# SMARANDA BARA ET AL. V. PRESEDINTELE CASEI NATIONALE DE ASIGURARI DE SANATATE (CNAS) ET AL., 1.10.2015 (“BARA”) - Type: Case Law - Source: CJEU - Date: 2015-10-01 - Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0201 - Canonical: https://overview.legal/posts/5957 - Topics: Processing, Criminal Data, Personal Data, Fairness & Transparency, Recipient, Data Portability, Right to Rectification, Right of Access Procedures, Right of Access, Controllers ## Summary Right to be informed: National law that does not require the specific transfer involved in the case cannot constitute “prior information” under Article 10 of Directive 95/46 (information requirement where data is collected from the data subject), enabling the controller to dispense with his obligation to inform the data subject of the recipients of the data. (¶¶ 34–38). Article 11 (information requirement where data is not collected from data subject) requires that specified information be provi ## Sections (11) ### ¶11 (information requirement where data is not collected from data subject) requires that specified information be provided to the data subject, including the categories of data concerned and the existence of the rights of access and rectification. Thus, the data subjects should have been informed of the processing by recipient and of the categories of data concerned, but the controller did not so inform them. (¶¶ 42–45). ## Excerpt > Topics: Controllers, Personal Data, Recipient ### ¶34 It follows that the requirement of fair processing of personal data laid down in Article 6 of Directive 95/46 requires a public administrative body to inform the data subjects of the transfer of those data to another public administrative body for the purpose of their processing by the latter in its capacity as recipient of those data. > Topics: Processing, Recipient, Fairness & Transparency, Personal Data · Applies: gdpr-art-6-en ### ¶35 It is clear from the information provided by the referring court that the applicants in the main proceedings were not informed by the ANAF of the transfer to the CNAS of personal data relating to them. > Topics: Personal Data ### ¶36 The Romanian Government submits, however, that the ANAF is required, in particular under Article 315 of Law No 95/2006, to transfer to the regional health insurance funds the information necessary for the determination by the CNAS as to whether persons earning income through self-employment qualify as insured persons. > Topics: Insurance ### ¶37 It is true that Article 315 of Law No 95/2006 expressly provides that 'the data necessary to certify that the person concerned qualifies as an insured person are to be communicated free of charge to the health insurance funds by the authorities, public institutions or other institutions in accordance with a protocol'. However, it is clear from the explanations provided by the referring court that the data necessary for determining whether a person qualifies as an insured person, within the meaning of the abovementioned provision, do not include those relating to income, since the law also recognises persons without a taxable income as qualifying as insured. > Topics: Insurance ### ¶38 In those circumstances, Article 315 of Law No 95/2006 cannot constitute, within the meaning of Article 10 of Directive 95/46, prior information enabling the data controller to dispense with his obligation to inform the persons from whom data relating to their income are collected as to the recipients of those data. Therefore, it cannot be held that the transfer at issue was carried out in compliance with Article 10 of Directive 95/46. > Topics: Controllers, Processing, Data Controller · Applies: gdpr-art-10-en ### ¶42 As regards, in the second place, Article 11 of the directive, paragraph 1 of that article provides that a controller of data which were not obtained from the data subject must provide the latter with the information listed in subparagraphs (a) to (c). That information concerns the identity of the data controller, the purposes of the processing, and any further information necessary to ensure the fair processing of the data. Amongst that further information, Article 11(1)(c) of the directive refers expressly to ‘the categories of data concerned’ and ‘the existence of the right of access to and the right to rectify the data concerning him’. > Topics: Right of Access Procedures, Right of Access, Personal Data, Processing · Applies: gdpr-art-11-par-1-en, gdpr-art-11-en ### ¶43 It follows that, in accordance with Article 11(1)(b) and (c) of Directive 95/46, in the circumstances of the case in the main proceedings, the processing by the CNAS of the data transferred by the ANAF required that the subjects of the data be informed of the purposes of that processing and the categories of data concerned. > Applies: gdpr-art-11-par-1-en ### ¶44 It is apparent from the information given by the referring court, however, that the CNAS did not provide the applicants in the main proceedings with the information listed in Article 11(1)(a) to (c) of the directive. > Applies: gdpr-art-11-par-1-en ### ¶45 It is appropriate to add that, in accordance with Article 11(2) of Directive 95/46, the provisions of Article 11(1) of the directive do not apply when, in particular, the registration or communication of the data are laid down by law, Member States being required to provide appropriate safeguards in those cases. For the reasons set out in paragraphs 40 and 41 of this judgment, the provisions of Law No 95/2006 relied on by the Romanian Government and the > Applies: gdpr-art-11-par-1-en, gdpr-art-11-par-2-en ### ¶2007 Protocol do not establish a basis for applying either the derogation under Article 11(2) or that provided for under Article 13 of the directive. > Applies: gdpr-art-11-par-2-en, gdpr-art-13-en ## Cited law provisions (6) ### GDPR — gdpr-art-11-par-1-en If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. ### GDPR — gdpr-art-11-par-2-en Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification. ### GDPR — gdpr-art-6-en Lawfulness of processing ### GDPR — gdpr-art-10-en Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. ### GDPR — gdpr-art-11-en Processing which does not require identification ### GDPR — gdpr-art-13-en Information to be provided where personal data are collected from the data subject --- Generated by overview.legal · https://overview.legal/posts/5957 · 2026-08-22