Conclusions
OPINION OF ADVOCATE GENERAL
TIZZANO
delivered on 14 November 2002 (1)
Case C-465/00
Rechnungshof
v
Österreichischer Rundfunk and Others
(Reference for a preliminary ruling from the Verfassungsgerichtshof)
and Joined Cases C-138/01 and C-139/01
Neukomm and Lauremann
v
Österreichischer Rundfunk
(Reference for a preliminary ruling from the Oberster Gerichtshof)
((Directive 95/46//EC – Scope))
1. By three separate orders, of 12 December 2000 and 14 and 28 February 2001, the Verfassungsgerichtshof and the Oberster Gerichtshof
(the Constitutional Court and the Supreme Court), Austria, have referred to the Court of Justice a number of questions for
a preliminary ruling on the interpretation of the provisions of Directive 95/46/EC on the protection of individuals with regard
to the processing of personal data and on the free movement of such data (hereinafter
Directive 95/46 or, simply,
the Directive)
(2)
and of the general principles of Community law regarding privacy. Briefly, the Austrian courts ask whether those provisions
and principles preclude national rules which require the collection of data on the income of certain employees of public entities
and companies to be included, naming the individuals concerned, in a report by a State body (Court of Auditors) intended to
be published.
Relevant provisions
The European Convention for the Protection of Human Rights and Fundamental Freedoms
2. In reconstructing the legal context relevant to the present cases, attention should be drawn first of all to Article 8 of
the European Convention on Human Rights and Fundamental Freedoms (hereinafter, the
ECHR), expressly invoked in certain questions, which provides:
1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with
the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being
of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of
the rights and freedoms of others
.
(3)
Directive 95/46
3. Of importance at the Community level is Directive 95/46, adopted on the basis of Article 100a of the EC Treaty (now Article 95 EC)
to encourage the free movement of personal data by the harmonisation of the laws, regulations and administrative provisions
of the Member States on the protection of individuals with regard to the processing of such data.
4. Underlying the Directive is the idea that
the difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard
to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory
of one Member State to that of another Member State [and that] this difference may therefore constitute an obstacle to the
pursuit of a number of economic activities at Community level, distort competition and impede authorities in the discharge
of their responsibilities under Community law (seventh recital). The Community legislature therefore considered that,
in order to remove the obstacles to flows of personal data, the level of protection of the rights and freedoms of individuals
with regard to the processing of such data must be equivalent in all Member States. To do that, it considered that a harmonising measure was necessary at Community level, since the objective of free movement
of personal data,
[was] vital to the internal market but [could not] be achieved by the Member States alone, especially in view of the scale
of the divergences [existing] between the relevant laws in the Member States and the need to coordinate the laws of the Member
States so as to ensure that the cross-border flow of personal data [was] regulated in a consistent manner ... in keeping with
the objective of the internal market as provided for in Article 7a of the Treaty (eighth recital). Following the adoption of a harmonising measure, however, given the equivalent protection resulting from
the approximation of national laws, the Member States [would] no longer be able to inhibit the free movement between them
of personal data on grounds relating to protection of the rights and freedoms of individuals, and in particular the right
to privacy (ninth recital).
5. That having been said, the Community legislature considered that, in establishing a level of protection
equivalent in all Member States, it was not possible to leave out of consideration the requirement that
the fundamental rights of individuals should be safeguarded (third recital). To that effect, it considered that
the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably
the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights
and Fundamental Freedoms and in the general principles of Community law. On that basis, it considered that
the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary,
seek to ensure a high level of protection in the Community (10th recital).
6. Article 1 of the Directive should therefore be read in the light of those assumptions and reasons; it defines the object of
the Directive as follows:
1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and
in particular their right to privacy with respect to the processing of personal data.
2. Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected
with the protection afforded under paragraph 1
.
7. As regards the principal definitions given in Article 2 of the Directive, it should be noted for present purposes that:
(a) personal data means
any information relating to an identified or identifiable natural person (
data subject); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification
number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) processing of personal data (
processing) means
any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection,
recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination
or otherwise making available, alignment or combination, blocking, erasure or destruction;
(c) controller means the
natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes
and means of the processing of personal data.
8. Article 3 defines the scope of the Directive, stating in paragraph 1 that its provisions
shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by
automatic means of personal data which form part of a filing system or are intended to form part of a filing system. Under paragraph 2, however, the scope of the Directive does not include the processing of personal data:
- ─
in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI
of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security
(including the economic well-being of the State when the processing operation relates to State security matters) and the activities
of the State in areas of criminal law;
- ─
or
by a natural person in the course of a purely personal or household activity.
