The Data Brief

A monthly data protection bulletin from the barristers at 5 Essex Chambers

Endemol Shine: no loophole for oral processing

26 March 2024

The CJEU has given a preliminary ruling that oral transfer of personal data does amount to processing for purposes of Article 4(2) of the GDP.

The question was referred to the court for consideration by the Finnish Court of Appeal, and it arises from a case concerning a Finnish television production company, Endemol Shine Finland. The TV company had been organising a competition, and was seeking information from the District Court of South Savo for information about possible criminal proceedings involving one of the participants. They were asking for the information to be disclosed orally.

In the main proceedings it is not disputed that the information they were seeking was personal data within the meaning of Article 4(1) of the GDPR. The question before the court was whether the oral processing would amount to processing of personal data within the meaning of Article 2(1) and Article 4(2) of the GDPR.

Article 4(2) GDPR defines the concept of ‘processing’ as ‘any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means’. Oral processing would therefore appear to fall within Article 4(2).

However, Article 2 GDPR provides that that regulation applies to:

  • processing wholly or partly by automated means, and
  • processing by non-automated means which forms or is intended to form part of a filing system

Article 4(6) GDPR gives ‘filing system’ a broad interpretation, covering ‘any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis’.

The information sought by the TV company was contained in the court’s register of persons, and this was held to fall within the definition of a filing system.

The court was quick to point out the danger of allowing oral processing to provide a loophole, pointing out that the GDPR’s objective was “to ensure a high level of protection of the fundamental rights and freedoms of natural persons” and that “circumventing the application of that regulation by disclosing personal data orally rather than in writing would be manifestly incompatible with that objective”.

A disappointing result for anyone hoping that simply asking for information orally would fall outside of the definition of “processing” – however, it’s possible that the next argument for loophole enthusiasts will be about pinning down what does and doesn’t count as a ‘filing system’.

Further reading:


The Data Brief

A monthly data protection bulletin from the barristers at 5 Essex Chambers

The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.

Visit the Information Law, Data Protection and AI area

Search The Data Brief

Portfolio Builder

Select the practice areas that you would like to download or add to the portfolio

Download    Add to portfolio   
Title Type CV Email

Remove All


Click here to share this shortlist.
(It will expire after 30 days.)