Vyriausioji tarnybinės etikos komisija (Opinion) French Text [2021] EUECJ C-184/20_O

1.

Known for having conceived the panopticon, a type of prison architecture to enable a guard, positioned in a central tower, to observe all the prisoners confined in individual cells surrounding the tower, who are unable to know that they are being observed, the English philosopher Jeremy Bentham also applied his desire for transparency to public life and considered that ‘the eye of the public makes the statesman virtuous’. ( 2 ) Those are certainly prophetic words, as regards at least the proposed mechanism, judging by the significant number of laws within the European Union that now require at least partial public disclosure on the declarations of interests and assets of those in public positions.

2.

Those enactments all seek to strike a balance between public disclosure and maintaining the privacy of the data subjects. The present case specifically concerns the compatibility with EU law of the processing of personal data that is characterised by part of the content of declarations of interests being placed online on the website of the public authority responsible for collecting and checking those declarations. Its interest also lies in the fact that it provides the Court with the opportunity to clarify the scope of the concept of special categories of data known as ‘sensitive data’.

3.

Apart from certain provisions of primary law, namely Articles 7, 8 and Article 51(2) of the Charter of Fundamental Rights of the European Union (‘the Charter’), also relevant in the present case are Articles 3 and 6 to 8 of Directive 95/46/EC ( 3 ) and Articles 2, 5, 6 and 9 of Regulation (EU) 2016/679. ( 4 )

4.

The Lietuvos Respublikos viešųjų ir privačių interesų derinimo įstatymas Nr. VIII-371 (Law No. VIII-371 of the Republic of Lithuania on the reconciliation of public and private interests) of 2 July 1997 (Žin., 1997, No 67-1659), in the version in force at the material time ( 5 ) (‘the Law on the reconciliation of interests’) provided, in Article 1, that it aims to reconcile the private interests of persons working in the public service and the public interests of society, to ensure, when decisions are taken, that the public interest takes precedence, to guarantee the impartiality of the decisions taken, and to prevent corruption from emerging and spreading in the public service. ( 6 )

5.

Article 6 of that law, entitled ‘Content of the declaration’, provided:

‘1.   The declarant shall set out in his or her declaration the following data concerning the declarant and his or her spouse, cohabitee or partner:

2.   The declarant may omit data relating to his or her spouse, cohabitee or partner if they are living apart, do not form a common household and the declarant is therefore not in possession of those data.’

6.

Article 10 of the Law on the reconciliation of interests, entitled ‘Public disclosure of data relating to private interests’, provided:

‘1.   Data set out in the declarations of elected representatives and persons occupying political posts, State officials, judges, heads and deputy heads of State or local authority institutions, temporary officials of political (personal) trust, State officials performing the duties of the head and deputy head of subdivisions of institutions or establishments, heads and deputy heads of undertakings and budgetary authorities of the State or of a local authority, heads and deputy heads of public establishments or associations that receive finance from the budget or from funds of the State or of a local authority, employees of the Bank of Lithuania with powers of public administration (performing functions in relation to supervision of the financial markets, to the extrajudicial settlement of disputes between consumers and financial market participants, and other public administration functions), members of the supervisory or administrative board and managers and deputy managers of public or private companies limited by shares in which the State or a local authority owns shares conferring on it more than one half of the voting rights in the general meeting of shareholders, members of the administrative board of State or local authority undertakings, presidents and vice-presidents of political parties, unpaid consultants and assistants and advisers of elected representatives and of persons occupying political posts, experts approved by the committees of the Parliament of the Republic of Lithuania, members of ministerial advisory boards, members of the Compulsory Health Insurance Council, unpaid advisers of the Compulsory Health Insurance Council, members of the National Health Council, doctors, dentists and pharmacists working in budgetary authorities or public establishments of the State or of a local authority, in State or local authority undertakings or in undertakings in which the State or a local authority owns shares conferring on it more than one half of the voting rights in the general meeting of shareholders which hold a health-care or pharmacy licence, and members of public procurement panels, persons entrusted by the head of a contracting authority with the award of contracts under the simplified procedure and experts participating in public procurement procedures (with the exception of data set out in the declarations of persons whose data are classified as laid down by statute and/or who carry out intelligence, counter-espionage or criminal intelligence activity) shall be public and be published on the website of the [Chief Ethics Commission] in accordance with the detailed rules laid down by it. Where a person whose data are public loses the status of declarant, the [Chief Ethics Commission], on application by the person concerned, shall remove the declaration from its website.

2.   The following data provided in the declaration cannot be made public: the personal identification number, the social security number, special personal data, and other data disclosure of which is prohibited by statute. In addition, the data of the other party to a transaction shall not be published where that party is a natural person.’

7.

The Vyriausioji tarnybinės etikos komisija (Chief Official Ethics Commission; ‘the Chief Ethics Commission’) is a public authority responsible for ensuring the application of the Law on the reconciliation of interests and, more particularly, for collecting and checking the declarations of interests.

8.

OT is the director of QP, a public establishment governed by Lithuanian law operating in the field of environmental protection.

9.

By a decision of 7 February 2018, the Chief Ethics Commission found that, by failing to lodge with it a declaration of private interests as required by the Law on the reconciliation of interests, OT had infringed Article 3(2) and Article 4(1) of that law.

10.

On 6 March 2018, OT brought an action before the referring court for annulment of that decision. He maintains that he is not a person subject to the obligation to declare private interests laid down in Article 2(1) of the Law on the reconciliation of interests and, furthermore, that publication on the Chief Ethics Commission’s website of the content of his declaration would adversely affect both his right to respect for private life and that of the other persons whom he would, as the case may be, be required to mention in his declaration.

11.

The Chief Ethics Commission contends that OT was required to lodge a declaration of private interests as he was vested with administrative powers within QP, a public institution benefiting from funding from EU structural funds and the budget of the Lithuanian State. It acknowledges that such a declaration may constitute an interference in the private life of OT and his spouse, but that interference is provided for by the Law on the reconciliation of interests.

12.

The referring court considers that the personal data appearing in a declaration of private interests, pursuant to Article 6(1) of the Law on the reconciliation of interests, are an integral part of the private life of the declarant and the other data subjects and that their disclosure, in the case of particularly sensitive data, such as family situation or sexual orientation, might well entail significant nuisance in the lives of those individuals. In its view, the exceptions provided for in Article 10 of that law are insufficient to ensure the protection of those data. In addition, publication on the internet of data relating to circumstances that might influence decision-taking in the exercise of public duties is not necessary for the attainment of the objective pursued by that law, namely implementation of the principle of transparency in the public service. The communication of the personal data appearing in the declaration at issue to the Chief Ethics Commission and the supervisory task assigned to the organs referred to in Article 22 of that law are sufficient measures to ensure the attainment of that objective.

13.

Being uncertain whether the regime established by the Law on the reconciliation of interests is compatible with the provisions of the GDPR, the Vilniaus apygardos administracinis teismas (Regional Administrative Court, Vilnius, Lithuania) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

14.