9. For present purposes, certain provisions of Chapter II,
General Rules on the Lawfulness of the Processing of Personal Data (Articles 5 to 21), should also be noted. It should be pointed out in particular that, according to Article 6(1),
Member States shall provide that personal data must be:
(a) processed fairly and lawfully;
(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.
Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided
that Member States provide appropriate safeguards;
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
...
.
10. Article 7 identifies those cases where
personal data may be processed and provides, so far as we are concerned here, that processing is permitted where it is necessary
for compliance with a legal obligation to which the controller is subject or
for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
or in a third party to whom the data are disclosed.
11. It should also be noted that Article 13 authorises Member States to derogate from certain provisions of the Directive and,
in particular, from Article 6(1), where it is necessary to safeguard, among other things,
an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and
taxation matters [subparagraph (e)]; or
a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in specific cases, including one as described in subparagraph (e) [subparagraph (f)].
12. Lastly Article 22 should be noted, according to which
Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him
by the national law applicable to the processing in question.
The Austrian legislation
13. Paragraphs 126b, 126c, 127, 127a and 127b of the Bundesverfassungsgesetz (the Austrian Constitution; hereinafter
B VG) govern the powers of the Rechnungshof (the Austrian Court of Auditors), making the following subject to audit by it: the
Federation; the
Länder ; major communes and ─ where a reasoned request has been made by a government of a
Land ─ communes with fewer than 20 000 inhabitants; associations of communes; social security institutions; statutory bodies representing
professional interests; entities, funds and foundations managed by organs of the Federation or
Länder or by persons appointed for that purpose by organs of the Federation or
Länder ; and undertakings managed by the Federal Government, a
Land or commune or (alone or jointly with other legal entities subject to audit by the Rechnungshof) controlled through a shareholding
of not less than 50%. Furthermore, Paragraph 31a(1) of the Rundfunkgesetz (Law on broadcasting)
(4)
provides that Österreichische Rundfunk (Austrian National Radio; hereinafter:
ÖRF) also is subject to audit by the Rechnungshof.
14. Pursuant to Paragraph 8 of the Bundesverfassungsgesetz über die Begrenzung von Bezügen öffentlicher Funktionäre (Federal constitutional
law on the limitation of income of public officials; hereinafter
BezBegrBVG):
(5)
1. Entities subject to audit by the Rechnungshof must, within the first three months of each second calendar year, inform the
Rechnungshof of the salaries or pensions of persons which in at least one of the two previous calendar years, were greater
in that year than 14 times 80% of the monthly reference amount under Section 1 [meaning, for 2000, salaries or pensions 14
times greater than EUR 5 887.87]. The entities must also inform the Rechnungshof of salaries and pensions of persons who receive
an additional sum or pension from an entity subject to audit by the Rechnungshof. ... If entities do not comply with that
duty of disclosure, the Rechnungshof shall inspect the relevant documents and draw up its report on the basis thereof....
3. The Rechnungshof shall summarise that information ─ for each year ─ in a report. The report shall include all persons whose
total yearly salary and pensions from entities subject to audit by the Rechnungshof exceed the amount referred to in subsection
(1) above. The report shall be sent to the Nationalrat, the Bundestrat and the Landtage of the
Länder
.
15. From the preparatory documents for the law we see that the above report must show the name of the employee and the amount
of salary received; the report must then be made available to the public so as to ensure
full information for Austrian citizens on salaries received in public entities.
(6)
Facts and Proceedings
Facts and questions referred in Case C-465/00
16. The origin of Case C-465/00 lies in a dispute over the interpretation of Paragraph 8 of the BezBegrBVG between the Rechnungshof
and a number of bodies subject to its audit: certain regional or local authorities (
Land Niederösterreich, the City of Wiener Neustadt and the Commune of Kaltenleutgeben); Österreichische Nationalbank (the Austrian
central bank); a statutory body representing its members' interests (Wirtschaftskammer Steiermark); a public undertaking responsible
for the performances of tasks relating to the public interest (ÖRF) and a public undertaking managed according to economic
criteria
in competition with other national and foreign undertakings not subject to audit by the Rechnungshof (Austrian Airlines Österreichische LuftverkehrsAktiengesellschaft; hereinafter simply
Austrian Airlines).
17. More specifically, at the time of the audit relating to pensions and salaries paid in the years 1998 to 1999, those entities
merely provided the data on the incomes of their employees in anonymous form, with the exception of Wirtschaftskammer Steiermark,
which provided no data. When the Rechnungshof subsequently attempted to conduct a direct examination of the accounting documents,
those entities did not agree to the audit or made it subject to the condition (which the Rechnungshof considered unacceptable)
of rendering the data anonymous.
