JUDGMENT OF THE CIVIL SERVICE TRIBUNAL

(Third Chamber)

16 September 2009

Case F-130/07

Fiorella Vinci

European Central Bank (ECB)

(Civil service – Staff of the ECB – Allegedly unlawful treatment of medical data – Medical examination imposed)

Application: brought under Article 36.2 of the Protocol on the Statute of the European System of Central Banks and of the European Central Bank, annexed to the EC Treaty, in which Ms Vinci seeks, first, a finding that the inclusion in her personal file of, first, the letter of 5 March 2007 sent to her by the Directorate-General for Human Resources, Budget and Organisation of the ECB and informing her that the medical adviser of the ECB had decided to refer her for a medical examination by an independent expert, scheduled for 8 March 2007, and then of the letter, also of 5 March 2007, sent by the Directorate General for Human Resources to the independent expert, Prof. A., requesting him to conduct a medical examination of the applicant, and lastly, of the certificate of 24 April 2007 from the ECB’s medical adviser finding that the applicant’s fitness for work was not reduced, was unlawful; second, a finding that the inclusion in her medical file of the report of the medical examination conducted on 8 March 2007 by Prof. A’s medical team was unlawful; third, a finding that the decision of the President of the ECB of 3 September 2007 rejecting her complaint of 2 August 2007 and refusing to remove the abovementioned documents from her personal and medical files in which they had been placed was unlawful; fourth, a finding that the letter of 5 March 2007 instructing her to attend a medical examination at Prof. A’s surgery on 8 March 2007 was unlawful; fifth, an order that the ECB pay her EUR 10 000 in compensation for the damage she claims to have suffered; and finally, sixth, an order that the ECB pay the costs.

Held: The action is dismissed. Each party is to bear its own costs.

Summary

1. Officials – Staff of the European Central Bank – Actions – Act adversely affecting an official – Definition – Refusal to delete personal data inserted by the administration in a personal file – Included

(European Parliament and Council Regulation No 45/2001, Art. 16; Conditions of Employment for Staff of the European Central Bank, Art. 42)

2. Officials – Staff of the European Central Bank – Actions – Obligation to submit a prior request despite the absence of a decision open to review – None

(Conditions of Employment for Staff of the European Central Bank, Arts 41 and 42; European Central Bank Staff Rules, Art. 8.1.0)

3. Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data by the Community institutions and bodies – Regulation No 45/2001 – Collection of medical data in order to monitor a situation of chronic absenteeism – Legality

(European Parliament and Council Regulation No 45/2001, Art. 4(1)(c))

4. Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data by the Community institutions and bodies – Regulation No 45/2001 – Collection of medical data in order to check whether absence on sick leave is justified – Scale of checks

(European Parliament and Council Regulation No 45/2001, Art. 10(2)(b); Conditions of Employment for Staff of the European Central Bank, Art. 31 ; European Central Bank Staff Rules, Art. 5.13.4)

5. Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data by the Community institutions and bodies – Regulation No 45/2001 – Processing of medical data – Legal basis

(European Parliament and Council Regulation No 45/2001, Art. 10(2)(b))

6. Approximation of laws – Protection of individuals with regard to the processing of personal data – Processing of such data by the Community institutions and bodies – Regulation No 45/2001 – Measure of a Community institution or body authorising the processing of staff members’ data – Respect for staff members’ privacy – Conditions

(European Parliament and Council Regulation No 45/2001)

1. A decision by the European Central Bank rejecting a request from a staff member seeking the deletion of personal data inserted by the administration in his personal file constitutes a measure which is open to review, as provided for in Article 42 of the Conditions of Employment for Staff of the European Central Bank. It is clear from Article 16 of Regulation No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data that a refusal to delete data will be unlawful if their processing and, in particular, their collection has been unlawful. Consequently, in considering the legality of a refusal to delete data, the court may examine the legality of all the processing of the data in question, particularly their recording and storage (i.e. insertion).

Furthermore, while Article 16 of Regulation No 45/2001 merely refers to the ‘unlawful’ nature of that processing by mentioning infringement of the provisions of Sections 1, 2 and 3 of Chapter II, it cannot be interpreted as confining the review of the legality of that processing solely to compliance with the provisions of the sections referred to. It is consequently for the court to assess whether a plea in law alleging unlawful processing is capable of compromising respect for privacy which the regulation is designed to guarantee with regard to the processing of personal data.

