McCULLOUGH V. CEDEFOP (11.6.2015) (“McCULLOUGH”)

Personal data: Personal does not mean private. Surnames in minutes are personal data even where (i) the minutes refer to meetings in connection with the exercise of their public duties and not in the private sphere, and (ii) the surnames were published in the internet. (¶ 66)

It follows from the case-law of the Court of Justice that surnames are personal data and are therefore protected by the provisions of Regulation No 45/2001 (judgments in Commission v Bavarian Lager, cited in paragraph 41 above, EU:C:2010:378, paragraph 68, and Dennekamp v Parliament, cited in paragraph 41 above, EU:T:2011:688, paragraph 27). The fact that the members of Cedefop’s decision-making bodies participated in the meetings of those bodies in connection with the exercise of their public duties and not in the private sphere, or indeed the fact that the surnames of the members of the Governing Board and the Bureau were published in the Official Journal of the European Union or on the Internet, does not affect the characterisation of their surnames as personal data (see, to that effect and by analogy, judgment of 2 October 2014 in Strack v Commission, C‑127/13 P, ECR, EU:C.2014:2250, paragraph 111).