18. The Rechnungshof then applied to the Verfassungsgerichtshof, seeking confirmation of its power to conduct the examination
on the premises of the entities cited, for the purpose of drawing up the report on incomes specified in Paragraph 8 of the
BezBegrBVG. The defendant entities opposed the claim of the Rechnungshof, seeking a declaration that it is unlawful for the
report to show the names and functions of the persons concerned. Among other points, they claimed that disclosure of the names
and functions of the employees concerned was contrary to the provisions of the Directive and to the Community principles on
the protection of privacy and would create an unlawful impediment to the free movement of workers.
19. Seised of those applications, the Verfassungsgerichtshof considered it necessary to refer to the Court of Justice, pursuant
to Article 234 EC, the following questions:
1. Are the provisions of Community law, in particular those on data protection, to be interpreted as precluding national rules
which require a State body to collect and pass on data on income for the purpose of publishing the names and income of employees
of:
(a) a regional or local authority,
(b) a broadcasting organisation governed by public law,
(c) a national central bank,
(d) a statutory body representing its members' interests,
(e) a partially State-controlled undertaking?
2. If the answer to at least part of the above question is in the affirmative:Are the provisions precluding the abovementioned national rules directly applicable, in the sense that persons obliged to
disclose data may rely on them in order to prevent the application of conflicting national rules?
Facts and questions submitted in Cases C-138/01 and C-139/01
20. Ms Christa Neukomm and Mr Josef Lauermann are employees of ÖRF, which pays them a salary above the threshold set in Paragraph 8
of the BezBegrBVG. Under that provision, ÖRF is therefore required to give the Rechnungshof the data relating to their pay.
21. Ms Neukomm and Mr Lauermann both applied, separately, to the Arbeits- und Sozialgericht, Vienna, and to the Landesgericht,
St Pölten, seeking emergency measures to prevent ÖRF from passing on their data with their names. In support of their applications,
so far as concerns this case, the applicants alleged breach of their fundamental rights (in particular the right to respect
for private life as laid down in Article 8 of the ECHR) and of the provisions of the Directive. In the course of the two proceedings,
the ÖRF ─ although asking for the applications to be dimissed, ─ declared that it took the same standpoint as its own employees.
22. The two courts dismissed the applicants' claims by decisions that were subsequently upheld on appeal by the Oberlandesgericht,
Vienna. The applicants then appealed in cassation against the decisions at second instance to the Oberster Gerichtshof which
─ referring to the questions already put by the Verfassungsgerichtshof ─ decided to stay proceedings and refer to the Court
the following questions for a preliminary ruling:
1. Are the provisions of Community law, in particular those on data protection [Articles 1, 2, 6, 7 and 22 of Directive 95/46/EC
in conjunction with Article 6 (ex Article F) of the EU Treaty and with Article 8 of the European Convention for the Protection
of Human Rights], to be interpreted as precluding national rules which require a broadcasting organisation governed by public
law acting as an entity recognised by law to pass on data concerning the incomes of its employees and a State body to collect
and to pass on such data for the purpose of publishing the names and incomes of those employees.
2. If the Court of Justice of the European Communities answers the question put in the affirmative: are the provisions precluding
national rules as described above directly applicable, in the sense that the entity obliged to disclose data may rely on them
in order to prevent the application of conflicting national rules and therefore may not rely upon an obligation imposed by
national law as regards the employees concerned by the disclosure
.
Proceedings before the Court
23. In Case C-465/00, observations were submitted by the parties to the main proceedings, the Commission and the Governments of
Austria, Denmark, Finland, Italy, the Netherlands, Sweden and the United Kingdom whilst, in Cases C-138/01 and C-139/01, joined
by order of 17 May 2001, observations were submitted by the Commission and the Governments of Austria, Italy, the Netherlands,
Sweden and the United Kingdom.
24. A joint hearing in the three cases was held on 18 June 2002, in which the Commune of Kaltenleutgeben, the
Land Niederösterreich, the Österreichische Nationalbank, Austrian Airlines, ÖRF, the Commission and the Governments of Austria,
Finland, Italy, the Netherlands and Sweden participated.
Legal analysis
25. As has been seen, essentially the same questions are put to the Court in all three cases: a question on the compatibility
of rules such as those of Austria with the provisions of the Directive and with the general principles of Community law regarding
privacy; and a second, alternative, question on the direct effect of the Community provisions with which, in the analysis
of the first question, those rules may be found to be incompatible.
