Belgium: /European Union: ECJ Rules On Obligation To Provide Information To Data Subjects

On 7 November 2013, the Court of Justice of the European Union ("ECJ") issued an interesting judgment concerning the obligation to provide information to data subjects when processing their personal data.

The ECJ gave its judgment after a reference for a preliminary ruling by the Belgian Constitutional Court (Grondwettelijk Hof / Cour constitutionnelle) in a case pending before the commercial court of Charleroi.

The institute for real estate agents (Beroepsinstituut van Vastgoedmakelaars / Institut professionnel des agents immobiliers – the "Institute"), a body responsible for ensuring compliance with the conditions of access to and the proper practice of the profession of real estate agent, had relied on services of private detectives to gather information relating to three real estate agents who had allegedly committed acts that were contrary to the ethical rules of the Institute.

The Commercial Court of Charleroi questioned the value to be attributed to the evidence established by the private detectives, given the fact that this proof had been obtained without compliance with the requirements of the protection of individuals with regard to the processing of personal data. The court noted that the Law on the Protection of Privacy in Relation to the Processing of Personal Data of 8 December 1992 (Wet tot bescherming van persoonlijke levenssfeer ten opzichte van de verwerking van persoonsgegevens / Loi relative à la protection de la vie privée à l'égard des traitements de données à caractère personnel) (the "Data Protection Law") required the data subjects to be informed of the processing of their personal data.

Article 3 of the Data Protection Law lays down several exceptions to this obligation of information of "the processing of personal data is carried out solely for journalistic purposes or the purpose of artistic or literary expression and where it is managed by the State security office, by the General intelligence and security service of the armed forces, by public authorities for the purpose of exercising their judicial police duties, by the police services for the purpose of exercising their administrative police duties, or by the European Centre for Missing and Sexually Abused Children."

The Commercial Court of Charleroi was uncertain whether Article 3 of the Law on the Protection of Privacy had not given rise to unequal treatment contrary to Articles 10 and 11 of the Belgian Constitution. In particular, the Commercial Court of Charleroi considered that this may be the case since the provision did not extend to private detectives the exceptions to the obligation to inform the data subjects which apply to other professional categories (or bodies working in the public interest), The Commercial Court of Charleroi therefore referred the case to the Belgian Constitutional Court.

Before examining this issue of inequality, the Belgian Constitutional Court held that it should be determined whether the Law on the Protection of Privacy, had properly implemented Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "Data Protection Directive"), since the Data Protection Law did not provide for exceptions for private detectives comparable to those referred to in Article 13 (1) (d) and (g) of the Data Protection Directive.

Article 13 (1) (d) and (g) of the Data Protection Directive provides that Member States may adopt legislative measures to restrict the scope of a controller's obligation of information when such a restriction constitutes a necessary measure to safeguard "(d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions"; and "(g) the protection of the data subject or of the rights and freedoms of others."

Having doubts as to whether the Member States enjoyed some latitude as to whether or not to adopt the exceptions in question, the Belgian Constitutional Court also decided to stay the proceedings and refer questions to the ECJ for a preliminary ruling.

In its first question, the Belgian Constitutional Court asked whether Article 13 of the Data Protection Directive had to be interpreted as meaning that Member States had the option, or the obligation, to transpose into their national law the exceptions which that article laid down to the obligation to inform data subjects of the processing of their personal data.

In response to this question the ECJ noted that it was clear from the wording and the use of the words "Member States may", that Article 13 (1) of the Data Protection Directive did not oblige the Member States to lay down in their national law exceptions for the purposes listed in Article 13 (1) of the Data Protection Directive. On the contrary, the ECJ noted that the EU legislator had intended to give Member States the freedom to decide whether they wished to take legislative measures aimed at limiting the extent of the obligations to inform the data subjects.

The ECJ thus considered that Article 13 (1) of the Data Protection Directive offered Member States the option to provide for one of the exceptions that it sets out but that Member States were not compelled to do so.

In its second question, the Belgian Constitutional Court asked the ECJ whether the activity of a private detective acting for a professional body in order to investigate breaches of ethics or a regulated profession, fell within the scope of Article 13 (1) of the Data Protection Directive.

In response to this second question, the ECJ held that the activities of a body such as the Institute correspond to the situation referred to in the exception provided for by Article 13 (1) (d) of the Data Protection Directive and was therefore capable of coming under that exception.

However, the ECJ noted that if a Member State had chosen not to implement the exception provided for in Article 13 (1) (d) of the Data Protection Directive, then the data subjects had to be informed of the processing of their personal data. It is therefore "for the Member States to decide whether they consider it necessary to provide, in their legislation for the exception laid down in Article 13 (1) (d) of the [Data Protection Directive] in favour of professional bodies such as IPI, acting directly or with the help of private detectives."

To conclude, given that Belgium did not provide for an exception in the Data Protection Law, the Institute was not entitled to rely on investigations made by private detectives without informing the data subjects.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.