Disclosure of Personal Information to Third Parties

In April 2025, the European Court of Justice ruled in the case of C‑710/23 L.H. v. Ministerstvo zdravotnictví, that the GDPR does not preclude national law, including case-law, from requiring controllers to inform and consult with individuals in the disclosure of information identifying them. 

Background

The decision of the Court arose out of a preliminary reference to it from the Supreme Administrative Court of the Czech Republic. The background, leading up to the referral, concerned a request by the applicant in the case (L.H.) to the Czech Ministry for Health to disclose the details of individuals who had signed contracts with the Ministry for the purchase of COVID-19 screening tests and the certificates relating to those tests. The Ministry partially granted L.H’s request by providing copies of the certificates he had requested but it had redacted personal information such as the names, signatures and contact information of the representatives. The Ministry justified its decision to redact on the basis of the GDPR. L.H. contested this before a lower court in the Czech Republic which ruled that national case-law required the Ministry to first inform or obtain the opinions of the data subjects on the request for the disclosure the data. The lower court ruled, as a matter of  principle, the Ministry, could not refuse to disclose the personal data to LH without first informing and consulting with the affected data subjects. The Ministry appealed this decision to the Supreme Administrative Court of the Czech Republic on the grounds that the entities it had contracts with in relation to the certificates are registered in China and the UK and it would be impossible to for it to inform and consult with the individuals concerned as it was not known where they resided. 

Questions for the Court

The Supreme Administrative Court referred two questions relating to the Ministry’s appeal to the European Court of Justice:

1. Whether the disclosure of identifying information such a name, signature and contact information of an individual representative of a legal entity made exclusively for the purpose of that person being  authorised to represent the legal entity constitutes processing of personal data under the scope of the GDPR?
2. Can national law, including case-law, extend the level of protection of personal data subjects beyond the text of the GDPR, in order to require a public authority to inform a data subject in advance of the submission of a request to provide his or her personal data to a third party?

Decision 

Unsurprisingly the European Court answered the first question in the affirmative, confirming that processing of personal data related to a representative function is processing of personal data. It noted that the fact that the sole purpose of the disclosure was to identify an individual authorised to act on behalf of a corporate body is irrelevant to the fact of data processing. 

On the second question, the Court interestingly confirmed that national law may include an obligation to inform and consult with data subjects where their personal data is the subject of a third party request. The Court ruled that such a requirement is to ensure fair, lawful and transparent processing by allowing an individual to express a view on the disclosure. Notwithstanding this, the Court also observed that an absolute application of such a national obligation could lead to a disproportionate restriction of the right to public access of official documents and to a practice of invoking the impossibility of consulting and informing in practice, which could be relied on to justify a systemic refusal to disclose information.

Analysis 

The decision of the Court is an important one for public bodies in assessing their obligations to disclose public records against data protection rights. Where national law requires disclosure of personal data to third parties, the GDPR cannot on its own be invoked as reason to restrict public access to that information. While the Court noted that a national obligation to inform and consult is permitted, a national obligation should not result in a disproportionate restriction on public access to documents. Unhelpfully, from a practical standpoint, the Court summarily concluded that the Czech Ministry for Health made its decision not to disclose on impossibility alone and did not attempt to reconcile interests. Other than a passing reference to Article 86 of the GDPR (which covers processing and public access to public documents), the Court does not consider what a reconciliation of interests would require before making a determination of impossibility or disproportionate effect. It is unfortunate that the Court did not consider give more consideration to this issue. Are matters such as statutory deadlines in other legislation governing disclosure and the interplay with a disclosure obligation in other legislation relevant? Are costs to the State in tracing individuals residing abroad and the type of personal data being processed factors to bear in mind? These and other issues will be important matters for public authorities to consider in the discharge of their obligations. 

Presently, Irish law does not include an analogous right to consult and inform to the right in Czech law discussed in the Court’s decision. Ireland’s Freedom of Information Act 2014 is the primary legislation governing the disclosure of public authorities’ records and that legislation contains an express exemption for non-disclosure of “personal information” of persons other than the requestor. Notwithstanding this, it is important to be aware that as the laws linking disclosure requirements and data protection evolve, invoking the GDPR on its own may not in itself be sufficient to refuse disclosure of personal data to a third party.

For further information please contact Partners Zelda Deasy, Seán O'Donnell, Jane O’Grady or any member of the Byrne Wallace Shields LLP Privacy and Data Protection team.