Case C-201/14, Bara – giving personal data and consent to processing for just one purpose [judgment 2015, ECLI:EU:C:2015:638]
When a person must give their personal data to a state body for one particular purpose, can a different body use the data on that database without that person’s consent, especially when their data is going to be used for a different purpose?
Facts
This data processing dispute originates in Romania, and the questions asked of the CJEU are self-explanatory.
Questions Referred
According to the Curia website, the Cluj Court of Appeal has asked:
1. Are national tax authorities, as the body representing the competent ministry of a Member State, a financial institution within the meaning of Article 124 TFEU?
2. Is it possible make provision, by means of a measure akin to an administrative measure, or indeed a protocol concluded between the national tax authorities and another State institution, for the transfer of the data base relating to the income earned by the citizens of a Member State from the national tax authorities to another institution of the Member State, without giving rise to a measure establishing privileged access, as defined in Article 124 TFEU?
3. Is the transfer of the data base, the purpose of which is to impose an obligation on the citizens of the Member State to pay social security contributions, to the Member State institution for whose benefit the transfer is made covered by the concept of prudential considerations within the meaning of Article 124 TFEU?
4. May personal data be processed by authorities for which such data were not intended where such an operation gives rise, retroactively, to financial loss?
Outcome. By judgment of 1 October 2015 (ECLI:EU:C:2015:638) the Court ruled, in the words of the operative part: “Articles 10, 11 and 13 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, must be interpreted as precluding national measures, such as those at issue in the main proceedings, which allow a public administrative body of a Member State to transfer personal data to another public administrative body and …” The full text is available on EUR-Lex and CURIA.