Pursuant to Article 101 of the Rules of Procedure of the Court, a request for clarification was addressed by the Court to the referring court, which replied by registered letter on 12 May 2021. The European Commission and the Lithuanian, Italian and Finnish Governments lodged written observations. The Lithuanian Government answered the written questions put by the Court in a pleading lodged on 30 July 2021.

15.

It is clear from both the wording and the scheme of Article 267 TFEU that the preliminary ruling procedure presupposes that a dispute is actually pending before the national courts in which they are called upon to give a decision which is capable of taking account of the preliminary ruling. Therefore, the Court may verify of its own motion that the dispute in the main proceedings is continuing. ( 7 )

16.

In answer to a question from the Court concerning the apparent exclusion of the applicant in the main proceedings from the scope ratione personae of the Law on the reconciliation of interests, as amended on 1 January 2020, the referring court stated that the Court’s answer was necessary in order to resolve the dispute in the main proceedings in the light of the national legislation in force on the date of the adoption of the contested decision of the Chief Ethics Commission. It added that the applicant in the main proceedings is still liable to be among the persons covered by that law in its current version.

17.

The referring court stated, also at the Court’s request, that the judgment of the Lietuvos Respublikos Konstitucinis Teismas (Constitutional Court of the Republic of Lithuania) of 20 September 2018 declaring its request for a review of the constitutionality of Article 10 of the Law on the reconciliation of interests inadmissible, on the ground that that provision is not applicable to the dispute in the main proceedings, has no impact on the continuation of the preliminary ruling proceedings. The referring court stated that, even though the question to be resolved is indeed, as the constitutional court stated, whether there has been an infringement of Article 3(2) and Article 4(1) of that law because the applicant in the main proceedings failed to fulfil his obligation to lodge the declaration of interests, review of the legality of the contested decision requires account to be taken of the consequences, resulting from the application of Article 10 of that law, of the lodging of such a declaration, namely the public disclosure on the Chief Ethics Commission’s website of certain data contained in the declaration.

18.

Having regard to the information provided by the referring court, it should be held that the dispute in the main proceedings is still pending before that court and that an answer from the Court to the questions referred remains useful for the resolution of that dispute. I would point out, moreover, that it is not for the Court, in the context of a request for a preliminary ruling, to rule on the interpretation of provisions of domestic law ( 8 ) and that the questions relating to the interpretation of EU law submitted by the national court in the factual and legislative context which that court is responsible for defining enjoy a presumption of relevance. It is not quite obvious in the present case that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose or that the questions put to the Court are hypothetical. ( 9 )

19.

In that regard, the Lithuanian Government’s assertion that the second question referred for a preliminary ruling is ‘theoretical’, on the ground that it is impossible to identify the sensitive data concerned by the publication because the declaration of interests has not been lodged by the applicant in the main proceedings, appears to me to be unfounded. I note that the national legislative framework presented by the referring court makes it possible to identify the nature of the data that should appear in that declaration and to determine with relative accuracy those data that escape publication on the Chief Ethics Commission’s website. To my mind, the Court has before it all the factual and legal material necessary to provide an answer that will be useful for the effective resolution of the dispute.

20.

It is apparent from the request for a preliminary ruling that the referring court clearly accepts that the national legislation at issue comes within the scope of the GDPR – both its scope ratione materiae and its scope ratione temporis – a position which to my mind calls for a number of observations.

21.

In accordance with Article 2(1) of the GDPR, that regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system; thus, the material scope of the GDPR is identical to that of Directive 95/46, which it repealed and replaced.

22.

It should be stated at the outset that the data contained in the declaration of interests that are required to be published on the Chief Ethics Commission’s website, namely, inter alia, the names of certain natural persons, are ‘personal data’ within the meaning of Article 4(1) of the GDPR or Article 2(a) of Directive 95/46, since they constitute ‘information relating to an identified or identifiable natural person’, and the fact that information is provided in the context of a professional activity does not mean that it cannot be characterised as ‘personal data’. ( 10 ) Both the collection of the data by that public body and their dissemination by being placed online on its website therefore constitute ‘the processing of personal data’ for the purposes of Article 4(2) of that regulation or Article 2(b) of that directive. ( 11 )

23.

It must be pointed out that, although in the light of the very broad definition of its scope the GDPR constitutes, in a way, the general law on personal data protection in the European Union, other rules of a sectoral nature which clarify and supplement that regulation have been adopted, and thus are forms of a lex specialis. That is true of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA. ( 12 )

24.

In that regard, Article 2(2)(d) of the GDPR provides that that regulation does not apply to the processing of personal data ‘by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security’. That exception to the applicability of the GDPR must, like the other exceptions provided for in Article 2(2), be interpreted strictly. As stated in recital 19 of that regulation, the reason for that exception is that the processing of personal data for such purposes by the competent authorities is governed by a more specific EU act, namely Directive 2016/680. ( 13 )

25.

That directive, which was adopted on the same day as the GDPR, defines, in Article 3(7), what is to be understood by ‘competent authority’ and such a definition must be applied, by analogy, to Article 2(2)(d) of the GDPR. In that regard, the Court has held that it is apparent from recital 10 of Directive 2016/680 that the concept of ‘competent authority’ must be understood in relation to the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, in view of the arrangements which may prove necessary because of the specific nature of those fields. ( 14 ) In addition, recital 11 of that directive explains that the GDPR applies to processing of personal data that is carried out by a ‘competent authority’, within the meaning of Article 3(7) of the directive, but for purposes other than those of the directive. ( 15 )

26.

In the main proceedings, according to the information provided by the referring court and the Lithuanian Government, the national legislation at issue aims to reconcile the private interests of persons working in the public service and the interests of society, to ensure that the public interest takes precedence when decisions are taken, to guarantee the impartiality of decisions and to ‘prevent corruption from emerging and spreading in the public service’. Corruption may, in particular, correspond to the actions of a person entrusted with a public duty who seeks or accepts an advantage in order to carry out or not carry out an act relating to his or her office, ( 16 ) conduct which may constitute a ‘criminal offence’ within the meaning of Article 2(2)(d) of the GDPR.

27.

In accordance with its general task of ensuring the proper application of the Law on the reconciliation of interests, the Chief Ethics Commission receives the declarations of interests of persons working in the public sector and publishes certain information contained in those declarations on its website. Article 22 of the Law on the reconciliation of interests reveals that, where there is substantiated information that a person is not complying with the legal requirements, the Chief Ethics Commission is empowered to order an inquiry into the conduct of the person concerned, to rectify the findings of the inquiry, to investigate the matter itself and to adopt a decision. In the absence of detail in the file submitted to the Court, the precise nature of the decisions that may be adopted by the Chief Ethics Commission is not obvious, while the case in the main proceedings shows, at the very least, that the Chief Ethics Commission is able to find that there has been an unlawful failure to lodge the declaration of interests, which necessarily results in an obligation for the person concerned to remedy that failure.

