Daragh Troy BL

Does your spouse’s name reveal your sexual orientation? The Court of Justice of the European Union has delivered judgment and, unsurprisingly, again given the broadest possible interpretation to the GDPR.

In this case, a Lithuanian law against corruption requires specific information to be declared by those working in certain positions, which is then published online by the regulator.

Persons in those positions are required to declare their interests, but also the interests of their “spouse, cohabitee or partner” including:

• Names, IDs and social security number;
• Gifts worth over €150; and
• Information about transactions in excess of €3,000.

Information relating to membership of any undertakings are also published, but information relating to political parties and trade unions are excluded, arguably in compliance with Article 9 GDPR.

Whilst the above information needs to be declared, there are exemptions to what is to be published, such as social security number and special personal data.

Despite an amendment to the law the CJEU considered the reference with regard to both the Data Protection Directive and GDPR.

The regulator found that a citizen had infringed the law in failing to lodge a declaration. He brought an action for annulment and asserts that the declaration is an infringement of Articles 6 and 9 GDPR, in respect of both his personal data and that of anyone else he may be required to name.

The Lithuanian Court referred two questions:

1. Do Articles 6(1) and 6(3) GDPR preclude the publication of the information contained in the declaration?
2. Is Article 9 GDPR engaged by the publication of such information that is “liable to disclose indirectly the… sexual orientation of a natural person”?

The CJEU, in answering yes to both, found:

• The reference was admissible, despite the relevant law having been amended in 2020.
• Personal data is still personal data notwithstanding that it was processed in the context of a “professional activity”.
• Article 6(1) is both an “exhaustive and restrictive” list.
• The processing is undeniably in the public interest and legitimate.
• Proportionality in this context is subjective to the specific member state.
• Lack of resources cannot constitute a legitimate ground to justify interference with a right under the Charter.
• Certain information to be published goes beyond what is sufficient to achieve its purpose and should be regarded as a serious interference.
• Such publication is “liable… to expose the persons concerned to repeated targeted advertising and commercial sales canvassing, or even to risks of criminal activity”.
• There should be no distinction between “reveal” and “concerning” in Article 9 and it should be interpreted widely.
• Such publishing, of the spouse/partner’s name is “liable indirectly to reveal sensitive information” and specifically “liable to disclose indirectly the sexual orientation” and must therefore be protected under Article 9.

This is vital reading for all controllers.

• Daragh Troy BL is a barrister. He accepts instructions across all civil matters with a focus on data protection, professional negligence, commercial and chancery law.