08-04-2024

In a recent judgment (Case C-740/22), the European Court of Justice (“the ECJ”) has ruled for the first time that the oral transfer of personal data can - under certain circumstances - be considered as “processing of personal data” within the scope of the GDPR.

In this case, the Finnish company, Endemol Shine, made an oral request to obtain information from a court regarding possible ongoing or completed criminal proceedings against a potential candidate participating in a selection procedure it organized for the purpose of clarifying the criminal record of that person.

The court refused the request as in its opinion the reason given by Endemol Shine did not justify the oral disclosure of this information, which constitutes processing of personal data. Endemol Shine brought an appeal against that judgment contending that the oral disclosure of the information does not constitute processing of personal data within the meaning of the GDPR. The appeal court referred the matter to the ECJ through a preliminary reference.

The ECJ was asked to provide clarification on whether an oral transmission of personal data qualifies as processing of personal data within the meaning of article 4(2) GDPR and, if so, whether that processing comes within the material scope of the GDPR, as defined in article 2(1) thereof.

Regarding the qualification as "processing" contained in article 4(2) GDPR, the ECJ found that the term "any operation" in the definition is intended to give the concept a broad and inclusive scope. This broad interpretation is confirmed by the use of the wording "such as", which indicates the non-exhaustive nature of listed operations. Moreover, the provision does not impose any conditions as to the form of processing, so that even oral transmission of personal data falls within this definition. This broad interpretation fits perfectly with the objective pursued by the GDPR, which is to ensure a high level of protection of individuals' fundamental rights. The possibility of circumventing its application by providing personal data orally rather than in written form would conflict with this objective the ECJ finds.

Regarding the question as to whether such processing falls within the material scope of the GDPR, the ECJ first clarifies that article 2(1) of the GDPR applies to both automated and non-automated processing of personal data contained or intended to be contained in a filing system. A "filing system" is defined as a structured collection of personal data that is intended to make the personal data easily retrievable.

Since oral communication as such is a non-automated processing, the data that are the subject of such processing must be contained in a filing system or intended to be contained in a filing system in order to fall within the material scope of the GDPR.

In the specific case, the ECJ found that the requested data was contained in a judicial register of persons, which was considered a filing system under the GDPR.

This landmark ruling introduces a new and very important insight namely that oral communication of personal data can fall within the scope of the GDPR as soon as this data is included in a filing system or intended for this.

Contributions by our experts Alice Van Houtte, Yuki Choy and Levi Van Dijck.