Oturma İzni Dosyasındaki Kişisel Verilere Erişim

—

YS, M and S, by B. Scholten, J. Hoftijzer and I. Oomen, advocaten,

—

the Netherlands Government, by B. Koopman and C. Wissels, acting as Agents,

—

the Czech Government, by M. Smolek, acting as Agent,

—

the Greek Government, by E.-M. Mamouna and D. Tsagkaraki, acting as Agents,

—

the French Government, by D. Colas and S. Menez, acting as Agents,

—

the Austrian Government, by C. Pesendorfer, acting as Agent,

—

the Portuguese Government, by L. Inez Fernandes and C. Vieira Guerra, acting as Agents,

—

the European Commission, by B. Martenczuk, P. van Nuffel and C. ten Dam, acting as Agents,

1

These requests for a preliminary ruling concern the interpretation of Articles 2(a), 12(a) and 13(1)(d), (f) and (g) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), and of Articles 8(2) and 41(2)(b) of the Charter of Fundamental Rights of the European Union (‘the Charter’).

2

The requests have been made in two sets of proceedings between YS, a third country national who applied for a residence permit for a fixed period in the Netherlands, and the Minister voor Immigratie, Integratie en Asiel (Minister for Immigration, Integration and Asylum, ‘the Minister’) and between the Minister and M and S, also third country nationals who made the same type of application, concerning the Minister’s refusal to communicate to those nationals a copy of an administrative document drafted before the adoption of the decisions on their applications for residence permits.

3

Directive 95/46, the object of which, according to Article 1, is to protect the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data, and to remove obstacles to the free flow of personal data, states in recitals 25 and 41 in its preamble:

...

4

The concept of ‘personal data’ is defined in Article 2(a) of Directive 95/46 as ‘any information relating to an identified or identifiable natural person (“data subject”)’.

5

Article 12 of that directive, entitled ‘Right of access’, provides as follows:

‘Member States shall guarantee every data subject the right to obtain from the controller:

6

Article 13(1) of that directive, entitled ‘Exemptions and restrictions’, provides:

‘Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in [Article] ... 12 ... when such a restriction constitutes a necessary [measure] to safeguard:

…

…

7

Article 14 of the directive provides that Member States are to grant the data subject the right, in certain circumstances, to object to the processing of data relating to him.

8

Under Articles 22 and 23(1) of the directive, Member States are to provide for the right of every person to a judicial remedy for any breach of the rights guaranteed to him by the national law applicable to the processing in question and to provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to the directive is entitled to receive compensation from the controller for the damage suffered.

9

Articles 2, 12 and 13 of Directive 95/46 were transposed into national law by Articles 1, 35 and 43 respectively of the Law on the Protection of Personal Data (Wet bescherming persoonsgegevens, ‘the Wbp’).

10

Article 35 of the Wbp is worded as follows:

‘The data subject shall have the right to apply to the controller without restraint and at reasonable intervals to be notified as to whether data relating to him are being processed. The controller shall notify the data subject in writing within four weeks if data relating to him are being processed.

Where such data are being processed, such notification shall contain a full overview thereof in an intelligible form, a description of the purpose or purposes of the processing, the categories of data concerned and the recipients or categories of recipients, as well as any available information as to the source of the data.’

11

Under Article 43(e) of the Wbp, the controller can exclude application of Article 35 of the Wbp in so far as is necessary in the interests of protecting the data subject or the rights and freedoms of others.

12

Under Article 29(1)(a) of the Law on Foreign Nationals 2000 (Vreemdelingenwet 2000, the ‘Vw 2000’), a residence permit for a fixed period may be granted to a foreign national who is a refugee. Under Article 29(1)(b) of that law, such a permit may also be granted to a foreign national who has proved that he has good grounds for believing that if he is expelled he will run a real risk of being subjected to the death penalty or execution, to torture, inhuman or degrading treatment or punishment, or to serious and individual threat to a civilian’s life or person by reason of indiscriminate violence in situations of international or internal armed conflict.