26. In answering the questions set out in the three orders for reference (which I shall of course discuss together), it is therefore
necessary to consider, first, whether national rules such as those at issue are compatible with the provisions of the Directive
and, second, whether such rules infringe the general principles of Community law regarding privacy. Then, if it is found that
those rules do infringe the provisions of the Directive or the principles concerning privacy, it will then be necessary to
consider also whether those provisions and principles are directly applicable.
Compatibility of national rules such as those at issue with the provisions of the Directive
Introduction
27. As I have said, the national courts ask, first, whether rules such as those at issue require personal-data processing in breach
of the requirements of the Directive. Of course, the answer to that question assumes that the Directive applies to the case
in point, and this is by no means to be taken for granted and indeed has been openly disputed by several parties.
28. I note here that, under Article 3, the provisions of the Directive do not apply to all
processing of personal data; for present purposes, in particular, they do not apply to processing
in the course of an activity which falls outside the scope of Community law (first indent of Article 3(2)). Assuming that the various operations prescribed in Paragraph 8 of the BezBegrBVG (collection
of data on salaries and pensions, provision of data to the Rechnungshof, inclusion in the report, submission of the report
to the competent bodies and publication of the report) entail
processing of personal data, almost all of the participants in the proceedings before the Court, and the referring courts themselves, have therefore
dwelt at length on the question whether or not the activities for which that processing has been effected do fall
outside the scope of Community law, within the meaning of the first indent of Article 3(2). Only if they do fall within its scope can it be held that such processing
is covered by the provisions of the Directive.
29. It therefore seems clear to me that for present purposes the question whether the Directive is applicable must be considered
as an inescapable preliminary point, since, if it were not, there would clearly be no reason to consider the compatibility
of rules such as those at issue. First of all, therefore, I shall examine that point.
Considerations put forward by the national courts and the arguments of the parties
30. Although they recognise that the point is disputed, the national courts appear inclined to hold that the Directive also covers
processing of the type in point, since it effected full harmonisation in this area in order to ensure full
protect[ion of] the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect
to the processing of personal data (Article 1(1)). They further observe that the Rechnungshof's audit activities, for which the processing now under consideration
is effected, may fall within the scope of Community law because it may have an effect on freedom of movement for workers (Article 39 EC),
particularly since such an audit is required even of a public company which is in competition with (national and foreign)
operators which are not required to make public the data on their employees' salaries.
31. Naturally, the entities which are defendants before the Verfassunggerichtshof think likewise. Essentially, albeit with minor
variations, they consider that the Rechnungshof's audit activities fall within the scope of Community law because, as they
affect the working conditions of the employees of the entities concerned, they touch on aspects governed in part by Community
provisions on social matters
(7)
and also, primarily, because they may impair the free movement of workers, in breach of Article 39 EC.
32. With particular reference to the latter aspect, it is maintained that, on the one hand, audit by the Rechnungshof adversely
affects the possibility for the employees of the entities concerned to seek work in another Member State (presumably because
publication of their salaries would restrict their negotiating power
vis-à-vis foreign companies) and, on the other hand, it discourages citizens of other Member States wishing to move to Austria to work
for the entities subject to audit by the Rechnungshof.
33. More specifically, then, the Austrian Central Bank claims that the impairment of free movement of workers is aggravated by
the fact that the audit also relates to the branches of the entities concerned located in other Member States, whilst Austrian
Airlines claims that that impairment is of particular importance to it, since it is in competition with airlines of other
Member States that are not subject to any similar audit.
34. Lastly, ÖRF contends that the Rechnungshof's activities fall within the scope of Community law (and hence that the processing
concerned is subject to the provisions of the Directive) because Paragraph 8 of the BezBegrBVG must be regarded as a provision
implementing the Directive.
35. On the other hand, the observations submitted by the Rechnungshof and by Austria and Italy are to the opposite effect. For
them, the audit activity prescribed by Paragraph 8 of the BezBegrBVG is the expression of an autonomous power of the State,
clearly intended for the pursuit of objectives of general interest in the field of public accounts and thus does not fall
within any aspect of Community law. These parties add that the Directive, adopted under Article 100a of the EC Treaty, essentially
pursues the objective of realisation of the internal market, in relation to which protection of the right to privacy is merely
incidental. They further contend that that audit is not such as to hinder the free movement of workers, because it does not
prevent the employees of the entities concerned from moving to work in another Member State, or workers from other Member
States from becoming employees of those entities.
36. For its part, the Commission has not taken a clear and unambiguous position on this point, for the written observations which
it has submitted in the three cases are not entirely the same and subsequently, at the hearing, it modified the conclusions
reached previously.
