C-92/09 and C-93/09 - Volker und Markus Schecke and Eifert (Joined Cases)

Facts — In 2005, Council Regulation 1290/05 created two agricultural funds, namely: the European Agricultural Guarantee Fund (EAGF) and the European Agricultural Fund for Rural Development (EAFRD). This Regulation required that the names of the beneficiaries of the funds, their place of establishment/residence, the postal code of this place and the annual amounts received by each of them were published on the Bundesanstalt’s website. The site was provided with a search tool. An agricultural undertaking, in the legal form of a partnership, and a full-time farmer applied to receive funds. Both of them asked the Wiesbaden Administrative Court to order the the competent local authority, Land Hessen (the controller), to refrain from, or to be prohibited from, transmitting or publishing those data for the purposes of the general publication of information on the financial amounts granted. The controller maintained that the obligation to publish arose from the legal text of Regulations n. 1290/2005 and n. 259/2008 (rules for the publication of information on the beneficiaries of the funds), but undertook not to publish amounts received by beneficiaries until a final decision was rendered.

In turn, the Administrative Court believed that the obligation to publish constituted an unjustified interference with the fundamental right to the protection of personal data. It considered that this obligation did not improve the prevention of irregularities, since extensive control mechanisms for that purpose were already in place. In those circumstances, the Administrative Court referred to the CJEU for preliminary rulings on the validity os such provisions. Holding — The CJEU recalled that, since the right to data protection is not absolute, it can be limited when the requirements set out in Article 52(1) CFR are met. In the case at hand, it acknowledged that such interference with Article 7 CFR and Article 8 CFR was provided for by law and met an objective of general interest, namely, enhancing the transparency on public funds. However, the CJEU found that the publication of the names of the beneficiaries and the exact amounts received constituted a disproportionate measure.

The CJEU stated that the EU institutions failed to carry out a balancing exercise between the public interest in transparency and the rights to privacy and data protection. It held that this exercise leads to the conclusion that there are others measures capable of effectively increasing transparency, while interfering less with the privacy of individuals. For instance, instead of a general publication affecting all beneficiaries, the Court suggested that a distinction could be drawn based on relevant criteria such as the periods during which those persons had received the aid, the frequency of the aid or its amount and nature. The CJEU also stated that “it is of no relevance in this respect that the data published concerns activities of a professional nature [...]. The European Court of Human Rights has held on this point, with reference to the interpretation of Article 8 Convention 108, that the term ‘private life’ must not be interpreted restrictively and that there is no reason of principle to justify excluding activities of a professional [...] nature from the notion of private life”.

Moreover, the CJEU noted that “legal persons can claim the protection of Article 7 CFR and Article 8 CFR in relation to such identification only in so far as the official title of the legal person identifies one or more natural persons. [...T]he right to respect for private life with regard to the processing of personal data, recognised by Article 7 CFR and Article 8 CFR, concerns any information relating to an identified or identifiable individual [...]”. However, in the case at stake, it recognized that requiring national authorities to examine whether the data of each beneficiary legal person identifies any associated natural persons before publishing the data, would impose an unreasonable administrative burden on those authorities. Therefore, the CJEU found it necessary to declare invalid certain provisions of Council Regulation n. 1290/2005 and to declare Regulation n. 259/2008 invalid in its entirety.

Holding — The CJEU recalled that, since the right to data protection is not absolute, it can be limited when the requirements set out in Article 52(1) CFR are met. In the case at hand, it acknowledged that such interference with Article 7 CFR and Article 8 CFR was provided for by law and met an objective of general interest, namely, enhancing the transparency on public funds. However, the CJEU found that the publication of the names of the beneficiaries and the exact amounts received constituted a disproportionate measure. The CJEU stated that the EU institutions failed to carry out a balancing exercise between the public interest in transparency and the rights to privacy and data protection. It held that this exercise leads to the conclusion that there are others measures capable of effectively increasing transparency, while interfering less with the privacy of individuals. For instance, instead of a general publication affecting all beneficiaries, the Court suggested that a distinction could be drawn based on relevant criteria such as the periods during which those persons had received the aid, the frequency of the aid or its amount and nature.

The CJEU also stated that “it is of no relevance in this respect that the data published concerns activities of a professional nature [...]. The European Court of Human Rights has held on this point, with reference to the interpretation of Article 8 Convention 108, that the term ‘private life’ must not be interpreted restrictively and that there is no reason of principle to justify excluding activities of a professional [...] nature from the notion of private life”. Moreover, the CJEU noted that “legal persons can claim the protection of Article 7 CFR and Article 8 CFR in relation to such identification only in so far as the official title of the legal person identifies one or more natural persons. [...T]he right to respect for private life with regard to the processing of personal data, recognised by Article 7 CFR and Article 8 CFR, concerns any information relating to an identified or identifiable individual [...]”.