13

The case officer of the Immigration and Naturalisation Service responsible for dealing with an application for a residence permit draws up, where he is not authorised to sign the decision, a draft decision which is submitted for assessment to a reviser in that service. The case officer attaches a document in which he explains to the reviser the reasons for his draft decision (‘the minute’). Where the case officer has the authority to sign, the minute is not submitted to a reviser but is used as an explanatory memorandum of the decision making process to justify the decision internally. The minute is part of the preparatory process within that service but not of the final decision, even though some points mentioned in it may reappear in the statement of reasons of that decision.

14

Generally, the minute contains the following information: name, telephone and office number of the case officer responsible for preparing the decision; boxes for the initials and names of revisers; data relating to the applicant, such as name, date of birth, nationality, gender, ethnicity, religion and language; details of the procedural history; details of the statements made by the applicant and the documents submitted; the legal provisions which are applicable; and, finally, an assessment of the foregoing information in the light of the applicable legal provisions. This assessment is referred to as the ‘legal analysis’.

15

Depending on the case, the legal analysis may be more or less extensive, varying from a few sentences to several pages. In an in-depth analysis, the case officer responsible for the preparation of the decision addresses, inter alia, the credibility of the statements made and explains why he considers an applicant eligible or not for a residence permit. A summary analysis may merely refer to the application of a particular policy line.

16

Until 14 July 2009, the Minister’s policy was to make the minute available upon mere request. Taking the view that the large number of those requests resulted in too great a work load, that the data subjects often misinterpreted the legal analyses contained in the minutes which were made available to them and that, because of that availability, the exchange of views within the Immigration and Naturalisation Service was recorded less frequently in the minutes, the Minister abandoned that policy.

17

Since then, requests for the communication of minutes have been systematically refused. Instead of obtaining a copy of the minute, the applicant now receives a summary of the personal data contained in the document, including information relating to the origin of those data and, where relevant, the bodies to which they were disclosed.

18

On 13 January 2009, YS submitted an application for a residence permit for a fixed period under asylum law. The application was rejected by decision of 9 June 2009. That decision was withdrawn by letter of 9 April 2010, and the application was once again rejected by decision of 6 July 2010.

19

By letter of 10 September 2010, YS asked for the minute relating to the decision of 6 July 2010 to be communicated to him.

20

By decision of 24 September 2010, that was refused. However, the decision did give a summary of the data contained in the minute, the origin of those data and the bodies to which the data had been disclosed. YS lodged an objection against the refusal to communicate the minute, which itself was rejected by decision of 22 March 2011.

21

YS then brought an action against that rejection decision before the Rechtbank Middelburg (District Court, Middelburg), on the ground that he could not lawfully be refused access to that minute.

22

In those circumstances, the Rechtbank Middelburg decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

23

By decision of 28 October 2009, the Minister granted M a residence permit for a fixed period as asylum seeker on the basis of Article 29(1)(b) of the Vw 2000. The reasons for that decision were not given, in that it did not set out the manner in which the case had been assessed by the Immigration and Naturalisation Service.

24

By letter of 30 October 2009, M, on the basis of Article 35 of the Wbp, requested access to the minute relating to that decision.

25

By decision of 4 November 2009, the Minister refused M access to the minute. He based the refusal on Article 43(e) of the Wbp, since he was of the view that access to such a document was liable adversely to affect the freedom of the case worker responsible for compiling it to include certain arguments and considerations in the minute which could be relevant in the decision-making process.

26

The objection to that refusal having been rejected by decision of 3 December 2010, M brought an action against that decision before the Rechtbank Middelburg. By decision of 16 June 2011, that court took the view that the interest relied on by the Minister to refuse access to the minute did not amount to an interest protected by Article 43(e) of the Wbp, and annulled the Minister’s decision as being based on reasoning that was wrong in law. It also found that there was no reason to maintain the legal effects of the decision, since the Minister, contrary to Article 35(2) of the Wbp, had not given access to the legal analysis in the minute from which it might have become evident why M could not be considered to be a refugee for the purposes of Article 29(1)(a) of the Vw 2000.

