Court Summary Lawful Basis: The applicant did not consent to the transfer of her medical file by the Commission to the European Parliament. The transfer was not “necessary for the purposes of complying with the specific rights and obligations of the controller in the field of employment law,” in accordance with Article 10(2)(b). The Parliament’s obligation to control fitness for duty could have been achieved by less intrusive means. Nor does Article 10(3) justify the transfer. (¶¶ 137–139) ## Excerpt 137 Secondly, as regards Article 10 of Regulation No 45/2001, it must be pointed out that, pursuant to paragraph 1 of that article, the processing of medical data is, in principle, prohibited. Paragraph 2 of Article 10 provides inter alia that paragraph 1 does not apply if the data subject gives his or her consent to processing or if processing is necessary for the purposes of complying with the specific rights and obligations of the controller in the field of employment law. 138 On the one hand, it is common ground that the applicant did not give her consent to the transfer from the Commission to the Parliament of the medical data concerning her. 139 On the other hand, although it is true that the transfer at issue was carried out in order to enable the Parliament to ascertain the applicant’s physical fitness to perform her duties in that institution, an obligation which arises from Articles 82 and 83 of the CEOS and which can be regarded as an ‘obligation in the field of employment law’ within the meaning of Article 10(2)(b) of Regulation No 45/2001, it is not established that that transfer was ‘necessary’ for the purposes of complying with that obligation.