28.

In the light of those factors, which reflect the purely national nature of the legislative framework and the domestic scope of the processing carried out by the Chief Ethics Commission with a fundamental objective of deterring, vis-à-vis those working in the Lithuanian public sector, any unlawful conduct in connection with the performance of their duties, it does not seem that that body may be regarded as a ‘competent authority’, within the meaning of Article 3(7) of Directive 2016/680, and, accordingly, that its activities may be covered by the exception provided for in Article 2(2)(d) of the GDPR. Consequently, the publication by the Chief Ethics Commission on its website of personal data contained in declarations of interests made by persons working in the public sector does indeed come within the material scope of the GDPR.

29.

As will be made clear below, in order for the Court to give a useful answer to the questions referred for a preliminary ruling, the answer must cover both the GDPR and Directive 95/46. I would observe, in that regard, that Article 2(2)(d) of the GDPR represents, in part, a continuation of the first indent of Article 3(2) of Directive 95/46, which provides that processing concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law is to be excluded from the scope of that directive, an exception that must be interpreted strictly. It seems clear to me that the processing of personal data by the Chief Ethics Commission does not concern public security, defence or State security. In addition, although it does not appear to be inconceivable that those data may be used in the context of criminal proceedings that might be brought, in the event of offences of active or passive corruption, against declarants, the data at issue in the main proceedings do not appear to have been collected with the specific objective of bringing such criminal proceedings or in the context of State activities relating to areas of criminal law. ( 17 )

30.

It should be noted that the two questions submitted to the Court concern the interpretation of provisions of the GDPR, which became applicable on 25 May 2018 and repealed Directive 95/46 with effect from that date. ( 18 ) However, the decision at issue in the main proceedings was taken on 7 February 2018, that is to say, before 25 May 2018, which must lead to the conclusion that the directive is applicable ratione temporis to the dispute in the main proceedings.

31.

Nonetheless, it is also apparent from the file submitted to the Court that, by its decision, the Chief Ethics Commission declared that, by failing to lodge a declaration of interests, the applicant in the main proceedings had infringed the Law on the reconciliation of interests, thus putting him in the position of having to provide that declaration. As there is nothing in the file to indicate that such a declaration was indeed submitted before 25 May 2018, it cannot be ruled out that, in the present case, the GDPR is applicable ratione temporis. That being so, in order to enable the Court to provide useful answers to the questions submitted by the referring court, those questions should be answered on the basis of both Directive 95/46 and the GDPR. ( 19 ) I would point out that, since the GDPR repealed Directive 95/46 and since the relevant provisions of that regulation have essentially the same scope as the relevant provisions of that directive, the Court’s case-law on that directive is also applicable, in principle, to that regulation. ( 20 )

32.

In the order for reference, which expresses the national court’s doubts as to the compatibility with EU law of the personal data processing carried out by the Chief Ethics Commission, the Court is asked to interpret Article 6(1) and Article 9(1) of the GDPR, in the context of two separate questions. In my view, those questions do not lend themselves to a joint examination, owing to the specific nature of the subject matter of the second question. The issue that is raised is the determination of the scope of the concept of ‘special categories of personal data’, within the meaning of Article 9(1) of the GDPR and Article 8(1) of Directive 96/46, in the context of national legislation which prohibits specifically the disclosure of data that come within those categories.

33.

That discussion is therefore to be distinguished from the discussion of the lawfulness of the processing at issue ( 21 ) prompted by the first question referred, concerning the interpretation of Article 6(1) of the GDPR, which reproduces, with amendments, Article 7 of Directive 95/46. In that regard, it is apparent from the request for a preliminary ruling that the referring court seeks to establish, more generally, whether the processing of personal data at issue in the main proceedings may be regarded as lawful in the light of all the principles relating to the processing of personal data and, in particular, in the light of the principle of proportionality. It follows that account must also be taken, in the answer to be given to the referring court, of the principles set out in Article 5(1) of that regulation and in Article 6(1) of that directive, in particular of the principle of ‘data minimisation’, which requires that the personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed and which gives expression to the principle of proportionality. ( 22 )

34.

By the first question, the referring court asks, in essence, whether Articles 5 and 6 of the GDPR, read in the light of Articles 7 and 8 of the Charter, must be interpreted as precluding national legislation under which part of the personal data contained in the declaration of interests which is required to be lodged by any head of a public establishment that receives public funds must be published on the website of the State authority responsible for collecting those declarations and checking their content.

35.

In accordance with recital 10 and Article 1 of Directive 95/46 and recital 4 and Article 1 of the GDPR, those two measures seek to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data relating to them. ( 23 ) Those rights, enshrined in Article 7 and Article 8, respectively, of the Charter, the latter of which is closely linked to the former, are not absolute rights, but must be considered in relation to their function in society and be weighed against other fundamental rights. Article 8(2) of the Charter thus authorises the processing of personal data if certain conditions are satisfied, namely that the personal data ‘must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some legitimate basis laid down by law’. Furthermore, Article 52(1) of the Charter accepts that limitations may be placed on the exercise of rights such as those enshrined in Articles 7 and 8 of the Charter, on condition that those limitations are provided for by law, that they respect the essence of those rights and freedoms and that, in accordance with the principle of proportionality, they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. They must apply only in so far as is strictly necessary and the legislation which entails the interference must lay down clear and precise rules governing the scope and application of the measure in question. ( 24 )

36.

As is clear from, in particular, the objective of the GDPR and of Directive 95/46, provided that the conditions for the lawful processing of personal data under those measures are satisfied, that processing is deemed also to satisfy the requirements laid down in Articles 7 and 8 of the Charter. Certain requirements set out in Article 8(2) of the Charter are indeed implemented, in particular, in Articles 6 and 7 of Directive 95/46 and in Articles 5 and 6 of the GDPR. ( 25 ) In that regard, it should be noted that, subject to the derogations permitted under Article 13 of that directive and Article 23 of that regulation, any processing of personal data must comply, first, with the principles relating to data quality set out in Article 6 of Directive 95/46 or Article 5 of the GDPR and, second, with one of the criteria governing the legitimacy of data processing listed in Article 7 of that directive or Article 6 of that regulation, both of which provisions set out an exhaustive list of the cases in which the processing of personal data can be regarded as being lawful. ( 26 )

37.

More particularly, the personal data must, under Article 6(1)(b) and (c) of Directive 95/46 or Article 5(1)(b) and (c) of the GDPR, first, be collected for specified, explicit and legitimate purposes and not be processed subsequently in a manner that is incompatible with those purposes and, second, be relevant and not excessive in relation to those purposes. In addition, according to Article 7(c) and (e) of that directive and Article 6(1)(c) and (e) of that regulation, respectively, the processing of personal data is lawful ‘if it is necessary for compliance with a legal obligation to which the controller is subject’ or if it is ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed’. ( 27 )

38.

