Acts of the institutions – Directives – Direct effect – Conditions (Art. 249(3) EC; European Parliament and Council Directive 95/46, Art. 7(f)) 1 The harmonisation of national laws sought by Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data is not limited to minimal harmonisation but amounts to harmonisation that is, in principle, complete. It is upon that view that the directive is intended to ensure free movement of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate. Consequently, it follows from that objective that Article 7 of the directive sets out an exhaustive, restrictive list of cases in which the processing of personal data may be regarded as being lawful. It follows that Member States cannot add new principles relating to the lawfulness of the processing of personal data to Article 7 of that directive or impose additional requirements that have the effect of altering the scope of one of the principles provided for in Article 7. That interpretation is not brought into question by the right of Member States under Article 5 of Directive 95/46 to specify the conditions under which the processing of personal data is lawful. Indeed, Member States may not, by virtue of their discretion under Article 5 of the directive, introduce principles relating to the lawfulness of the processing of personal data other than those listed in Article 7 of the directive, nor may they alter, by additional requirements, the extent of the principles provided for in Article 7. (see paras 29-30, 32-33, 35-36) 2 Article 7(f) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as precluding national rules which, in the absence of the data subject’s consent, and in order to allow such processing of that data subject’s personal data as is necessary to pursue a legitimate interest of the data controller or of the third party or parties to whom those data are disclosed, require, in addition to respect for the fundamental rights and freedoms of the data subject, that those data should also appear in public sources, thereby excluding, in a categorical, generalised way, any processing of data not appearing in such sources. On the one hand, it follows from the objective of the directive of ensuring free movement of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate that Article 7 thereof sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful. Consequently, Member States may not add new principles relating to the lawfulness of the processing of personal data or impose additional requirements that have the effect of amending the scope of one of the principles provided for in Article 7. Nor, under Article 5 of the directive, may Member States introduce principles relating to the lawfulness of the processing of personal data other than those listed in Article 7, or alter, by additional requirements, the scope of the principles provided for in Article 7. On the other hand, in order to carry out the necessary balancing of the opposing rights and interests, provided for in Article 7(f) of the directive, Member States may establish guidelines. They may take into consideration too the fact that the seriousness of the infringement of the data subject’s fundamental rights resulting from that processing can vary depending on whether or not the data in question already appear in public sources. In the latter case, the infringement will be more serious. However, it is no longer a mere clarification, but an additional requirement precluded by Article 7(f) of the directive if national rules exclude the possibility of processing certain categories of personal data by definitively prescribing, for those categories, the result of the balancing of the opposing rights and interests, without allowing a different result by virtue of the particular circumstances of an individual case. (see paras 29-30, 32, 36, 44-49, operative part 1) 3 Directive 95/46, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, includes rules having a degree of flexibility and, in many instances, leaves to the Member States the task of deciding the details or choosing between options. A distinction, consequently, must be made between national measures that provide for additional requirements amending the scope of a principle referred to in Article 7 of the directive, on the one hand, and national measures which provide for a mere clarification of one of those principles, on the other hand. The first type of national measure is precluded. It is only in the context of the second type of national measure that Member States enjoy some latitude, pursuant to Article 5 of the directive. (see para. 35) 4 Article 7(f) Directive 95/46, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, sets out two cumulative conditions that must be fulfilled in order for the processing of personal data to be lawful, namely: first, the processing of the personal data must be necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed and, secondly, such interests must not be overridden by the fundamental rights and freedoms of the data subject. The second of those conditions necessitates a balancing of the opposing rights and interests concerned which depends, in principle, on the individual circumstances of the particular case in question and in the context of which the person or the institution which carries out the balancing must take account of the significance of the data subject’s rights arising from Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. (see paras 38, 40) 5 The right to respect for private life with regard to the processing of personal data, recognised