Help us make the FRA website better for you!

Take part in a one-to-one session and help us improve the FRA website. It will take about 30 minutes of your time.

YES, I AM INTERESTED NO, I AM NOT INTERESTED

Spain/ Supreme Court/ Roj: STS 2336/2019

Community of Madrid v. State Administration, Mr. José and Others
Deciding body type
National Court/Tribunal
Deciding body
The Supreme Court. Contentious Chamber
Decision date
08/07/2019
ECLI (European case law identifier)
ECLI: ES:TS:2019:2336

Karta tad-Drittijiet Fundamentali tal-Unjoni Ewropea

Title II: Freedoms

Article 7 - Respect for private and family life

Title II: Freedoms

Article 8 - Protection of personal data

VIEW FULL CASE
  • Spain/ Supreme Court/ Roj: STS 2336/2019

    Key facts of the case:

    The Contentious-Administrative Chamber, Third Section of the Supreme Court has heard an appeal in cassation registered under number RCA/1966/2018, filed by the lawyer of the COMMUNITY OF MADRID against the sentence of the First Section of the Contentious-Administrative Chamber of the National Audience of December 1, 2017, which dismissed administrative action No 1558/2015 brought against the decision of the Director of the Data Protection Agency of 16 April 2015 declaring that the Madrid Housing Institute (Consejería de la Vivienda de Madrid, Consejería de Transportes, Infraestructuras y Vivienda de la Comunidad de Madrid) has infringed the provisions of Article 6.1 of Organic Law 15/1999, of 13 December, on the Protection of Personal Data, considered as serious in article 44.3 d) of the aforementioned Organic Law. The ADMINISTRATION OF THE STATE and Mr. José Y OTROS have been appealed.

    The case concerns the inclusion of tenants’ information in a Tender for the sale of 32 developments (rented and leased housing, garages, storerooms and premises) belonging to the Madrid Housing Institute, which was published in the Community of Madrid Official Bulletin (BOCAM), on 7 June 2013. The Tender with all the Annexes was published on the contracting party's profile, in an open file, and on the Community of Madrid's website, on 7 June 2013, and it was available for 19 days. The documentation that could be downloaded contained data relating to dwellings and premises (Annex I), as well as a list of litigious proceedings in which 41 housing units of tenants were included in various legal proceedings (Annex VIII). In the information regarding the address of the housing the name and surnames of the tenants were included, although not their ID card.

     

    After setting out the jurisprudential doctrine set out in the corresponding legal basis of the ruling, which includes Article 8 of the Charter of Fundamental Rights, regarding the applicative interpretation of Article 6 of Law 15/1999 of 13 December on the Protection of Personal Data, the Chamber ruled that the appeal in cassation lodged by the lawyer of the COMMUNITY OF MADRID against the sentence of the First Section of the Contentious-Administrative Chamber of the National Audience of December 1, 2017, issued in the contentious-administrative appeal number 1558/2015, had no place.

    Key legal question:

    The dissemination of personal data in open, that is to say, with unlimited access, on a Public Administration website on the occasion of the processing of an administrative contracting procedure is subject to compliance with the obligations established in Organic Law 15/1999, of 13 December, on the Protection of Personal Data, and, specifically, to the legal duty of having to obtain the consent of those affected regarding the collection and processing of data that are not essential, necessary or pertinent for the adequate and regular exercise of public functions. The exception provided for in article 6.2 of the aforementioned Organic Law cannot be interpreted in an expansive manner.

     

    The question on which the Contentious-Administrative Chamber of the Supreme Court should rule, with the aim of forming jurisprudence, focused on elucidating whether, within the framework of a procedure for the sale by the Administration of litigious real estate, it is possible to dispense with the consent of the affected party, by publicising the tender specifications, which contain certain personal data, as the budget for the application of the exception provided for in Article 6.2 of Organic Law 15/1999, of 13 December, on the Protection of Personal Data is concurrent.

    In more precise terms, the Court should decide whether it is legitimate to dispense with the consent of the data subject in this case, as this is a case in which the disclosure of personal data identificativos of the names and surnames of natural persons is formally protected by a law (article 140 of Law 33/2003, of 3 November, on Public Administration Assets), and the Administration considers that the dissemination of such data is necessary for the exercise of its own functions within the scope of its powers, or if, on the contrary, the unequivocal consent of the same should be required.