It must be pointed out that both the GDPR and Directive 95/46 provide that Member States may derogate, in particular, from Article 5 and Article 6(1), respectively, of those measures, where that is necessary in order to safeguard certain important objectives of general public interest, inter alia – for present purposes – the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. Indeed, Article 23(1)(d) of the GDPR, which reproduces in amended form the provision previously set out in Article 13(1)(d) of Directive 95/46, states that EU and Member State law may restrict by way of legislative measures the scope of the obligations and rights provided for in that regulation, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard certain important objectives of general public interest such as that referred to above. ( 28 )

39.

Thus, Article 23 of the GDPR and Article 13 of Directive 95/46 cannot be interpreted as being capable of conferring on Member States the power to undermine respect for private life, disregarding Article 7 of the Charter, or any of the other guarantees enshrined therein. In particular, as is the case for Article 13(1) of Directive 95/46, the power conferred on Member States by Article 23(1) of the GDPR may be exercised only in accordance with the requirement of proportionality, according to which derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary. ( 29 )

40.

I would observe that, as the order for reference stands, it does not seem to me to be possible to determine whether the provisions of the Law on the reconciliation of interests correspond to implementation of Article 13 of Directive 95/46 or Article 23 of the GDPR. It is appropriate, in those circumstances, to examine the lawfulness of the processing at issue in the light of Articles 5 and 6 of the GDPR and of Articles 6 and 7 of Directive 95/46, but the reasoning set out below would be equally relevant in the case of national legislation resulting from the implementation of Article 23 of the GDPR or Article 13 of Directive 95/46.

41.

The requirement that all processing of personal data is to be lawful, set out in Article 6(1) of Directive 95/46 and Article 5(1) of the GDPR, is given concrete form in Articles 7 and 6, respectively, of those measures, which list the various possible legal bases that can ensure that lawfulness.

42.

Thus, the processing of the data is to be lawful, according to Article 7(c) of that directive or Article 6(1)(c) of that regulation, if it is necessary for compliance with a legal obligation to which the controller is subject. In that regard, it seems clear to me that the placing of such data online on the Chief Ethics Commission’s website comes under that provision rather than under Article 7(e) of that directive or under Article 6(1)(e) of that regulation, to which the referring court refers.

43.

In disclosing to the general public, on its website, part of the data contained in the declarations of interests which it has previously collected, the Chief Ethics Commission – the controller – complies with the specific obligation imposed on it by Article 10(1) of the Law on the reconciliation of interests. As the Lithuanian Government submits in its observations, that obligation is included in a binding legislative provision that requires particular processing by the Chief Ethics Commission, which cannot choose whether or not to fulfil that obligation. That situation is distinguished from the situation referred to in Article 7(e) of Directive 95/46 or Article 6(1)(e) of the GDPR, which does not require the controller to be acting under a legal obligation. ( 30 ) In any event, although it is sufficient, as the wording of Article 6(1) of the GDPR, which replaces Article 7 of Directive 95/46, confirms, that a single ground for legitimation may be applicable, the Court has accepted that the same processing might satisfy several grounds for legitimation. ( 31 )

44.

In accordance with Article 6(1)(b) of Directive 95/46 or Article 5(1)(b) of the GDPR, personal data must be processed for legitimate purposes. It must be pointed out that the GDPR has made clear that the legal basis of the processing of such data in order to comply with an obligation imposed on the controller is to be laid down by EU law or the law of the Member State concerned, which must meet an ‘objective of public interest and be proportionate to the legitimate aim pursued’. ( 32 )

45.

As previously mentioned, the public disclosure by the Chief Ethics Commission of part of the personal data contained in the declarations of interests is necessary for compliance with a legal obligation to which that authority is subject. That obligation itself has a general purpose defined in Article 1 of the Law on the reconciliation of interests, the legitimacy of which seems to be objectively indisputable. Ensuring that the public interest takes precedence when decisions are taken by persons working in the public service, ensuring the impartiality of those decisions, preventing conflicts of interest and preventing corruption from emerging and spreading in the public service are manifestly legitimate objectives of public interest ( 33 ) within the meaning of Article 6(3) of the GDPR, and thus capable of allowing a limitation to be placed on the exercise of the rights guaranteed by Articles 7 and 8 of the Charter.

46.

It is not disputed that, since the collection and public disclosure of personal data contained in declarations of interests is provided for by the Law on the reconciliation of interests, the interference with the right to respect for private life which it constitutes must be considered to be formally provided for by law, for the purposes of Article 8(2) and Article 52(1) of the Charter. However, in accordance with Article 52(3) of the Charter, the requirement that the interference be provided for by law must be recognised as having the same scope as that attributed by the European Court of Human Rights in the context of its interpretation of Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950, which covers the lack of precision or insufficient precision of the law. ( 34 )

47.

I note, in that regard, that recital 41 of the GDPR states that the legal basis of the processing or the legislative measure which defines the legal basis must be clear and precise and its application must be foreseeable to persons subject it, in accordance with the case-law of the Court and the European Court of Human Rights. The case-law of the Court ( 35 ) does in fact reflect that requirement of foreseeability, the purpose of which is, in particular, to ensure that the rules governing the scope and application of the measure in question are sufficiently clear and precise, ( 36 ) in such a way as to allow the data subject to understand what types of data will be processed, how they will be processed and the purpose of the processing. ( 37 )

48.

In the present case, although to my mind the national legislation at issue satisfies the requirement of foreseeability as regards the definition of the type of processing carried out and its purposes, I have, on the other hand, certain questions as regards the determination of the data that are processed. That determination entails reading Article 6 of the Law on the reconciliation of interests, which describes the content of the declaration of interests, in conjunction with Article 10 of that law, which refers to the data ‘provided in the declaration’ that cannot be disclosed on the Chief Ethics Commission’s website. Apart from the choice of a legislative drafting technique that avoids stating in positive terms the data contained in that declaration that must be published, I note that the precise scope of Article 10 of that law is genuinely difficult to apprehend. Indeed, with the exception of the express reference in Article 10(2) to personal identification and social security numbers, a generic reference is made to ‘special personal data’ and to ‘other data disclosure of which is prohibited by statute’. ( 38 )

49.

At the Court’s request, the referring court explained that the special data were, first of all, those set out in Article 2(8) of the Lithuanian Law on the legal protection of personal data, namely those relating to a person’s racial or ethnic origin, political, religious, philosophical or other convictions, trade union membership, health or sex life, and information concerning a criminal conviction of that person, that is to say, a definition similar to that given in EU law. ( 39 ) The referring court also stated that the Lithuanian legislation prohibits the making public of a not insignificant set of information and referred to a number of provisions of the abovementioned law that prohibit the disclosure of various types of data, some of which data are already referred to in Article 10(2) of the Law on the reconciliation of interests while other data covered are prima facie not provided in the declaration of interests that must be lodged with the Chief Ethics Commission. The referring court itself wondered whether the expression ‘other data disclosure of which is prohibited by statute’ did not refer, ultimately, solely to the reference, in Article 10(1) of the Law on the reconciliation of interests, to information in the declarations of persons whose data are classified as laid down by statute and/or who carry out intelligence, counter-espionage or criminal intelligence activity. ( 40 )

50.