by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, concerns any information relating to an identified or identifiable individual. However, it follows from Articles 8(2) and 52(1) of the Charter that, under certain conditions, limitations may be imposed on that right. (see para. 42) 6 Whenever the provisions of a directive appear, so far as their subject-matter is concerned, to be unconditional and sufficiently precise, they may be relied on before the national courts by individuals against the State where the latter has failed to implement that directive in domestic law by the end of the period prescribed or where it has failed to implement that directive correctly. That is the case with Article 7(f) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. While that directive confers on the Member States a greater or lesser discretion in the implementation of some of its provisions, Article 7(f) states an unconditional obligation. (see paras 51-52, 55, operative part 2) JUDGMENT OF THE COURT (Third Chamber) 24 November 2011 (*) (Processing of personal data – Directive 95/46/EC – Article 7(f) – Direct effect) In Joined Cases C‑468/10 and C‑469/10, REFERENCES for a preliminary ruling under Article 267 TFEU from the Tribunal Supremo (Spain), made by decisions of 15 July 2010, received at the Court on 28 September 2010, in the proceedings Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) (C‑468/10), Federación de Comercio Electrónico y Marketing Directo (FECEMD) (C‑469/10) v Administración del Estado, intervening parties: Unión General de Trabajadores (UGT) (C‑468/10 and C‑469/10), Telefónica de España SAU (C‑468/10), France Telecom España SA (C‑468/10 and C‑469/10), Telefónica Móviles de España SAU (C‑469/10), Vodafone España SA (C‑469/10), Asociación de Usuarios de la Comunicación (C‑469/10), THE COURT (Third Chamber), composed of K. Lenaerts (Rapporteur), President of the Chamber, R. Silva de Lapuerta, E. Juhász, T. von Danwitz and D. Šváby, Judges, Advocate General: P. Mengozzi, Registrar: M. Ferreira, Principal Administrator, having regard to the written procedure and further to the hearing on 15 September 2011, after considering the observations submitted on behalf of: – Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF), by C. Alonso Martínez and A. Creus Carreras, abogados, – Federación de Comercio Electrónico y Marketing Directo (FECEMD), by R. García del Poyo Vizcaya and M.Á. Serrano Pérez, abogados, – the Spanish Government, by M. Muñoz Pérez, acting as Agent, – the European Commission, by I. Martínez del Peral and B. Martenczuk, acting as Agents, having decided, after hearing the Advocate General, to proceed to judgment without an Opinion, gives the following Judgment 1 These references for a preliminary ruling concern the interpretation of Article 7(f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31). 2 The references have been made in two sets of proceedings between, on the one hand, Asociación Nacional de Establecimientos Financieros de Crédito (National Association of Credit Institutions) (‘ASNEF’), in the first case, and Federación de Comercio Electrónico y Marketing Directo (Federation of Electronic Commerce and Direct Marketing) (‘FECEMD’), in the second case, and, on the other, the Administración del Estado. Legal context European Union (‘EU’) law Directive 95/46 3 Recitals 7, 8 and 10 in the preamble to Directive 95/46 read as follows: ‘(7) … the difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory of one Member State to that of another Member State; … this difference may therefore constitute an obstacle to the pursuit of a number of economic activities at Community level, distort competition and impede authorities in the discharge of their responsibilities under Community law; … this difference in levels of protection is due to the existence of a wide variety of national laws, regulations and administrative provisions; (8) …, in order to remove the obstacles to flows of personal data, the level of protection of the rights and freedoms of individuals with regard to the processing of such data must be equivalent in all Member States; … this objective is vital to the internal market but cannot be achieved by the Member States alone, especially in view of the scale of the divergences which currently exist between the relevant laws in the Member States and the need to coordinate the laws of the Member States so as to ensure that the cross-border flow of personal data is regulated in a consistent manner that is in keeping with the objective of the internal market …; … Community action to approximate those laws is therefore needed; … (10) … the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms [signed in Rome on 4 November 1950 (‘the ECHR’)] and in the general principles of Community law; …, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community’. 4 Article 1 of Directive 95/46, entitled ‘Object of the Directive’, is drafted in the following terms: ‘1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data. 2 Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection afforded under paragraph 1.’ 5 Article 5 of Directive 95/46 is worded as follows: ‘Member States shall, within the limits of the provisions of this Chapter, determine more precisely the conditions under which the processing of personal data is lawful.’ 6 Article 7 of Directive 95/46 states: ‘Member States shall provide that personal data may be processed only if: (a) the data subject has unambiguously given his consent; or … (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection under Article 1(1).’