16 According to the order for reference, public bodies are empowered, under Law No 95/2006, to transfer personal data to the health insurance funds so that the latter may determine whether an individual qualifies as an insured person. The data concern the identification of persons (surname, first name, personal identity card number, address) but does not include data relating to income received.
17 The referring court wishes to determine whether the processing of the data by the CNAS required prior information to be given to the data subjects as to the identity of the data controller and the purpose for which the data was transferred. That court is also asked to determine whether the transfer of the data on the basis of the 2007 Protocol is contrary to Directive 95/46 which requires that all restrictions on the rights of data subjects are laid down by law and accompanied by safeguards, in particular when the data is used against those persons.
18 In those circumstances, the Curtea de Apel Cluj decided to stay proceedings and refer the following questions to the Court for a preliminary ruling:
‘(1) Is a national tax authority, as the body representing the competent ministry of a Member State, a financial institution within the meaning of Article 124 TFEU?
(2) Is it possible to make provision, by means of a measure akin to an administrative measure, namely a protocol concluded between the national tax authority and another State institution, for the transfer of the database relating to the income earned by the citizens of a Member State from the national tax authority to another institution of the Member State, without giving rise to a measure establishing privileged access, as defined in Article 124 TFEU?
(3) Is the transfer of the database, the purpose of which is to impose an obligation on the citizens of the Member State to pay social security contributions to the Member State institution for whose benefit the transfer is made, covered by the concept of prudential considerations within the meaning of Article 124 TFEU?
(4) May personal data be processed by authorities for which such data were not intended where such an operation gives rise, retroactively, to financial loss?’
The questions referred
Admissibility
Admissibility of the first to third questions
19 According to settled case-law, the Court may refuse to rule on a question referred for a preliminary ruling by a national court where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its object, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (see judgment in PreussenElektra, C‑379/98, EU:C:2001:160, paragraph 39 and the case-law cited).
20 All of the observations presented to the Court submit that the first to third questions referred concerning the interpretation of Article 124 TFEU are inadmissible on the ground that they bear no relation to the object of the dispute in the main proceedings.
21 In that regard, it must be recalled that Article 124 TFEU falls within Part Three of the TFEU, under Title VIII on economic and monetary policy. That article prohibits any measure, not based on prudential considerations, establishing privileged access by Union institutions, bodies, offices or agencies, central governments, regional, local or other public authorities, other bodies governed by public law, or public undertakings of Member States to financial institutions.
22 The origin of that prohibition is to be found in Article 104 A of the EC Treaty (which became Article 102 EC), which was inserted in the EC Treaty by the Treaty of Maastricht. It was one of the provisions of the TFEU relating to the economic policy that intended to encourage the Member States to follow a sound budgetary policy, not allowing monetary financing of public deficits or privileged access by public authorities to the financial markets to lead to excessively high levels of debt or excessive Member State deficits (see, to that effect, judgment in Gauweiler and Others, C‑62/14, EU:C:2015:400, paragraph 100).
23 It is, therefore, quite obvious that the interpretation of Article 124 TFEU requested bears no relation to the actual facts or object of the dispute in the main proceedings, which concerns the protection of personal data.
24 It follows that it is not necessary to reply to the first to third questions.
Admissibility of the fourth question
25 The CNAS and the Romanian Government submit that the fourth question is inadmissible. That government submits that there is no link between the damage relied on by the applicants in the main proceedings and the annulment of the administrative acts contested within those proceedings.
26 In that regard, it must be borne in mind that, according to the settled case-law of the Court, questions on the interpretation of EU law referred by a national court in the factual and legislative context which that court is responsible for defining, the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevance. The Court may refuse to rule on a question referred for a preliminary ruling by a national court only where it is quite obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose, where the problem is hypothetical, or where the Court does not have before it the factual or legal material necessary to give a useful answer to the questions submitted to it (judgment in Fish Legal and Shirley, C‑279/12, EU:C:2013:853, paragraph 30 and the case-law cited).