    Outcome of the case:

    The High Court rejected the lawsuit declaring that there was no place for the cassation appeal filed by the lawyer of the COMMUNITY OF MADRID against the judgment of the First Section of the Contentious-Administrative Chamber of the National Audience of December 1, 2017, issued in the contentious-administrative appeal number 1558/2015. And it ruled that the Public Administration responsible for the processing of data must comply with the legal duty, consisting of obtaining the consent of the affected persons in accordance with the provisions of article 6 of Organic Law 15/1999, of 13 December, on the Protection of Personal Data, in order not to incur in the infraction provided for in article 44.3 of the aforementioned Organic Law, which considers a serious infraction to treat personal data in violation of the principles and guarantees established in said law.

  • Paragraphs referring to EU Charter

    Article 8 of the Charter of Fundamental Rights of the European Union, under the heading "Protection of personal data", states: "1. Everyone has the right to the protection of personal data concerning him. 2. These data shall be treated fairly, for specific fines and on the basis of the consent of the person concerned or under another legitimate basis provided by law. Every person has the right to access the data collected concerning him or her and to his or her rectificación. 3. Respect for these rules shall be subject to the control of an independent authority.

     

    In the judgement of the Administrative Chamber of the Supreme Court 12/2019 (RC 5579/2017), in relation to the legitimate interest of Internet users to have access to the information in question, it is stated: "[...] Article 11 of the Charter of Fundamental Rights of the European Union proclaims freedom of expression and information in the following terms: "1. Everyone has the right to freedom of expression. This right includes freedom to hold opinions and to receive and impart information and ideas without interference by public authorities and regardless of frontiers. 2. The freedom and pluralism of the media shall be respected.

     

    The Court of Justice of the European Union, interpreting Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, in the judgment of 13 May 2014, (Case C-131/12 ) has pointed out that the processing of personal data by the manager of an internet search engine may affect significantly the fundamental rights to respect for private life and protection of personal data when the search is carried out on the basis of the name of a natural person, since such processing enables any interested party to know through the list of results the structured view of the information relating to that person on the internet, which potentially affects a multitude of aspects of his private life. The Court of Justice maintains that the removal of links from the list of results on the basis of the name of the natural person concerned by the dissemination of the news could have an impact on the legitimate interest of internet users potentially interested in having access to the information in question. It is therefore necessary to strike a fair balance between this interest and the fundamental right of the person concerned under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

     

    The judgment of the European Court of Justice of 13 May 2014 (Case C-131/12 ) clearly sets out the commitments and obligations acquired by the Member States of the European Union to protect citizens' right to privacy against the mechanised processing of their personal data, in the light of the Charter of Fundamental Rights and Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, in the following terms: "66 As a preliminary point, it should be recalled that, as is clear from Article 1 and recital 10 thereof, Directive 95/46 is intended to ensure a high level of protection of the freedoms and fundamental rights of natural persons, in particular their privacy, with regard to the processing of personal data (see, to that effect, IPI, EU:C:2013:715, paragraph 28).

    The Court of Justice has already held that the provisions of Directive 95/46, in so far as they regulate the processing of personal data liable to infringe fundamental freedoms and, in particular, the right to privacy, must be interpreted in the light of the fundamental rights which, according to settled case-law, form part of the general principles of law guaranteed by the Court of Justice and which are currently enshrined in the Charter (see, in particular, Connolly v Commission, C-274/99 P , EU:C:2001:127 , paragraph 37, and Österreichischer Rundfunk and others, EU:C:2003:294 , paragraph 68).

     

    Thus, Article 7 of the Charter guarantees respect for private life, while Article 8 of the Charter expressly proclaims the right to the protection of personal data. Paragraphs 2 and 3 of the latter specify that these data will be treated fairly, for fines concrete and on the basis of the consent of the person concerned or under another legitimate basis provided by law, that every person has the right to access data collected concerning him and to obtain his rectificación and that compliance with these rules will be subject to control by an independent authority. These requirements apply in particular Articles 6, 7, 12, 14 and 28 of Directive 95/46.

     

  • Paragraphs referring to EU Charter (original language)

    El artículo 8 de la Carta de los Derechos Fundamentales de la Unión Europea , bajo la rúbrica "Protección de datos de carácter personal", dispone: "1. Toda persona tiene derecho a la protección de los datos de carácter personal que la conciernan. 2. Estos datos se tratarán de modo leal, para fines concretos y sobre la base del consentimiento de la persona afectada o en virtud de otro fundamento legítimo previsto por la ley. Toda persona tiene derecho a acceder a los datos recogidos que la conciernan y a su rectificación. 3 .El respeto de estas normas quedar· sujeto al control de una autoridad independiente.".

