OPINION OF ADVOCATE GENERAL
Sharpston
delivered on 17 June 2010 (1)
Joined Cases C‑92/09 and C‑93/09
Volker und Markus Schecke GbR (Case C-92/09)
v
Land Hessen
(Reference for a preliminary ruling from the Verwaltungsgericht Wiesbaden (Germany))
(Protection of individuals regarding the treatment of personal data – Publication of information on beneficiaries of funds deriving from the European Agricultural Guarantee Fund and the European Agricultural Fund for rural development – Validity of the legal provisions that provide for such publication and the manner in which it is to be made)
Hartmut Eifert (Case C-93/09)
v
Land Hessen
(Reference for a preliminary ruling from the Verwaltungsgericht Wiesbaden (Germany))
(Protection of individuals regarding the treatment of personal data – Publication of information on beneficiaries of funds deriving from the European Agricultural Guarantee Fund and the European Agricultural Fund for rural development – Validity of the legal provisions that provide for such publication and the manner in which it is to be made)
1. Viewed in terms of the European Union’s budget, the common agricultural policy (‘the CAP’) has been the Union’s most important policy for more than 40 years. In 1984 the CAP accounted for more than 71% of expenditure and it is currently considered to stand at approximately 40%, still the largest single item.
2. This reference from the Verwaltungsgericht (Administrative Court), Wiesbaden (Germany), challenges the validity of European Union (‘EU’) legislation which requires disclosure of the amounts awarded to farmers from CAP funds, together with their names, municipality of residence and, where available, postcode. The case raises important constitutional issues within EU law: in essence, whether the objective of achieving transparency in the management of CAP finance may in principle override the individual’s fundamental right to respect for his private life and personal data and, if so, where the balance between the two is to be struck.
Legal framework
Fundamental rights
The European Convention on Human Rights (2)
3. Article 8 of the European Convention on Human Rights (‘the ECHR’) provides:
‘1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.’
4. Supplementing that provision, the Council of Europe approved on 28 January 1981 the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (‘Convention No 108’). Article 1 of Convention No 108 describes the aim and purpose of the convention in the following terms: ‘the purpose of this convention is to secure … for every individual … respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him’. (3)
The Charter of Fundamental Rights of the European Union (4)
5. Article 7 of the Charter states: ‘Everyone has the right to respect for his or her private and family life, home and communications’.
6. Article 8 provides:
‘1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.’
7. Article 52 of the Charter sets out the conditions which govern any interference with or derogation from the rights guaranteed under the Charter. In particular:
‘1. Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.
…
3. In so far as this Charter contains rights which correspond to rights guaranteed by the [ECHR], the meaning and scope of those rights shall be the same as those laid down by the said Convention. This provision shall not prevent Union law providing more extensive protection.’
8. Article 6(1) TEU states that the rights, freedoms and principles set out in the Charter ‘shall have the same legal value as the Treaties’.
Data protection
Directive 95/46/EC (5)
9. Recital 1 recalls that:
‘… the objectives of the Community, as laid down in the Treaty, as amended by the Treaty on European Union, include … promoting democracy on the basis of the fundamental rights recognised in the constitution and laws of the Member States and in the [ECHR]’.
10. Recitals 10, 11 and 12 state that the aim of the Directive is to ensure a high level of protection of fundamental rights:
‘(10) … the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the [ECHR] and in the general principles of Community law; … for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;
(11) … the principles of the protection of the rights and freedoms of individuals, notably the right to privacy, which are contained in this Directive, give substance to and amplify those contained in [Convention No 108] …;
(12) … the protection principles must apply to all processing of personal data by any person whose activities are governed by Community law …’
11. Recital 28 states that the processing of personal data must be proportionate: ‘… any processing of personal data must be lawful and fair to the individuals concerned; … in particular, the data must be adequate, relevant and not excessive in relation to the purposes for which they are processed; … such purposes must be explicit and legitimate and must be determined at the time of collection of the data; … the purposes of processing further to collection shall not be incompatible with the purposes as they were originally specified …’.
12. Recitals 30 and 33 state:
‘(30) … in order to be lawful, the processing of personal data must in addition be carried out with the consent of the data subject or be necessary for the conclusion or performance of a contract binding on the data subject, or as a legal requirement, or for the performance of a task carried out in the public interest or in the exercise of official authority, or in the legitimate interests of a natural or legal person, provided that the interests or the rights and freedoms of the data subject are not overriding;
…
(33) … data which are capable by their nature of infringing fundamental freedoms or privacy should not be processed unless the data subject gives his explicit consent; … however, derogations from this prohibition must be explicitly provided for in respect of specific needs, in particular where the processing of these data is carried out for certain health-related purposes by persons subject to a legal obligation of professional secrecy or in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms;
…’
13. Article 1(1) of Directive 95/46 provides: ‘… Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data’.
14. Article 2 defines ‘personal data’, the ‘processing of personal data’ and ‘the data subject’s consent’ respectively as follows:
‘(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; …
(h) “the data subject’s consent” shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.’
15. Article 7 provides that personal data may be processed only if certain conditions are met, namely that the data subject has unambiguously given his consent (Article 7(a)) or that processing is ‘necessary’ for one or more purposes, exhaustively listed. Of these only two are potentially relevant here:
‘(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
…
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (6) or in a third party to whom the data are disclosed; …’
16. Article 18 states:
‘1. Member States shall provide that the controller or his representative, if any, must notify the supervisory authority referred to in Article 28 (7) before carrying out any wholly or partly automatic processing operation or set of such operations intended to serve a single purpose or several related purposes.
2. Member States may provide for the simplification of or exemption from notification only in the following cases and under the following conditions:
– where, for categories of processing operations which are unlikely, taking account of the data to be processed, to affect adversely the rights and freedoms of data subjects, they specify the purposes of the processing, the data or categories of data undergoing processing, the category or categories of data subject, the recipients or categories of recipient to whom the data are to be disclosed and the length of time the data are to be stored, and/or
– where the controller, in compliance with the national law which governs him, appoints a personal data protection official, responsible in particular:
– for ensuring in an independent manner the internal application of the national provisions taken pursuant to this Directive;
– for keeping the register of processing operations carried out by the controller, containing the items of information referred to in Article 21(2),
thereby ensuring that the rights and freedoms of the data subjects are unlikely to be adversely affected by the processing operations.
…’
17. Article 20 provides:
‘1. Member States shall determine the processing operations likely to present specific risks to the rights and freedoms of data subjects and shall check that these processing operations are examined prior to the start thereof.
2. Such prior checks shall be carried out by the supervisory authority following receipt of a notification from the controller or by the data protection official, who, in cases of doubt, must consult the supervisory authority.
3. Member States may also carry out such checks in the context of preparation either of a measure of the national parliament or of a measure based on such a legislative measure, which define the nature of the processing and lay down appropriate safeguards.’
18. Article 21(2) provides that Member States must ensure that the supervisory authority keeps a register of processing operations notified in accordance with Article 18.
Directive 2006/24 (8)
19. Article 1(1) states that the ‘… Directive aims to harmonise Member States’ provisions concerning the obligations of the providers of publicly available electronic communications services or of public communications networks with respect to the retention of certain data which are generated or processed by them, in order to ensure that the data are available for the purpose of the investigation, detection and prosecution of serious crime, as defined by each Member State in its national law’.
20. Article 1(2) provides that the directive applies to traffic and location data on both legal entities and natural persons and to the related data necessary to identify the subscriber or registered user. (9)
21. Article 3 requires Member States to adopt measures to ensure that certain categories of data (specified in Article 5) are retained in accordance with the directive. Those include data necessary to trace and identify the source of a communication, concerning inter alia, internet access (Article 5, point 1(a)(2)). Retained data are provided only to the competent authorities in specific cases and in accordance with national law; subject to appropriate safeguards (including the requirement to respect the ECHR) (Article 4).
22. Article 6 states: ‘Member States shall ensure that the categories of data specified in Article 5 are retained for periods of not less than six months and not more than two years from the date of the communication’.
The European Transparency Initiative
23. In launching the European Transparency Initiative (‘the ETI’) in 2005, the Commission stressed the importance of a ‘high level of transparency’ to ensure that the Union is ‘open to public scrutiny and accountable for its work’. (10) The Commission identified one of the main areas for action as being to ‘allow better scrutiny of use of EU funds …’. (11)
The Financial Regulation (12)
24. The importance of transparency in the management of the general budget is expressly emphasised in the Financial Regulation.
25. The third recital recognises transparency as a fundamental principle. Recital 12 then states: ‘…as regards the principle of transparency, information on implementation of the budget and the accounts should be improved’.
26. As part of the initiative to improve transparency, Article 30(3) provides:
‘The Commission shall make available, in an appropriate manner, information on the beneficiaries of funds deriving from the budget held by it when the budget is implemented on a centralised basis and directly by its departments, and information on the beneficiaries of funds as provided by the entities to which budget implementation tasks are delegated under other modes of management.
This information shall be made available with due observance of the requirements of confidentiality, in particular the protection of personal data as laid down in [Directive 95/46 (13)] and [Regulation (EC) No 45/2001 (14)], and of the requirements of security, taking into account the specificities of each management mode referred to in Article 53 and where applicable in conformity with the relevant sector-specific rules.’
27. Article 53b(2)(d) provides that the Member States must ‘ensure, by means of relevant sector-specific regulations and in conformity with Article 30(3), adequate annual ex-post publication of beneficiaries of funds deriving from the budget’.
The funding of the CAP
Council Regulation (EC) No 1290/2005 (15)
28. Council Regulation No 1290/2005 provides the basic rules for the financial management of the CAP and creates two funds, the European Agricultural Guarantee Fund (the EAGF) and the European Agricultural Fund for Rural Development (the EAFRD). (16)
29. Recital 36 acknowledges that, ‘[a]s personal data or business secrets might be involved in the application of the national control systems and the conformity clearance, the Member States and the Commission should guarantee the confidentiality of the information received in the context of these operations’.
30. Article 1 of Council Regulation No 1290/2005 explains that its purpose is to set ‘… specific requirements and rules on the financing of expenditure falling under the common agricultural policy, including expenditure on rural development’.
