Case C‑473/12

Institut professionnel des agents immobiliers (IPI)

v

Geoffrey Englebert and Others

(Request for a preliminary ruling from the Cour constitutionnelle (Belgium))

‛Processing of personal data — Directive 95/46/EC — Articles 10 and 11 — Obligation to inform — Article 13(1)(d) and (g) — Exceptions — Scope of exceptions — Private detectives acting for the supervisory body of a regulated profession — Directive 2002/58/EC — Article 15(1)’

Summary — Judgment of the Court (Third Chamber), 7 November 2013

1. Approximation of laws — Protection of natural persons with regard to the processing of personal data — Directive 95/46 — Duty to provide information — Exceptions — Obligation on Member States to transpose those exceptions into their national law — No obligation

   (European Parliament and Council Directive 95/46, Art. 13(1))

2. Approximation of laws — Protection of natural persons with regard to the processing of personal data — Directive 95/46 — Duty to provide information — Exceptions — Scope — Private detectives acting for the supervisory body of a regulated profession — Included

   (European Parliament and Council Directive 95/46, Art. 13(1)(d))

1.  Article 13(1) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that Member States have no obligation, but have the option, to transpose into their national law one or more of the exceptions which it lays down to the obligation to inform data subjects of the processing of their personal data.

   In that regard, the provisions of Directive 95/46 are necessarily relatively general given that the directive has to be applied to a large number of very different situations, and includes rules with a degree of flexibility and, in many instances, leaves to the Member States the task of deciding the details or choosing between options.

   Member States are not obliged to lay down in their national law exceptions for the purposes listed in Article 13(1)(a) to (g) but, on the contrary, the legislature intended to give them the freedom to decide whether, and if so for what purposes, they wish to take legislative measures aimed at limiting, inter alia, the extent of the obligations to inform the data subject.

   Furthermore, Member States may lay down such measures only when they are necessary. The requirement that the measures be necessary is thus a precondition for the application of the option granted to Member States by that article, and does not mean that they are required to adopt the exceptions at issue in all cases where that condition is satisfied.

   (see paras 31, 32, 53, operative part)

2.  The activity of a private detective acting for a professional body in order to investigate breaches of ethics of a regulated profession is covered by the exception in Article 13(1)(d) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

   Since Directive 95/46 does not specify the manner in which the investigation and detection of failures to comply with the rules are carried out, it does not prevent a professional body such as that regulating the profession of estate agent from having recourse to specialised investigators, such as private detectives responsible for that investigation and detection, in order to perform its duties.

   It follows that, if a Member State has chosen to implement the exception provided for in that article, then the professional body concerned and the private detectives acting for it may rely on it and are not subject to the obligation to inform the data subject provided for in Articles 10 and 11 of that directive.

   If, on the other hand, the Member State has not provided for that exception, the data subjects must be informed of the processing of their personal data according to the detailed provisions, in particular those concerning timing, of Articles 10 and 11.

   It is therefore open to Member States to take the view that the professional bodies and the private detectives acting for them have sufficient means, notwithstanding the application of Articles 10 and 11 of that directive, of detecting the breaches of ethics at issue, so that it is not necessary for that exception to be implemented in order for those bodies to be able to carry out their duty of ensuring compliance with the rules.

   (see paras 44-46, 48, 53, operative part)

Case C‑473/12

Institut professionnel des agents immobiliers (IPI)

v

Geoffrey Englebert and Others

(Request for a preliminary ruling from the Cour constitutionnelle (Belgium))

‛Processing of personal data — Directive 95/46/EC — Articles 10 and 11 — Obligation to inform — Article 13(1)(d) and (g) — Exceptions — Scope of exceptions — Private detectives acting for the supervisory body of a regulated profession — Directive 2002/58/EC — Article 15(1)’

Summary — Judgment of the Court (Third Chamber), 7 November 2013

1. Approximation of laws — Protection of natural persons with regard to the processing of personal data — Directive 95/46 — Duty to provide information — Exceptions — Obligation on Member States to transpose those exceptions into their national law — No obligation

   (European Parliament and Council Directive 95/46, Art. 13(1))

2. Approximation of laws — Protection of natural persons with regard to the processing of personal data — Directive 95/46 — Duty to provide information — Exceptions — Scope — Private detectives acting for the supervisory body of a regulated profession — Included

   (European Parliament and Council Directive 95/46, Art. 13(1)(d))

1.  Article 13(1) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that Member States have no obligation, but have the option, to transpose into their national law one or more of the exceptions which it lays down to the obligation to inform data subjects of the processing of their personal data.

   In that regard, the provisions of Directive 95/46 are necessarily relatively general given that the directive has to be applied to a large number of very different situations, and includes rules with a degree of flexibility and, in many instances, leaves to the Member States the task of deciding the details or choosing between options.

   Member States are not obliged to lay down in their national law exceptions for the purposes listed in Article 13(1)(a) to (g) but, on the contrary, the legislature intended to give them the freedom to decide whether, and if so for what purposes, they wish to take legislative measures aimed at limiting, inter alia, the extent of the obligations to inform the data subject.

   Furthermore, Member States may lay down such measures only when they are necessary. The requirement that the measures be necessary is thus a precondition for the application of the option granted to Member States by that article, and does not mean that they are required to adopt the exceptions at issue in all cases where that condition is satisfied.

   (see paras 31, 32, 53, operative part)

2.  The activity of a private detective acting for a professional body in order to investigate breaches of ethics of a regulated profession is covered by the exception in Article 13(1)(d) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

   Since Directive 95/46 does not specify the manner in which the investigation and detection of failures to comply with the rules are carried out, it does not prevent a professional body such as that regulating the profession of estate agent from having recourse to specialised investigators, such as private detectives responsible for that investigation and detection, in order to perform its duties.

   It follows that, if a Member State has chosen to implement the exception provided for in that article, then the professional body concerned and the private detectives acting for it may rely on it and are not subject to the obligation to inform the data subject provided for in Articles 10 and 11 of that directive.

   If, on the other hand, the Member State has not provided for that exception, the data subjects must be informed of the processing of their personal data according to the detailed provisions, in particular those concerning timing, of Articles 10 and 11.

   It is therefore open to Member States to take the view that the professional bodies and the private detectives acting for them have sufficient means, notwithstanding the application of Articles 10 and 11 of that directive, of detecting the breaches of ethics at issue, so that it is not necessary for that exception to be implemented in order for those bodies to be able to carry out their duty of ensuring compliance with the rules.

   (see paras 44-46, 48, 53, operative part)