It is thus apparent that a person working in the Lithuanian public sector who is required to lodge a declaration of interests with the Chief Ethics Commission is faced with the need to undertake an analysis and research in order to try to determine the exclusions referred to in Article 10 of the Law on the reconciliation of interests and thus the data which are ultimately ‘disclosable’, without being in any way certain about the result of his or her assessment.

51.

Similar doubts, in the light of the requirement of foreseeability, are to my mind raised by Article 6(1) of the Law on the reconciliation of interests which requires the declarant to indicate in the declaration ‘close relatives or other persons or data known by the declarant liable to give rise to a conflict of interests’. The declarant is thus faced with the impossible, or at least the perilous, task of being required to determine what in all honesty he or she considers to be prima facie capable of influencing or appearing to influence the independent and objective exercise of his or her functions, in the knowledge that any omission in that regard might then be held against him or her. That determination of a situation of possible conflict of interests is solely a matter for the legislature and especially not for the citizen concerned.

52.

In that context, it must be recalled that the protection of the fundamental right to respect for private life means, inter alia, that any individual may be certain that the personal data relating to him or her is correct and that it is processed in a lawful manner. ( 41 ) The purpose of the requirement of foreseeability is, in particular, to enable that person to understand the precise extent to which his or her data will be processed and to take the decision, where appropriate, to enforce his or her rights to lodge a complaint with the supervisory authority or bring a legal action against the controller if he or she considers that the processing of the data concerning him or her infringes the GDPR. ( 42 ) It is for the referring court to ascertain, in the light of national law, whether the legal basis of the processing at issue satisfies the requirement of foreseeability. ( 43 )

53.

It seems necessary to me to refer to the observations of the Lithuanian and Finnish Governments highlighting the discretion left to the Member States to determine the processing of personal data, as expressly recognised in Article 6(3) of the GDPR. It is indeed not in dispute that the national legislation may, pursuant to Article 6(3), contain specific provisions to adapt the application of that regulation which may, in particular, relate to the general conditions governing the lawfulness of the processing, the types of data processed and the data subjects. Nonetheless, Article 6(3) of that regulation states that, when such data are processed pursuant to a legal obligation to which the controller is subject, the law of the Member State concerned must meet an objective of public interest and be proportionate to the legitimate aim pursued. Furthermore, the Court has clearly held that, in order to be lawful, all processing of personal data must satisfy a twofold requirement, namely, it must comply with one of the criteria relating to the legitimacy of data processing listed in Article 7 of Directive 95/46 or Article 6 of the GDPR, and it must also comply with the principles relating to data quality set out in Article 6 of that directive or in Article 5 of that regulation, which constitute an expression of the principle of proportionality. ( 44 )

54.

In order to satisfy the conditions laid down by those provisions, it is necessary that the placing online on the Chief Ethics Commission’s website of part of the information contained in the declarations of interests does in fact meet the objective of general interest defined in Article 1 of the Law on the reconciliation of interests, without going beyond what is necessary in order to achieve that objective. As recital 39 of the GDPR makes clear, that requirement of necessity is not met where the objective of general interest pursued can reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter, since derogations and limitations in relation to the principle of protection of such data must apply only in so far as is strictly necessary. ( 45 ) In addition, an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective and the interests and rights at issue. ( 46 )

55.

The requirement of proportionality expresses a relationship between the objectives pursued and the means of achieving those objectives, with the result that there is an overriding need for a clear and precise definition of those objectives. ( 47 ) Both the referring court and the interested parties maintain that the national legislation at issue aims to ensure transparency in the management of the public service so as to strengthen citizens’ trust in public-sector action and to enable them to exercise effective control over the decision makers’ use of the State funds made available to them.

56.

However, as stated above, the objectives of the measure at issue are defined in Article 1 of the Law on the reconciliation of interests and consist in preventing situations of conflict of interests and corruption in the public sector, by reinforcing the probity and impartiality of officials. There is thus no express reference in that provision, according to the information provided in the order for reference, to an objective of transparency. ( 48 ) One might therefore wonder whether the publication on the internet of name-specific data relating to the content of the declaration of interests is a genuinely suitable means of achieving the only aims officially stated in the national legislation, as the effectiveness of the social control made available to the general public, brought about by that general publicity, seems to me to be questionable. ( 49 )

57.

That said, it seems reasonable to me to consider that in the present case the general objective of transparency, as described in the preceding points of this Opinion, is an underlying objective, arising implicitly but necessarily from Article 1 of the Law on the reconciliation of interests. ( 50 ) I would point out that the principle of transparency is enshrined in Articles 1 and 10 TEU and in Article 15 TFEU and that, inter alia, it guarantees that the administration enjoys greater legitimacy and is more effective and more accountable to the citizen in a democratic system. In a situation where the legislation expressly stated an objective of increasing transparency of the use of Community funds and the improvement of the good financial management of those funds by reinforcing public control of the use of the sums in question, the Court held that the publication on the internet of data by name relating to the beneficiaries concerned and the precise amounts received by them was liable to increase transparency with respect to the use of the agricultural aid concerned. The Court stated that such information made available to citizens reinforces public control of the use to which that money is put and contributes to the best use of public funds. ( 51 )

58.

A measure is necessary when the legitimate objective pursued cannot be achieved by a measure that is just as appropriate but less restrictive. In other words, can the objectives pursued by the electronic publication required by the Law on the reconciliation of interests be achieved by other means that are just as efficient but less restrictive of the declarants’ rights to respect for their private life and to the protection of their personal data? The answer to that question must in my view be in the affirmative, for a number of reasons.

59.

In the first place, I share the referring court’s approach that the lodging of the declarations of interests with the Chief Ethics Commission and the checks that must be carried out by that authority are appropriate means sufficient to achieve the objective pursued by the Law on the reconciliation of interests. I am aware, in that regard, that I am departing from the prevailing opinion concerning the requirement of transparency, which has been described as ‘irresistible’ and ‘neurotic’, ( 52 ) and has become an end in itself and an absolute democratic cardinal virtue. I consider, for my part, that what is in the public interest does not necessarily coincide with what is of interest to the public ( 53 ) and that safeguarding public-sector action by preventing conflicts of interest and corruption is basically the responsibility of the State, which cannot, in the name of the dogma of transparency, subcontract to citizens the monitoring of legislation designed to ensure the probity and impartiality of public officials.

60.

More specifically, it should be pointed out that the national legislation at issue has first of all a preventive objective. In that context, the obligation to lodge declarations of interests with a public authority responsible for checking them is in itself capable of ensuring the desired deterrent effect vis-à-vis the affected public decision makers, irrespective of any generalised publicity of part of the content of those declarations.