31. Article 2 establishes the EAGF and the EAFRD and provides that both funds are to come under the general EU budget.
32. Articles 6, 7 and 11 provide that payments are made to beneficiaries by paying agencies, which are departments or bodies of Member States. The paying agencies must satisfy themselves that aid applications comply with the conditions of the provisions under which they are granted.
33. Article 9 imposes obligations on the Commission and Member States to ensure effective protection of the Community’s financial interests. (17)
34. Article 44 provides: ‘Member States and the Commission shall take all necessary steps to ensure the confidentiality of the information communicated or obtained under inspection and clearance of accounts measures implemented under this Regulation. The principles mentioned in Article 8 of [Council Regulation (Euratom, EC) No 2185/96 (18)] shall apply to that information’.
35. Council Regulation No 1290/2005 was modified by Council Regulation (EC) No 1437/2007. (19) The purpose of the modification is explained in recitals 12 to 14 in the preamble to Council Regulation No 1437/2007 as follows:
‘(12) It is necessary to clarify the legal basis for the adoption of detailed rules for the application of Regulation (EC) No 1290/2005. In particular, the Commission should be able to adopt detailed rules of application in respect of the publication of information on beneficiaries of the common agricultural policy, in respect of intervention measures where no fixed sum per item has been laid down in a common market organisation and in respect of appropriations which have been carried over to finance direct payments to farmers under the common agricultural policy.
(13) In the context of the revision of Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities, the provisions on the annual ex-post publication of beneficiaries of funds deriving from the budget were inserted into that Regulation in order to implement the European Transparency Initiative. Sector-specific Regulations are to provide the means for such a publication. Both the EAGF and the EAFRD form part of the general budget of the European Communities and finance expenditure in a context of shared management between the Member States and the Community. Rules should therefore be laid down for the publication of information on the beneficiaries of these Funds. To that end, Member States should ensure annual ex-post publication of the beneficiaries and the amounts received per beneficiary under each of these Funds.
(14) Making this information accessible to the public enhances transparency regarding the use of Community funds in the common agricultural policy and improves the sound financial management of these funds, in particular by reinforcing public control of the money used. Given the overriding weight of the objectives pursued, it is justified with regard to the principle of proportionality and the requirement of the protection of personal data to provide for the general publication of the relevant information as it does not go beyond what is necessary in a democratic society and for the prevention of irregularities. Taking into account the opinion of the European Data Protection Supervisor, [(20)] it is appropriate to make provision for the beneficiaries of funds to be informed that those data may be made public and that they may be processed by auditing and investigating bodies.
…’
36. The two amendments of present relevance are Article 42, point 8b, and Article 44a.
37. Article 42 enables the Commission to adopt rules to implement Council Regulation No 1290/2005. Point 8b states that the Commission shall adopt:
‘[T]he detailed rules on the publication of information concerning beneficiaries referred to in Article 44a and on the practical aspects related to the protection of individuals with regard to the processing of their personal data in accordance with the principles laid down in Community legislation on data protection. These rules shall ensure, in particular, that the beneficiaries of funds are informed that these data may be made public and may be processed by auditing and investigating bodies for the purpose of safeguarding the financial interests of the Communities, including the time that this information shall take place.’
38. Article 44a provides:
‘Pursuant to Article 53b(2)(d) of Regulation (EC, Euratom) No 1605/2002, Member States shall ensure annual ex-post publication of the beneficiaries of the EAGF and the EAFRD and the amounts received per beneficiary under each of these Funds. The publication shall contain at least:
(a) for the EAGF, the amount subdivided in direct payments within the meaning of Article 2(d) of Regulation (EC) No 1782/2003 and other expenditure;
(b) for the EAFRD, the total amount of public funding per beneficiary.’
Commission Regulation (EC) No 259/2008 (21)
39. The preamble confirms that the Regulation was adopted after consulting the European Data Protection Supervisor. (22)
40. Recital 2 explains that the purpose of publication is to enhance transparency regarding the use of EU funds and to improve sound financial management.
41. Recital 3 states that, in order to meet that objective ‘… the minimum requirements as to the content of the publication should be laid down. These requirements should not go further than what is necessary in a democratic society in order to reach the objectives pursued ...’.
42. Recital 5 acknowledges that ‘… the objective of transparency does not require that the information remains available indefinitely, a reasonable period of availability of the published information should be laid down …’.
43. Recital 6 explains: ‘ [m]aking this information accessible to the public enhances transparency regarding the use of Community funds in the common agricultural policy and improves the sound financial management of these funds, in particular by reinforcing public control of the money used. Given the overriding weight of the objectives pursued, it is justified with regard to the principle of proportionality and the requirement of the protection of personal data to provide for the general publication of the relevant information as it does not go beyond what is necessary in a democratic society and for the prevention of irregularities …’.
44. Article 1(1) of Commission Regulation No 259/2008 provides that information published in respect of beneficiaries of the funds is to include the following elements:
‘(a) the first name and the surname where the beneficiaries are natural persons;
(b) the full legal name as registered where the beneficiaries are legal persons;
(c) the full name of the association as registered or otherwise officially recognised where the beneficiaries are associations of natural or legal persons without an own legal personality;
(d) the municipality where the beneficiary resides or is registered and, where available, the postal code or the part thereof identifying the municipality;
(e) for the European Agricultural Guarantee Fund, hereinafter referred to as EAGF, the amount of direct payments within the meaning of Article 2(d) of Regulation (EC) No 1782/2003 received by each beneficiary in the financial year concerned;
(f) for the EAGF, the amount of payments other than those referred to in point (e) received by each beneficiary in the financial year concerned;
(g) for the European Agricultural Fund for Rural Development, hereinafter referred to as EAFRD, the total amount of public funding received by each beneficiary in the financial year concerned, which includes both the Community and the national contribution;
(h) the sum of the amounts referred to in points (e), (f) and (g) received by each beneficiary in the financial year concerned;
(i) the currency of these amounts.’
45. Article 1(2) allows Member States to publish more detailed information than provided for in Article 1(1).
46. Article 2 provides that ‘[t]he information referred to in Article 1 shall be made available on a single website per Member State through a search tool allowing the users to search for beneficiaries by name, municipality, amounts received as referred to in (e), (f), (g) and (h) of Article 1 or a combination thereof and to extract all the corresponding information as a single set of data’.
47. Article 3 states that information concerning beneficiaries is to be published by 30 April for the preceding financial year and to remain available on the website for two years from the date of initial publication.
48. Article 4 provides:
‘1. Member States shall inform the beneficiaries that their data will be made public in accordance with Regulation (EC) No 1290/2005 and this Regulation and that they may be processed by auditing and investigating bodies of the Communities and the Member States for the purpose of safeguarding the Communities’ financial interests.
2. In case of personal data, the information referred to in paragraph 1 shall be provided in accordance with the requirements of Directive 95/46/EC and the beneficiaries shall be informed of their rights as data subjects under this Directive and of the procedures applicable for exercising these rights.
3. The information referred to in paragraphs 1 and 2 shall be provided to the beneficiaries by including it in the application forms for receiving funds deriving from the EAGF and EAFRD, or otherwise at the time when the data are collected.
...’
49. Article 5 requires the Commission to set up and maintain a Community website under its central internet address which includes links to the websites of all of the Member States.
Facts, procedure and questions referred
50. The applicants in these two cases are a partnership (Volker und Markus Schecke GbR: Case C-92/09) and an individual (Mr Hartmut Eifert: Case C-93/09), who each operate a farming business. Both applicants object to the publication of their details, in accordance with Commission Regulation No 259/2008, as recipients of agricultural subsidies. On 31 December 2008, Volker und Markus Schecke GbR were granted a payment of EUR 64 623.65. On 5 December 2008 Mr Eifert was granted a payment of EUR 6 110.11 to support farming in a less-favoured area.
51. The application forms for the grants contained the following notice: ‘I am aware that Article 44a of Regulation (EC) No 1290/2005 requires publication of information on the beneficiaries of the EAGF and the EAFRD and the amounts received per beneficiary. The publication relates to all measures applied for in connection with the Common Application, which constitutes the single application for the purposes of Article 11 of Commission Regulation (EC) No 796/2004, (23) and is effected annually at the latest by 31 March of the following year’.
52. The names of beneficiaries, their localities, postal codes and the amounts awarded are made available on the website (24) of the Bundesanstalt für Landwirtschaft und Ernährung (‘BfLE’) (Federal Agency for Agriculture and Nutrition), the interested party in the national proceedings. The website includes a search tool which enables users simply by entering details for one field (for example, the postal code) to obtain the corresponding list of named beneficiaries of grants from the EAGF or EAFRD. The data protection notice published as part of the information on the website contains the statement: ‘On each occasion that the server is accessed data are stored for statistical and security purposes. For a limited period the IP address of the internet service provider, date and time and details of pages accessed are stored. The data are used only for the purposes of improving the website and not made available to third parties or evaluated in a manner which traces the identity of users’.
53. Volker und Markus Schecke GbR and Mr Eifert launched proceedings against the Land Hessen on, respectively, 26 September and 18 December 2008. Each sought an order prohibiting publication of their personal details as beneficiaries of grants received under the funds.
54. The applicants take the view that Article 44a of Council Regulation No 1290/2005 infringes EU data protection law. The information published on the website is personal data and there are no overriding public interests which justify this interference with their rights.
55. The Land Hessen contends that the obligation on Member States to publish those data on the internet results from Article 44a of Council Regulation No 1290/2005 in conjunction with Commission Regulation No 259/2008. In its view, there can be no doubt that those provisions are valid. There is an overriding public interest in publication, which facilitates transparency with regard to spending on agriculture and the prevention of irregularities. Moreover, it does not exceed what is necessary in a democratic society. Furthermore, the applicants were informed in the application form that the authorities are obliged to publish their personal data and therefore the submission of the application form constitutes their consent to such disclosure for the purposes of Article 7(a) of Directive 95/46. The Land Hessen argues that in any event the applicants could have chosen to avoid publication by forgoing the aid.
56. The referring court considers that the applicants’ case turns on the validity of Articles 42, point 8b, and 44a of Council Regulation No 1290/2005 and Commission Regulation No 259/2008. If those measures are invalid, the data processing by the BfLE is unlawful and the prohibition which the applicants seek should accordingly be granted.