37. In its written observations submitted in Case C-465/00, the Commission maintained that the Directive does not apply to processing
such as that at issue, because it is effected in the course of an audit of accounts which falls outside the scope of Community
law. That audit activity is concerned with national budgetary policy which, apart from certain restrictions laid down in
the context of the economic and monetary union, is not regulated at Community level and therefore remains essentially within
the competence of the Member States. Furthermore, the Commission continues, there is no question either of the activity concerned
falling within the scope of Community law as a result of its possible effect on the functioning of the internal market. This
is so, in particular, because (i) the report on incomes and publication thereof involves no cross-frontier processing of data;
(ii) the assumed competitive disadvantage for undertakings subject to audit by the Rechnungshof is in any case negligible;
and (iii) the influence of the legislation at issue on the choices made by workers is too indirect and uncertain for it actually
to represent a barrier to their movement within the Community.
38. In its written observations submitted later in Joined Cases C-138/01 and C-139/01, the Commission essentially repeats the
view that the Rechnungshof's activities fall outside the scope of Community law. However, it added that the processing effected
by the entities subject to audit by the Rechnungshof by means of collecting the data on their employees' salaries is actually
carried out in the course of two separate activities: the first is the payment of those salaries and falls within the scope
of Community law because it may have an effect on free movement of workers and on the principle of equal pay for male and
female workers (Article 141 EC); the other is the passing on of the data concerned to the Rechnungshof for writing of the
report referred to in Paragraph 8 of the BezBegrBVG ─ and that activity, as maintained earlier, falls outside the scope of
Community law. Since the former activity is
obscured by the accounts-audit activity (for which subsequent processing is effected by the Rechnungshof), the Commission submitted
that the collection of data on incomes likewise is not processing covered by the provisions of the Directive.
39. However, at the hearing, the Commission modified that submission and took the view that the Directive is applicable. In particular,
it began by noting that Paragraph 8 of the BezBegrBVG essentially prescribes five processes: collection of data by the entities
subject to audit; passing those data to the Rechnungshof; the Rechnungshof's inclusion of them in its report; the sending
of the report to the Parliament and publication of the report. The four latter processes are not covered by the provisions
of the Directive, in the sense contemplated in Article 3(2), as they are carried out in the course of an accounting-audit
activity outside the scope of Community law. However, departing from what it had maintained earlier, at the hearing the Commission
observed that the first of the processes, where the entities subject to audit collect the data, does fall under the provisions
of the Directive. The reason for that is that it is carried out (only) for the payment of salaries and, thus, for an activity
which falls within the scope of Community law, firstly because it may have an effect on the free movement of workers and,
secondly, because it is relevant to the implementation of various Community provisions on social matters (in particular Article 141
EC). But if such data are re-used also for the accounting-audit activity, they would then be
further processed within the meaning of Article 6(1)(b) of the Directive and the lawfulness of that processing must be considered in the light
of the derogations set out in Article 13.
Assessment
40. Turning now to an assessment of the various submissions, I would first of all agree with the Commission that Paragraph 8 of
the BezBegrBVG essentially prescribes five forms of processing: collection of data on salaries and pensions by the entities
concerned; passing those data to the Rechnungshof; the Rechnungshof's inclusion of these in its report; the sending of the
report to the Parliament and the other competent bodies and publication of the report. However, I do not agree with the Commission's
contention in its second set of written observations, and at the hearing, as regards the first of those forms of processing
(collection of data by the entities subject to audit by the Rechnungshof); that is to say, I do not believe that the entities
concerned effect this form of processing for the payment of salaries to their employees or, as a result, for an activity which,
in the Commission's view, falls within
the scope of Community law for the purposes of Article 3(2) of the Directive ─ unlike the activity for which the four other processes are intended.
41. It seems to me that Paragraph 8 of the BezBegrBVG does impose on the entities subject to Rechnungshof audit a processing which
is
different and additional to that which they normally carry out in the management of their accounts, for the purpose of paying salaries to their employees:
the first of the forms of processing required in that provision in effect involves the selection and extrapolation, from all
the data to be found in those entities' accounts, of the data relating to the salaries and pensions
of persons which in at least one of the two previous calendar years were greater in that year than 14 times 80% of the monthly
reference amount, taking account also of any other salaries and pensions received from other entities subject to audit by the Rechnungshof.
This is therefore a special processing of the data held by those entities and assuredly it must not be confused with other
forms of processing which those entities must normally carry out in managing their accounts and in paying salaries to all
employees. And that is because, unlike those forms of processing, this is a form of processing for a particular purpose, specifically
and exclusively intended to permit the accounting-audit activity prescribed in Paragraph 8.
