Case Law · CJEU EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
CJEU: Member States cannot add lawful grounds for data processing beyond Directive 95/46
Valid purposes for processing: EU data protection law sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as lawful.
Original title: ASOCIACION NACIONAL DE ESTABLECIMIENTOS FINANCIEROS DE CREDITO (ASNEF) AND FEDERACION DE COMERCIO ELECTRONICO Y MARKETING DIRECTO (FECEMD) V. ADMINISTRACION DEL ESTADO, 24.Nov.2011 (“ASNEF”)
Judgment
Summary
Member States cannot add new principles relating to the lawfulness of processing or impose additional requirements. (¶¶ 29-32)
Full text
summary
Valid purposes for processing: EU data protection law sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as lawful. Member States cannot add new principles relating to the lawfulness of processing or impose additional requirements. (¶¶ 29-32)
¶29 excerpt
Accordingly, it has been held that the harmonisation of those national laws is not limited to minimal harmonisation but amounts to harmonisation which is generally complete. It is upon that view that Directive 95/46 is intended to ensure free movement of personal data while guaranteeing a high level of protection for the rights and interests of the individuals to whom such data relate (Lindqvist, paragraph 96).
¶30 excerpt
Consequently, it follows from the objective of ensuring an equivalent level of protection in all Member States that Article 7 of Directive 95/46 sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful.
¶31 excerpt
That interpretation is corroborated by the term ‘may be processed only if’ and its juxtaposition with ‘or’ contained in Article 7 of Directive 95/46, which demonstrate the exhaustive and restrictive nature of the list appearing in that article.
¶32 excerpt
It follows that Member States cannot add new principles relating to the lawfulness of the processing of personal data to Article 7 of Directive 95/46 or impose additional requirements that have the effect of amending the scope of one of the six principles provided for in Article 7.
How it connects
References
Related across sources
Guidelines 05/2020 consent under Regulation 2016/679 Guidelines on consent May 4, 2020 Consent Data Portability Personal Data
Guidelines 07/2020 concepts of controller and processor in the GDPR Jul 7, 2021 Controllers Processors IP Address
Guidelines 3/2019 processing of personal data through video devices Jan 30, 2020 Personal Data Processing Material scope (GDPR)
Guidelines 06/2020 interplay of the Second Payment Services Directive and the GDPR Guidelines on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Dec 15, 2020 International Transfer GDPR Article 5 Principles of Processing Personal Data
Guidelines 04/2021 Codes of Conduct as tools for transfers Guidelines on codes of conduct and monitoring bodies Feb 22, 2022 International Transfer Processing Agreement Codes of Conduct