57. The referring court also identified a series of more technical questions as to whether the requirement to publish the personal data of beneficiaries who receive grants under the EAGF and the EAFRD is compatible with certain aspects of the EU legislation on data protection, in particular, Directives 95/46 and 2006/24.
58. The national court therefore stayed the proceedings and referred the following questions to the Court for a preliminary ruling:
‘1. Are point 8b of Article 42 and Article 44a of [Council Regulation No 1290/2005] inserted by [Council Regulation No 1437/2007], invalid?
2. Is Commission Regulation No 259/2008
(a) invalid, or
(b) valid by reason only of the fact that [Directive 2006/24] is invalid?
If the provisions mentioned in the first and second questions are valid:
3. Must the second indent of Article 18(2) of Directive [95/46] be interpreted as meaning that publication in accordance with [Commission Regulation No 259/2008] may be effected only following implementation of the procedure in lieu of notification to a supervisory authority established by that article?
4. Must Article 20 of Directive [95/46] be interpreted as meaning that publication in accordance with [Regulation No 259/2008] may be effected only following exercise of the prior check required by national law in that case?
5. If the fourth question is answered in the affirmative: Must Article 20 of Directive [95/46] be interpreted as meaning that no effective prior check has been performed, if it was effected on the basis of a register established in accordance with the second indent of Article 18(2) of that directive which lacks an item of information prescribed?
6. Must Article 7 – and in this case, in particular, subparagraph (e) – of [Directive 95/46] be interpreted as precluding a practice of storing the IP addresses of the users of a homepage without their express consent?’
59. Written observations have been submitted on behalf of Volker und Markus Schecke GbR, the Land Hessen, the Greek, Netherlands and Swedish Governments, the Council and the Commission, all of whom (save for the Netherlands Government) made oral representations at the hearing on 2 February 2010.
Assessment
60. The six questions referred by the national court may be sub-divided as follows.
61. Questions 1 and 2a constitute the core of the reference. In them, the referring court queries the validity of the Community legislation that provides for compulsory publication on the internet of certain data concerning beneficiaries of the EAGF and EAFRD. I shall address those questions first, after a series of preliminary observations.
62. Next, the referring court asks three detailed questions concerning certain provisions in Directive 95/46 that govern notifications of data processing (questions 3, 4 and 5). If the Court agrees with the answers that I propose to questions 1 and 2a, it becomes (strictly speaking) unnecessary to address those questions. In case the Court should disagree with me, I shall address them briefly.
63. Finally, the referring court asks two questions involving ‘users’ of data accessed via the internet and the interpretation of Directive 2006/24 (questions 2b and 6). For reasons that I set out later, I consider those questions to be inadmissible.
Questions 1 and 2a
Preliminary observations
– Introduction
64. I shall not waste time or space on a lengthy exegesis of the importance of fundamental rights in the legal order of the European Union. Fundamental rights have been an essential part of that legal order for many years. (25) The ECHR enjoys a special position as a source of such rights; and the Court has particular regard to the case-law of the European Court of Human Rights (which, for the shake of brevity, I shall refer to as ‘the Strasbourg Court’). (26) I regard it as inconceivable that EU secondary legislation that contravened fundamental rights in general, or the ECHR or the Charter in particular, could be upheld as valid by the Court. (27)
65. I begin with a brief outline of the competing objectives that have to be balanced in this case: the right of access to information in the interest of transparency, on the one hand; and the rights to privacy and to the protection of personal data, on the other. I shall then consider one specific objection that has been raised to the applicants relying on the rights that they would otherwise enjoy (to privacy and/or to the protection of personal data) – namely that by signing the applications for CAP funding, they consented to the contested publication.
– Transparency and the provision of information
66. The importance of transparency is firmly established in EU law. Article 1 EU refers to decisions being taken ‘as openly as possible’. (28) The Court has described the purpose of the principle of transparency as being to give the widest possible access to citizens to information with a view to reinforcing the democratic character of the institutions and the administration. (29) Providing data to the public about the beneficiaries of EU funds under shared management is one of the specific measures identified in the ETI. (30) At the political level, transparency has thus been recognised as an essential component in a democratic public administration.
67. It is less clear whether transparency is a general principle of EU law (31) or, indeed, itself a fundamental right. The concept of transparency and its status within EU law has arisen in cases concerning access to documents. (32) In his Opinion in Hautala, (33) Advocate General Léger described transparency of the decision-making process in the context of giving the public the widest possible access to documents held by the institutions as a fundamental right. However, the Court did not deal expressly with that point. In Interporc, (34) the Court did not accept the appellant’s contention that transparency was a general principle of EU law which had the effect of overriding Decision 94/90/ECSC, EC, Euratom ,(35) the legal instrument on which the Commission had based its decision refusing access to documents. (36) I shall deliberately leave the point open here, as it is not necessary to decide it in this case. That is because classification of a particular objective as a fundamental right is not a precondition for that objective to fall within the exceptions in Article 8(2) ECHR.
68. The national court appears to entertain doubts as to whether transparency can constitute an objective in itself, regarding it as merely a description of the contested measures. Those doubts seem to me misplaced. Whilst it is perfectly true that transparency is not a ‘right’ in the sense of something that is enumerated explicitly in the classic text of the ECHR, transparency has been endorsed (very clearly) as being a desirable and necessary objective in a democratic society. It is expressly referred to in the Charter – a much more recent democratic enumeration of fundamental rights. (37) My starting point is therefore that action taken in the interests of transparency is action taken in pursuit of a democratically desirable aim.
69. Transparency, by its very nature, has to be an open-ended concept. Its purpose is to further openness in a democratic society. Transparency may help to protect the citizen against arbitrary abuse of power. More generally, granting wide access to information so as to achieve an informed public and democratic debate enables citizens to exercise effective supervision over how public authorities make use of the power that those very citizens have conferred on them. Thus, transparency is about public control over public institutions. To the extent that greater transparency equates to more openness and more democratic accountability, greater transparency (rather than less) is normally to be applauded.
70. However, sometimes (as here) transparency may have to be weighed against another competing objective. To that extent, absolute transparency is not necessarily an absolute good. It is not always a case of ‘the more the better’. Thus, ‘maximum transparency in the public interest’ cannot become a mantra to justify overriding individual rights. In the present case, in order to determine whether the correct balance has been struck between transparency, on the one hand, and privacy and the protection of personal data, on the other hand, it will be necessary to examine exactly what transparency is meant to achieve in the specific context of the CAP.
– The rights to privacy and the protection of personal data
71. Two separate rights are here invoked: a classic right (protection of privacy under Article 8 ECHR) and a more modern right (the data protection provisions of Convention No 108). In Charter terms, similar rights are identified respectively in Articles 7 and 8. The Court has recognised the close link between the fundamental rights to privacy and the right to data protection. (38)
72. The Strasbourg Court has already held that a legal person (as well as a natural person) may invoke Article 8 ECHR (39) and that its protection extends to professional and business activities. (40) The rights to privacy and data protection therefore apply prima facie to both of the applicants in the national proceedings (given the respective content of those rights, it would be absurd to say that a legal person can invoke Article 8 ECHR but not Convention No 108). The Strasbourg Court has likewise held that private life includes personal identity, such as a person’s name, (41) and that the protection of personal data is of fundamental importance to a person’s enjoyment of his right to respect for private life. (42)
73. Like a number of the classic ECHR rights, the right to privacy is not an absolute right. Article 8(2) ECHR expressly recognises the possibility of exceptions to that right, as does Article 9 of Convention No 108 in respect of the right to protection of personal data. Article 52 of the Charter likewise sets out (in general terms) similar criteria that, if fulfilled, permit exceptions to (or derogation from) Charter rights.
– Does ‘consent’ to publication preclude subsequent reliance on the rights claimed?
74. The order for reference and the written observations lodged by the Land Hessen discuss whether the fact that the applicants were notified, on the application form seeking CAP support, that their data would be processed and nevertheless signed the application forms means that they cannot subsequently object to publication. That discussion raises two distinct issues: (a) did the applicants give their consent ‘unambiguously’ within the meaning of Article 7(a) of Directive 95/46 (so that it was ‘freely given, specific and informed’ within the definition in Article 2(h) of that directive), thus making the processing of their data lawful by virtue of that consent; (b) are they prevented, by virtue of any principle of EU administrative law, from invoking the rights that they would otherwise enjoy?
75. In relation to the first point, in response to a direct question from the Court during the hearing, the agent for the Commission expressly confirmed that that institution did not seek to rely on consent under Article 7(a) of the directive, but relied exclusively on the provisions of Article 7(c) (that processing was ‘necessary for compliance with a legal obligation to which the controller is subject’). The Council did not seek to argue otherwise.
76. In relying upon Article 7(c) of Directive 95/46, the Commission’s premiss is that the two legal obligations under which the data of beneficiaries who receive funds from the EAGF or the EAFRD are processed (Article 44a of Council Regulation No 1290/2005 and more particularly Commission Regulation No 259/2008) are valid. However, if either or both provisions are held to be invalid, that ground of justification for data processing falls away. There would no longer be a legal obligation upon the controller to process the data. In the context of proceedings in which the validity of the provisions imposing the legal obligation is (precisely) at issue, the argument is therefore circular. I shall not discuss it further. I return, rather to the question of consent.
77. Did the applicants give unambiguous consent by signing the application form? Their counsel argued that the precise wording that appears on the CAP form (43) meant that signing indicates merely awareness that publication would happen, rather than consent to such publication. On closer examination, there is real merit in that rather technical argument.
78. The application form does indeed speak of ‘publication of information on the beneficiaries of the EAGF and the EAFRD and the amounts received per beneficiary’ and refers to Article 44a of Council Regulation No 1290/2005 (and, for good measure, to Article 11 of Commission Regulation No 796/2005). Taken in isolation – that is, read without having to hand the full texts, not only of Council Regulation No 1290/2005 but also of Commission Regulation No 259/2008 – the application form does not make it unambiguously clear that an applicant is consenting to publication of his name, municipality of residence (and, where available, postcode) and the amounts awarded to him from the EAGF and/or the EAFRD. An applicant would only be aware that that was the true meaning of his consent to publication if he happened to be aware of what Article 1(1) of Regulation No 259/2008 says. Only that provision sets out the full detail of what publication will entail. But Regulation No 259/2008 is not mentioned in the notice on the form; and its existence cannot be deduced from reading the text of either of the two regulations that the application form does refer to.
