The CJEU has given judgment in Case C-201/14 Smaranda Bara and Others v Presedintele Casei Nationale de Asigurari de Sanatate and Others. It held that, where personal data is subject to transfer and processing between public administrative bodies, the data subject must be informed in advance.
Facts
Ms Smaranda Bara and numerous other Romanian citizens are self-employed workers. The Romanian tax authority transferred data relating to their declared income to the National Health Insurance Fund, which then required the payment of arrears of contributions to the health insurance regime.
The persons concerned (data subjects) contested, before the Curtea de Apel Cluj (Court of Appeal, Cluj, Romania), the lawfulness of that transfer under the Directive. They claimed that their data were used for purposes other than those for which those data had initially been communicated to the tax authority, without their prior explicit consent and without their having previously been informed.
Romanian law empowers public bodies to transfer personal data to the health insurance funds so that the latter may determine whether an individual qualifies as an insured person. The data concern the identification of persons (surname, first name, personal identity card number, address) but does not include data relating to income received.
The Romanian Court of Appeal, Cluj, asked the Court of Justice, in essence, whether EU law precludes a public administrative body from transferring personal data to another public administrative body for the purpose of their subsequent processing, without the data subjects being informed of that transfer and processing.
Judgment
The CJEU has held that the requirement of fair processing of personal data requires a public administrative body to inform the data subjects of the fact that their data will be transferred to another public administrative body for the purpose of their processing by the latter in its capacity as recipient of those data. The directive expressly requires that any restrictions on the requirement to provide information are imposed by legislative measures.
The Romanian law that provides for the free transfer of personal data to the National Health Insurance Fund does not constitute prior information that would allow the data controller to dispense with his obligation to provide prior information to the persons from whom data are collected. That law does not define either the transferable data or the detailed arrangements for transferring those data, which are to be found only in a bilateral protocol agreed between the tax authority and the Health Insurance Fund.
As regards the subsequent processing of the data transferred, the directive provides that a controller of data must inform the data subjects as to his own identity, the purpose of the processing, and any further information necessary to ensure the fair processing of the data. That further information includes the categories of data concerned and the existence of the right of access to and the right to rectify the data concerning him.
The Court observes that the National Health Insurance Fund’s processing of data transferred by the tax authority required informing the data subjects of the purposes of that processing and the categories of data concerned. In this case, the Health Insurance Fund had not provided that information.
The Court held that EU law precludes the transfer and processing of personal data between two public administrative bodies without the persons concerned (data subjects) having been informed in advance.