27

By decision of 10 February 2010, which did not state reasons, the Minister granted S an ordinary residence permit for a fixed period on the ground of ‘dramatic circumstances’. By letter of 19 February 2010, S, on the basis of Article 35 of the Wbp, requested the minute relating to that decision.

28

The request was rejected by decision of 31 March 2010, which was confirmed by decision of 21 October 2010 following an objection. In the decision of 21 October 2010, the Minister took the position that the decision of 31 March 2010 had already stated which personal data were included in the minute and that the request for access to the minute had thus been met. Furthermore, he was of the opinion that the Wbp does not confer any rights of access to the minute.

29

By decision of 4 August 2011, the Rechtbank Amsterdam (District Court, Amsterdam) declared well-founded the action brought by S against the decision of 21 October 2010 and annulled that decision. That court found, inter alia, that the minute in question did not contain any information other than personal data of S, that he had a right of access to those data under the Wbp, and that the Minister’s refusal to allow access was not validly based.

30

The Minister decided to appeal to the Raad van State (Council of State) both in the dispute concerning M and in that concerning S.

31

In those circumstances, the Raad van State decided to join the cases concerning M and S, to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

32

By decision of 30 April 2013, Cases C‑141/12 and C‑372/12 were joined for the purposes of the oral procedure and of the judgment.

33

By the first and second questions in Case C‑141/12 and the fifth question in Case C‑372/12, which it is appropriate to examine together, the referring courts ask, in essence, whether Article 2(a) of Directive 95/46 must be interpreted as meaning that the data relating to the applicant for a residence permit and the legal analysis included in the minute are ‘personal data’ within the meaning of that provision.

34

Although all interested parties who adopted a view on this point consider that the data relating to the applicant for a residence permit included in the minute correspond to the concept of ‘personal data’ and propose, consequently, that a positive reply be given to the first question in Case C‑141/12, opinions differ in relation to the legal analysis in that administrative document, which is the subject of the second question in that case and the fifth question in Case C‑372/12.

35

YS, M and S, the Greek, Austrian and Portuguese Governments and the European Commission consider that, in so far as the legal analysis refers to a specific natural person and is based on the situation and that person’s individual characteristics, it also comes under the concept of ‘personal data’. The Greek Government and the Commission state, however, that that applies solely to legal analyses which contain information concerning an individual and not to those which contain only an abstract legal interpretation, while M and S consider that even such an abstract interpretation falls within the scope of that provision if it is decisive for the assessment of the application for a residence permit and is applied to the specific case of the applicant.

36

By contrast, according to the Netherlands, Czech and French Governments, the legal analysis in a minute does not come under the concept of ‘personal data’.

37

In this respect, it should be noted that Article 2(a) of Directive 95/46 defines personal data as ‘any information relating to an identified or identifiable natural person’.

38

There is no doubt that the data relating to the applicant for a residence permit and contained in a minute, such as the applicant’s name, date of birth, nationality, gender, ethnicity, religion and language, are information relating to that natural person, who is identified in that minute in particular by his name, and must consequently be considered to be ‘personal data’ (see, to that effect, inter alia the judgment in Huber, C‑524/06, EU:C:2008:724, paragraphs 31 and 43).

39

As regards, on the other hand, the legal analysis in a minute, it must be stated that, although it may contain personal data, it does not in itself constitute such data within the meaning of Article 2(a) of Directive 95/46.