(see paras 46-48, 66-67)

2. Since the European Central Bank Staff Rules do not lay down a specific prior request procedure in circumstances where the Bank has not previously taken a decision open to review, an applicant cannot be criticised for having requested an administrative review without the Bank having first adopted a decision open to review.

Furthermore, since it necessarily presupposes that a prior decision exists, the two-month period which starts to run from the notification of the contested decision, as provided for in Article 8.1.0 of the Staff Rules, does not apply where it is in the course of an administrative review procedure that a decision arises which may subsequently be contested in a complaint and then in court proceedings.

(see paras 51, 53, 55)

3. Where a Community institution or body is authorised to undertake a potentially invasive collection of its staff’s medical data which could compromise their privacy, the use of that collection must not go beyond what is strictly necessary, taking account of the factual circumstances in which the institution or body exercises that power. It must therefore observe the principle of proportionality, particularly as prescribed concerning protection with regard to the processing of personal data by Article 4(1)(c) of Regulation No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data. It is also the duty of the Community judicature to monitor compliance with that principle.

The collection of medical data by a Community institution or body in the form of a full examination of a staff member’s general state of health for the purpose, first, of checking whether his repeated absences are justified and, second, of assessing whether it is necessary to adapt his working conditions on account of possible problems he might have in performing his duties as a result of his state of health cannot be regarded as excessive. In such circumstances the administration may legitimately consider that a full examination of the staff member’s state of health is necessary to end a situation of chronic absenteeism which it regards as unsatisfactory for both itself and the person concerned. Furthermore, in such a situation, an institution is entitled, if not obliged as a result of its duties towards its staff, to assess the need to adapt a staff member’s working conditions in the light of any problems he might have in performing his duties as a result of his state of health.

(see paras 87, 89, 90, 102, 139)

4. Although the provisions of Article 10(2)(b) of Regulation No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data require that the processing of data falling within the scope of those provisions must be necessary for the purposes of complying with the specific rights and obligations of the controller in the field of employment law, it does not follow from those provisions that any text providing for the processing of ‘special categories of data’ within the meaning of the title of Article 10 of the regulation must itself explicitly state the precise purpose of that processing and thus prove that it is necessary.

In any event, although Article 5.13.4 of the European Central Bank Staff Rules does not expressly identify which objectives might justify the use of the collection of medical data provided for, those objectives may be clearly inferred from the context in which that article is found. The purpose of all the provisions of Article 5.13 is to define the conditions for the application of Article 31 of the Conditions of Employment for Staff of the European Central Bank, which provides that ‘members of staff who provide evidence of incapacity to perform their duties because of illness or accident shall be granted paid sick leave’. The measures laid down in Article 5.13.4 are thus intended to be applied where a staff member is absent on sick leave in order to check whether that absence is justified, and the extent of those checks may legitimately vary depending, in particular, on the frequency of the absences.

(see paras 100-101, 138)

5. It does not follow from the provisions of Article 10(2)(b) of Regulation No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data that those provisions require that any processing of special categories of data as defined in paragraph 1 of that article must be authorised by a text directly provided for in the Treaties establishing the European Communities. Such an interpretation is not consistent with the wording of the text and in particular the use of the expression ‘on the basis thereof’ which, while it implies a link between the text providing for the processing of data and the Treaties, does not imply that that link must be direct.

Furthermore, while it is true that the French version of Article 10(2)(b) of Regulation No 45/2001 provides that processing of, in particular, medical data must be authorised by the Treaties or other ‘actes législatifs’ adopted on the basis of those Treaties, the expression ‘actes législatifs’ must be interpreted as referring to the concept of a ‘measure of legislative scope’, as is the case with other language versions which use a more general expression not referring to the necessity for processing to be authorised by a measure of a particular body.

(see paras 115-116, 118-119)

6. With regard to a measure of a Community institution or body authorising the processing of its staff’s personal data and falling within the scope of Regulation No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, the protection of staff members’ privacy is sufficiently guaranteed where the text authorising the processing of data is a measure of legislative scope which has been adequately advertised, and where the processing in question is foreseeable.

(see para. 122)