Infringement of the Regulation 45/2001. Part II.
This month E-Crime Expert is presenting relevant Case law and rulings regarding data protection rights, law applicability and enforcement.
The purpose of this new series is to show actually how the relevant law should be applied in order to properly balance the right to free access of public information, free flow of information and the right to Privacy and Personal Data protection.
The series will balance both the applicability of Data Protection law in the private and public sector, focusing mostly on the Directive 95/46/EC (private sector) and Regulation 45/2001/EC (rights to data protection of individuals working with/for EU Institutions and bodies).
This week will be presented another important Case law, regarding to the Regulation 45/2001/EC: How the privacy and data protection rights of EU officials, contract agents, staff are protected when their private data and information is processed by the EU Institutions and Bodies.
Here it was presented the first Part of this Case law.
Case F-46/09: Judgment of the Civil service Tribunal (First Chamber)
The Applicant brought this action seeking, primarily, to cancel the decision of 19 December 2008 by which the European Parliament has withdrawn the job offer that had been presented on 10 December 2008, based on the opinion of the medical officer from the Parliament dated December 18, 2008, and secondly, seeking compensation for damages.
For sustaining his case, the applicant raises the following arguments:
-The opinion of the Parliament’s medical officer is subjective as it is based on the documents from the Commission’s medical service, dating from almost two years back and without any prior clinical and psychological examination of the applicant;
– Secondly, he considerers that the Article 33, second paragraph, of the Conditions of Employment along with the rights to defense, were infringed as the contested decision was adopted without the applicant’s right to defense or make himself heard;
– Thirdly, he considered that the principle with regards to respect for privacy and private life were infringed along with the provisions of Regulation No 45/2001;
– Last but not least, he identifies the existence of moral harassment.
-Article 82, paragraph 3 of the Conditions for Employment of Other Servants in the European Union,
-Article 33, second paragraph of the Statute for the European Union Officials,
-Article 1, paragraph 1, and Articles 4, 6, 7, 10 Regulation (EC) No 45/2001 of the European Parliament and the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by institutions.
Findings (regarding the applicant’s four arguments):
1) The Court finds that the Parliament medical officer’s opinion is expressed in a categorical but general terms, without examining the applicant as part of the hiring medical procedure of the Parliament and relayed just on medical tests done almost 2 years before by another Institution.
2) The breach of a procedural rule, including the principle of respect for the rights of defense, is likely to invalidate the decision itself to the extent that such breach has affected the content of the final decision. In this particular case the Parliament’s medical examiner should have had invited the applicant and at least discussed the previous tests’ result if not accepting the new one voluntarily taken by the applicant with the Leopold Clinic, but never assessed by the Parliament. Subsequently, the plea alleging infringement of Article 33, second paragraph of the statute, must also be accepted.
3) At the outset, it should be noted that Article 1 of Regulation No 45/2001 expressly provides that the institutions and bodies of the European Union shall ensure, in accordance with that regulation, the protection of fundamental rights and freedoms of individuals. Also, the provisions of this regulation shall not be interpreted as conferring legitimacy on an interference with the right to respect for private life as guaranteed by Article 8 ECHR
As rightly pointed out by the applicant, the Parliament can contentious claim that the transfer would be legally based on the Article 10, paragraph 3 of Regulation No 45/2001. While this section empowers the members of the medical service of an institution to process the data necessary for the diagnosis of medical fitness of a person to exercise his functions, it has neither the purpose nor the effect of authorize a transfer of medical data such as challenged in this litigation, even if it is done between members of the medical services of the two institutions.
With regard to the Article 7 of Regulation No 45/2001, it must be noted, as rightly submitted by the applicant, that a transfer is not considered necessary within the meaning of Article 10 of this Regulation.
Moreover, it is true that the transfer at issue was made to put the Parliament in a position to check the physical fitness of the applicant to exercise his duties in this institution, obligation under articles 82 and 83 of the CEOS that can be analyzed as an “obligation in employment law” within the meaning of Article 10, paragraph 2 b) of Regulation no 45/2001, but was not established first that the transfer was “necessary” to meet this obligation. As pointed out by the EDPS, other less intrusive measures to privacy could be envisaged, allowing Parliament to ensure full implementation of Articles 82 and 83 of the CEOS. The Parliament could have particularly invited the applicant to provide certain information about his medical history and to perform medical examinations required by its own services, before asking the Commission to transfer the data. In addition, the relatively old data transferred, collected in 2006 and 2007, more than a year and a half before the contested decision, does not support the Parliament’s thesis that this transfer would have been necessary, and opposes to the data quality requirements as laid down under Article 4, Regulation 45/2001.
However, it is undisputed that the applicant has not consented to the transfer of the medical data from the Commission to the Parliament.
Furthermore, with regard to Article 10 of Regulation No 45/2001, it should be noted that under paragraph 1 of this Article, the processing of medical data is, in principle, prohibited. Paragraph 2 of Article 10 provides that paragraph 1 shall not apply if the person gives consent to processing or if processing is necessary to meet the obligations and specific rights of the controller in the labour field.
Stay tuned for the second part of the Court’s findings and JUDGEMENT.
Any questions can be submitted to: firstname.lastname@example.org
Additional information can be found at: www.e-crimeexppert.com
What do you think about the findings? Do you think that the applicant was right? Can you “guess” the Court’s Judgement?
Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.
- @k3rstin Hi Kerstin. Im fine thank you. Still in Brussels. Can we collaborate on any project/assignment? Best regards, Dan. 1 year ago
- 6 Essential Tips on How to Prevent Online Shopping Fraud wp.me/p1N1s0-jD 3 years ago
- Cyberbullying wp.me/p1N1s0-jz 3 years ago
- 10 Ways to Prevent Your Identity From Being Stolen wp.me/p1N1s0-jv 3 years ago
- Infographic-Privacy and Security on Facebook wp.me/p1N1s0-jp 3 years ago