Database Reference
In-Depth Information
From the point of view of data protection the pivotal question is whether the
processing of one's data in a particular database is legitimate. Is there a reason that
legitimizes one's presence in the database? Article 7 of the
DP
Directive gives
several reasons that could make data processing legitimate, the most important
32
one being Article 7(f): when it is “necessary for the purposes of the
legitimate
interests
pursued by the controller”.
33
Thus, the data protection perspective looks
at the legitimacy of one's presence in the database
in itself
.
Contrary to data protection, anti-discrimination would take a
comparative
point
of view: it looks at the difference in treatment between those who are included in
the database and those who are not. Data protection asks: is the goal for which the
data are being processed legitimate? Anti-discrimination asks: is the difference in
treatment legitimized by a related and proportionate difference in the respective
situations?
The interesting move in
Huber
(2008) is that the ECJ interconnects these two
legal regimes. The 'magical' words that link them together are
necessity
and
proportionality
. With regard to data protection,
necessity
is embodied in the
purpose specification principle
, which requires that data must be “collected for
specified, explicit and legitimate purposes and not further processed in a way
incompatible with those purposes” (art. 6(b)
DP
), and
proportionality
is embodied
in the
data quality principle
, which requires,
inter alia
, that the data must be
“adequate, relevant and not excessive in relation to the purposes for which they
are collected and/or further processed”(art. 6(c)
DP
). This entails that even when
the aims of an instance of data processing are legitimate according to art. 7, this
particular instance will only effectively be fully legitimate if the data collected and
the way they are processed are in line with the requirements of art. 6
DP
. In other
words, a processing of data will be lawful if it is legitimate (according to article
7). However, this same processing would lose its legitimacy if it were not,
additionally
, necessary and proportional to the aim pursed (Gutwirth, 2002).
Thus, in
Huber,
it is not disputed that the processing of data of foreign residents
serves objectives of public interest - applying the laws of residence and producing
population statistics, but it is questioned whether these acts of processing are
proportionate to the pursued objectives. In a move that is not uncontested, the
Court engages the
necessity/proportionality
discussion only on the basis of art. 7,
without any additional reference to art. 6. As a result, the Court links art. 7(e) of
the Data Protection Directive to the prohibition of anti-discrimination based on
32
Contrary to what is often argued, we do not believe that the consent criterion of Article
7(a)
DP
is the most important. Since art. 7(e) and (f) do already justify any processing of
personal data tending to the realisation of a legitimate aim of the data controller, the
legitimacy by consent criterion foreseen by art. 7(a) will often, if not always, be
superfluous. If the consent criterion could supersede the other “legitimate aims” criteria
this would perversely imply that consent could legitimize processing for “illegitimate
aims”, which would be an unacceptable outcome.
33
We underline that in
Huber
, the article at stake was Article 7(e), which can be considered
a sub category of article 7(f), as it states that data may be processed if the “processing is
necessary for the performance of a task carried out in the public interest or in the exercise
of official authority vested in the controller or in a third party to whom the data are
disclosed”.
Search WWH ::
Custom Search