61.

In addition, although the obligation to lodge declarations of interests is already the expression of transparency, transparency would be enhanced by public and regular feedback on the activity of the independent administrative authority responsible, like the Chief Ethics Commission, for ensuring the correct application of the declaration-of-interests mechanism. The ability to publish a report identifying proven cases of conflicting interests, failures to lodge the declaration and dishonest declarations, and setting out the action taken in relation to those situations, would make it possible to increase the citizen’s trust in public-sector action just as well as, if not better than, information consisting in the placing online of neutral declaratory data.

62.

It should also be borne in mind that, as provided in Article 86 of the GDPR, personal data in official documents held by a public authority may be disclosed by that authority in accordance with EU or Member State law to which the public authority is subject. That being so, it seems relevant to take into account what the public is able to obtain from the Chief Ethics Commission – the public authority that holds the official documents that declarations of interest constitute – under the national rules on public access to documents, access which must be reconciled with the fundamental rights to respect for private life and to the protection of personal data, as Article 86 indeed expressly requires. ( 54 )

63.

The approach under which the legitimate objective of the national legislation may be directly ensured by the checking of the declarations of interests by the Chief Ethics Commission implies that that body has the human, material and legal resources that would enable it to carry out its task effectively. ( 55 ) The question of proportionality is above all, in my view, the question of the means made available to the public authorities responsible for checking the situation of declarants in the light of the number of declarants. In those circumstances, it is for the referring court to ascertain, in the light of the foregoing considerations, whether the objective of the national legislation at issue in the main proceedings could have been achieved just as effectively by the mere compulsory transmission of the declarations of interests to the Chief Ethics Commission and the checking of those declarations, and, more generally, the monitoring of that legislation, by that authority.

64.

If the answer is in the negative, I observe, in the second place, that the question arises of the proportionality of the processing at issue in the light of the type of data published. It should be borne in mind, in that regard, that the condition relating to the necessity of the processing must be examined in conjunction with the ‘data minimisation’ principle, enshrined in Article 6(1)(c) of Directive 95/46 and in Article 5(1)(c) of the GDPR, under which personal data must be ‘adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed’. ( 56 )

65.

As has been mentioned in this Opinion, only a part of the personal data contained in the declarations of interests is required to be subject to electronic publication in accordance with Article 10 of the national legislation at issue. Subject to the interpretation of that provision by the referring court, the data liable to be placed online include, in particular, the names and forenames of the declarant’s spouse, cohabitee or partner and information as to the ‘close relatives or other persons or data known by the declarant liable to give rise to a conflict of interests’.

66.

Whilst, in pursuing an objective of preventing conflicts of interest and corruption in the public sector, it is expedient to require, as part of the content of declarations of interests, information relating to the situation and activities of the declarant’s spouse, cohabitee or partner, the disclosure to the general public of name-specific data relating to those persons and the indicating of the close relatives or other persons known by the declarant liable to give rise to a conflict of interests seem to me to go beyond what is strictly necessary. ( 57 ) The objective of public interest pursued by the Lithuanian legislation at issue could in my view be achieved if the declaration of interests referred only, generically, to a spouse, cohabitee or partner, as the case may be, together with the relevant indication of the interests held by those persons in relation to their activities.

67.

I note, moreover, that under Article 25 of the GDPR controllers must implement, both at the time of the determination of the means for processing and at the time of the processing itself, appropriate technical and organisational measures, such as pseudonymisation, ( 58 ) which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of that regulation and protect the rights of data subjects. Pseudonymisation might therefore be implemented with regard to the designation of the spouse, cohabitee or partner.

68.

In my view, the public disclosure of gifts received during the last 12 calendar months the value of which exceeds EUR 150, and of information about transactions which have been concluded during that period or are still current, if their value is greater than EUR 3000, also exceeds the limits of what is strictly necessary, in so far as those elements include an indication of the nature of the gifts and the subject matter of the transaction concerned. That processing seems disproportionate in that it results in generalised publicity concerning the assets held by the declarant and his or her close relatives, which may be of significant value (works of art, jewellery, and so forth), and thus exposes the persons concerned to the risk of criminal activity. ( 59 ) Here again, mere mention of the donors or of the other party to the transaction, apart from the natural persons already excluded by Article 10(2) of the Law on the reconciliation of interests, may seem sufficient to achieve the objective pursued.

69.

In the third place, the proportionality of the measure at issue should be considered in relation to the determination of the declarants subject to the requirement of online publication of data relating to them.

70.

It is to be noted that, in accordance with the national legislation at issue, the list of persons subject to the obligation to lodge a declaration of interests does not correspond to the more restrictive list of those whose data contained in the declarations are then placed online. The latter category includes, pursuant to the Law on the reconciliation of interests as in force at the time of the adoption of the decision contested in the main proceedings, the heads and deputy heads of associations or public establishments financed by the budgets or funds of the State or a local authority. It is in the light of that status, as a result of which he was treated as a public servant, that the applicant in the main proceedings was considered to come within the scope ratione personae of that law.

71.

He is thus placed on the same level as persons elected to office, State officials, judges, managers of public or private companies limited by shares in which the State or a local authority owns shares conferring on it more than one half of the voting rights, members of the administrative board of State or local authority undertakings, or presidents and vice-presidents of political parties. Such a situation is in my view of such a kind as to amount to disproportionate treatment – because it is undifferentiated treatment – of the participants, in the broad sense, in public-sector action, who are not exposed to the same degree of risks of conflicts of interest or corruption or involved in a relationship of the same intensity with the public, whose trust in public officials is meant to be maintained, or indeed strengthened.

72.

Only the existence of a serious risk of conflicts of interest or of corruption in the context of the administration of public affairs affecting the general public may justify the placing online of the personal data of the declarants who, on account of their elective office or their professional activity, face such a risk. The objective of enhancing the guarantees of probity and impartiality of the other declarants, of preventing conflicts of interest and corruption in the public sector and of strengthening public trust in public officials is directly ensured by the checking of the declarations of interests by the Chief Ethics Commission. Given the extreme variety of the situations that can be imagined, it seems impossible to me to establish exhaustively objective criteria that would render it possible to identify the existence of that risk or to make a systematically relevant categorisation of public decision makers. ( 60 )

73.

It is therefore for the referring court to ascertain whether, in the circumstances of the main proceedings – including, in particular, the nature and the scope of the activity of the public establishment concerned in relation to the public, the decision-making power of the applicant in the main proceedings in connection with the employment or management of public funds, and the amount of those funds allocated and posted on the establishment’s budget – the functions of the person concerned may be considered to expose him to a serious risk of situations of conflicts of interest and corruption liable to have a serious effect on society. ( 61 )

74.