40

As the Advocate General noted in essence in point 59 of her Opinion, and as the Netherlands, Czech and French Governments noted, such a legal analysis is not information relating to the applicant for a residence permit, but at most, in so far as it is not limited to a purely abstract interpretation of the law, is information about the assessment and application by the competent authority of that law to the applicant’s situation, that situation being established inter alia by means of the personal data relating to him which that authority has available to it.

41

That interpretation of the concept of ‘personal data’ for the purposes of Directive 95/46 not only follows from the wording of Article 2(a) but is also borne out by the objective and general scheme of that directive.

42

In accordance with Article 1 of that directive, its purpose is to protect the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data, and thus to permit the free flow of personal data between Member States.

43

According to recital 25 in the preamble to Directive 95/46, the principles of protection of natural persons provided therein are reflected, on the one hand, in the obligations imposed on those responsible for processing data concerning those persons and, on the other hand, in the rights conferred on individuals, the data on whom are the subject of processing, to be informed that processing is taking place, to consult the data, to request corrections and even to object to processing in certain circumstances.

44

As regards those rights of the data subject, referred to in Directive 95/46, it must be noted that the protection of the fundamental right to respect for private life means, inter alia, that that person may be certain that the personal data concerning him are correct and that they are processed in a lawful manner. As is apparent from recital 41 in the preamble to that directive, it is in order to carry out the necessary checks that the data subject has, under Article 12(a) of the directive, a right of access to the data relating to him which are being processed. That right of access is necessary, inter alia, to enable the data subject to obtain, depending on the circumstances, the rectification, erasure or blocking of his data by the controller and consequently to exercise the right set out in Article 12(b) of that directive (see, to that effect, the judgment in Rijkeboer, C‑553/07, EU:C:2009:293, paragraphs 49 and 51).

45

In contrast to the data relating to the applicant for a residence permit which is in the minute and which may constitute the factual basis of the legal analysis contained therein, such an analysis, as the Netherlands and French Governments have noted, is not in itself liable to be the subject of a check of its accuracy by that applicant and a rectification under Article 12(b) of Directive 95/46.

46

In those circumstances, extending the right of access of the applicant for a residence permit to that legal analysis would not in fact serve the directive’s purpose of guaranteeing the protection of the applicant’s right to privacy with regard to the processing of data relating to him, but would serve the purpose of guaranteeing him a right of access to administrative documents, which is not however covered by Directive 95/46.

47

In an analogous context, as regards the processing of personal data by the EU institutions, governed on the one hand by Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1), and on the other by Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ 2001 L 145, p. 43), the Court has previously held, in paragraph 49 of the judgment in Commission v Bavarian Lager, C‑28/08 P, EU:C:2010:378, that those regulations have different objectives and that, in contrast to Regulation No 1049/2001, Regulation No 45/2001 is not designed to ensure the greatest possible transparency of the decision-making process of the public authorities and to promote good administrative practices by facilitating the exercise of the right of access to documents. That finding applies equally to Directive 95/46, which, in essence, has the same objective as Regulation No 45/2001.

48

It follows from all the foregoing considerations that the answer to the first and second questions in Case C‑141/12 and the fifth question in Case C‑372/12 is that Article 2(a) of Directive 95/46 must be interpreted as meaning that the data relating to the applicant for a residence permit contained in the minute and, where relevant, the data in the legal analysis contained in the minute are ‘personal data’ within the meaning of that provision, whereas, by contrast, that analysis cannot in itself be so classified.

49

In the light of the answer given to the first and second questions in Case C‑141/12 and to the fifth question in Case C‑372/12, and since the referring court specified that the sixth question raised in Case C‑372/12 requires an answer only if the legal analysis in the minute must be classified as personal data, there is no need to answer that sixth question.

50

By the third and fifth questions in Case C‑141/12 and by the first and second questions in Case C‑372/12, which it is appropriate to examine together, the referring courts ask, in essence, whether Article 12(a) of Directive 95/46 and Article 8(2) of the Charter must be interpreted as meaning that the applicant for a residence permit has a right of access to data concerning him which are in the minute and, if so, whether that right to access implies that the competent authorities must provide him with a copy of that minute or whether it is sufficient for them to send him a full summary of those data in an intelligible form.

