menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Spain) language
Contact our local member in Spain mail_outline
Visit the website of RPCC Estudio Jurídico account_balance

arrow_backPrevious Article
Article 86
Next Articlearrow_forward

Processing and public access to official documents

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 86 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 86 keyboard_arrow_up
Show the recitals of the Regulation related to article 86 keyboard_arrow_down Hide the recitals of the Regulation related to article 86 keyboard_arrow_up

(154)This Regulation allows the principle of public access to official documents to be taken into account when applying this Regulation. Public access to official documents may be considered to be in the public interest. Personal data in documents held by a public authority or a public body should be able to be publicly disclosed by that authority or body if the disclosure is provided for by Union or Member State law to which the public authority or public body is subject. Such laws should reconcile public access to official documents and the reuse of public sector information with the right to the protection of personal data and may therefore provide for the necessary reconciliation with the right to the protection of personal data pursuant to this Regulation. The reference to public authorities and bodies should in that context include all authorities or other bodies covered by Member State law on public access to documents. Directive 2003/98/EC of the European Parliament and of the Council (14) leaves intact and in no way affects the level of protection of natural persons with regard to the processing of personal data under the provisions of Union and Member State law, and in particular does not alter the obligations and rights set out in this Regulation. In particular, that Directive should not apply to documents to which access is excluded or restricted by virtue of the access regimes on the grounds of protection of personal data, and parts of documents accessible by virtue of those regimes which contain personal data the re-use of which has been provided for by law as being incompatible with the law concerning the protection of natural persons with regard to the processing of personal data.

Show the recitals of the Directive related to article 86 keyboard_arrow_down Hide the recitals of the Directive related to article 86 keyboard_arrow_up

(72) Whereas this Directive allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Directive,

The GDPR

The right to personal data protection cannot be an absolute obstacle to the communication of administrative documents. For this reason, Article 86 stipulates that the personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in order to reconcile public access to official documents with the right to the protection of personal data.

Recital 154 stipulates that “public authorities and public bodies” should be understood to mean authorities and bodies governed by the law of a Member State in the area of the public access to documents.

These communications must however be in compliance with the law of the Union or the Member State to which the public authority or the public body holding the said administrative documents is subject.

The Directive

The Directive did not address the problem of the access to administrative documents and its reconciliation with the data protection (see however recital 72).

Potential issues

The Regulation refuses to unify the rules in order to ensure the difficult balance between the right of access to administrative documents, data protection and reliance on national law (even though a Union law may also address it).

arrow_back Previous Article • Article 86 • Next Article arrow_forward
arrow_back Previous Article • Article 86 Next Article arrow_forward
arrow_back Previous Article • Article 86 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C-710/23 (3 April 2025) - Ministerstvo zdravotnictví

On those grounds, the Court (First Chamber) hereby rules:

1.      Points 1 and 2 of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that the disclosure of the first name, surname, signature and contact details of a natural person representing a legal person constitutes processing of personal data. The fact that that disclosure is made for the sole purpose of enabling the identification of the natural person authorised to act on behalf of that legal person is irrelevant in that regard.

2.      Article 6(1)(c) and (e) of Regulation 2016/679, read in conjunction with Article 86 of that regulation,

must be interpreted as not precluding national case-law which requires a controller, being a public authority responsible for reconciling public access to official documents with the right to the protection of personal data, to inform and consult the natural person concerned prior to the disclosure of official documents containing such data, provided that such an obligation is not impossible to implement and that it does not require disproportionate effort and, therefore, it does not result in a disproportionate restriction on public access to those documents.

Judgment of the Court 

Retour au sommaire

Spain

STS 1119/2025, 11 September 2025

Retour au sommaire
arrow_back Previous Article • Article 86 Next Article arrow_forward
Regulation
1e 2e

Art. 86

Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation.
1st proposal close

No specific provision
2nd proposal close

Art. 80a

Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union law or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation.
Directive close

(72) Whereas this Directive allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Directive
Spain
compare_arrows
visibility Old law

Disposición adicional segunda. Protección de datos y transparencia y acceso a la información pública.

