The CJEU has issued a very interesting judgment (Case C‑486/12) in the context of the Data Protection regime.
A dispute arose when a Dutch public authority wished to charge €12.80 to a person for seeking information about themselves under the Dutch Data Protection law. The person in question refused to pay the fee and appealed to court (and as an aside they also attempted to FOI their data instead). The Dutch court then sought to refer some questions to the CJEU, namely:
1. Does the provision of access [to data] (pursuant to Article 79(2) of the Wet GBA) constitute compliance with the obligation [to communicate] data undergoing processing as referred to in the second indent of Article 12(a) of Directive [95/46/EC]?
2. Does Article 12(a) of [that directive] preclude the levying of fees in respect of the communication, by means of a transcript from the municipal database, of the personal data undergoing processing?
3. If Question 2 is to be answered in the negative: is the levying of the present fee excessive [for the purposes of] Article 12(a) of [that directive]?’
The court’s ruling is particularly interesting in light of Ireland’s strange and unusual regime of charging for FOI requests, and whether that might be an infringement of the European Convention of Human Rights (or indeed the Charter). It also should impact how Ireland charges citizens for Data Protection requests themselves (€6.35). The court found:
29. In view of the importance – highlighted in recitals 2 and 10 in the preamble to Directive 95/46 – of protecting privacy, emphasised in the case-law of the Court (see Rijkeboer, paragraph 47 and the case-law cited) and enshrined in Article 8 of the Charter, the fees which may be levied under Article 12(a) of the directive may not be fixed at a level likely to constitute an obstacle to the exercise of the right of access guaranteed by that provision.
Here a direction connection is made between fees and the Charter of Fundamental Rights as enshrined in the European Treaties. It goes on:
30. It should be held that, for the purposes of applying Article 12(a) of Directive 95/46, where a national public authority levies a fee on an individual exercising the right to access personal data relating to him, the level of that fee should not exceed the cost of communicating such data. That upper limit does not prevent the Member States from fixing such fees at a lower level in order to ensure that all individuals retain an effective right to access such data.
This is similar to the regime that exists under the Aarhus Convention. In other words, no upfront fees, or search and retrieval fees, may apply to requests. In essence this means that no fees should now be charged for requests under the Data Protection Act. We have sought a response from the Irish Data Protection Commissioner, but imagine Ireland must legislate in light of this judgment.
As for FOI, I believe this further strengthens the case that FOI request charges in Ireland are illegal.