51

All the parties to the proceedings before the Court agree that Article 12(a) of Directive 95/46 grants an applicant for a residence permit a right of access to all the personal data contained in the minute, although their views as regards the actual extent of that right differ according to their interpretation of the concept of ‘personal data’.

52

As regards the form that that access must take, YS, M and S and the Greek Government consider that the applicant has the right to obtain a copy of the minute. They maintain that only such a copy would allow him to ensure that he is in possession of all the personal data which concern him in the minute.

53

By contrast, according to the Netherlands, Czech, French and Portuguese Governments and the Commission, neither Article 12(a) of Directive 95/46 nor Article 8(2) of the Charter requires Member States to provide a copy of the minute to the applicant for a residence permit. Thus, there are other possible ways of disclosing, in an intelligible form, the personal data contained in such a document, inter alia by providing him with a full and comprehensible summary of those data.

54

As a preliminary point, it should be noted that the provisions of Directive 95/46, in so far as they govern the processing of personal data liable to infringe fundamental freedoms, in particular the right to privacy, must necessarily be interpreted in the light of fundamental rights, which, according to settled case-law of the Court, form an integral part of the general principles of law whose observance the Court ensures and which are now set out in the Charter (see, inter alia, the judgments in Connolly v Commission, C‑274/99 P, EU:C:2001:127, paragraph 37; Österreichischer Rundfunk and Others, C‑465/00, C‑138/01 and C‑139/01, EU:C:2003:294, paragraph 68; and Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 68).

55

Article 8 of the Charter, which guarantees the right to the protection of personal data, provides in paragraph 2, inter alia, that everyone has the right of access to data which have been collected concerning him or her. That requirement is implemented by Article 12(a) of Directive 95/46 (see, to that effect, the judgment in Google Spain and Google, EU:C:2014:317, paragraph 69).

56

That provision of Directive 95/46 provides that Member States are to guarantee every data subject the right to obtain from the controller, without constraint at reasonable intervals and without excessive delay or expense, communication to him in an intelligible form of the data undergoing processing and of any available information as to their source.

57

Although Directive 95/46 requires Member States to ensure that every data subject can obtain from the controller of personal data communication of all such data processed by the controller relating to the data subject, it leaves it to the Member States to determine the actual material form that that communication must take, as long as it is ‘intelligible’, in other words it allows the data subject to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that that person may, where relevant, exercise the rights conferred on him by Articles 12(b) and (c), 14, 22 and 23 of the directive (see, to that effect, the judgment in Rijkeboer, EU:C:2009:293, paragraphs 51 and 52).

58

Therefore, in so far as the objective pursued by that right of access may be fully satisfied by another form of communication, the data subject cannot derive from either Article 12(a) of Directive 95/46 or Article 8(2) of the Charter the right to obtain a copy of the document or the original file in which those data appear. In order to avoid giving the data subject access to information other than the personal data relating to him, he may obtain a copy of the document or the original file in which that other information has been redacted.

59

In situations such as those in the main proceedings, it follows from the answer given in paragraph 48 above that only the data relating to the applicant for a residence permit contained in the minute and, where relevant, the data in the legal analysis contained in the minute are ‘personal data’ within the meaning of Article 2(a) of Directive 95/46. Consequently the right of access which that applicant may rely on under Article 12(a) of Directive 95/46 and Article 8(2) of the Charter relates solely to those data. For that right of access to be complied with, it is sufficient for the applicant for a residence permit to be provided with a full summary of all of those data in an intelligible form, that is, a form which allows him to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that he may, where relevant, exercise the rights conferred on him by Articles 12(b) and (c), 14, 22 and 23 of that directive.

