The AVG has heightened requirements for the processing of special personal data, such as data on health, race or sexual orientation (1). Sometimes such data can be derived indirectly from other data. For example, if someone wearing glasses is depicted in a photograph, something could be indirectly inferred about his health. Should a photograph of someone wearing glasses always be considered special personal data?
In answering this question, we generally consider the context in which the data is processed. See, for example, on the AP's website (2):
"No special personal data. You process ordinary - and therefore not special - personal data with your photos or videos if all 3 of the following points apply: the photos or videos are not aimed at special personal data or making distinctions based on these data. It is also not reasonably foreseeable to you that someone will discriminate on the basis of your photos or videos. It is inevitable that you will process special personal data when you take the photos or videos. Ordinary personal data will usually be involved in, for example, a face book on the employer's intranet, a class photo or promoting a (general) event."
Based on this contextual approach, a photograph of an eyeglass wearer need not always be treated as special personal data. This practical approach is very welcome, as otherwise very many processing operations would fall under the heightened requirements for processing special personal data and would therefore not be possible, even processing operations without a high risk to the private lives of the data subjects.
The OT case (3) involved the publication on the Internet of the name of the partner of the director of a Lithuanian subsidized institution. Pursuant to anti-corruption legislation, he had to provide a large number of details of himself and his life partner. Some of these were also made public via the Internet. The partner's gender can be deduced from the name, and from the combination of the partners' names the sexual orientation of both partners. Thus, the name does not tell directly, but indirectly, about the sexual orientation. Does this make the name special personal data? The Court answered this question in the affirmative.
The judgment reveals a peculiarity in the text of Article 9 AVG. Sometimes it refers to data that "shows" something, sometimes it refers to data "about" or "relating to."
Therefore, should indirect data be considered in one category of special personal data rather than others? With respect to sexual orientation, this is data "about" a person's sexual orientation. Would this exclude indirect data? The Court rules that no significance should be attached to these textual differences and that, also in light of the protective nature of the provision, all special personal data should be given the same, broad, interpretation. All categories of special personal data may similarly include data from which sensitive information may be indirectly derived. Thus, data "about" may include data from which something is indirectly apparent.
Does this broad explanation now also exclude the contextual approach? I think not.
First, the Court's approach is not primarily linguistic. The Court's approach results in the same, broad, interpretation being given to the various categories of special personal data. I believe that this uniform approach then also applies to the application of nuances to this broad interpretation, whereby in cases where there is no intention to process special personal data and there are also no important risks, there may be reason not to qualify indirect data as special personal data (4).
Second, the Court links its conclusions in paragraph 128 of law and in the operative part of the judgment very strictly to a number of facts and circumstances of the case, whereas the preliminary question had a much more general scope. The circumstances mentioned by the Court are:
publication on the Internet; of personal data that may indirectly reveal the sexual orientation of a natural person; by a public authority charged with collecting the declarations of private interests and exercising control over their content.
Thus, the Court clearly does not choose to formulate a general premise but expressly limits its judgment to the circumstances of the case. Taken together, these circumstances indicate a high risk of invasion of private life. Unlike the fact that someone wears glasses, which are immediately visible at every contact, someone's sexual orientation is not always public and it is up to the person himself to make it known or not. It is not for the government to reveal that unsolicited.
Also, the explicit link to the circumstances of the case is in itself an indication that the Court considers an analysis of the context of the processing relevant to the question of whether (indirect) data in a specific case should qualify as special personal data.
My conclusion, therefore, is that in the circumstances of the case it was very obvious to designate the partner's name as special personal data, but that this does not automatically imply that all data from which a special personal data can be indirectly derived should be designated as special personal data in all circumstances. No line, then, with the contextual approach to special personal data.
See in particular Article 9 AVG.
https://www.autoriteitpersoonsgegevens.nl/nl/onderwerpen/foto-en-film/beeldmateriaal, laatst bekeken op 22 mei 2023. Aanknopingspunten voor een contextuele benadering zijn ook te vinden in overweging 51 bij de AVG en in richtsnoeren van het Europees Comité voor Gegevensbescherming (EDPB, Guidelines 3/2019 on processing of personal data through video devices, 29 januari 2020; par. 60 en verder).
ECJ EU 1 August 2022, C-184/20, OT v Vyriausioji tarnybinės etikos komisija, ECLI:EU:C:2022:601. This blog is partly an adaptation of my note to the judgment in JBP 2023/41.
As in recital 51 to the AVG with respect to biometric data.
