CJEU - Judgment C-473/12 IPI 7 Nov 2013

JUDGMENT OF THE COURT (Third Chamber)

7 November 2013 (*)

(Processing of personal data – Directive 95/46/EC – Articles 10 and 11 – Obligation to inform – Article 13(1)(d) and (g) – Exceptions – Scope of exceptions – Private detectives acting for the supervisory body of a regulated profession – Directive 2002/58/EC – Article 15(1))

In Case C-473/12,

REQUEST for a preliminary ruling under Article 267 TFEU from the Cour constitutionnelle (Belgium), made by decision of 10 October 2012, received at the Court on 22 October 2012, in the proceedings

Institut professionnel des agents immobiliers (IPI)

Geoffrey Englebert,

Immo 9 SPRL,

Grégory Francotte,

intervening parties:

Union professionnelle nationale des détectives privés de Belgique (UPNDP),

Association professionnelle des inspecteurs et experts d’assurances ASBL (APIEA),

Conseil des ministres,

THE COURT (Third Chamber),

composed of M. Ilešič, President of the Chamber, C.G. Fernlund (Rapporteur), A. Ó Caoimh, C. Toader and E. Jarašiūnas, Judges,

Advocate General: Y. Bot,

Registrar: V. Tourrès, Administrator,

having regard to the written procedure and further to the hearing on 11 July 2013,

after considering the observations submitted on behalf of:

– Institut professionnel des agents immobiliers (IPI), by Y. Paquay and H. Nyssen, avocats,

– the Belgian Government, by M. Jacobs and C. Pochet, acting as Agents, and B. Renson, avocat,

– the Czech Government, by M. Smolek, acting as Agent,

– the Netherlands Government, by B. Koopman and C. Wissels, acting as Agents,

– the European Parliament, by A. Caiola and A. Pospíšilová Padowska, acting as Agents,

– the European Commission, by F. Clotuche-Duvieusart and B. Martenczuk, acting as Agents,

having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,

gives the following

Judgment

1 This request for a preliminary ruling concerns the interpretation of Article 13(1)(d) and (g) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).

2 The request has been made in proceedings between the Institut professionnel des agents immobiliers (IPI) (Belgian Institute of Estate Agents) on the one hand and Mr Englebert, Immo 9 SPRL and Mr Francotte on the other concerning alleged breaches of the national rules on the exercise of the profession of estate agent.

Legal context

European Union law

Directive 95/46

3 Recitals 3, 8, 10, 37 and 43 in the preamble to Directive 95/46 read as follows:

‘(3) Whereas the establishment and functioning of an internal market in which, in accordance with Article 7a of the Treaty, the free movement of goods, persons, services and capital is ensured require not only that personal data should be able to flow freely from one Member State to another, but also that the fundamental rights of individuals should be safeguarded;

…

(8) Whereas, in order to remove the obstacles to flows of personal data, the level of protection of the rights and freedoms of individuals with regard to the processing of such data must be equivalent in all Member States; …

…

(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;

…

(37) Whereas the processing of personal data for purposes of journalism or for purposes of literary [or] artistic expression, in particular in the audiovisual field, should qualify for exemption from the requirements of certain provisions of this Directive in so far as this is necessary to reconcile the fundamental rights of individuals with freedom of information …

…

(43) Whereas restrictions on the rights of access and information and on certain obligations of the controller may similarly be imposed by Member States in so far as they are necessary to safeguard, for example, national security, defence, public safety, or important economic or financial interests of a Member State or the Union, as well as criminal investigations and prosecutions and action in respect of breaches of ethics in the regulated professions; …’

4 Article 1(1) of Directive 95/46 states:

‘In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.’

5 Article 2(a) and (d) of Directive 95/46 states:

‘For the purpose of this Directive:

(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); …

…

(d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; …’

6 Article 9 of Directive 95/46 states:

‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’

7 Section IV of Directive 95/46, entitled ‘Information to be given to the data subject’, comprises Articles 10 and 11 which govern situations where the data have been collected from the data subject and where the data have not been obtained from the data subject respectively.

