In Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) (C?468/10) and Federación de Comercio Electrónico y Marketing Directo (FECEMD) (C?469/10) v Administración del Estado, the ECJ had to consider a reference for a preliminary ruling concern the interpretation of Article 7(f) of the Data Protection Directive (Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31)). The references were made in two sets of proceedings with differing claimants, ASNF is Spain’s National Association of Credit Institutions and FECEMD is the Federation of Electronic Commerce and Direct Marketing). The defendant was, effectively, the State.
The part of a Royal Decree that was relevant to the proceedings provided(ECJ’s translation):
‘… personal data may be processed or transferred without the data subject’s consent when:
(a) it is authorised by a regulation having the force of law or under Community law and, in particular, when one of the following situations applies:
– the purpose of the processing or transfer is to satisfy a legitimate interest of the data controller or recipient guaranteed by these rules, as long as the interest or fundamental rights and liberties of the data subjects, as provided in Article 1 of Organic Law 15/1999 of 13 December, are not overriding;
– the processing or transfer of data is necessary in order for the data controller to fulfil a duty imposed upon him by one of those provisions;
(b) the data which are the subject of processing or transfer are in sources accessible to the public and the data controller, or the third party to whom data has been communicated, has a legitimate interest in their processing or knowledge, as long as the fundamental rights and liberties of the data subject are not breached.
The aforesaid notwithstanding, the public administration may communicate the data collected from sources accessible to the public to the data controllers of privately owned files pursuant to this subsection only when they are so authorised by a regulation having the force of law.’
ASNEF and FECEMD claimed that this provision added, to the condition relating to the legitimate interest in data processing without the data subject’s consent, a condition which does not exist in the Data Protection Directive, namely that the data should appear in public sources.
The Tribunal Supremo (Supreme Court, Spain) considered that the merits of the actions brought by ASNEF and FECEMD respectively depended to a large extent on the interpretation by the Court of Article 7(f) of Directive 95/46. The Tribunal Supremo took the view that, if the ECJ were to hold that Member States are not entitled to add extra conditions to those required by that provision, and if that provision were to be found to have direct effect, the Royal Decree having effect in Spain would have to be set aside. The following questions were referred to the ECJ:
‘(1) Must Article 7(f) of [Directive 95/46] be interpreted as precluding the application of national rules which, in the absence of the interested party’s consent, and to allow processing of his personal data that is necessary to pursue a legitimate interest of the controller or of third parties to whom the data will be disclosed, not only require that fundamental rights and freedoms should not be prejudiced, but also require the data to appear in public sources?
(2) Are the conditions for conferring on it direct effect, set out in the case-law of the Court … met by the abovementioned Article 7(f)?’
The ECJ observed (at [38]-[40]) that Article 7(f) sets out two cumulative conditions that must be fulfilled in order for the processing of personal data to be lawful: first, the processing of the personal data must be necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed; and, secondly, such interests must not be overridden by the fundamental rights and freedoms of the data subject. It followed that, in relation to the processing of personal data, Article 7(f) of Directive 95/46 precludes any national rules which, in the absence of the data subject’s consent, impose requirements that are additional to the two cumulative conditions set out in the preceding paragraph. However, account must be taken of the fact that the second of those conditions necessitates a balancing of the opposing rights and interests concerned which depends, in principle, on the individual circumstances of the particular case in question and in the context of which the person or the institution which carries out the balancing must take account of the significance of the data subject’s rights arising from Articles 7 and 8 of the ECHR.
The ECJ’s response to the referred questions was as follows:
‘1. Article 7(f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as precluding national rules which, in the absence of the data subject’s consent, and in order to allow such processing of that data subject’s personal data as is necessary to pursue a legitimate interest of the data controller or of the third party or parties to whom those data are disclosed, require not only that the fundamental rights and freedoms of the data subject be respected, but also that the data should appear in public sources, thereby excluding, in a categorical and generalised way, any processing of data not appearing in such sources.
2. Article 7(f) of Directive 95/46 has direct effect.’
