Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
The CJEU has given a preliminary ruling that oral transfer of personal data does amount to processing for purposes of Article 4(2) of the GDP.
The question was referred to the court for consideration by the Finnish Court of Appeal, and it arises from a case concerning a Finnish television production company, Endemol Shine Finland. The TV company had been organising a competition, and was seeking information from the District Court of South Savo for information about possible criminal proceedings involving one of the participants. They were asking for the information to be disclosed orally.
In the main proceedings it is not disputed that the information they were seeking was personal data within the meaning of Article 4(1) of the GDPR. The question before the court was whether the oral processing would amount to processing of personal data within the meaning of Article 2(1) and Article 4(2) of the GDPR.
Article 4(2) GDPR defines the concept of ‘processing’ as ‘any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means’. Oral processing would therefore appear to fall within Article 4(2).
However, Article 2 GDPR provides that that regulation applies to:
Article 4(6) GDPR gives ‘filing system’ a broad interpretation, covering ‘any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis’.
The information sought by the TV company was contained in the court’s register of persons, and this was held to fall within the definition of a filing system.
The court was quick to point out the danger of allowing oral processing to provide a loophole, pointing out that the GDPR’s objective was “to ensure a high level of protection of the fundamental rights and freedoms of natural persons” and that “circumventing the application of that regulation by disclosing personal data orally rather than in writing would be manifestly incompatible with that objective”.
A disappointing result for anyone hoping that simply asking for information orally would fall outside of the definition of “processing” – however, it’s possible that the next argument for loophole enthusiasts will be about pinning down what does and doesn’t count as a ‘filing system’.
Further reading:
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