42. That having been made clear, in order to establish whether the five forms of processing required by Paragraph 8 of the BezBegrBVG
are covered by the provisions of the Directive, it is now necessary to inquire whether the Rechnungshof's audit activity for
which they are intended falls within
the scope of Community law within the meaning of Article 3(2) of the Directive.
43. I believe that that question must be answered in the negative. The Rechnungshof undertakes this activity for the purpose
of ensuring
full information for Austrian citizens on salaries received in public entities and so to encourage proper management of public resources. It is therefore, as the Rechnungshof itself, the Commission and
the Austrian and Italian Governments have observed, a public-audit activity prescribed and regulated by the Austrian authorities
(and in fact in a constitutional law) on the basis of a choice of a policy and institutional nature made by them autonomously
and not intended to give effect to a Community obligation. Since it is not the subject of any specific Community legislation,
that activity can only fall within the competence of the Member States.
44. Nor do I think that this conclusion is affected by the opposing arguments raised in an attempt to bring the activity of the
Rechnungshof within the scope of Community law. To that end, as we have seen, particular emphasis has been placed on the alleged
relevance of that activity for certain provisions of the Treaty and of secondary law, but I do not think that any of the hypotheses
invoked are well founded.
45. First of all, apart from making a general reference, no-one has really been able to explain what relevance that activity can
have from the standpoint of Article 141 EC. Given that the activity relates without distinction to the data on workers of
either sex, it is, specifically, not possible to see in what way the audit by the Rechnungshof might affect application of
the principle of equal pay enshrined in that provision. Nor can I understand what relationship there can be between the audit
and the other Community provisions in the social field referred to by some of the participants in these proceedings, that
is to say, with Articles 136 EC and 137 EC on social policy, Directive 76/207 on the implementation of the principle of equal
treatment for men and women as regards access to employment, vocational training and promotion, and working conditions,
(8)
and with Regulation No 1408/71 on the application of social security schemes to employed persons and their families moving
within the Community.
(9)
Furthermore, those reference are made without any explanation and, in any event, try as I may, I am unable to perceive the
link with the Rechnungshof's audit activity.
46. Next, I find that the attempt to bring that activity within the scope of Community law by invoking its possible effect on
the freedom of movement for workers, guaranteed by Article 39 EC, is strained and in any event not convincing. I would observe,
as a preliminary point, that the orders for reference reveal no cross-border elements which might justify applying that article to
the cases in the main proceedings except, at most, on a hypothetical basis: but that is in conflict with the case-law of the
Court according to which
[a] purely hypothetical prospect of employment in another Member State does not establish a sufficient connection with Community
law to justify the application of Article 48 of the Treaty [now Article 39 EC].
(10)
47. But even leaving that point aside, I believe that the rules at issue here also cannot properly be described as an obstacle
to freedom of movement for workers. Given that they relate equally to national and to foreign workers, it seems to me that
any possible influence on workers' decisions that they may have is too uncertain and indirect for it really to constitute
an obstacle to workers' movement for the purposes of Article 39 EC. In that connection, I would recall that the case-law
of the Court, while accepting that
[p]rovisions which, even if they are applicable without distinction, preclude or deter a national of a Member State from leaving
his country of origin in order to exercise his right to freedom of movement ... constitute an obstacle to that freedom, has made it clear, however, that,
in order to be capable of constituting such an obstacle, [such provisions] must affect access of workers to the labour market.
(11)
Accordingly, as observed in particular by the Austrian Government, even if audit by the Rechnungshof may perhaps rank among
the factors taken into consideration by some workers in making their professional decisions, it clearly does not affect either
access by workers from other Member States in Austria to employment with the entities concerned nor access by the employees
of those entities to the employment market in the other Member States.
48. Lastly, equally unfounded, it seems to me, and not very clear either, is the argument of the ÖRF to the effect that the Rechnungshof's
audit activity falls within the scope of Community law because Paragraph 8 of the BezBegrBVG must be characterised as a provision
implementing the Directive. In reality, that provision does not lay down rules of a general nature on processing of personal
data, for the purpose of transposing the provisions of the Directive; it only requires specific forms of processing which
are strictly necessary for the carrying out of the audit activity of the Rechnungshof. If one is not to engage in a circular
argument and in any case contradict the underlying objective of Article 3(2), one cannot regard as a provision transposing
the Directive any national provision whatever which requires the processing of personal data and then, from that premiss,
infer that every form of processing prescribed by a national provision is covered by the provisions of the Directive because,
by definition, it is carried out in the course of an activity that falls within
the scope of Community law.
