ASNEF: Lawful basis for processing under Member State law
--
JOINED CASES C-468/10 AND C-469/10, ASOCIACION NACIONAL DE ESTABLECIMIENTOS FINANCIEROS DE CREDITO (ASNEF) AND FEDERACION DE COMERCIO ELECTRONICO Y MARKETING DIRECTO (FECEMD) V. ADMINISTRACION DEL ESTADO, 24.Nov.2011 (“ASNEF”)
Key point
Valid purposes for processing: EU data protection law sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as lawful. Member States cannot add new principles relating to the lawfulness of processing or impose additional requirements.
A Spanish law requiring that data being process under legitimate interest be limited to data available through public sources (thereby excluding, in a categorical and generalized way, any processing of data not appearing in such sources even where the processing respected the fundamental rights and freedoms of the data subjects involved) is an incorrect implementation of the Data Protection Directive (Directive 95/46/EC). The national law provides for additional requirements amending the scope of a principle referred to in Article 7 of the Directive (which is precluded) as opposed to providing for a mere clarification of one of those principles (which would be allowed).
Direct applicability of Directive 95/46: Whenever the provisions of a Directive appear to be unconditional and sufficiently precise,they have direct effect if the Member State has failed to implement that Directive in domestic law by the end of the prescribed period. Article 7(f) is sufficiently precise, as it states an unconditional obligation. (¶¶ 52-55)
Background
- Article 7(f) of Directive 95/46/EC (the Data Protection Directive) was implemented in Spain through Organic Law 15/1999 and Royal Decree 1720/2007.
- Royal Decree 1720/2007 required that, in the absence of the interested party’s consent, and to allow processing of his personal data that is necessary to pursue a legitimate interest of the controller or recipients, it is necessary not only that the fundamental rights and freedoms of the data subject should not be prejudiced, but also that the data should appear in public sources. These requirements go beyond the provisions of Article 7(f) of Directive 95/46.