8 Article 10 of Directive 95/46 states:

‘Member States shall provide that the controller or his representative must provide a data subject from whom data relating to himself are collected with at least the following information, except where he already has it:

(a) the identity of the controller and of his representative, if any;

(b) the purposes of the processing for which the data are intended;

– the recipients or categories of recipients,

– whether replies to the questions are obligatory or voluntary, as well as the possible consequences of failure to reply,

– the existence of the right of access to and the right to rectify the data concerning him

in so far as such further information is necessary, having regard to the specific circumstances in which the data are processed, to guarantee fair processing in respect of the data subject.’

9 Article 11 of the directive states that, where the data have not been obtained from the data subject, Member States are to provide that the controller or his representative must at the time of undertaking the recording of personal data or, if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide the data subject with at least the information set out in that article, except where he already has it.

10 Paragraph 1 of Article 13 of Directive 95/46, which is entitled ‘Exemptions and restrictions’, provides:

‘Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary measures to safeguard:

(a) national security;

(b) defence;

(d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;

(e) an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters;

(f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e);

(g) the protection of the data subject or of the rights and freedoms of others.’

Directive 2002/58/EC

11 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37) provides in Article 15(1):

‘Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive [95/46]. …’

Belgian law

12 The Law of 8 December 1992 on the protection of privacy in relation to the processing of personal data (Moniteur belge, 18 March 1993, p. 5801) was amended by the Law of 11 December 1998 implementing Directive 95/46/EC (Moniteur belge, 3 February 1999, p. 3049) (‘the 1992 Law’). Article 9 of the 1992 Law, paragraphs 1 and 2 of which correspond to Articles 10 and 11 of the directive respectively, imposes an obligation to inform the data subject.

13 Article 3(3) to (7) of the 1992 Law lays down exceptions and restrictions to that obligation to inform, inter alia, where the processing of personal data is carried out solely for journalistic purposes or the purpose of artistic or literary expression and where it is managed by the Sûreté de l’État (State security office), by the Service général du renseignement et de la sécurité (General intelligence and security service of the armed forces), by public authorities for the purpose of exercising their judicial police duties, by the police services for the purpose of exercising their administrative police duties, or by the European Centre for Missing and Sexually Abused Children.

The facts in the main proceedings and the questions referred for a preliminary ruling

14 IPI, established by Royal Decree of 17 February 1995, is, inter alia, responsible for ensuring compliance with the conditions of access to and the proper practice of the profession of estate agent. It may, for that purpose, be a party to legal proceedings and report to the judicial authorities any infringement of the applicable rules. IPI is authorised to use the services of private detectives in order to carry out its duties.

15 In the course of its activity, IPI asked the Tribunal de commerce de Charleroi (Charleroi Commercial Court) to declare that Mr Englebert, Immo 9 SPRL and Mr Francotte had acted contrary to those rules and to order Mr Englebert and Mr Francotte to cease various estate agency activities. IPI based its action on facts gathered by private detectives whom it had used.

16 The Tribunal de commerce de Charleroi raised the question of the value to be attributed to the evidence furnished by the private detectives, given the possibility that it had been obtained without respecting the requirements of the protection of individuals with regard to the processing of personal data and, consequently, in breach of the 1992 Law. That court stated that, according to IPI, the implementation of that law, which requires the data subject to be informed of the detective’s investigation in advance or, where the data is collected from third parties, at the time of undertaking the recording of the data at issue, makes it impossible for a private detective to carry on his activities. The Tribunal de commerce de Charleroi was uncertain whether, by not extending to private detectives the exceptions to that obligation to inform which apply to other professional categories or bodies working in the public interest, Article 3(3) to (7) of the 1992 Law gives rise to unequal treatment contrary to the Constitution. It therefore decided to refer the question to the Cour constitutionnelle (Constitutional Court).

17 That court considers that it must be determined whether the 1992 Law, by not laying down exceptions for private detectives comparable to those referred to in Article 13(1)(d) and (g) of Directive 95/46, correctly implements that provision. It states that Article 3(3) to (7) of the 1992 Law gives rise to a difference in treatment between, on the one hand, persons pursuing a journalistic, artistic or literary activity, security and police services and the European Centre for Missing and Sexually Abused Children and, on the other, persons exercising the profession of private detective, in that only the former are exempt from the obligation to inform laid down in Article 9 of the 1992 Law.

18 According to the referring court, that exception can be explained in terms of the activities exercised, which are related to public information or to cultural life, to the maintenance of security and public order, and to the defence of the fundamental rights of the most vulnerable.

19 Private detectives are stated to be in a different situation. The referring court notes that, even though their profession is regulated by a 1991 law which establishes the structure of the profession and makes its exercise subject to the authorisation of the Minister for the Interior, their activity is unconnected with the protection of those fundamental rights and general interests and generally relates to the protection of private interests.

20 The Cour constitutionnelle notes that, although Article 13(1) of Directive 95/46 seems to grant Member States some freedom as to whether or not to adopt the exceptions in question, nevertheless a doubt exists in view of the complete harmonisation achieved, in principle, by that directive.

21 In those circumstances, the Cour constitutionnelle decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘1. Is Article 13(1)(g) in fine of Directive [95/46] to be interpreted as meaning that it leaves the Member States free to choose whether or not to provide for an exception to the immediate obligation to inform set out in Article 11(1) if this is necessary in order to protect the rights and freedoms of others, or are the Member States subject to restrictions in this matter?

2. Do the professional activities of private detectives, governed by national law and exercised in the service of authorities authorised to report to the judicial authorities any infringement of the provisions protecting a professional title and organising a profession, come, depending on the circumstances, within the exception referred to in Article 13(1)(d) and (g) in fine of [Directive 95/46]?

3. In the event of a negative reply to Question 2, is Article 13(1)(d) and (g) in fine of [Directive 95/46] compatible with Article 6(3) [TEU], more specifically with the principle of equality and non-discrimination?’

Consideration of the questions referred

Preliminary observation

22 In its first question, the referring court refers to an obligation to inform the data subject immediately which is referred to in Article 11 of Directive 95/46.

23 It must, however, be observed that that provision, which concerns data which have not been obtained from the data subject, provides for information to be provided to the data subject not at the time when the data are obtained but at a later stage. By contrast, Article 10 of Directive 95/46, which refers to the collection of data from the data subject, provides for the data subject to be informed at the time the data are collected (see, to that effect, Case C-553/07 Rijkeboer [2009] ECR I-3889, paragraph 68). The immediate nature of the provision of information to the data subject thus comes not from Article 11 of Directive 95/46, mentioned by the referring court, but from Article 10.

24 As regards investigations carried out by a private detective, it is apparent from the order for reference that he may need to collect data either directly from the data subject or indirectly, inter alia, from third parties. It must, therefore, be stated that both Article 10 and Article 11(1) of Directive 95/46 may, depending on the circumstances, be relevant for such investigations.

Questions 1 and 2

25 By its first two questions, which should be considered together, the referring court asks, in essence, first, whether Article 13(1) of Directive 95/46 must be interpreted as meaning that Member States have the option, or the obligation, to transpose into their national law the exceptions which that article lays down to the obligation to inform data subjects of the processing of their personal data and, secondly, whether the activity of a private detective acting for a professional body in order to investigate breaches of ethics of a regulated profession, in this case that of estate agent, falls within the scope of Article 13(1)(d) or (g).

26 At the outset, it must be stated that data such as those which, according to the referring court, are collected by the private detectives in the main proceedings relate to persons acting as estate agents and concern identified or identifiable natural persons. They are therefore personal data within the meaning of Article 2(a) of Directive 95/46. Their collection, storage and transmission by a regulated body such as IPI or by the private detectives acting for it therefore represent the ‘processing of personal data’ within the meaning of Article 2(b) of Directive 95/46 (see Case C-524/06 Huber [2008] ECR I-9705, paragraph 43).

27 In order to reply to the question, it must be examined, in the first place, whether, pursuant to Article 13(1) of Directive 95/46, Member States have the option to provide, or are obliged to provide, for one or more of the exceptions listed in that article to the obligation to inform the data subject of the processing of personal data.

28 It is apparent from recitals 3, 8 and 10 of Directive 95/46 that the European Union legislature sought to facilitate the free movement of personal data by the approximation of the laws of the Member States while safeguarding the fundamental rights of individuals, in particular the right to privacy, and ensuring a high level of protection in the European Union. Article 1 of the directive thus requires the Member States to ensure the protection of the fundamental rights and freedoms of natural persons, in particular their privacy, with respect to the processing of personal data (Huber, paragraph 47, and Joined Cases C-468/10 and C-469/10 ASNEF and FECEMD [2011] ECR I-12181, paragraph 25).

29 For that purpose, Directive 95/46 contains, in Articles 10 and 11, obligations to inform the data subject of the processing of his personal data while providing, in Article 13(1), that the Member States may adopt legislative measures to restrict the scope of those obligations where such a measure is necessary for the purposes set out in Article 13(1)(a) to (g).

30 The referring court raises the question of the leeway Member States have in view of the legislature’s objective of harmonisation, as set out in recital 8 of the directive, which is intended to ensure that the level of protection of the rights and freedoms of individuals with regard to the processing of personal data is equivalent in all Member States.

31 It should be noted that the Court has previously held that Directive 95/46 amounts to harmonisation which is generally complete (see Case C-101/01 Lindqvist [2003] ECR I-12971, paragraphs 95 and 96, and Huber, paragraphs 50 and 51). However, the Court has also found that the provisions of Directive 95/46 are necessarily relatively general given that it has to be applied to a large number of very different situations, and that the directive includes rules with a degree of flexibility and, in many instances, leaves to the Member States the task of deciding the details or choosing between options (Lindqvist, paragraph 83).

32 As regards Article 13(1) of Directive 95/46, it is clear from its wording, and in particular from the use of the words ‘Member States may’, that that provision does not oblige the Member States to lay down in their national law exceptions for the purposes listed in Article 13(1)(a) to (g) but, on the contrary, the legislature intended to give them the freedom to decide whether, and if so for what purposes, they wish to take legislative measures aimed at limiting, inter alia, the extent of the obligations to inform the data subject. Furthermore, it is also apparent from the wording of Article 13(1) that the Member States may lay down such measures only when they are necessary. The requirement that the measures be ‘necessary’ is thus a precondition for the application of the option granted to Member States by Article 13(1), and does not mean that they are required to adopt the exceptions at issue in all cases where that condition is satisfied.

33 That interpretation is, first, supported by the wording of recital 43 of Directive 95/46, according to which restrictions on the rights of information ‘may … be imposed by Member States in so far as they are necessary to safeguard’ those purposes. That interpretation is, next, confirmed by a comparison of, on the one hand, the wording of Article 13(1) of Directive 95/46 and, on the other hand, Article 9 and recital 37 of the directive, which for their part clearly impose an obligation on the Member States to provide for exceptions and derogations for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in so far as they are necessary to reconcile the right to privacy with the rules governing freedom of expression.

34 That interpretation is also confirmed by the Court’s analysis in Case C-275/06 Promusicae [2008] ECR I-271 of Article 15(1) of the directive on privacy and electronic communications, which is formulated in similar terms to Article 13(1) of Directive 95/46 and, furthermore, expressly refers to that article.

35 The Court found, first, that Article 15(1) gives Member States the possibility of providing for exceptions to the obligation of principle to ensure the confidentiality of personal data (Promusicae, paragraph 50).

36 As regards one of those exceptions, the Court then held that Article 15(1) cannot, however, be interpreted as compelling the Member States, in the situations it sets out, to lay down an obligation to disclose (Promusicae, paragraphs 51 and 53).

37 It must, therefore, be considered that Article 13(1) of Directive 95/46 offers Member States the option to provide for one or more of the exceptions that it sets out, but they are not compelled to do so.

38 It must therefore be examined, in the second place, whether the activity of a private detective acting for a regulated body, such as IPI, falls within the scope of the exceptions provided for in Article 13(1)(d) and (g) of Directive 95/46.

39 According to settled case-law, the protection of the fundamental right to privacy requires that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary (Case C-73/07 Satakunnan Markkinapörssi and Satamedia [2008] ECR I-9831, paragraph 56, and Joined Cases C-92/09 and C-93/09 Volker und Markus Schecke and Eifert [2010] ECR I-11063, paragraphs 77 and 86).

40 As regards the exceptions set out in Article 13(1)(d) and (g) of Directive 95/46, the former refers in particular to a specifically defined situation, namely the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions, and the latter to the protection of the rights and freedoms of others, which by contrast are not defined.

