The Belgian Constitutional Court recently requested in a ruling (pdf) that the European Court of Justice provide an interpretation concerning the scope of the principle of transparency from the privacy law. The Belgian Court wanted to know in particular whether, and if so under which circumstances, it is permitted to incorporate exceptions to this principle of transparency in the law. The question is consequently relevant to all parties that covertly process personal data.
Brief summary of background to issue
The core of the issue revolves around the following (cf. the somewhat more extensive summary of the Centre of Expertise on European Law (ECER)). The Belgian Professional Association of Real Estate Agents (BIV) summoned persons or companies before the District Court in Charleroi and demanded that they discontinue certain actions. The source of the evidence for those (allegedly unlawful) acts comes wholly or partially from private investigators.
The Belgian court considered whether this evidence had been lawfully obtained, since the private investigators had not made it known to the data subjects that personal data had been collected from them – and this while one of the fundamental principles of the privacy law is precisely the principle of transparency.
Principle of transparency of privacy law
Pursuant to Articles 10 and 11 of the Privacy Directive, the person who is responsible for processing personal data must inform the data subject about his identity, the purposes of the processing and – to the extent necessary – any other information. The underlying idea is that this way the data subject (the one whose data are being processed) will always know, or at least can know, which parties dispose of his data and for which purposes those data are being processed. This principle of transparency from this European Directive has been implemented in the Netherlands (read: transposed into Dutch law) in Section 33 of the Dutch Personal Data Protection Act (Wbp) and Section 34 Wbp.
Restricted exceptions to this principle
That same European Privacy Directive stipulates that exceptions may be made to this principle of transparency only in a limited number of cases. Article 13(1) of the Directive states specifically that restrictions are only permitted when such measures are necessary to safeguard:
1. national security;
2. national defence;
3. public security;
4. the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;
5. an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters;
6. a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in the cases referred to under 3), 4) and 5);
7. the protection of the data subject or of the rights and freedoms of others.
Discretionary interpretation for Member States or not?
The Belgian legal code apparently stipulates that private investigators need not comply with the requirements of the principle of transparency. The underlying idea is likely that they cannot perform their work if they have to inform the person whom they are observing or on whom they are collecting information about what they are doing.
The question, however, is whether that special position for private investigators qualifies for the list of exceptions to the Privacy Directive referred to above. In that context the Belgian Constitutional Court considered the question as to the extent to which there was any room for interpretation for the Member States in the application of those exceptions. In the rulings Asociación Nacional de Establecimientos Financieros de Crédito and Federación de Comercio Electrónico y Marketing Directo of 24 November 2011, the ECJ specifically emphasised, among other aspects, that in principle a harmonised privacy law is in force within the entire European Union, that Member States were within their rights to establish regulations that were supplemental to, but not derogating from the Directive and that in the application of exceptions to the Directive a proper balance must always be safeguarded between the various fundamental rights protected by the legal structure of the European Union (as such including the privacy law).
Three questions posed by ECJ
But what does that context outlined by the European Court of Justice specifically mean? The Belgian Constitutional Court posed three questions in respect thereof that I will quote and then explain briefly.
1. Is Article 13(1)(g), in fine, of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data to be interpreted as meaning that it leaves the Member States free to choose whether or not to provide for an exception to the immediate obligation to inform set out in Article 11(1) if this is necessary in order to protect the rights and freedoms of others, or are the Member States subject to restrictions in this matter?
The background to this question is as follows. The Belgian Court considered whether the exception contained in the Directive entails that a Member State is permitted, at its own discretion, to incorporate exceptions to the privacy law into its own legislation, as long as that exception relates to “the protection of the data subject or of the rights and freedoms of others”?
If that were the case, major differences in the application of the European privacy law could start to arise between the various Member States, since, after all, every Member State could then add other exceptions to the law. The threshold for “the protection of the data subject or of the rights and freedoms of others” is, after all, quickly met (at least arguments in favour thereof can always be brought up).
Are such European differences desirable now that it has just been emphasised that an overarching privacy law should be in force in Europe? If, however, restrictions apply to the formulation of exceptions, which exceptions should that specifically be?
2. Do the professional activities of private investigators, governed by national law and exercised in the service of authorities authorised to report to the judicial authorities any infringement of the provisions protecting a professional title and organising a profession, come, depending on the circumstances, within the exception referred to in Article 13(1)(d) and (g), in fine, of Directive 95/46?
The first question is abstract in nature: within which contexts are Member States permitted to formulate exceptions to the privacy law? By contrast, the second question is very specific: does the exception that Belgium has made for private investigators meet the requirements of this context or not?
3. In the event of a negative reply to Question 2, is Article 13(1)(d) and (g), in fine, of the aforementioned Directive compatible with Article 6(3) of the Treaty on European Union, more specifically with the principle of equality and non-discrimination?
This question is perhaps the most interesting of the three. The Belgian issue ended up at the Constitutional Court after the District Court in Charleroi had posed questions to the Constitutional Court. The District Court in Charleroi considered whether it was in conflict with the principle of equality to demand of private investigators that they comply with the requirements of the principle of transparency, which would in fact make the practice of their profession impossible. This question is practically being repeated verbatim by the Constitutional Court in this question referred to the ECJ.
The question is interesting in that it can easily be flipped around. On the one hand, the question is indeed whether the principle of transparency from privacy law makes the practice of the profession of private investigators impossible; on the other hand, you have to wonder about the value of the privacy law if all kinds of exceptions are permitted to preserve certain professions and services. And is the size of the list of exceptions not in danger of getting out of control when the exception for private investigators is sanctioned by the European Court of Justice? It will likely come down to a balancing of interests. It will also be interesting to see how the ECJ will consider this.
Interesting, but not just for private investigators
Thus, the issue is not only of interest to private investigators. It will possibly become clear as well for other parties that covertly collect personal data (marketing agencies, recruiters, list brokers, etc.) whether the principle of transparency applies to them.
What is more, the formulation of questions 1 and 3 is so general in nature that it is quite possible that the ECJ will also respond in general terms regarding the application of exceptions to the privacy law (not only for exceptions to the obligation of transparency, but also for all principles of the privacy law). As such, it could suddenly become clear whether, and if so the extent to which, exceptions to the rules of the privacy law are permissible.
It could take no less than three years before the ECJ responds to the Belgian questions. We will keep you abreast of developments.