60

It follows from the foregoing considerations that the answer to the third and fifth questions in Case C‑141/12 and the first and second questions in Case C‑372/12 is that Article 12(a) of Directive 95/46 and Article 8(2) of the Charter must be interpreted as meaning that an applicant for a residence permit has a right of access to all personal data concerning him which are processed by the national administrative authorities within the meaning of Article 2(b) of that directive. For that right to be complied with, it is sufficient for the applicant to be provided with a full summary of those data in an intelligible form, that is, a form which allows him to become aware of those data and to check that they are accurate and processed in compliance with that directive, so that he may, where relevant, exercise the rights conferred on him by that directive.

61

By the fourth question in Case C‑141/12 and the third and fourth questions in Case C‑372/12, which it is appropriate to examine together, the referring courts ask, in essence, whether Article 41(2)(b) of the Charter must be interpreted as meaning that the applicant for a residence permit may rely against national authorities on the right of access to the file provided for in that provision and, if so, what is the scope of the phrase ‘while respecting the legitimate interests of confidentiality’ in decision-making within the meaning of that provision.

62

The Commission considers that those questions are inadmissible on account of their hypothetical and obscure wording.

63

It should be borne in mind that, according to settled case-law of the Court, questions on the interpretation of EU law referred by a national court in the factual and legislative context which that court is responsible for defining, and the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevance. The Court may refuse to rule on a question referred by a national court only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (see, inter alia, the judgment in Márquez Samohano, C‑190/13, EU:C:2014:146, paragraph 35 and the case-law cited).

64

However, that is not so in the present case. In the light of the factual context outlined by the referring courts, it does not appear that the question of whether the applicants in the main proceedings may, pursuant to Article 41(2)(b) of the Charter, rely on a right of access to the file concerning their applications for a residence permit is of a purely hypothetical nature. The wording of the questions and the information concerning them in the orders for reference are, furthermore, sufficiently clear to determine the scope of those questions and to enable, first, the Court to answer them and, secondly, the interested parties to submit their observations pursuant to Article 23 of the Statute of the Court of Justice of the European Union.

65

On the substance of the questions referred, YS, M and S as well as the Greek Government consider that the applicant for a resident permit may take Article 41(2)(b) of the Charter as a basis for a right of access to the file, given that, in the context of the procedure for granting such a permit, the national authorities apply the asylum directives. By contrast, the Netherlands, Czech, French, Austrian and Portuguese Governments and the Commission consider that Article 41 of the Charter is directed exclusively at the EU institutions and cannot, therefore, establish a right of access to a file in the context of a national procedure.

66

It should be noted from the outset that Article 41 of the Charter, ‘Right to good administration’, states in paragraph 1 that every person has the right to have his or her affairs handled impartially, fairly and within a reasonable time by the institutions, bodies, offices and agencies of the European Union. Article 41(2) specifies that that right includes the right of every person to have access to his or her file, while respecting the legitimate interests of confidentiality and of professional and business secrecy.

67

It is clear from the wording of Article 41 of the Charter that it is addressed not to the Member States but solely to the institutions, bodies, offices and agencies of the European Union (see, to that effect, the judgment in Cicala, C‑482/10, EU:C:2011:868, paragraph 28). Consequently, an applicant for a resident permit cannot derive from Article 41(2)(b) of the Charter a right to access the national file relating to his application.

68

It is true that the right to good administration, enshrined in that provision, reflects a general principle of EU law (judgment in HN, C‑604/12, EU:C:2014:302, paragraph 49). However, by their questions in the present cases, the referring courts are not seeking an interpretation of that general principle, but ask whether Article 41 of the Charter may, in itself, apply to the Member States of the European Union.

69

Consequently, the answer to the fourth question in Case C‑141/12 and the third and fourth questions in Case C‑372/12 is that Article 41(2)(b) of the Charter must be interpreted as meaning that the applicant for a residence permit cannot rely on that provision against the national authorities.

70

Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Third Chamber) hereby rules: