Personal Data in the CJEU

Working out what is and what is not personal data is often difficult, and all the more so where a document is contains different sections or has mixed purposes. In Cases C‑141/12 and C‑372/12 YS v Minister voor Immigratie, Integratie en Asiel (judgment of 17 July 2014, nyr), a request had been made by an immigrant in Holland for a copy of an administrative report concerning his application for a residence permit. It is helpful to set out the details of the document sought. A case officer drafts a document in which he explains the reasons for his draft decision (“the Minute”). The Minute is part of the preparatory process within that service but not of the final decision, even though some points mentioned in it may reappear in the statement of reasons of that decision.

Generally, the Minute contains the following information: name, telephone and office number of the case officer responsible for preparing the decision; boxes for the initials and names of revisers; data relating to the applicant, such as name, date of birth, nationality, gender, ethnicity, religion and language; details of the procedural history; details of the statements made by the applicant and the documents submitted; the legal provisions which are applicable; and, finally, an assessment of the foregoing information in the light of the applicable legal provisions. This assessment is referred to as the ‘legal analysis’. Depending on the case, the legal analysis may be more or less extensive, varying from a few sentences to several pages. In an in-depth analysis, the case officer responsible for the preparation of the decision addresses, inter alia, the credibility of the statements made and explains why he considers an applicant eligible or not for a residence permit. A summary analysis may merely refer to the application of a particular policy line.

Was the Minute personal data within the meaning Article 2(a) of Directive 95/46/EC? There is no doubt, said the CJEU, that the data relating to the applicant for a residence permit and contained in a minute, such as the applicant’s name, date of birth, nationality, gender, ethnicity, religion and language, are information relating to that natural person, who is identified in that minute in particular by his name, and must consequently be considered to be ‘personal data’: at [38].

However, the legal analysis in the Minute, although it may contain personal data, does not in itself constitute such data: at [39]. Held the CJEU, “a legal analysis is not information relating to the applicant for a residence permit, but at most, in so far as it is not limited to a purely abstract interpretation of the law, is information about the assessment and application by the competent authority of that law to the applicant’s situation, that situation being established inter alia by means of the personal data relating to him which that authority has available to it”: at [40]. Extending the application of personal data to cover the legal analysis would not guarantee the right to privacy, or the right to check the accuracy of the personal data itself, but would amount to a right to administrative documents, which the Directive does not provide: at [45]-[46].

Not the most ground-breaking decision to emanate from Luxembourg, but a nonetheless interesting reminder of the utility of carefully distinguishing between different types of data within the same document.

Christopher Knight