49. All of the considerations set out above lead me therefore to consider that the forms of data processing of the type prescribed
in Paragraph 8 of the BezBegrBVG are not covered by the provisions of the Directive, because they are effected in the course
of a public activity of audit of accounts which falls outside the scope of Community law within the meaning of Article 3(2)
of the Directive.
50. Nor, moreover, do I believe that it can be objected here, as the national courts appear to do, that the Directive must also
be applied in similar cases because it is intended to guarantee
[protection of] the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect
to the processing of personal data (Article 1(1)).
51. As I have observed before, in my Opinion in Case C-101/01,
Lindqvist , the Directive was adopted on the basis of Article 100a of the Treaty in order to encourage the free movement of personal
data by the harmonisation of the laws, regulations and administrative provisions of the Member States on the protection of
natural persons with regard to the processing of such data. In particular, the Community legislature sought to establish a
level of protection
equivalent in all Member States, in order to remove the obstacles to flows of personal data deriving from the difference in levels of protection of the rights
and freedoms of individuals, notably the right to privacy, ... afforded in the Member States (seventh and eighth recitals).
The intention here was that, following adoption of the harmonisation directive,
given the equivalent protection resulting from the approximation of national laws, the Member States [would] no longer be
able to inhibit the free movement between them of personal data on grounds relating to protection of the rights and freedoms
of individuals, and in particular the right to privacy (ninth recital).
52. It is indeed true that, in determining that level of protection
equivalent in all Member States, the legislature took account of the need to safeguard
the fundamental rights of individuals (second and third recitals), with the aim of ensuring a
high level of protection (tenth recital). But the context and the purpose of all this was still the attainment of the principal objective
of the Directive, that is the intention of encouraging the free movement of personal data, since that was considered to be
vital to the internal market (eighth recital).
53. The safeguarding of fundamental rights constitutes therefore an important value and a requirement taken into account by the
Community legislature in delineating the harmonised system needed for the establishment and functioning of the internal market,
but it is not an
independent objective of the Directive. If it were, it would have to be accepted that the Directive is intended to protect individuals
with respect to the processing of personal data even quite apart from the objective of encouraging the free movement of such
data, with the incongruous result that even forms of processing carried out in the course of activities entirely unrelated
to the establishment and functioning of the internal market would also be brought within its scope.
54. If, furthermore, over and above the purpose of encouraging the free movement of personal data within the internal market,
one also attached to the Directive the additional, independent objective of guaranteeing the protection of fundamental rights
(in particular the right to privacy), there would be a danger of compromising the validity of the Directive itself, because,
in such a case, its legal basis would clearly be inappropriate. Article 100a could not be invoked as a basis for measures
going beyond the specific purposes stated in that provision, that is to say, for measures not justified by the objective of
encouraging
the establishment and functioning of the internal market.
55. On that point, I would note that recently, in its judgment annulling Directive 98/43/EC
(12)
as having no legal basis, the Court had occasion to explain that
the measures referred to in Article 100a(1) of the Treaty are intended to improve the conditions for the establishment and
functioning of the internal market. To construe that article as meaning that it vests in the Community legislature a general
power to regulate the internal market would not only be contrary to the express wording of the provisions cited above but
would also be incompatible with the principle embodied in Article 3b of the EC Treaty (now Article 5 EC) that the powers of
the Community are limited to those specifically conferred on it.
(13)
And, with specific reference to the protection of fundamental rights, I would note that, in Opinion 2/94, which followed
the adoption of the Directive, the Court expressly stated that
no provision of the Treaty [gave] the Community institutions, in general terms, the power of legislating on human rights.
(14)
56. In the light of all the foregoing considerations, I therefore consider that forms of processing of personal data prescribed
in legislation such as that at issue are not covered by the provisions of the Directive, since they are carried out
in the course of an activity which falls outside the scope of Community law within the meaning of Article 3(2) of the Directive. Consequently, such legislation cannot be held to be incompatible with
the provisions of the Directive.
Compatibility of national legislation such as that at issue with the general principles of Community law regarding privacy
57. Now that it has been shown that the Directive is not applicable in the present cases, it still remains to be considered whether
legislation such as that at issue is compatible with the general principles of Community law regarding privacy, among which
should be mentioned specifically the right to respect for private life as laid down in Article 8 of the ECHR,
(15)
expressly referred to in the orders for reference.
58. On this point, I must observe that where
national legislation falls within the field of application of Community law the Court, in a reference for a preliminary ruling,
must give the national court all the guidance as to interpretation necessary to enable it to assess the compatibility of that
legislation with the fundamental rights ... whose observance the Court ensures. However, the Court has no such jurisdiction
with regard to national legislation lying outside the scope of Community law.
