The GDPR
The right to personal data protection cannot be an absolute obstacle to the communication of administrative documents. For this reason, Article 86 stipulates that the personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in order to reconcile public access to official documents with the right to the protection of personal data.
Recital 154 stipulates that “public authorities and public bodies” should be understood to mean authorities and bodies governed by the law of a Member State in the area of the public access to documents.
These communications must however be in compliance with the law of the Union or the Member State to which the public authority or the public body holding the said administrative documents is subject.
The Directive
The Directive did not address the problem of the access to administrative documents and its reconciliation with the data protection (see however recital 72).
Potential issues
The Regulation refuses to unify the rules in order to ensure the difficult balance between the right of access to administrative documents, data protection and reliance on national law (even though a Union law may also address it).
European Union
CJEU caselaw
C-710/23 (3 April 2025) - Ministerstvo zdravotnictví
On those grounds, the Court (First Chamber) hereby rules:
1. Points 1 and 2 of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
must be interpreted as meaning that the disclosure of the first name, surname, signature and contact details of a natural person representing a legal person constitutes processing of personal data. The fact that that disclosure is made for the sole purpose of enabling the identification of the natural person authorised to act on behalf of that legal person is irrelevant in that regard.
2. Article 6(1)(c) and (e) of Regulation 2016/679, read in conjunction with Article 86 of that regulation,
must be interpreted as not precluding national case-law which requires a controller, being a public authority responsible for reconciling public access to official documents with the right to the protection of personal data, to inform and consult the natural person concerned prior to the disclosure of official documents containing such data, provided that such an obligation is not impossible to implement and that it does not require disproportionate effort and, therefore, it does not result in a disproportionate restriction on public access to those documents.
Judgment of the Court
Retour au sommaire
Retour au sommaire