27 It must be observed that the main proceedings concern the lawfulness of processing of tax data collected by the ANAF. The referring court is uncertain as to the interpretation of Directive 95/46, in the context of reviewing the lawfulness of the transfer of those data to the CNAS and their subsequent processing. The fourth question referred is therefore relevant and sufficiently precise to enable the Court to give a useful answer. Accordingly, the request for a preliminary ruling must be held to be admissible as regards the fourth question.
Substance
28 By its fourth question, the referring court asks, in essence, whether Articles 10, 11 and 13 of Directive 95/46 must be interpreted as precluding national measures, such as those at issue in the main proceedings, which allow a public administrative body in a Member State to transfer personal data to another public administrative body and their subsequent processing, without the data subjects being informed of that transfer and processing.
29 In that regard, it must be held, on the basis of the information provided by the referring court, that the tax data transferred to the CNAS by the ANAF are personal data within the meaning of Article 2(a) of the directive, since they are ‘information relating to an identified or identifiable natural person’ (judgment in Satakunnan Markkinapörssi and Satamedia, C‑73/07, EU:C:2008:727, paragraph 35). Both the transfer of the data by the ANAF, the body responsible for the management of the database in which they are held, and their subsequent processing by the CNAS therefore constitute ‘processing of personal data’ within the meaning of Article 2(b) of the directive (see, to that effect, inter alia, judgments in Österreichischer Rundfunk and Others, C‑465/00, C‑138/01 and C‑139/01, EU:C:2003:294, paragraph 64, and Huber, C‑524/06, EU:C:2008:724, paragraph 43).
30 In accordance with the provisions of Chapter II of Directive 95/46, entitled ‘General rules on the lawfulness of the processing of personal data’, subject to the exceptions permitted under Article 13 of that directive, all processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of the directive and, secondly, with one of the criteria for making data processing legitimate listed in Article 7 of the directive (judgments in Österreichischer Rundfunk and Others, C‑465/00, C‑138/01 and C‑139/01, EU:C:2003:294, paragraph 65; Huber, C‑524/06, EU:C:2008:724, paragraph 48; and ASNEF and FECEMD, C‑468/10 and C‑469/10, EU:C:2011:777, paragraph 26).
31 Furthermore, the data controller or his representative is obliged to provide information in accordance with the requirements laid down in Articles 10 and 11 of Directive 95/46, which vary depending on what data are, or are not, collected from the data subject, and subject to the exceptions permitted under Article 13 of the directive.
32 As regards, first, Article 10 of the directive, that article provides that the data controller must provide a data subject, from whom data relating to himself are collected, with the information listed in subparagraphs (a) to (c), except where he already has that information. That information concerns the identity of the data controller, the purposes of the processing and any further information necessary to guarantee fair processing of the data. Amongst the additional information necessary to guarantee fair processing of the data, Article 10(c) of the directive expressly refers to ‘recipients or categories of recipients of the data’ and ‘the existence of a right of access to and the right to rectify the data concerning [that person]’.
33 As the Advocate General observed in point 74 of his Opinion, the requirement to inform the data subjects about the processing of their personal data is all the more important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, set out in Article 12 of Directive 95/46, and their right to object to the processing of those data, set out in Article 14 of that directive.
34 It follows that the requirement of fair processing of personal data laid down in Article 6 of Directive 95/46 requires a public administrative body to inform the data subjects of the transfer of those data to another public administrative body for the purpose of their processing by the latter in its capacity as recipient of those data.
35 It is clear from the information provided by the referring court that the applicants in the main proceedings were not informed by the ANAF of the transfer to the CNAS of personal data relating to them.
36 The Romanian Government submits, however, that the ANAF is required, in particular under Article 315 of Law No 95/2006, to transfer to the regional health insurance funds the information necessary for the determination by the CNAS as to whether persons earning income through self-employment qualify as insured persons.