79. Article 7 of Directive 95/46 lists, exhaustively, the strict conditions under which data processing may lawfully take place. Article 7(a) requires the data subject to have given ‘unambiguous’ consent. Acknowledging prior notice that publication of some kind will happen is not the same as giving ‘unambiguous’ consent to a particular kind of detailed publication. Nor can it properly be described as a ‘freely given specific indication’ of the applicants’ wishes in accordance with the definition of the data subject’s consent in Article 2(h). I therefore consider that the applicants did not give their consent to the processing (that is, here, the publication) of their data within the meaning of Article 7(a) of Directive 95/46.
80. That said, the technical argument is of little long-term value. Even if it were upheld in the present case, it could readily be defeated in the future simply be rewording the form and mentioning Commission Regulation No 259/2008, so as to make the consent given by the data subject quite unambiguous. It is therefore necessary to address the second point.
81. Article 7 of Directive 95/46 provides a framework within which the processing of personal data within the Member States may be made legitimate. (44) It reflects Article 8(2) of the Charter, which provides that data must be processed fairly and ‘on the basis of the consent of the person concerned’ (or some other legitimate basis laid down by law). Article 7(a) of Directive 95/46 adds the further stipulation that consent must be ‘unambiguous’. Within that framework, it seems to me that one must first necessarily examine the nature of the alleged consent; and that it must be open to an applicant to argue either that, although the consent was voluntary, he should not have been required to relinquish the right in question; or that consent was not freely given.
82. The first alternative does not require further elaboration. So far as the second is concerned, I would be prepared to accept that significant economic duress sufficed to render consent non-voluntary (and thus not ‘freely given’ within the meaning of Article 2(h) of Directive 95/46).
83. Whether there really was such duress here would be a question of fact for the national court to determine. It is worth recording that during the hearing, counsel for the applicants indicated – without being contradicted by either institution – that funding obtained from the CAP may represent between 30% and 70% of a farmer’s income.
84. A possible counter-example was given (from the bench) of the situation in which someone approaches a bank for a loan: can they choose whether or not to accept the loan on the terms in which it is offered? Whatever the true degree of commercial choice available to an applicant in the open market place, here there is only one ‘banker’ that makes available the support funds that the European Union deems it appropriate and right to provide to farmers. It was suggested that there is, in reality, no practical alternative to the CAP for many of the farmers that apply for CAP funding. They rely on that funding to be able to run viable small- and medium-sized farms that generate an adequate level of income for them and their families. Again, that is a question of fact which falls within the exclusive province of the national court.
85. It seems to me, however, that as a matter of principle a person applying for funding from a public body such as the European Union (whether the Union is acting alone or jointly with the Member States) cannot be required, solely as a condition of obtaining that funding, to forgo a fundamental right from which he would otherwise derive protection.
86. In those circumstances, I am of the view that the applicants are not precluded from invoking their right to data protection (whether under Directive 95/46 or Convention No 108) by having signed the application forms for CAP funding. The Court should therefore proceed to examine the issues that lie at the heart of this case.
Analysis
87. It is clear that the Court must approach questions 1 and 2a in a series of analytical stages (some of which can, however, be dealt with fairly briefly). (45) Since the action before the national court is based on an alleged violation of the applicants’ rights to privacy and the protection of personal data, those rights (rather than the right to transparency) must serve as the starting point. Is there an interference with the rights to privacy and the protection of personal data? If so, is it ‘in accordance with the law’? Is it (in principle) ‘necessary in a democratic society’ because it corresponds to a pressing social need? And is it proportionate? Answering that final question involves specifying with clarity and precision exactly what the aim of the contested measures is, examining whether the specific measures chosen (with the particular degree of interference with rights that they entail) are appropriate to achieve that aim and checking that they do not go beyond what is necessary to do so.
– Is there an interference with a protected right?
88. Both the Council and the Commission accept that the legislation at issue results in an interference with the applicants’ right to privacy, but consider it to be less serious than the interference examined by the Court in ÖRF. (46) However, the Commission contends that the legislation is compatible with the fundamental right to protection of personal data. The Council does not address that issue.
89. In my view, the contested measures clearly interfere with the applicants’ rights both to privacy and to the protection of personal data.
90. In ÖRF, public bodies subject to control by the Rechnungshof (Austrian Court of Audit) were required to communicate to it salaries and pensions exceeding a certain level which they paid to their employees and pensioners, together with the names of the recipients. That information was used for the purposes of drawing up an annual report to be communicated to the Nationalrat, the Bundesrat and the Landtage (the lower and upper chambers of the Federal Parliament and the provincial assemblies) and made available to the general public. The Court held that Directive 95/46 was applicable; accepted that the communication of data relating to remuneration by an employer to a third party constituted an interference with the right to privacy in Article 8 ECHR and went on to analyse whether that interference was justified.
91. In Satakunnan Markkinapörssi, (47) the data to which the questions related comprised the surname and given name of certain natural persons whose income exceeded certain thresholds as well as the amount, to the nearest EUR 100, of their earned and unearned income and details relating to wealth tax levied on them. The data, which the newspaper was able to obtain from the Finnish tax authorities under national legislation on public access to information, was set out in the form of an alphabetical list and organised according to municipality and income bracket. An individual could, however, request removal of his data from the list. The data were clearly ‘personal data’ that were ‘processed’ within the meaning of Directive 95/46. Had the Court not held that the processing activities complained of were conducted ‘solely for journalistic purposes’ within the meaning of the derogation contained in Article 9 of the Directive, those activities would have been an unlawful infringement of the individuals’ rights to privacy and to the protection of their personal data.
92. In the present case, beneficiaries under the CAP are identified individually, by name. The address at which they are to be found is identified with a considerable degree of precision, in as much as the municipality in which they reside is given and, if possible, the postcode. Postcodes are usually applied to a rather restricted area (otherwise they would be of limited use in sorting mail). When used in conjunction with other readily available online sources of information (such as telephone directories), they frequently enable a person’s exact address to be ascertained). The precise amount of assistance that beneficiaries obtain from the CAP is shown. It seems plausible that, at least in certain instances, such information enables conclusions to be drawn (rightly or wrongly) as to the beneficiaries’ overall level of income. (48) Thus, the Court’s approach in ÖRF and Satakunnan Markkinapörssi can readily be applied here. Indeed, the first two questions referred, by querying the validity of those measures, seek in essence to ascertain whether that interference is, or is not, justified. Their starting point (in my view, correctly) is that interference does take place.
– Is the interference ‘in accordance with the law’?
93. With the exception of Article 1(2) of Commission Regulation No 259/2008, to which I shall return later, (49) I consider that the publication requirements are sufficiently clear and precise to satisfy the requirement that publication should be ‘in accordance with the law’, ‘laid down by law’ or ‘provided by law’: the different formulations – which I take to be synonymous – that are to be found, respectively, in Article 8(2) ECHR and Articles 8(2) and 52(1) of the Charter. The contested provisions make it clear that certain information relating to beneficiaries will be published and specify the form that such publication will take.
– Is publication (in principle) ‘necessary in a democratic society’ because it corresponds to a pressing social need?
94. The express general purpose of the provisions whose validity is challenged in the first two questions (Articles 42, point 8b, and 44a of Council Regulation No 1290/2005, and Commission Regulation No 259/2008) is to implement the ETI and to enhance transparency regarding the use of CAP funds. (50) Promoting transparency is, in principle, a legitimate basis for interfering with the rights to privacy and the protection of personal data. In so saying, I mean merely that it is, potentially, a legitimate aim that may be regarded as necessary in a democratic society. (51) I am therefore prepared to accept that in principle – and I stress those words – some degree of interference with the rights to privacy and to the protection of personal data in order to promote transparency of the democratic process is ‘necessary in a democratic society’ because it corresponds to a pressing social need.
95. Expressing the same point in Charter terms, promoting transparency of the democratic process is a ‘legitimate basis’ for data processing within the meaning of Article 8(2) and an ‘objective of general interest recognised by the Union’ for the purposes of Article 52(1).
96. If and to the extent that proper application of the principle of transparency means that measures should be taken to inform the general public (as distinct from particular groups of persons within the public, such as investigative journalists, who may – perhaps – have more time and resources to consult traditional sources of information, such as registers kept in municipal offices and reference works held only in major public libraries), the obvious medium of publication is now the internet. However, the very accessibility, searchability and convenience of the internet mean that such publication will, potentially, be correspondingly more intrusive of the applicants’ rights to privacy and to protection of their personal data than publication in some more traditional way. When considering whether publication of personal data at a particular level of detail is a justified and proportionate interference with those rights, the nature and consequences of internet publication must be borne in mind.
97. The Council and the Commission have construed Article 42, point 8b, and Article 44a of Council Regulation No 1290/2005 as referring to publication in which individual beneficiaries are identified by name in conjunction with the amounts they receive. I would distinguish between the two provisions.
98. Article 42, point 8b, is an enabling provision – neither more nor less. It confers on the Commission the necessary delegated powers to enact the detailed rules. I do not share the referring court’s view that Article 42, point 8b, fails to comply with Article 202, third indent, EC (conferral of implementing powers on the Commission by the Council) and Article 211, fourth indent, EC (exercise by the Commission of such delegated powers). (52)
99. It is true that Article 42, point 8b, is broadly drawn. However, in setting the parameters within which the Commission may act exercising delegated powers, the Council enjoys a wide discretion. The Council is not obliged to specify the essential components of that power. A general power is sufficient. (53)
100. The Commission was, moreover, not given an unfettered discretion within which to act. Article 42, point 8b, provides in terms that the Commission shall enact the detailed rules ‘in accordance with the principles laid down in the Community legislation on data protection’. Thus, when Article 42, point 8b, requires those rules to contain provisions that data ‘may be made public’, it does not follow that the rules enacted had to be in the form chosen by the Commission. Rather, the Commission was given power to enact detailed rules, but only rules of a kind that did not infringe the right to protection of personal data to an impermissible extent.
