V & EDPS V. EUROPEAN PARLAMENT, 5.7.2011 (“V v. European Parliament”)

Lawful Basis: The applicant did not consent to the transfer of her medical file by the Commission to the European Parliament. The transfer was not “necessary for the purposes of complying with the specific rights and obligations of the controller in the field of employment law,” in accordance with Article 10(2)(b). The Parliament’s obligation to control fitness for duty could have been achieved by less intrusive means. Nor does Article 10(3) justify the transfer. (¶¶ 137–139)

Secondly, as regards Article 10 of Regulation No 45/2001, it must be pointed out that, pursuant to paragraph 1 of that article, the processing of medical data is, in principle, prohibited. Paragraph 2 of Article 10 provides inter alia that paragraph 1 does not apply if the data subject gives his or her consent to processing or if processing is necessary for the purposes of complying with the specific rights and obligations of the controller in the field of employment law.

On the one hand, it is common ground that the applicant did not give her consent to the transfer from the Commission to the Parliament of the medical data concerning her.

On the other hand, although it is true that the transfer at issue was carried out in order to enable the Parliament to ascertain the applicant’s physical fitness to perform her duties in that institution, an obligation which arises from Articles 82 and 83 of the CEOS and which can be regarded as an ‘obligation in the field of employment law’ within the meaning of Article 10(2)(b) of Regulation No 45/2001, it is not established that that transfer was ‘necessary’ for the purposes of complying with that obligation. As the EDPS points out and was stated in paragraph 125, other measures involving less interference with private life were possible, enabling the Parliament to ensure the full application of Articles 82 and 83 of the CEOS. Before asking the Commission to transfer those data to it, the Parliament could, in particular, have invited the applicant to provide certain information on her medical history and had the necessary medical examinations performed by its own staff. In addition, the fact that the data transferred were relatively old, having been collected in 2006 and 2007, more than one and a half years prior to the decision at issue, does not support the Parliament’s argument that that transfer was necessary.