Transfer of personal data: EU ruling emphasises the authorities' duty of disclosure

Transfer of personal data between two public authorities requires that the affected citizens are notified.

The European Court of Justice has ruled (C-201/14) on the question whether personal data may legally be transferred from the Rumanian tax authorities to the national health insurance.

The Court found that the duty of disclosure had not been observed even though special authority existed to transfer part of the data.

As the authorities had no grounds for setting aside the duty of disclosure in relation to the transfer of the data, the authorities were obligated to observe the duty of disclosure in relation to the citizens under the Data Protection Directive.

The Court found that the national health insurance should have notified the affected citizens of both the purpose of the processing and the data being processed.

The action is based on the Rumanian act on personal data

According to Rumanian legislation, it is possible for the authorities to disclose data concerning name, ID number and address to the national health insurance with the result that the health insurance can assess whether a citizen is entitled to benefits. The rules do not decide whether income data may be disclosed.

The tax authorities' transfer of income data was used by the health insurance to carry out collections from citizens.