101. Accordingly, I see no reason to doubt the validity of Article 42, point 8b, of Council Regulation No 1290/ 2005.
102. The position is rather different as regards Article 44a. Although the words ‘annual ex‑post publication of the beneficiaries of the EAGF and the EAFRD’ do not themselves require individual beneficiaries to be so identified (indeed, they merely echo the wording of Article 53b(2)(d) of the Financial Regulation), the subsequent requirements to ensure publication of ‘the amounts received per beneficiary under each of these Funds’ and that publication is to contain ‘for the EAFRD, the total amount of public funding per beneficiary’, read in conjunction with recitals 13 and 14 to Council Regulation No 1437/2007 (which introduced the crucial amendment to Regulation No 1290/2005), indicate that Article 44a of Council Regulation No 1290/2005 must be read as requiring individualised publication.
103. Such individualised publication might be of the kind that duly found its way into the requirements laid down by Commission Regulation No 259/2008. In the present case, it is that specific form of ‘publication in the interests of transparency’ whose proportionality falls to be assessed. However, I regard it as in principle possible that individualised publication could involve supplying less detail about the individual concerned – for example by not linking each beneficiary’s name with the municipality of residence and/or postcode.
– Is the interference proportionate?
104. The Court’s settled case-law states that ‘… the principle of proportionality, which is one of the general principles of Community law, requires that acts adopted by Community institutions do not exceed the limits of what is appropriate and necessary in order to attain the legitimate objectives pursued by the legislation in question; where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued’. (54)
105. It cannot be sufficient for the Council and Commission merely to invoke the principle of transparency in general terms in order to demonstrate that the specific measures put in place are justified and that the legislation is, accordingly, perfectly valid. That is because the necessity, appropriateness and proportionality of a legislative measure can be assessed only by reference to a precise and specific objective. Transparency as such has clearly been identified as desirable: as a social and democratic good. But what, precisely, is transparency meant to be achieving in the specific context of these two regulations?
106. The recitals to Council Regulation No 1437/2007 (which introduced the relevant amendments into Council Regulation No 1290/2005), together with the recitals to Commission Regulation No 259/2008, set out the aims of the contested measures in terms that are adequate to satisfy the requirement that legislative acts be reasoned. (55)
107. Thus, recital 13 explains that the objective of Council Regulation No 1437/2007 is to implement the ETI in respect of CAP expenditure. Recital 14 confirms that annual ex-post publication of beneficiaries under the EAGF and the EAFRD is meant to enhance transparency and improve sound financial management regarding the use of CAP funds, in particular by reinforcing public control of the money used. Those recitals also indicate that the legislator was aware that any interference with the right to privacy and the right to protection of personal data had to be proportionate.
108. Recital 2 to Commission Regulation No 259/2008 mimics the opening words of recital 14 to Council Regulation No 1437/2007, indicating that, ‘[t]he purpose of publication … is to enhance transparency regarding the use of the Funds and to improve their sound financial management’. Recital 3 states that ‘minimum requirements’ as to the content of the publication should be laid down, whilst recalling that ‘[t]hese requirements should not go further than what is required in a democratic society in order to reach the objectives pursued’. Recital 6 is a verbatim reprise of the first two sentences of recital 14 of Council Regulation No 1437/2007. Other recitals to the Commission regulation merely add that, ‘to comply with the data protection requirements’, beneficiaries should be given prior notice of publication and informed of their rights under [Directive 95/46]’ (recital 7); (56) and that, ‘for the sake of transparency’, beneficiaries of the Funds ‘should also be informed that … their personal data may be processed by auditing and investigating bodies of the Communities and the Member States’ (recital 8).
109. In the written observations, a certain amount of effort was devoted to examining the publication requirements under various other EU funds, in particular the European Social Fund (‘ESF’). In essence, the applicants point out that the ESF does not require the beneficiaries of awards to be named. By analogy, they submit, the position of beneficiaries under the CAP funds should be the same. Both the Council and the Commission contest the analogy, arguing that the position of the beneficiaries in the two sectors is not the same. First, payments under the ESF are not made directly to natural or legal persons as beneficiaries, but are made to intermediate organisations (such as a regional authority), for a particular project. Second, equivalent disclosure in the context of the ESF would result in a much more serious interference with the ultimate beneficiary’s right to privacy, because disclosure would reveal aspects of the beneficiary’s personal situation or status, such as disability or unemployment, which (the institutions claimed) was not in any sense the case in respect of beneficiaries under the CAP.
110. It seems to me that there are both similarities and differences between the funds; and I am not sure there is much to be gained by entering into a detailed comparison here. The structure of the financial provisions is indeed different. At the same time, the way in which the institutions have implemented the ETI in other sectors may shed light by showing alternative ways of reconciling the objectives of transparency, on the one hand, and the rights to privacy and to the protection of personal data, on the other hand.
111. The fisheries sector is one in which payments are made directly to beneficiaries but the objective of transparency is achieved in a different, perhaps more targeted, way. Thus, Article 51 of Council Regulation (EC) No 1198/2006 (57) makes arrangements for publication such that there is a clear link between the grant, the project and the individual. It is therefore relatively easy to see how such information could inform a public debate on financing in the fisheries sector. Such a link between, on the one hand, the beneficiary and the amount of aid that he receives and, on the other hand, the purpose for which the aid is granted is lacking in the arrangements for publication under examination in the present case.
112. At the end of the day, however, it seems to me that the publication arrangements introduced in respect of each fund in order to implement the ETI must be evaluated if and as necessary in the light of the particular circumstances, requirements and objectives identified by the legislator. There is, I think, no single hard and fast rule as to what is, and what is not, acceptable.
113. To summarise the position thus far: the drafting of the recitals and the substantive provisions at issue is capable of supporting the conclusion that the interference, in the interests of transparency, with the rights to privacy and the protection of personal data might satisfy the proportionality test. However, in order to reach a concluded view as to whether the interference is indeed proportionate, it is necessary to examine the additional material put forward by the parties during the oral part of the procedure.
114. At the hearing, the various possible objectives were explored at greater length. Both institutions made general submissions about transparency as a fundamental right and its importance as a principle of democracy. The Council claimed that publication was not such as to permit conclusions to be drawn as to beneficiaries’ personal circumstances or income (a claim that was flatly contradicted both by counsel for the applicants and by Mr Volker Schecke, who addressed the Court in person in answer to a question from the Court). (58) Both institutions advanced general claims as to the importance of proper management of Community funds and the need for citizens to be able to participate in an (imprecisely defined) public debate (59) in an (unspecified) way. The Council emphasised that publication was not just about transparency: it was also about public control. If publication were to be restricted to the major beneficiaries under the EAGF and the EAFRD it would fail to inform and empower taxpayers in any given community who had an interest in the aid granted to their neighbours. That was also part of the public debate and it was therefore necessary to identify both major and minor recipients of aid, without distinction. The Commission demurred: the aim of the measures was not, it said, to enable people to satisfy their prurient curiosity about their neighbours’ financial position. Rather, it was to facilitate a public debate as to whether CAP aid should be modified, or perhaps provided in a different manner. For example, should such aid go to large companies or small local farmers? Should it be concentrated in disadvantaged areas?
115. The Commission was asked specifically whether publication of details of beneficiaries was intended, by making possible an enhanced level of vigilance on the part of the general public, to strengthen fraud prevention. It categorically refuted that suggestion, stating that existing anti-fraud measures were adequate. (60) The Council apparently disagreed with the Commission on this (rather important) point, arguing that publication was good because more fraud prevention would be a good thing. However, the Council did not – as I understand it – go so far as to claim that the detailed rules put in place by the Commission were intended primarily to fulfil that purpose.
116. So, was the objective to provide the general public with a greater level of knowledge and awareness about how CAP funds were being spent? Yes, indeed, said the institutions. But why, in that case, was it necessary to publish the name and address of every beneficiary, together with the amount received? Why not some form of data aggregation? Surely informing the public could sufficiently be achieved by grouping data together in pertinent categories, thus preserving the anonymity of individual beneficiaries? Well, said the Commission, that would be very burdensome administratively; and besides, part of the objective was to enhance the general public’s knowledge of who was getting what financial support. (61) I take that to be an (indirect) claim that the general public should know the precise details of beneficiaries. Whether the Commission meant ‘all beneficiaries’ or merely individuals like ‘the Austrian count’ (courteously not identified by name by the Commission’s agent at the hearing) who is, apparently, a major beneficiary of CAP funds was and remained unclear.
117. It thus became apparent that the institutions had rather different notions of the objectives of the contested legislative provisions. The Commission referred repeatedly to the ‘public debate’. It did not, however, define what that really meant. Nor did it explain why the personal details of literally millions of individuals needed to be published in disaggregated form on the internet in order to stimulate (or perhaps facilitate) that debate. The Council referred, in addition, to publication being justified in order to enhance public control over CAP expenditure as part of the fight against fraud – a position from which the Commission expressly dissociated itself.
118. In my view, this is not good enough. The Court has to assess the proportionality of the measures chosen by reference to the desired end to be attained. Once one tries to conduct that assessment here it is, in my view, impossible to uphold the validity of the legislation. The vague (if not actually contradictory) nature of the objectives that the institutions say they are pursuing does not permit the conclusion that the measures put in place satisfy the proportionality test. Rather, the discussion during the hearing (which was based on, and to a certain extent provoked by, the material advanced in the institutions’ written observations) made it clear that, depending on precisely which objective one identified as the primary objective, a different type of data publication might well be both less intrusive and more appropriate.
119. Let me illustrate the point. If the concern is to see who precisely gets very significant levels of funding from the CAP budget, publication should indeed provide the names of beneficiaries (whether companies or individuals) and show the amount(s) each receives, but such publication should be limited to those receiving more than a specified amount in any calendar year. If, on the other hand, the aim behind publication is to enable the public to participate, on an informed basis, in the debate as to whether the greater part of CAP support should go to one category of farmer rather than another, or whether a particular type of agricultural activity should get more assistance than another, data should be published in an aggregated form that enables the ordinary member of the public to grasp where the money is currently being spent. The material presented by the institutions, both in writing and orally at the hearing, signally failed to explain why the specific form of publication chosen – raw data that is not grouped or aggregated or indeed linked to any obvious characteristic of the CAP that the public might want to debate – does the job that it is meant to do in a proportionate way.
