When a Company Name Names People: Volker und Markus Schecke and Eifert (CJEU, C-92/09 and C-93/09)
Background
Volker und Markus Schecke GbR, a farming partnership, and Hartmut Eifert, a full-time farmer, both in the German Land of Hesse, received aid from the EU’s agricultural funds (EAGF and EAFRD) for 2008 (para 25). EU rules required each Member State to publish the beneficiaries every year on a single searchable website, including a natural person’s first name and surname, a legal person’s full registered name, their municipality and postcode, and the amounts received (paras 16 and 21–22).
The applicants went to court to stop publication of their data. They said the aid made up between 30% and 70% of beneficiaries’ income, so publication revealed their income, and that anonymous statistics would do (paras 28 and 73). The Administrative Court of Wiesbaden asked the CJEU whether the rules were valid (para 35).
The Court’s Findings
Who can claim protection. The right to the protection of personal data concerns information relating to an identified or identifiable individual. Legal persons can claim it only in so far as their official title identifies one or more natural persons. That was the case for the partnership, whose name directly identified its partners (paras 52–54).
Professional data are still private. Publishing the names and amounts interfered with private life, because the amounts were part of the beneficiaries’ income. It made no difference that the data concerned professional activities (paras 58–59). The beneficiaries had only been told publication would happen, so it did not rest on their consent (para 63).
Disproportionate for natural persons. Transparency in the use of public funds is a legitimate objective (paras 67–71). But the Council and the Commission had not considered less intrusive options for individuals, such as limiting publication by the period, frequency, nature or amount of the aid received. No automatic priority can be given to transparency over data protection, even where important economic interests are at stake (paras 79–86).
Proportionate for legal persons. For legal persons, in so far as they could rely on the Charter at all, publication stayed within the limits of proportionality. The seriousness of the interference differs between legal and natural persons; legal persons are already subject to more onerous publication obligations; and requiring authorities to check, for every legal person, whether its name identified individuals would impose an unreasonable administrative burden (paras 87–88).
Timeline
Amber marks the decisive decision or ruling.
| Date | Who | Action |
|---|---|---|
| 26 Sep 2008 | Volker und Markus Schecke GbR | Brings proceedings to stop publication (C-92/09) |
| 18 Dec 2008 | Hartmut Eifert | Brings proceedings to stop publication (C-93/09) |
| 27 Feb 2009 | Administrative Court, Wiesbaden | Refers questions to the CJEU; received 6 March 2009 |
| 2 Feb 2010 | CJEU (Grand Chamber) | Holds the hearing |
| 17 Jun 2010 | Advocate General Sharpston | Delivers her Opinion |
| 9 Nov 2010 | CJEU (Grand Chamber) | Delivers judgment |
Dates are from the judgment (paras 28 and 36 and its heading).
The Outcome
This was a preliminary ruling with no fine. The Court declared the publication rules invalid in so far as they required publishing personal data about every natural person who received aid, without distinguishing by relevant criteria such as the periods, frequency, nature and amount of the aid (para 89). Given the number of publications already made, it ruled that the invalidity could not be relied on to challenge publications made before the judgment (para 94).
What Could Have Been Done Differently
The Court said the institutions should have examined whether a more limited publication by name, for example according to how long, how often, what kind and how much aid a person received, would have met the transparency objective while interfering less with individuals’ rights (paras 81–83). For legal persons, the existing approach stood.
A company’s own data sit outside data protection law, but a company name that names people doesn’t. And information about people doesn’t lose protection because it concerns their work.
Frequently Asked Questions
Can a legal person rely on the right to data protection?
Only in so far as its official title identifies one or more natural persons, the CJEU held. A partnership whose name identified its partners could rely on it.
Why was publication lawful for legal persons but not for individuals?
The Court found the interference is less serious for legal persons, that they are already subject to more onerous publication obligations, and that checking every legal person’s name for identifiable individuals would be an unreasonable burden.
Does data about someone’s business activity count as private?
Yes. The Court held it is of no relevance that the published data concern professional activities, because private life is not to be interpreted restrictively.
Whether a business record identifies a person can change what you are allowed to publish or share. Classifying records at the point of collection makes that easier to decide.