In the light of the foregoing considerations, it does not seem, in my view, that the objectives of preventing conflicts of interest and corruption in the public sector, enhancing the guarantees of probity and impartiality of public decision makers and strengthening citizens’ trust in public-sector action cannot reasonably be achieved just as effectively by other less restrictive means. Consequently, the necessity, in order to ensure those objectives, of the online publication of declarants’ personal data cannot therefore be considered to be made out. ( 62 )

75.

Even if the processing at issue might be characterised as appropriate and necessary (quod non) in order to achieve the objectives pursued, it might nonetheless not be considered lawful. It would still be necessary to ascertain whether the fundamental rights of the person whose data should be protected would take precedence over the legitimate interest pursued by the data controller; the assessment of that condition requires a balancing of the opposing rights and interests concerned, which depends on the individual circumstances of the particular case in question, and in the context of which account must be taken of the significance of the data subject’s rights arising from Articles 7 and 8 of the Charter. ( 63 ) The Court has made clear, in that regard, that no automatic priority can be conferred on the objective of transparency over the right to protection of personal data. ( 64 )

76.

The criterion relating to the seriousness of the interference with the data subject’s rights and freedoms is an essential component of the weighing or balancing exercise on a case-by-case basis. In that respect, account must be taken, inter alia, of the nature of the personal data at issue, in particular of any sensitivity of those data, and of the nature of, and specific methods for, the processing of the data at issue, in particular of the number of persons having access to those data and the methods of accessing them. The data subject’s reasonable expectations that his or her personal data will not be processed when, in the circumstances of the case, that person cannot reasonably expect further processing of those data are also relevant for the purposes of the balancing exercise. Those factors must be balanced against the importance, for the whole of society, of the legitimate interest pursued in the present case by the national legislation at issue, inasmuch as it seeks essentially to ensure the probity and impartiality of public-sector actors and to prevent conflicts of interest and corruption in that sector. ( 65 )

77.

As regards the seriousness of the interference, it should be pointed out, first of all, that the processing at issue does not concern only the actual declarant, who is individually and directly concerned in his or her capacity as public decision maker, but also his or her spouse, partner or cohabitee and, as the case may be, close relatives or persons known by the declarant liable to give rise to a conflict of interests according to the wording of Article 6(1) of the Law on the reconciliation of interests. The term ‘close relatives’ could clearly cover, in particular, the declarant’s children and parents, which potentially leads to the online publication of name-specific data of all the members of a family, together with specific information about their activities.

78.

Next, it is undisputed that the processing at issue has the effect of making the personal data of the abovementioned individuals accessible to an indefinite number of persons. Once those data are placed online on the Chief Ethics Commission’s website, they may be freely consulted by internet users and, as the case may be, retained or disseminated by those persons. Furthermore, the organisation and aggregation of information published on the internet that are effected by search engines with the aim of facilitating their users’ access to that information may, when users carry out their search on the basis of an individual’s name, result in them obtaining through the list of results a structured overview of the information relating to that individual that can be found on the internet, enabling them to establish a more or less detailed profile of the data subject. ( 66 ) Such a disclosure regime is liable to lead to a situation in which those data are disclosed to persons who, for reasons unrelated to the general objective of preventing conflicts of interest and corruption in the public sector, wish to find out about the financial situation of the declarant and the members of his or her family, concerning the ownership of shares, financial investments, movable or immovable property, all of which is information that may appear in the declarations of interests that have to be published. ( 67 ) That disclosure is thus such as to expose the persons concerned to repeated targeted advertising and commercial sales canvassing or even to risks of criminal activity.

79.

In those circumstances, the processing at issue seems to me to constitute a serious interference with the fundamental rights of data subjects to respect for private life and to the protection of their personal data. That finding is capable of justifying the conclusion that the national legislation concerned prima facie does not observe a fair balance as regards the taking into consideration of the rights and interests involved. Nonetheless, the Lithuanian Government points out, rightly, that, when weighing up the rights and interests in question, it is necessary to have regard to the level of corruption observed in the public sector, a level which justifies the adoption by each Member State of what it considers to be the most appropriate means of combating that phenomenon. Indeed, the interest of the public in accessing information may, even within the European Union, vary from one Member State to another, so that the result of the weighing up of that interest, on the one hand, and the data subject’s rights to respect for family life and to the protection of personal data, on the other hand, is not necessarily the same for all Member States. ( 68 ) In the present case, the reality and the extent of a phenomenon of corruption in the public service are in my view particular circumstances specific to the main proceedings which it is for the referring court to assess. ( 69 )

80.

It should be recalled that Article 10(2) of the Law on the reconciliation of interests lays down a general prohibition on the publication of personal data coming within special categories, and makes no provision for any attenuation of that prohibition. According to the referring court, the implementation of that provision causes difficulties, which leads it to ask the Court, in essence, about the scope, in EU law, of the concept of ‘special categories of personal data’ which is referred to in Article 9(1) of the GDPR.

81.

That article, which reproduces with some amendments Article 8(1) of Directive 95/46, provides that processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation are to be prohibited. ( 70 )

82.

The referring court considers that, even though the data coming in the strict sense within the special categories are not placed online on the Chief Ethics Commission’s website, it is possible for an internet user to deduce from certain data covered by the mandatory publication requirement laid down in Article 10(1) of the Law on the reconciliation of interests sensitive information relating, in particular, to a declarant’s political opinions, trade union membership or sexual orientation. ( 71 ) In that regard, it indeed cannot be denied that, although the name-specific data relating to the declarant’s spouse, cohabitee or partner do not in themselves constitute sensitive data, the fact that they are placed online is liable to reveal to the public the declarant’s sex life or sexual orientation, as well as that of his or her spouse, cohabitee or partner.

83.

The question referred is therefore whether Article 9(1) of the GDPR or Article 8(1) of Directive 95/46 must be interpreted as encompassing the processing of personal data that are prima facie not sensitive which, by means of an intellectual exercise involving comparison and/or deduction, enables sensitive date to become known indirectly. The Lithuanian Government objects to such an interpretation, in that its effect would be to render the processing of certain data, and thus the attainment of the legitimate objective pursued, such as the publication of data relating to the spouse, cohabitee or partner for the purposes of preventing conflicts of interest and corruption in the public sector, difficult or indeed impossible. In its submission, only processing that is clearly intended to process personal data coming inherently within the special categories is covered by Article 9(1) of the GDPR or Article 8(1) of Directive 95/46, ( 72 ) and such processing is precluded in the present case, in the light of the prohibition of the publication of sensitive data contained in Article 10(2) of the Law on the reconciliation of interests.

84.

According to settled case-law, in interpreting a provision of EU law it is necessary to consider not only its wording, but also the context in which it occurs and the objectives pursued by rules of which it is part. ( 73 )

85.