120. So as to avoid any misunderstanding, let me be very clear on two points. First, I am not prescribing to the Commission the precise form in which it should publish data. I am not a statistician; and that is the legislature’s business, not the Court’s. What I am saying is that, where the legislature has chosen a particular form of publication that is intrusive of a right, the responsible institution must be able to explain to the Court why that particular form of publication is necessary, appropriate and proportionate to the specific aim that is pursued. In my view, such an explanation has not emerged in the present case. I do not regard administrative convenience (however desirable that assuredly will be from the perspective of any institution) as an adequate justification by itself.
121. Second, I am (likewise) not prescribing what the precise aim of publication should be. That, again, is the legislature’s business (and, of course, the legislature enjoys a reasonable margin of discretion in what it chooses). Different (multiple) aims may indeed require different (multiple) forms of publication. But each form must be capable of justification as proportionate in the light of the precise, clearly identified, aim that it is intended to serve.
Conclusion on proportionality and proposed answers to questions 1 and 2a
122. The reasoning contained in the recitals to Council Regulation No 1437/2007 (which introduced the relevant amendments into Council Regulation No 1290/2005) and Commission Regulation No 259/2008 is adequate but couched in general terms. Whether Articles 42, point 8b and 44a of Council Regulation No 1290/2005 and Commission Regulation No 259/2008 are to be considered a proportionate interference with the right to privacy and the right to protection of personal data therefore turns on whether there is a plausible explanation for why the institutions chose a particular form of publication, at a particular level of detail (wholly disaggregated raw data) and why that form of publication was necessary, appropriate and proportionate to achieve the precise aim that publication was intended to serve.
123. In my view, the institutions have not given the Court an explanation that, upon examination, stands up to scrutiny. I do not think that the Court should rubber stamp legislation that refers quite correctly to general principles that are eminently desirable, but – when more specific explanation is sought in order to enable the Court to perform its judicial function – reveals the level of confusion and inter-institutional incoherence that has emerged in this case.
– Council Regulation No 1290/2005
124. Regarding Council Regulation No 1290/2005, examination of question 1 does not reveal any element such as to affect the validity of Article 42, point 8b. However, Article 44a is invalid in so far as it requires automatic publication of the names, the municipality of residence and where available the postal code of all beneficiaries under the EAGF and the EAFRD together with the sums received by each beneficiary from those funds.
– Commission Regulation No 259/2008
125. The validity of Commission Regulation No 259/2008 depends entirely on whether the detailed rules that it lays down to implement Council Regulation No 1290/2005 as amended by Council Regulation No 1437/2007 are proportionate. It will be evident from what I have said above that, in my view, they are not. The answer to question 2a should therefore be, that Commission Regulation No 259/2008 is invalid.
126. Article 1(2) of Commission Regulation No 259/2008 merits a brief separate discussion. That provision states: ‘Member States may publish more detailed information than provided for in paragraph 1’ (which sets out the minimum publication requirements under the regulation). I have already concluded that Commission Regulation No 259/2008 should be declared invalid in its entirety. But, even if I had not reached that conclusion, I would have invited the Court to strike down Article 1(2) of that regulation.
127. The Commission explained that, when drafting the Regulation, its objective was to set the publication requirements at a level that respected the varying traditions within the Member States as to the disclosure of personal data. I make the preliminary point that the Member States are, in any event, required to respect the rights guaranteed by Article 8 ECHR and by Convention No 108. They do not require permission from the Commission to publish more extensive information, to the extent that that does not conflict with the requirements of those provisions. Conversely, such permission could not render lawful what would otherwise be unlawful.
128. More fundamentally, to the extent that Article 1(2) authorises, or purports to authorise, more extensive publication, I cannot see how the resulting interference viewed from the perspective of European Union law, would be ‘in accordance with the law’. In order for an interference to be ‘in accordance with the law’ under Article 8(2) ECHR, the provision authorising the interference must be sufficiently clear in its terms to give citizens an adequate indication of the circumstances in which public authorities may interfere with private life. (62) In my view, it is impossible to predict, on the basis of the text of Article 1(2), what additional form(s) publication might take, the additional detail(s) that might be disclosed or the reason(s) that might be given to justify such additional publication. That is unacceptable; and – without more – renders the measure unlawful.
Questions 3, 4 and 5
129. I shall now turn to the detailed questions concerning Directive 95/46, as outlined in point 62 above.
130. Questions 3, 4 and 5 concern Section IX of Directive 95/46, Articles 18 to 21 of which deal with notification. In essence, the data controller (the person who determines the purposes and means of processing personal data, as defined in Article 2(d)) is required to notify the relevant national supervisory authority before carrying out specific data processing acts. The purpose of notification is to enhance transparency for data subjects. Currently each Member State has its own rules for notifications and exceptions from the obligation to notify. (63)
Question 3
131. By question 3 the referring court asks whether, if there is a failure to observe the notification procedure in Article 18 of Directive 95/46, that renders any subsequent processing of personal data unlawful.
132. Article 18(1) of Directive 95/46 provides that the supervisory authority must be notified before processing operations are carried out. However, Article 18(2) permits Member States to simplify or provide exemption from that notification requirement in two sets of circumstances: where they lay down detailed rules for processing certain categories of data which are ‘unlikely … to affect adversely the rights and freedoms of data subjects’ (Article 18(2), first indent) and where the data controller, in compliance with national law, appoints a personal data protection official responsible for ensuring that the rights and freedoms of data subjects are unlikely to be adversely affected by processing operations (Article 18(2), second indent). The data protection official is responsible ‘for ensuring in an independent manner the internal application of the national provisions taken pursuant to [Directive 95/46]’ and ‘for keeping the register of processing operations carried out by the [data] controller’, (64) thus permitting ex post verification of such operations.
133. Article 19(1)(a) to (f) prescribes the minimum contents for a notification under Article 18. The elements identified in Article 19(1)(a) to (e) inclusive must subsequently be recorded in the register of processing operations in order to comply with Article 21(2). (65) Member States are at liberty to specify additional material that must be contained in a notification and/or in the register. (66)
134. The Land Hessen has chosen to implement Article 18(2), second indent, with the result that prior notification of processing operations to the supervisory authority under Article 18(1) is not required. In such circumstances (and contrary to the view expressed by the referring court), there is no requirement that a ‘complete and effective notification’ be submitted. The control over the legality of processing is an ex post control effected through the register, not an ex ante control.
135. The information that the national court has identified as missing from the register is information that goes beyond the minimum requirements in Article 19(1)(a) to (e). The national court notes, for example, that the register is ‘incomplete’ because details of the time-limits within which data must be deleted have been omitted. Does that render the subsequent data processing unlawful as a matter of EU law?
136. In my view, it does not.
137. Member States may legitimately simplify the notification procedure or exempt certain operations from notification provided that they comply with the conditions laid down in Article 18(2). To comply with this part of Directive 95/46, it suffices that any data protection official appointed under Article 18(2), second intent, discharges his overriding obligation ‘to ensure that the rights and freedoms of the data subjects are unlikely to be adversely affected by the processing operations’ and that the register of processing operations contains the minimum elements required by Article 21(2). The consequences (if any) of failing to include in such a register additional items of information that go beyond those minimum elements are a matter for national law, not EU law.
Question 4
138. The referring court asks whether Article 20 of Directive 95/46 must be interpreted as meaning that publication of information about beneficiaries under the EAGF and the EAFRD may be effected only following the prior check required by national law. It considers that both German federal law and the law of the Land Hessen require such a prior check to be made. In the absence of such a prior check, the publication would not be fair and lawful within the meaning of Article 6(1)(a) of Directive 95/46.
139. The Land Hessen submits that a prior check in accordance with Article 20 of Directive 95/46 is not a pre-condition for publication of beneficiaries’ details under Commission Regulation No 259/2008. It contends, first, that Article 20(1) does not subject all processing operations, automatically, to a prior check. Second, it submits that publication under Commission Regulation No 259/2008 does not give rise to any ‘specific risks for data subjects’. Third, it points out that in any event a measure of preliminary assessment is conducted prior to publication as a result of the combined operation of Article 44a of Council Regulation 1290/2005 and Commission Regulation 259/2008.
140. Directive 95/46 does not itself specify which processing operations (67) should be considered to constitute a specific risk to the rights and freedoms of data subjects. It places that responsibility on the Member States. Thus, Article 20(1) provides that ‘Member States shall determine the processing operations likely to present specific risks to the rights and freedoms of data subjects’ and ‘shall check that these processing operations are examined prior to the start thereof’ (emphasis added). It is only such processing operations that must be made subject to a prior check, in accordance with the procedure laid down in Article 20(2).
141. However, the preamble to Directive 95/46 provides helpful guidance as to what Article 20 is meant to cover. Thus, recital 53 identifies certain processing operations as being ‘likely to pose specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, such as that of excluding individuals from a right, benefit or a contract, or by virtue of the specific use of new technologies …’. Recital 54 states that ‘with regard to all the processing undertaken in society, the amount posing such specific risks should be very limited …’.
142. Article 20(1) applies prima facie to all processing operations. It then requires Member States to determine which limited subset of such operations are ‘processing operations likely to present specific risks to the rights and freedoms of data subjects’. In respect of that limited subset (but not in respect of any other processing operations), there is a mandatory requirement to ensure that a check takes place before processing may be carried out. The nature of that prior check is specified in Article 20(2).
143. However, it is for the Member State to specify, under national law, which are the categories of processing operation to which the Article 20(2) procedure applies. It follows that it is for the national court – and the national court alone – to determine whether national law does, or does not, classify the publication of the details of beneficiaries under the EAGF and the EAFRD as such a processing operation.
144. It therefore seems to me that there is no need for the Court to answer question 4.
Question 5
145. The national court asks whether Article 20 of Directive 95/46 must be interpreted as meaning that no effective prior check has been performed if it was effected on the basis of a register established under Article 18(2), second indent, which lacked an item of prescribed information.
