive was a right of data subjects to have their personal data communicated to them in “intelligible form”. On this basis, the CJEU was satisfied that YS’s right of access could be satisfied by providing him with a full summary of his personal data contained in the minute, provided that this is in an intelligible form which enables him to check that the data are accurate and lawfully processed.

Conclusion

This decision of the CJEU may prove to be of assistance to a data controller that receives a subject access request. The CJEU has provided further guidance on the meaning of personal data under EU law and appears to have adopted a narrower interpretation of this term than that previously expressed at a European level by the Article 29 Working Party in its Opinion No. 4/2007. The CJEU’s decision highlights that certain documents connected to a data subject may not be required to be released pursuant to a subject access request where the data subject is not the subject of the document in question.

This decision also clarifies that the CJEU is of the view that the right of access to personal data under the Directive may be satisfied by providing the data subject with a full summary of the relevant personal data in intelligible form. This indicates that data controllers are not obliged to provide data subjects with a copy of the document itself which contains the relevant personal data in order to comply with a subject access request.