Can you get around the restrictions in the GDPR by picking up the phone and disclosing personal data orally instead of writing it down? No, confirms the ECJ in Endemol Shine Finland (Case C-740/22).
Endemol Shine Finland is a television production company. It makes all your favourite Finnish reality TV shows including Masterchef Finland, Big Brother Finland and Ex on the Beach Finland Afterski. This case arises out of a request the company made to the District Court of South Savo for information on possible ongoing or completed criminal proceedings concerning a person involved in a competition it was organising. The information, if provided, would be disclosed to the company orally.
The District Court refused the request on the basis that there was not a legitimate reason for processing the criminal offence data under Finnish law, implementing Article 10 of the GDPR.
On appeal Endemol Shine Finland argued that the oral disclosure of the information would not constitute processing of personal data within the meaning of Article 4(2) of the GDPR. The Finnish Court of Appeal requested a preliminary ruling on, amongst other things, whether oral disclosures of information constituted processing of personal data within the meaning of Article 4(2) of the GPDR and, if so, whether the particular processing in the case came within the material scope of the GDPR.
The ECJ held the concept of processing in Article 4(2) of the GPDR necessarily covered the oral disclosure of personal data: [32]. This conclusion was supported by the wording of Article 4(2), which made it apparent that the EU legislature intended to give the concept of processing a broad scope [29], and by the objective of the GDPR, which seeks, amongst other things, to ensure a high level of protection of the fundamental rights and freedoms of natural persons. The ECJ stated, “The possibility of circumventing the application of that regulation by disclosing personal data orally rather than in writing would be manifestly incompatible with that objective”: [31].
The ECJ went on to consider whether the oral processing of the data would fall within the material scope of the GDPR. It held that it was clear from the request for a preliminary ruling that the data sought is contained in “a court’s register of persons” which appeared to be a filing system within the meaning of Article 4(6), and therefore fell within the scope of the GDPR: [38].
This judgment is obviously not binding on UK courts, but it would be safe for data controllers to assume that they can’t simply sidestep the UK GDPR by picking up the phone and making an oral disclosure.
The decision also confirms that the concept of data processing is broader under the GDPR than it was under the Data Protection Act 1998. In Scott v LGBT Foundation Ltd [2020] WLR 62, Sani J held that the DPA 1998 did not apply to purely verbal communications. Christopher Knight blogged about that judgment here.
Oliver Mills