146. I confess to finding this question impenetrable. The entries in the register referred to in Article 18(2) and Article 21 of Directive 95/46 are entries of processing operations notified in accordance with Article 18. However, in respect of processing operations that a Member State has exempted from notification under Article 18(2), second indent, the entry in the register (according to the text of that provision) refers to a ‘register of processing operations carried out by the controller’ – that is, where the entries are made after the data processing has taken place. In contrast, the prior check referred to in Article 20 is just that: a check that is conducted before the processing operation commences. It follows that the authority conducting the prior check could not be influenced in any way by the entry in the register relating to that operation, which will not yet have been compiled. Nor is the processing operation likely to be ‘publicised’ (in accordance with Article 21(1)) until its details have been recorded in the register.
147. Of course, the position might be otherwise if national law, in identifying a particular category of processing operation as meriting a prior check in accordance with Article 20, had (a) specified that such a category could not be exempted from notification under Article 18(2), (b) specified that the appropriate entry in the register should be compiled forthwith on receipt of the notification, (c) specified that certain material (as a minimum, the information listed in Article 19(1)(a) to (f), but potentially more detailed information as well) should be recorded in the register and (d) specified that the competent authority should rely on the contents of the register when deciding whether or not to authorise the processing operation. But this is mere speculation. Nothing in the order for reference suggests that national law has so stipulated in respect of publication of the details of beneficiaries under the EAGF and the EARDF.
148. In the absence of adequate material to explain the pertinence of the question – indeed, of any clear factor linking the question asked to the circumstances of the case and the matters that the national court has to decide – I suggest that the Court should decline to answer the question.
Question 2b and Question 6
149. Question 2b and question 6 raise issues as to the rights of users (68) (that is, persons who seek access to data on beneficiaries published under Commission Regulation No 259/2008) rather than data subjects, such as the applicants.
150. In my view, both questions are inadmissible.
Question 2b
151. This question is curiously phrased. In it, the referring court asks whether Commission Regulation No 259/2008 is valid only because Directive 2006/24 is invalid. So far as I understand it, the national court’s reasoning is as follows. Users who wish to access information published under Commission Regulation No 259/2008 can do so only via the internet. That means that they cannot do so anonymously, because their details will be retained for up to two years pursuant to Directive 2006/24. If, however, that provision within Directive 2006/24 were unlawful, the result would be to render Directive 2006/24 invalid. The corollary of that invalidity would, however, be that Commission Regulation No 259/2008 could be considered to be valid after all.
152. Challenges to the validity of EU legislation are conventionally brought on ‘grounds of lack of competence, (69) infringement of an essential procedural requirement, (70) infringement of [the EC] Treaty or of any rule of law relating to its application, or misuse of powers’. (71) It is novel for the Court to be asked whether the validity of one EU measure (here, Commission Regulation 259/2008) is contingent on the (in)validity of another EU measure in a distantly related field (here, Directive 2006/24).
153. In my view, question 2b is purely hypothetical. It is therefore inadmissible for two reasons.
154. First, the question has no relevance to the issue that arises in the main proceedings, which is whether the national court should make an order in terms that would prohibit the Land Hessen from publicising the applicants’ details as beneficiaries under the EAGF and/or the EAFRD.
155. The Court’s settled case-law confirms that it does not criticise a national court’s reason for making a reference. A preliminary reference may be rejected only where it is obvious that the interpretation of EU law or the examination of the validity of a rule of EU law sought by a national court bears no relation to the actual nature of the case or to the subject-matter of the main action. (72) This is, however, such a case.
156. Viewed at their most extensive, the national proceedings concern the rights to privacy and data protection of beneficiaries under the EAGF and EAFRD: specifically, whether the personal details of such beneficiaries should or should not be disclosed on a database accessible via the internet. The national proceedings are therefore concerned with the beneficiaries as data subjects, but have nothing to do with their rights as users or, indeed, the rights of any other parties.
157. The validity of Directive 2006/24 therefore has no bearing on the matters that the national court must determine in order to decide the main action.
158. Second, the context in which the question is put to the Court is not one in which, on the facts, data relating to a party to the national proceedings have been retained under Directive 2006/24 (still less provided to the competent authorities under Article 4 thereof). It would be entirely inappropriate for the Court to embark on an examination of the validity of Directive 2006/24 in the abstract. Nor is there any need to examine the validity of Directive 2006/24 in order to arrive at a conclusion as to the validity of Commission Regulation No 259/2008.
159. I therefore consider question 2b to be inadmissible.
Question 6
160. The referring court asks whether Article 7 of Directive 95/46 – in particular, Article 7(e) (73) – must be interpreted as precluding the storage of the IP address of users who access websites containing the information published under Commission Regulation No 259/2008 without those users’ express consent.
161. Again, the question is somewhat convoluted. As I understand it, the referring court starts from the premiss that, if a user wishes to consult information published under Commission Regulation No 259/2008, he can do so only via the internet. That means that his personal data (the IP address) will be ‘processed’ within the meaning of Directive 95/46. The referring court then asks whether such processing is precluded under Article 7 of Directive 95/46 unless express consent has been given.
162. As I have already indicated, the main action concerns the disclosure of information about data subjects (the beneficiaries of the CAP funds). It has nothing to do with the rights of users (or even users as data subjects). The sixth question is therefore also inadmissible, for the reasons set out above.
Conclusion
163. Accordingly, I am of the opinion that, in answer to the questions referred by the Verwaltungsgericht Wiesbaden (Germany) the Court should rule as follows:
(1) Examination of question 1 does not reveal any element such as to affect the validity of Article 42, point 8b, of Council Regulation (EC) No 1290/2005 of 21 June 2005 on the financing of the common agricultural policy.
(2) Article 44a of Council Regulation No 1290/2005 is invalid in so far as it requires automatic publication of the names, municipality of residence and where available the postal code of all beneficiaries under the European Agricultural Guarantee Fund (the EAGF) and the European Agricultural Fund for Rural Development (the EAFRD) together with the sums received by each beneficiary from those funds.
(3) Commission Regulation (EC) No 259/2008 of 18 March 2005 laying down detailed rules for the application of Council Regulation (EC) No 1290/2005 as regards the publication of information on the beneficiaries of funds deriving from the EAGF and the EAFRD is invalid.
(4) Question 2b and question 6 are inadmissible.
(5) There is no need to reply to questions 3, 4 and 5.
1 – Original language: English.
2 – Signed in Rome on 4 November 1950.
3 – Like the ECHR, Convention No 108 is in force in all Member States.
4 – Proclaimed in Nice on 7 December 2000 (OJ 2000 C 364, p. 1). An updated version was approved by the European Parliament on 29 November 2007, after removal of the references to the ill-fated European Constitution (OJ 2007 C 303, p. 1): (‘the Charter’).
5 – Directive of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
6 – The controller is defined in Article 2(d) as the person or body who determines the purposes and means of processing personal data.
7 – One or more supervisory authorities are identified by the Member State and made responsible for monitoring the application of the directive within its territory. Their detailed duties and powers are set out in that article. In particular, each supervisory authority is responsible (under Article 28(3), second indent) for delivering opinions before processing operations are carried out under Article 20.
8 – Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or public communications networks and amending Directive 2002/58/EC (OJ 2006 L 105, p. 54).
9 – Article 2 of Directive 2006/24 states: […] ‘user’ means any legal entity or natural person using a publicity available electronic communications service, for private or business purposes, without necessarily having subscribed to that service. Article 2 of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37) provides the following definitions: […] (b) ‘traffic data’ means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof; (c) ‘location data’ means any data processed in an electronic communications network, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service.
10 – SEC (2005) 1300.
11 – See the Green Paper ‘European Transparency Initiative’, COM(2006) 194 final, p. 3.
12 – Council Regulation (EC Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities (OJ 2002 L 248, p. 1), as amended by Council Regulation (EC, Euratom) No 1995/2006 of 13 December 2006 (OJ 2006 L 390, p. 1) and Council Regulation (EC) No 1525/2007 of 17 December 2007 (OJ 2007 L 343, p. 9).
13 – See footnote 5.
14 – Regulation of the European Parliament and of the Council of 18 December 2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1).
15 – Regulation of 21 June 2005 on the financing of the common agricultural policy (OJ 2005 L 209, p. 1).
16 – I shall refer to the EAGF and the EAFRD in this Opinion as ‘the funds’.
17 – Detailed provisions are also set out in Articles 32 to 37, which deal with conformity assessment and monitoring by the Commission.
18 – Regulation of 11 November 1996 concerning on-the-spot checks and inspections carried out by the Commission in order to protect the European Communities’ financial interests against fraud and other irregularities (OJ 1996 L 292, p. 2). In general those principles are that information acquired under the Regulation shall be covered by professional secrecy and protected in the same way as similar information is protected under the legislation of the national State that received it and the corresponding provisions applicable to the EU institutions. In particular, the Commission must ensure that in the implementation of the Regulation its inspectors comply with Community and national provisions on the protection of personal data as laid down in Directive 95/46.
19 – Regulation of 26 November 2007 amending Regulation (EC) No 1290/2005 on the financing of the common agricultural policy (OJ 2007 L 322, p. 1).
20 – Opinion of 10 April 2007 (OJ 2007 C 134, p. 1).
21 – Regulation of 18 March 2008 laying down the detailed rules for the application of Council Regulation (EC) No 1290/2005 as regards the publication of information on the beneficiaries of funds deriving from the European Agricultural Guarantee Fund (EAGF) and the European Agricultural Fund for Rural Development (EAFRD) (OJ 2008 L 76, p. 28).
22 – The results of that consultation are not published on the European Data Protection Supervisor’s website.
23 – Regulation of 21 April 2004 laying down detailed rules for the implementation of cross-compliance, modulation and the integrated administration and control system provided for in Council Regulation (EC) No 1782/2003 establishing common rules for direct support schemes under the common agricultural policy and establishing certain support schemes for farmers (OJ 2004 L 141, p. 18).
24 – http://www.agrar-fischerei-zahlungen.de
25 – The Court’s case-law dates back to 1969: see for example, Case 29/69 Stauder [1969] ECR 419, paragraph 7, and Case 11/70 Internationale Handesgesellschaft [1970] ECR 1125, paragraph 4. More recently, see Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunkand Others (‘ÖRF’) [2003] ECR I‑4989, paragraphs 68 and 69, and Case C‑275/06 Promusicae [2008] ECR I‑271, paragraph 62.
