European Court of Justice

Today, the European Court of Justice (ECJ) handed down its decision in Google v. CNIL, dealing with the remit of the ‘right to be forgotten’ (RTBF). In short, the ECJ held that the operator of a search engine is not required to carry out de-referencing on all domain extensions of its search engine when dealing with a RTBF request. It is required, however, to carry out de-referencing on the versions of its search engine corresponding to all member states and take measures to protect the data subject’s fundamental rights. Though the decision was made under the former Data Protection Directive, it will have implications for data subjects under the General Data Protection Regulation (GDPR) as the RTBF was codified by GDPR Article 17.

Continue Reading Forget-me-not: Google v. CNIL defines territorial scope of the right to be forgotten

On 27 September 2017, the European Court of Justice (“ECJ”) handed down its preliminary ruling to the Supreme Court of the Slovak Republic (“Supreme Court”) regarding the interpretation of “a task carried out in the public interest” as a legitimate basis for processing personal data under Article 7(e) of the Data Protection Directive (95/46/EC) (“Directive”) (Puskar v Finance Directorate of the Slovak Republic, Case C-73/16, 27 September 2017).

The ECJ ruling also considered: (i) an individual’s right to an effective remedy before a court, and (ii) the admissibility of evidence obtained unlawfully, under Article 47 of the Charter of Fundamental Rights of the European Union. In this blog, however, we will look at the ECJ’s interpretation of Article 7(e) of the Directive.

Background

The request for a preliminary ruling of the ECJ was made by the Supreme Court following a dispute between Mr. Puškár and the Slovakian tax authorities.

Mr. Puškár sought a decision to prevent the tax authorities from including his personal information in a confidential list of so-called ‘front-men,’ prepared by the tax authorities for the purpose of collecting taxes and combatting fraud (“Contested List”), and to delete any reference to him in such lists. ‘Front-men’ are individuals who purport to act as ‘fronts’ in company director roles. Mr. Puškár argued that the Contested List was drawn up without a legal basis and that his personal data was processed without his consent.

The Supreme Court referred several questions to the ECJ, including whether the provisions of Article 7(e) of the Directive permits a Member State to process personal data (i.e. creating the Contested List) for the purpose of collecting tax and combatting tax fraud without the consent of the individuals concerned.
Continue Reading European Court of Justice provides guidance on “tasks carried out in the public interest.”

The European Courts of Justice (ECJ) ruled in the case of Institut professionel des agents immobiliers (IPI) v. Englebert, E.C.J No. C 473/12, 11/07/13) that EU member states have the option, but not an obligation, to transpose the list of exceptions provided under Article 13 of the EU Data Protection Directive 95/46/EC, which allows

In the midst of discussions on Google’s revised privacy policy and its compliance with EU legislation, Spain’s highest court, the Audiencia Nacional de España, has referred a case up to the European Court of Justice (ECJ) to decide on whether Spanish citizens can lawfully demand that Google delete information about them from its search engine,

“You wait for ages for one and then two turn up at the same time!” The European Court of Justice issued two significant rulings this past November.

The first addressed the manner in which Spain enacted the Data Protection Directive. In Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) v Administración del Estado (C-468/10) and