On 17 July 2014, the Court of Justice of the European Union (the "ECJ") handed down an interesting judgment providing further guidance on what constitutes personal data for the purpose of EU law.

The case concerned a request for a preliminary ruling made by a Dutch court following an action brought by third country nationals who had filed an application for residency with the Dutch Immigration and Naturalisation Service (the "INS").

When the INS processes an application for residency, this application is initially reviewed by a case officer who then forwards a draft decision to a reviser. Based on this draft decision, the reviser takes a final decision on the application for residency. As part of this internal process, the case officer must attach to his draft decision an internal administrative document in which he outlines the reasons for a particular decision (the "Minute").

Generally, the Minute contains information such as the name, phone number and office contact details of the case officer responsible for preparing the decision, the names of the reviser and data relating to the applicant (such as name, date of birth, nationality, gender, ethnicity, religion and language). In the Minute, the case officer also addresses the credibility of the statements made by the applicant and outlines the reasons why he believes that the application should succeed or fail (the "Legal Analysis").

In the case at hand, relying on his right to access to personal data, an applicant whose residency application had been refused, requested a copy of the Minute evidencing the refusal. The INS refused to provide a copy of the Minute, and only sent to the applicant a summary of the personal data contained in the document (including information relating to the origin of such data and the bodies to which they were disclosed).

The applicant, however, brought an action before a local court arguing that he could not lawfully be refused access to the Minute. The local court stayed the proceedings and asked the ECJ (i) whether certain data contained in the Minute constituted personal data; (ii) whether the Legal Analysis also constituted personal data; and (iii) how the data could be provided in response to an access request.

Personal Data Contained in Minute

First of all, the ECJ found that there was no doubt that the basic information recorded in the Minute (e.g. the applicant's name, date of birth, nationality) constituted personal data.

Legal Analysis

By contrast, in relation to the Legal Analysis, the ECJ determined that while it may contain personal data, it was not itself personal data. The ECJ noted that such information did not constitute information relating to the applicant, but at most information about the assessment and application of the law to the applicant's situation.

In reaching this conclusion, the ECJ recalled that the protection of the fundamental right to respect for private life meant that a data subject should be certain that the personal data concerning him were correct and that they were processed in a lawful manner. The right of access therefore enabled a data subject to obtain the rectification, erasure or blocking of his data by the controller.

Consequently and in contrast to the basic information contained in the Minute, the ECJ reasoned that the Legal Analysis is not in itself liable to be the subject of a check of its accuracy and request for rectification by the applicant. The ECJ therefore concluded that extending the right of access of the applicant to the Legal Analysis would not serve the applicant's right to privacy.

How to Provide Access to Personal Data

The ECJ then looked at the form of personal data contained in the Minute that was given to the applicant.

The ECJ recalled that Member States were free to determine the material form of the data subject's access to a given document (as long as it was "intelligible" and allowed the data subject to become aware of such data and check that they were accurate).

As long as these objectives are satisfied, the ECJ found that the applicant did not have any right to obtain a copy of the document or the original file in which those data appeared. The ECJ held that it was sufficient for the applicant to be provided with a full summary of all the personal data contained in the Minute without receiving a copy of the Minute. Indeed, such a summary was sufficient to allow the applicant to check that the data was accurate and had been lawfully processed.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.