26 – See Joined Cases C‑238/99 P, C‑244/99 P, C‑245/99 P, C‑247/99 P, C‑250/99 P to C‑252/99 P and C‑254/99 P Limburgse Vinyl Maatschappij and Others v Commission [2002] ECR I‑8375, paragraph 274, and Case C‑301/04 P Commission v SGLCarbon [2006] ECR I‑5915, paragraph 43. See further Case C‑73/07 Teitosuojavaltuutettu v Satakunnan MarkkinapörssiOy and Satamedia Oy [2008] ECR I‑9831, in particular the Opinion of Advocate General Kokott, point 37.
27 – In Case C‑84/95 Bosphorus [1996] ECR I‑3953, at point 53 of his Opinion, Advocate General Jacobs stated that ‘[r]espect for fundamental rights is … a condition of the lawfulness of Community acts …’.
28– Article 6(1) EU states that the EU is founded on the principles of liberty, democracy, respect for human rights and fundamental freedoms and the rule of law, principles which are common to the Member States.
29 – Case C‑353/99 P Hautala [2001] ECR I‑9565, paragraph 24 of the judgment and point 52 of Advocate General Léger’s Opinion.
30 – See point 23 above.
31 – Transparency is certainly considered by some commentators to fall within this category: see, for example, K. Lenaerts, ‘In the Union we trust: trust – enhancing principles of Community Law’, Common Market Law Review 2004, p. 317, and Craig and de Búrca, EU Law text, cases and materials (4th edition 2007), p. 567. However, the Court has not yet ruled definitively on this issue.
32 – See in particular, Case C‑58/94 Netherlands v Council [1996] ECR I‑2169, paragraph 35; Hautala, cited in footnote 29 above (where the Court was considering an appeal by the Council against the judgment of the Court of First Instance annulling the Council’s decision refusing access to a Council working group report on arms exports), paragraph 22, and Case C‑41/00 P Interporc [2003] ECR I‑2125, paragraphs 38 to 43.
33 – Cited in footnote 29 above, points 76 and 77.
34 – Cited in footnote 32 above.
35 – Commission Decision of 8 February 1994 on public access to Commission documents (OJ 1994 L 46, p. 58).
36 – Interporc, cited in footnote 32 above, paragraph 43; see also the Opinion of Advocate General Léger at point 80.
37 – The Charter was not binding at the time the principal action arose: see, by analogy, Case C‑540/03 Parliament v Council (family reunification) [2006] ECR I‑5769, at paragraph 38. Following the entry into force of the Treaty of Lisbon, with effect from 1 December 2009 the Charter has the force of primary law (Article 6(1) TEU).
38 – See Promusicae, cited in footnote 25 above, paragraph 63, and point 51 of the Opinion of Advocate General Kokott; see more recently the Opinion of Advocate General Ruiz‑Jarabo Colomer in Case C‑553/07 Rijkeboer [2009] ECR I‑0000, points 18 to 20. The link between privacy and data protection is also reflected in recitals 10 to 12, and Article 1(1) of, Directive 95/46. See also in this respect, the German Bundesverfassungsgericht (Federal Constitutional Court), judgment of 15 December 1983 (‘Volkszählungsurteil’, 1 BvR 209, 269, 362, 420, 440, 484/83, BVerfGE 65, 1), and more recently, judgment of 2 March 2010 1 BvR 256, 263, 586/08, available on www.bundesverfassungsgericht.de).
39 – See Niemietz v Germany, 16 December 1992, paragraphs 29 to 31, Series A No 251‑B.
40 – See Colas Est and others v France, No 37971/97, paragraph 41, ECHR 2002‑III and Peck v United Kingdom, No 44647/98, paragraph 57, ECHR 2003‑I. Within the Court’s own case-law, see Case C‑450/06 Varec [2008] ECR I‑581, paragraph 48.
41 – See Von Hannover v Germany, No 59320/00, paragraph 50, ECHR 2004‑VI, and the case-law cited there, and Karakó v Hungary, No 39311/05, paragraph 21, 28 April 2009.
42 – See S & Marper v United Kingdom [GC] Nos 30562/04 and 30566/04, paragraph 103, 4 December 2008.
43 – Set out in full at point 51 above.
44– Article 5 of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1) provides equivalent protection in respect of data processing carried out by the institutions.
45 – See the Court’s analysis in ÖRF, cited in footnote 25 above, following the established case-law of the Strasbourg court, the conditions are cumulative: see, for example, Amann v Switzerland [GC], No 27798/95, paragraph 80, ECHR 2000‑II. The exceptions in Article 8(2) of the ECHR are to be interpreted narrowly and the need for them in a given case must be convincingly established: see Funke v France, 25 February 1993, paragraph 55, Series A No 256‑A and the case-law cited there and Buck v Germany, No 41604/98, paragraph 37, ECHR [2005]‑IV.
46 – Cited in footnote 25 above and discussed at point 90 below.
47 – Case C‑73/07, cited in footnote 26 above.
48 – See above, point 83 and below, point 114.
49 – See points 126 to 128 below.
50 – See recitals 13 and 14 to Council Regulation No 1437/2007 and recital 2 to Commission Regulation No 259/2008. The Financial Regulation (whose validity has not been called into question) likewise emphasises the importance of transparency (recitals 3 and 12), makes provision for the Commission to ‘make available, in an appropriate manner, information on the beneficiaries of funds’ whilst respecting ‘the requirements of confidentiality, in particular the protection of personal data’ (Article 30(3)), and requires Member States to ‘ensure, by means of relevant sector-specific regulations and in conformity with Article 30(3), adequate annual ex-post publication of beneficiaries of funds deriving from the budget’ (Article 53b(2)(d)).
51– The interference must (of course) be specified with sufficient accuracy to be ‘in accordance with the law’ (see above) and also be proportionate if it is to be lawful.
52 – Article 202 is now replaced in substance by Article 16(1) TEU and by Articles 290 and 291 TFEU. Article 211 is now replaced in substance by Article 17(1) TEU.
53 – Case 25/70 Köster [1970] ECR 1161, paragraph 6; Case 23/75 Rey Soda [1975] ECR 1279, paragraph 11; and Case C‑240/90 Germany v Commission [1992] ECR I‑5383, paragraph 41.
54 – Case C‑310/04 Spain v Council [2006] ECR I‑17285, paragraph 97. See also Case C‑331/88 Fedesa and Others [1990] ECR I‑4023, paragraph 13; Joined Cases C‑133/93, C‑300/93 and C‑362/93 Crispoltoni and Others [1994] ECR I‑4863, paragraph 41; and Case C‑189/01 Jippes and Others [2001] ECR I‑5689, paragraph 81 and the case-law there cited.
55 – Article 253 EC, now Article 296 TFEU.
56 – See, to the same effect, the final sentence of recital 14 to Council Regulation No 1437/2007 and the opinion of the European Data Protection Supervisor of 10 April 2007 (OJ 2007 C 134, p. 1), referred to in that recital.
57 – Regulation of 27 July 2006 on the European Fisheries Fund (OJ 2006 L 223, p. 1).
58 – Mr Volker Schecke stressed the close link that will exist, in many cases, between the CAP subsidy and the total income obtained by a family farm with a known number of persons to support. He maintained, giving illustrations, that the intrusion into a beneficiary’s private life that might result from neighbours taking advantage of such publication was sometimes considerable.
59 – During the course of the hearing, examples were given of the possible public debate(s) that might take place: specifically, the journalistic debate in France about whether smaller or larger farmers were getting assistance (the Commission referred here to an article published in Le Monde on 30 March 2010), and the Greek Government mentioned its initiative to create a public debate before the planned re-structuring of the CAP in 2013. Examples do not, however, of themselves define a debate.
60 – Control mechanisms to counter fraud and to prevent irregularities are indeed provided for in Council Regulation No 1290/2005: see for example, Article 9 and Articles 30 to 37.
61 – It seems, from external evidence, that recognition of this objective followed a major initiative by investigative journalists in a number of Member States to try to ascertain whether some major beneficiaries of CAP funding were wealthy landowners or large agro-businesses rather than small farmers. See The Guardian Monday 22 January 2007, ‘So that’s where the 100 billion went’.
62 – See the judgment of the ECHR Court Malone v United Kingdom, 2 August 1984, Series A No 82, paragraphs 67 and 68.
63 – See the Vademecum on notification requirements, adopted by the Working Party established under Article 29 of Directive 95/46, which explains the basics of the notification system in each Member State.
64 – Article 21(2) requires Member States to provide that a register of processing operations notified in accordance with Article 18 be kept by the supervisory authority.
65 – The ‘general description allowing a preliminary assessment to be made of the appropriateness of the measures taken pursuant to Article 17 to ensure security of processing’ specified in Article 19(1)(f) is the only element that is not carried over into the register.
66 – See the opening part of Article 19(1) and Article 21(2), second sentence, respectively.
67 – Processing operations are defined in Article 2(b) of Directive 95/46 as ‘any operation or set of operations which is performed upon personal data … such as … disclosure by transmission, dissemination or otherwise making available …’.
68 – ‘Users’ are defined in Article 2 of Directive 2006/24: see footnote 9 above.
69 – See, for example, Case C‑376/98 Germany v Parliament and Council [2000] ECR I‑8419.
70 – See, for example, Case C‑378/00 Commission v Parliament and Council [2003] ECR I‑937, paragraph 34.
71 – Article 230 EC.
72 – Case 126/80 Salonia [1980] ECR 1563; Case C‑206/08 Eurawasser [2009] ECR I‑0000, paragraphs 33 and 34; and Case C‑314/08 Filipiak [2009] ECR I‑0000, paragraphs 40 to 42.
73 – Article 7(e) authorises ‘processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority’. Furthermore, the situations identified in Article 7(b) to (f) are all of equal weight, both to each other and to the situation identified in Article 7(a) (unambiguous consent given by the data subject). It is therefore rather difficult to conceive how Article 7(e) could preclude processing unless Article 7(a) is satisfied.