(16)
59. Since, as I have said, I consider that the audit activity prescribed by the national legislation at issue falls outside the
scope of Community law, I therefore believe that the Court does not have jurisdiction to rule whether that legislation is
compatible with the general principles of Community law on privacy.
The questions on the direct applicability of the provisions of the Directive and of the general principles of Community law
on privacy
60. Having regard to the conclusions which I have reached in the foregoing paragraphs, I consider that there is no need to discuss
the questions on direct applicability of the provisions of the Directive and of the general principles of Community law on
privacy.
Conclusion
In the light of the considerations set out above, I therefore propose that the answer to the questions referred by the Verfassungsgerichtshof
and the Oberster Gerichtshof should be that forms of processing of personal data prescribed by legislation such as that at
issue are not covered by the provisions of the Directive, since they are carried out
in the course of an activity which falls outside the scope of Community law within the meaning of Article 3(2) of the Directive. The Court does not have jurisdiction to rule on whether that legislation
is compatible with the general principles of Community law on privacy.
- 1 –
- Original language: Italian.
- 2 –
- Directive of the European Parliament and of the Council of 24 October 1995 (OJ 1995 L 281, p. 31).
- 3 –
- This provision is repeated by Article 7 of the Charter of Fundamental Rights of the European Union, which provides that
[e]veryone has the right to respect for his or her private and family life, home and communications. Referring specifically to the protection of personal data, Article 8 of the Charter then states:
1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some
other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him
or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority
.
- 4 –
- BGBl. 379/1984 (Wv) idF BGBl. I 49/2000.
- 5 –
- BGBl. I 64/1997.
- 6 –
- Draft Law and Report from Parliamentary Commission, 453/A and 687 BlgNR, 20. GP.
- 7 –
- In this connection, reference was made in particular to Articles 136 EC, 137 EC and 141 EC, to Council Directive 76/207/EEC
of 9 February 1976 on the implementation of the principle of equal treatment for men and women as regards access to employment,
vocational training and promotion, and working conditions (OJ 1976 L 39, p. 40) and Regulation (EEC) No 1408/71 of the Council
of 14 June 1971 on the application of social security schemes to employed persons and their families moving within the Community
(OJ, English Special Edition 1971 (II), p. 416 ).
- 8 –
- Council Directive 76/207, cited in footnote 7.
- 9 –
- Council Regulation No 1408/71, cited at footnote 7.
- 10 –
- Judgment in Case 180/83
Moser [1984] ECR 2539, paragraph 18. On this, see also the judgments in Case 175/78
Saunders [1979] ECR 1129; in Case C-332/90
Steen [1992] ECR I-341; and in Joined Cases C-64/96 and C-65/96
Uecker and Jacquet [1997] ECR I-3171.
- 11 –
- Judgment in Case C-190/98
Graf [2000] ECR I-493, paragraph 23.
- 12 –
- Directive 98/43/EC of the European Parliament and of the Council of 6 July 1998 on the approximation of the laws, regulations
and administrative provisions of the Member States relating to the advertising and sponsorship of tobacco products (OJ 1998
L 213, p. 9).
- 13 –
- Judgment in Case C-376/98
Germany v
Parliament and Council [2000] ECR I-8419, paragraph 83.
- 14 –
- Opinion 2/94 [1996] ECR I-1759, paragraph 27.
- 15 –
- As we know,
according to settled case-law, fundamental rights form an integral part of the general principles of law, whose observance
the Court ensures. For that purpose, the Court draws inspiration from the constitutional traditions common to the Member States
and from the guidelines supplied by international treaties for the protection of human rights on which the Member States have
collaborated or to which they are signatories. The ECHR has special significance in that respect (judgment of the Court in Case C-274/99 P
Connolly v
Commission [2001] ECR I-1611, paragraph 37). To the same effect, see also Article 6(2) EU, according to which
[t]he Union shall respect fundamental rights, as guaranteed by the European Convention for the Protection of Human Rights
and Fundamental Freedoms signed in Rome on 4 November 1950 and as they result from the constitutional traditions common to
the Member States, as general principles of Community law.
- 16 –
- Judgment in Case C-299/95
Kremzow [1997] ECR I-2629, paragraph 15. To the same effect see also the judgment in Case C-159/90
Society for the Protection of Unborn Children Ireland v
Grogan and Others [1991] ECR I-4685, paragraph 31, that in Case C-309/96
Annibaldi [1997] ECR I-7493, paragraph 13, and the order in Case C-361/97
Nour [1998] ECR I-3101, paragraph 19.