In the first place, it follows from the wording of Article 9(1) of the GDPR that that regulation distinguishes three types of processing according to the type of data concerned, namely: (i) the processing of personal data ‘revealing’ racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; (ii) the processing of genetic data and of biometric data for the purpose of uniquely identifying a natural person; and (iii) the processing of data ‘concerning’ health or ‘concerning’ a natural person’s sex life or sexual orientation. Those words reproduce in part the wording of Article 8(1) of Directive 95/46, according to which Member States are to prohibit the processing of personal data ‘revealing’ racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of data ‘concerning’ health or sex life. The use of the verb ‘reveal’ is consistent with the taking into account of processing that not only is of inherently sensitive data but indirectly enables disclosure thereof following an intellectual exercise involving deduction or cross-referencing. That does not apply, in my view, to the word ‘concerning’, which strikes a more direct and more immediate link between the processing and the data concerned, envisaged from an inherent point of view. ( 74 ) It seems that such an interpretative analysis must lead to the conclusion that the definition of processing of special categories of personal data varies according to the type of sensitive data concerned, which in my view is not desirable. ( 75 )

86.

I further note that, at least so far as biometric data are concerned, the EU legislature was careful to state, in recital 51 and Article 9(1) of the GDPR, that the processing of photographs should not systematically be considered to be processing of special categories of personal data, as they are covered by the definition of biometric data only when processed through a specific technical means ‘for the purpose of’ uniquely identifying a natural person. The purposive approach to which the Lithuanian Government refers seems here to apply only to biometric data.

87.

In the second place, it seems to me that it is also relevant to view the question of the determination of the special categories of personal data together with the question of the definition of an ‘identifiable natural person’, namely a natural person who can be identified, directly or ‘indirectly’, in particular by reference to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity. ( 76 ) The European legislature thus chooses a realistic approach by taking into account the possibility of reconstituting information from the cross-referencing or aggregation of varied elements.

88.

In the third place, it should be borne in mind that, as follows from Article 1 and recital 10 of Directive 95/46, and from Article 1 and recital 4 of the GDPR, those two measures seek to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data relating to them. ( 77 ) Furthermore, specific and enhanced protection is the objective sought where sensitive data are processed, having regard to the significant risks for fundamental rights and freedoms inherent in that type of processing. ( 78 ) The solutions adopted by the Court in its preliminary rulings reflect the taking into consideration of that objective.

89.

Thus, when asked by a referring court whether the information that a person had injured her foot and was on half-time on medical grounds constituted personal data concerning health within the meaning of Article 8(1) of Directive 95/46, the Court answered in the affirmative, stating that, in the light of the purpose of that directive, the expression ‘data concerning health’ used in Article 8(1) of that directive must be given a ‘wide interpretation’ so as to include information concerning all aspects, both physical and mental, of the health of an individual. ( 79 )

90.

The Court has held that an interpretation of Article 8(1) and (5) of Directive 95/46 or Article 9(1) and Article 10 of Regulation 2016/679 that excluded a priori and generally the activity of a search engine from the specific requirements laid down by those provisions for processing relating to the special categories of data referred to there would run counter to the purpose of those provisions, namely to ensure ‘enhanced protection’ as regards such processing, which, because of the particular sensitivity of the data, is liable to constitute, as also follows from recital 33 of that directive and recital 51 of that regulation, a particularly serious interference with the fundamental rights to privacy and the protection of personal data, guaranteed by Articles 7 and 8 of the Charter. ( 80 )

91.

Accordingly, it cannot be accepted that the processing of personal data that might lead to the indirect disclosure of sensitive data of the data subject should escape the obligations and guarantees laid down by Directive 95/46 and the GDPR; that would compromise the effectiveness of those measures and the effective and complete protection of the fundamental rights and freedoms of natural persons which they seek to ensure, in particular their right to privacy, with respect to the processing of personal data, a right to which those measures accord special importance, as is confirmed in particular by Article 1(1) and recitals 2 and 10 of that directive and Article 1(2) and recitals 1 and 4 of the GDPR. ( 81 ) In other words, the fact that information relating to, in particular, the sex life or sexual orientation of the declarant and of his or her spouse, cohabitee or partner is brought indirectly to the knowledge of the general public cannot be regarded as collateral damage that is regrettable but acceptable in the light of the purpose of a processing which is not prima facie concerned with sensitive data or which indeed expressly prohibits their use, as in the present case.

92.

That solution is in my view consistent with the approach taken by the Court, which, going beyond formal appearances, carries out a substantive analysis of the processing in question in order to verify the real scope of the type of data processed. Assessing the proportionality of national legislation that allowed a State authority to require providers of electronic communications services to carry out the general and indiscriminate transmission of traffic data and location data for the purpose of safeguarding national security, the Court held that the interference with the right enshrined in Article 7 of the Charter entailed by the transmission of such data must be regarded as being particularly serious, bearing in mind inter alia ‘the sensitive nature of the information which [those] data may provide’. ( 82 )

93.

In its opinion on the compatibility of the draft agreement between Canada and the European Union on the transfer and processing of passenger name record data ( 83 ) with Article 16 TFEU and Article 7, Article 8 and Article 52(1) of the Charter, the Court analysed the existence of an interference with the fundamental right to the protection of personal data that is guaranteed in Article 8 of the Charter. In that regard, it observed that although some of those data, taken in isolation, do not appear to be liable to reveal important information about the private life of the persons concerned, the fact remains that, taken as a whole, the data may, inter alia, reveal a complete travel itinerary, travel habits, relationships existing between two or more persons and information relating to the financial situation of air passengers, their dietary habits or state of health, and ‘may even provide sensitive information about those passengers’. Assessing the necessity of the interferences caused by the draft agreement, as regards the data of the air passengers which it covered, the Court stated that, although none of the 19 headings set out in the annex to that agreement expressly refers to sensitive data, such data could nevertheless fall under one of those headings.

94.

Such an approach is, admittedly, not unproblematic. Thus, the determination of the purposes but especially of the means of the processing will have to be subject to a particularly attentive evaluation including the potential processing of sensitive data (which is readily identifiable in the case in the main proceedings). That, however, is merely the protection of data from the outset of the processing that is already required in Article 25 of the GDPR. In addition, it seems wrong to me to rely, as the Lithuanian Government does, on a negative consequence based on the assertion that certain types of processing, such as that at issue in the main proceedings, are impossible to implement. It must be emphasised that the prohibition of processing of special categories of personal data is relative, as certain exceptions and derogations are provided for in Article 8(2) and (4) of Directive 95/46 and Article 9(2) of the GDPR, the latter provision mentioning no fewer than 10 situations in which the processing of sensitive data is lawful. I observe, in that regard, that the processing at issue could perfectly well have been based on Article 8(4) of Directive 95/46, which was reproduced, with some amendments, in Article 9(2)(g) of the GDPR, ( 84 ) if the Lithuanian legislature had not chosen to prohibit the publication of sensitive data. ( 85 )

95.

In the light of the foregoing considerations, I propose that the Court answer the Vilniaus apygardos administracinis teismas (Regional Administrative Court, Vilnius, Lithuania) as follows: