The European Courts of Justice (ECJ) ruled in the case of Institut professionel des agents immobiliers (IPI) v. Englebert, E.C.J No. C 473/12, 11/07/13) that EU member states have the option, but not an obligation, to transpose the list of exceptions provided under Article 13 of the EU Data Protection Directive 95/46/EC, which allows for the collection and processing of personal data without notifying the data subject in the following limited necessary circumstances:
- To safeguard national security
- For defence
- For public security
- For the prevention, investigation, detection and prosecution of criminal offences or breaches of ethics for regulated professions
- For an important economic or financial interest of a Member State, including budgetary or taxation matters
- For monitoring, inspection or regulatory functions
- For the protection of the data subject or the rights and freedoms of others.
The case involved the use of private detectives by the Belgian Professional Institute of Estate Agents (IPI) to collect information on a real estate company that allegedly breached regulatory rules. The admissibility of the private detectives’ evidence in court was questioned on the grounds that the estate agents had not been informed that their personal data would be processed by third parties in accordance with Article 11(1) of the EU Directive. IPI argued that the use of private detectives would fall within the exception under Article 13(1)(d) of the EU Directive which permits the collection of data without consent for the prevention, investigation, detection and prosecution of breaches for regulated professions.
Article 9 of the Belgian data protection Act of December 8, 1992 on Protection of Privacy in relation to the Processing of Personal Data (as amended) (the Belgian Law), corresponds to Article 10 and 11 of the EU Directive and imposes the obligation to inform data subjects of data processing activities. There are the following exceptions to this obligation under Articles 3(3)-(7) under the Belgian Law:
- For journalistic purposes
- For artistic or literary expression
- By public authorities for exercising judicial police duties
- By police services for the purpose of administering police duties
- By the European Centre for Missing and Sexually Abused Children
Belgian law did not therefore strictly transpose comparable exceptions to those set out in Article 13 of the EU Directive, which led the Belgian Constitutional Court to refer to the ECJ for clarification on the requirement for national laws of member states to directly implement Article 13.
The ECJ ruled that if Belgium had transposed the exceptions of Article 13 of the EU Directive into national law, then the use of private detectives would fall within the exception under Article 13(1)(d) of the EU Directive. However, the ECJ clarified that the transposition of the exceptions to the requirement that data processors inform data subjects about the processing of their personal data under Article 13 of the Directive is optional, not obligatory, for EU member states. Therefore, notwithstanding the relevant exception under Article 13 (1)(d), Belgian law did not provide a comparable exception in this case. To this extent, the agents should have been informed of the data processing by the private investigators in accordance with Article 10 and 11 of the EU Directive (and Article 9 of the Belgian Law).
The ruling highlights the importance of the proposed EU Data Protection Regulation, which will harmonise national data protection laws across all EU member states to eradicate discrepancies in interpretation and implementation of the EU Directive.