37 It is true that Article 315 of Law No 95/2006 expressly provides that ‘the data necessary to certify that the person concerned qualifies as an insured person are to be communicated free of charge to the health insurance funds by the authorities, public institutions or other institutions in accordance with a protocol’. However, it is clear from the explanations provided by the referring court that the data necessary for determining whether a person qualifies as an insured person, within the meaning of the abovementioned provision, do not include those relating to income, since the law also recognises persons without a taxable income as qualifying as insured.
38 In those circumstances, Article 315 of Law No 95/2006 cannot constitute, within the meaning of Article 10 of Directive 95/46, prior information enabling the data controller to dispense with his obligation to inform the persons from whom data relating to their income are collected as to the recipients of those data. Therefore, it cannot be held that the transfer at issue was carried out in compliance with Article 10 of Directive 95/46.
39 It is necessary to examine whether Article 13 of the directive applies to that failure to inform the data subjects. It is apparent from Article 13(1)(e) and (f) that Member States may restrict the scope of the obligations and rights provided for in Article 10 of the same directive when such a restriction constitutes a necessary measure to safeguard ‘an important economic or financial interest of a Member State […], including monetary, budgetary and taxation matters’ or ‘a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e)’. Nevertheless, Article 13 expressly requires that such restrictions are imposed by legislative measures.
40 Apart from the fact, noted by the referring court, that data relating to income are not part of the personal data necessary for the determination of whether a person is insured, it must be observed that Article 315 of Law No 95/2006 merely envisages the principle of the transfer of personal data relating to income held by authorities, public institutions and other institutions. It is also apparent from the order for reference that the definition of transferable information and the detailed arrangements for transferring that information were laid down not in a legislative measure but in the 2007 Protocol agreed between the ANAF and the CNAS, which was not the subject of an official publication.
41 In those circumstances, it cannot be concluded that the conditions laid down in Article 13 of Directive 95/46 permitting a Member State to derogate from the rights and obligations flowing from Article 10 of the directive are complied with.
42 As regards, in the second place, Article 11 of the directive, paragraph 1 of that article provides that a controller of data which were not obtained from the data subject must provide the latter with the information listed in subparagraphs (a) to (c). That information concerns the identity of the data controller, the purposes of the processing, and any further information necessary to ensure the fair processing of the data. Amongst that further information, Article 11(1)(c) of the directive refers expressly to ‘the categories of data concerned’ and ‘the existence of the right of access to and the right to rectify the data concerning him’.
43 It follows that, in accordance with Article 11(1)(b) and (c) of Directive 95/46, in the circumstances of the case in the main proceedings, the processing by the CNAS of the data transferred by the ANAF required that the subjects of the data be informed of the purposes of that processing and the categories of data concerned.
44 It is apparent from the information given by the referring court, however, that the CNAS did not provide the applicants in the main proceedings with the information listed in Article 11(1)(a) to (c) of the directive.
45 It is appropriate to add that, in accordance with Article 11(2) of Directive 95/46, the provisions of Article 11(1) of the directive do not apply when, in particular, the registration or communication of the data are laid down by law, Member States being required to provide appropriate safeguards in those cases. For the reasons set out in paragraphs 40 and 41 of this judgment, the provisions of Law No 95/2006 relied on by the Romanian Government and the 2007 Protocol do not establish a basis for applying either the derogation under Article 11(2) or that provided for under Article 13 of the directive.
46 Having regard to all the foregoing considerations, the answer to the question referred is that Articles 10, 11 and 13 of Directive 95/46 must be interpreted as precluding national measures, such as those at issue in the main proceedings, which allow a public administrative body of a Member State to transfer personal data to another public administrative body and their subsequent processing, without the data subjects having been informed of that transfer or processing.
Costs
47 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Third Chamber) hereby rules:
Articles 10, 11 and 13 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, must be interpreted as precluding national measures, such as those at issue in the main proceedings, which allow a public administrative body of a Member State to transfer personal data to another public administrative body and their subsequent processing, without the data subjects having been informed of that transfer or processing.
[Signatures]
* Language of the case: Romanian.
© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.
BAILII: