The Court of Justice of the European Union has given Spain a smacked wrist over its data protection laws, effectively saying that they were too weighted in favour of the data subject’s privacy.
The prosaically-named law in question (“Spanish Organic Law 15/1999 and Royal Decree 1720/2007”) only allowed the data controller to process personal data without the subject’s express consent if the data was already in the public domain. Any readers who deal with the personal data of others will appreciate how restrictive that could be.
This went further than the requirements of the Data Protection Directive, which is designed to balance the the privacy of data subjects against the needs of data controllers to use and transfer data. Whether it achieves such a balance is another question – there will no doubt be many contributions to the current review of the Data Protection Directive arguing that it goes too far one way or the other.
The Spanish position makes an interesting contrast with the UK’s. We have also been criticised for not transposing the terms of the Directive correctly, in enacting the Data Protection Act 1998, but from a different direction. The Directive says that data, which at first sight seems anonymous, will be personal data if a third party could combining the data with other information they already have in order to identify the data subject. The DPA, however, concerns itself only with whether a person can be identified by combining that data with other information held by the data controller. It has therefore been accused of not going far enough to protect individuals’ privacy.
This issue has caused no end of difficulty in cases involving the overlap between the DPA and FOI, and the Courts now seem to be taking the line that information available to third parties is relevant – e.g Craigdale Housing Association v Scottish Information Commissioner and Department of Health v Information Commissioner. The legal basis on which they’re doing that is not entirely clear, but it’s quite possible that their efforts may be keeping the UK from suffering the same fate as the Spanish.
On December 2, 2011