EU Court Expands GDPR Reach: Oral Data Sharing Now Requires Protections

EU Court Expands GDPR Reach: Oral Data Sharing Now Requires Protections

The Court of Justice of the European Union (CJEU) issued a ground-breaking decision in the Endemol Shine case (C-740/22) on March 7, 2024. This judgment broadens the definition of "processing" under the General Data Protection Regulation (GDPR) to include the oral disclosure of personal data.

In its ruling, the CJEU not only clarified the concept of "processing" but also skillfully addressed the intricate equilibrium between the public's right to access official documents and the imperative to safeguard personal data. The CJEU concluded that fundamental rights to privacy and personal data protection outweigh the public's interest in accessing official documents.

The appeal raised three key questions for the CJEU:

1. Does verbally sharing personal data qualify as "processing" under the GDPR?

2. Can information about criminal convictions, stored in a court filing system, be disclosed orally for public access to official documents?

3. Does the identity of the person requesting the information (company or individual) matter?

The case stemmed from a situation in Finland where Endemol Shine, a production company, sought information on a participant's criminal record from a District Court. This request was made verbally. The court, however, refused, citing a lack of legitimate reason under Finnish law implementing Article 10 of the GDPR. Endemol Shine appealed, arguing that oral data disclosure wouldn't constitute "processing" under the regulation.

The CJEU's judgment clarified several aspects. Firstly, it emphasised the broad scope intended by the EU legislature for "processing" under the GDPR. This includes oral disclosure of personal data, as written down in Article 4(2). The court reasoned that allowing companies to circumvent the GDPR by simply talking about personal data would undermine its core objective: protecting the fundamental rights and freedoms of individuals.

Secondly, the CJEU confirmed that the data requested by Endemol Shine resided in a "court's register of persons," a filing system under Article 4(6) of the GDPR. This solidified the applicability of the regulation to this case.

However, the court also acknowledged the public interest in accessing official documents. Here, the CJEU struck a crucial balance. While recognizing this interest, it ultimately ruled that the fundamental rights of data subjects to privacy and personal data protection outweigh the public's right to access information, especially when dealing with sensitive data like criminal convictions. This right to privacy prevails regardless of whether the data seeker is a company or an individual.

This decision has significant implications for data handling practices across the EU. Here are some key takeaways:

• The scope of "processing" under the GDPR is broader than previously understood. Even oral communication of personal data falls under its purview.

• Companies cannot avoid GDPR obligations by simply opting for verbal communication of personal data.

• Personal data related to criminal convictions, stored in court-maintained registers, cannot be disclosed orally for public access unless the requester demonstrates a specific need for the information, irrespective of their identity.

This ruling holds great significance as it affirms the expansive definition of 'processing' under the GDPR, underscoring that GDPR obligations cannot be evaded by merely verbally disclosing personal data instead of putting it in writing.

Moreover, the verdict mandates that personal data concerning an individual's criminal convictions, documented in a court-maintained register, cannot be disclosed to any individual seeking access to official documents unless the requester demonstrates a specific interest in obtaining the mentioned information, irrespective of whether they are a commercial entity or a private individual.