     

    En la sentencia de la Sala de lo Contencioso-Administrativo del Tribunal Supremo 12/2019 (RC 5579/2017), en relación al interés legítimo de los internautas a tener acceso a una información en cuestión, se dice: "[...] En el artículo 11 de la Carta Derechos Fundamentales de la Unión Europea se proclaman la libertad de expresión y de información en los siguientes términos: "1. Toda persona tiene derecho a la libertad de expresión. Este derecho comprende la libertad de opinión y la libertad de recibir o de comunicar informaciones o ideas sin que pueda haber injerencia de autoridades públicas y sin consideración de fronteras. 2. Se respetan la libertad de los medios de comunicación y su pluralismo."

     

    El Tribunal de Justicia de la Unión Europea, interpretando la Directiva 95/46/CE del Parlamento Europeo y del Consejo, de 24 de octubre de 1995, relativa a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos, en la sentencia de 13 de mayo de 2014, (asunto C-131/12 ) ha señalado que el tratamiento de datos personales efectuado por el gestor de un motor de búsqueda de internet puede afectar significativamente a los derechos fundamentales de respeto a la vida privada y la protección de los datos personales cuando la búsqueda se lleva a cabo a partir del nombre de una persona física, toda vez que dicho tratamiento permite a cualquier interesado conocer mediante la lista de resultados la visión estructurada de la información relativa a esa persona en internet, que afecta potencialmente a una multitud de aspectos de su vida privada. El Tribunal de Justicia mantiene que, la supresión de vínculos de la lista de resultados a partir del nombre de la persona física afectada por la difusión de la noticia podría tener repercusión en el interés legítimo de los internautas interesados potencialmente en tener acceso a la información en cuestión, por lo que es necesario buscar un justo equilibrio entre este interés y el derecho fundamental de la persona afectada con arreglo a los artículos 7 y 8 de la Carta de Derechos Fundamentales de la Unión Europea.

     

    En la sentencia del Tribunal de Justicia de la Unión Europea de 13 de mayo de 2014 (Asunto C-131/12 ), se expone de forma clara cuáles son los compromisos y las obligaciones que adquieren los Estados miembros de la Unión Europea para proteger de forma eficaz el derecho a la intimidad de los ciudadanos frente al tratamiento mecanizado de sus datos personales, a la luz de la Carta de Derechos Fundamentales y de la Directiva 95/46/ CE del Parlamento Europeo y del Consejo, de 24 de octubre de 1995, relativa a la protección de las personas físicas en lo que respeta al tratamiento de datos personales y a la libre circulación de estos datos, en los siguientes términos: "66 Con carácter previo, procede recordar que, como se desprende de su artículo 1 y de su considerando 10, la Directiva 95/46 tiene por objeto garantizar un nivel elevado de protección de las libertades y los derechos fundamentales de las personas físicas, sobre todo de su vida privada, en relación con el tratamiento de datos personales (véase, en este sentido, la sentencia IPI, EU:C:2013:715 , apartado 28).

     

    El Tribunal de Justicia ya ha declarado que las disposiciones de la Directiva 95/46, en la medida en que regulan el tratamiento de datos personales que pueden atentar contra las libertades fundamentales y, en particular, contra el derecho a la intimidad, deben ser interpretadas a la luz de los derechos fundamentales que, según reiterada jurisprudencia, forman parte de los principios generales del Derecho cuyo respeto garantiza el Tribunal de Justicia y que están actualmente recogidos en la Carta (véanse, en particular, las sentencias Connolly/Comisión, C-274/99 P , EU:C:2001:127 , apartado 37, y Österreichischer Rundfunk y otros, EU:C:2003:294 , apartado 68).

     

    De este modo, el artículo 7 de la Carta garantiza el respecto de la vida privada, mientras que el artículo 8 de la Carta proclama expresamente el derecho a la protección de los datos personales. Los apartados 2 y 3 de este último precisan que estos datos se tratarán de modo leal, para fines concretos y sobre la base del consentimiento de la persona afectada o en virtud de otro fundamento legítimo previsto por la ley, que toda persona tiene derecho a acceder a los datos recogidos que le conciernan y a obtener su rectificación y que el respeto de estas normas estará sujeto al control de una autoridad independiente. Aplican estos requisitos, en particular, los artículos 6 , 7 , 12 , 14 y 28 de la Directiva 95/46 .