La publicidad activa y el acceso a la información pública regulados por el Título I de la Ley 19/2013, de 9 de diciembre, de transparencia, acceso a la información pública y buen gobierno, así como las obligaciones de publicidad activa establecidas por la legislación autonómica, se someterán, cuando la información contenga datos personales, a lo dispuesto en los artículos 5.3 y 15 de la Ley 19/2013, en el Reglamento (UE) 2016/679 y en la presente ley orgánica.

 

Disposición final undécima. Modificación de la Ley 19/2013, de 9 de diciembre, de transparencia, acceso a la información pública y buen gobierno.

Se modifica la Ley 19/2013, de 9 de diciembre, de transparencia, acceso a la información pública y buen gobierno, en los siguientes términos:

Uno. Se añade un nuevo artículo 6 bis, con la siguiente redacción:

«Artículo 6 bis. Registro de actividades de tratamiento.

Los sujetos enumerados en el artículo 77.1 de la Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales, publicarán su inventario de actividades de tratamiento en aplicación del artículo 31 de la citada Ley Orgánica.»

Dos. El apartado 1 del artículo 15 queda redactado como sigue:

«1. Si la información solicitada contuviera datos personales que revelen la ideología, afiliación sindical, religión o creencias, el acceso únicamente se podrá autorizar en caso de que se contase con el consentimiento expreso y por escrito del afectado, a menos que dicho afectado hubiese hecho manifiestamente públicos los datos con anterioridad a que se solicitase el acceso.

Si la información incluyese datos personales que hagan referencia al origen racial, a la salud o a la vida sexual, incluyese datos genéticos o biométricos o contuviera datos relativos a la comisión de infracciones penales o administrativas que no conllevasen la amonestación pública al infractor, el acceso solo se podrá autorizar en caso de que se cuente con el consentimiento expreso del afectado o si aquel estuviera amparado por una norma con rango de ley.»

---

Second additional provision: Data protection and transparency and access to public information.

Active publicity and access to public information regulated by Title I of Law 19/2013, of December 9, 2013, on transparency, access to public information and good governance.

government, as well as the active publicity obligations established by regional legislation, shall be subject, when the information contains personal data, to the provisions of Articles

5.3 and 15 of Law 19/2013, Regulation (EU) 2016/679 and this Organic Law.

 

Eleventh final provision. Modification of Law 19/2013, of December 9, on transparency, access to public information and good governance.

Law 19/2013, of December 9, 2013, on transparency, access to public information and good governance, is amended as follows:

A new article 6 bis is added, with the following wording:

"Article 6 bis. Registration of treatment activities.

The subjects listed in Article 77.1 of the Organic Law on the Protection of Personal Data and Guarantee of Digital Rights shall publish their inventory of processing activities in application of Article 31 of the aforementioned Organic Law."

Two. Paragraph 1 of Article 15 shall read as follows:

"If the information requested contains personal data revealing ideology, trade union affiliation, religion or beliefs, access may only be authorized with the express written consent of the data subject, unless the data subject had manifestly made the data public prior to the request for access.

If the information includes personal data referring to racial origin, health or sex life, includes genetic or biometric data or contains data relating to the commission of criminal or administrative offenses that do not entail a public warning to the offender, access may only be authorized with the express consent of the person concerned or if it is covered by a regulation with the rank of law".
Old law close

Article 21.- Communication of data between public administrations.- Organic Law 15/1999 on the Protection of Personal Data.-

1. Personal data collected or drawn up by public administrations in the performance of their tasks shall not be communicated to other public administrations for the exercise of different powers or powers relating to other matters, unless such communication has been provided for in the provisions creating the file, or in a higher-ranking provision regulating its use, or where the communication is for the purpose of subsequent processing for historical, statistical or scientific purposes.

2. Personal data which a public administration obtains or draws up on behalf of another administration may be communicated.

3. Notwithstanding the provisions of Article 11.2.b), communication of data obtained from sources accessible to the public shall apply to files in private ownership only with the consent of data subject or when a law stipulates otherwise.

4. In the cases provided for in paragraphs 1 and 2 of this Article, the consent of the data subject referred to in Article 11 of this Law shall not be required.
arrow_back Previous Article • Article 86 Next Article arrow_forward
close

2016 - www.itiplaw.eu.