41 It is necessary first to examine the exception provided for in Article 13(1)(d) of the directive and ascertain whether it applies to the activity of a private detective acting for a body such as IPI.

42 According to the order for reference, the profession of estate agent is a regulated profession in Belgium and IPI is a professional body responsible for ensuring compliance with the rules at issue through investigating and reporting breaches of those rules.

43 The activity of a body such as IPI corresponds to the situation referred to by the exception in Article 13(1)(d) of Directive 95/46, and is therefore capable of coming under that exception.

44 Since Directive 95/46 does not specify the manner in which the investigation and detection of failures to comply with the rules are carried out, it must be considered that the directive does not prevent such a professional body from having recourse to specialised investigators, such as private detectives responsible for that investigation and detection, in order to perform its duties.

45 It follows that, if a Member State has chosen to implement the exception provided for in Article 13(1)(d), then the professional body concerned and the private detectives acting for it may rely on it and are not subject to the obligation to inform the data subject provided for in Articles 10 and 11 of Directive 95/46.

46 If, on the other hand, the Member State has not provided for that exception, the data subjects must be informed of the processing of their personal data according to the detailed provisions, in particular those concerning timing, of Articles 10 and 11.

47 According to IPI, application of the exception to the obligation to inform, to IPI itself and to private detectives acting on its behalf, is necessary for it to carry out its role. The IPI claims it would be impossible for private detectives to carry out their activity for IPI effectively if they had to disclose their identity and the reasons for their investigations before even questioning the persons they are investigating. The Netherlands Government also claimed that the investigations at issue would be bound to fail.

48 As is apparent from paragraph 37 above, however, it is for the Member States to decide whether they consider it necessary to provide, in their legislation for the exception laid down in Article 13(1)(d) of Directive 95/46 in favour of professional bodies such as IPI, acting directly or with the help of private detectives. It is open to them to take the view that those professional bodies and the private detectives acting for them have sufficient means, notwithstanding the application of Articles 10 and 11 of that directive, of detecting the breaches of ethics at issue, so that it is not necessary for that exception to be implemented in order for those bodies to be able to carry out their duty of ensuring compliance with the rules.

49 As to the extent of that exception, the concept of ‘breaches of ethics’ must next be defined. Differences in opinion have emerged in the written and oral observations submitted to the Court on this point. According to the Belgian Government, and contrary to what IPI claims, the breaches in question only concern the conduct of estate agents duly licenced to practise their profession and do not extend to the conduct of persons who, without being licensed, pass themselves off as estate agents.

50 In that regard, it should be stated that the rules on access to a regulated profession form part of the rules of professional ethics. It follows that investigations concerning the acts of persons who breach those rules by passing themselves off as estate agents are covered by the exception in Article 13(1)(d) of Directive 95/46.

51 Consequently, under that directive, Member States may provide that a regulated professional body, such as IPI, may, alone or with the help of private detectives, investigate possible breaches of the rules of ethics, including breaches resulting from the acts of persons who have failed to observe the rules relating to access to the profession, while being covered by that exception.

52 Having regard to the scope of that exception, it is not necessary to examine whether the activity of a private detective acting for a professional body such as IPI is also covered by the exception provided for in Article 13(1)(g) of Directive 95/46.

53 The answer to the first two questions is therefore that:

– Article 13(1) of Directive 95/46 must be interpreted as meaning that Member States have no obligation, but have the option, to transpose into their national law one or more of the exceptions which it lays down to the obligation to inform data subjects of the processing of their personal data;

– the activity of a private detective acting for a professional body in order to investigate breaches of ethics of a regulated profession, in this case that of estate agent, is covered by the exception in Article 13(1)(d) of Directive 95/46.

Question 3

54 Given the answer to the first two questions, there is no need to answer the third question.

Costs

55 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Third Chamber) hereby rules:

Article 13(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that Member States have no obligation, but have the option, to transpose into their national law one or more of the exceptions which it lays down to the obligation to inform data subjects of the processing of their personal data.

The activity of a private detective acting for a professional body in order to investigate breaches of ethics of a regulated profession, in this case that of estate agent, is covered by the exception in Article 13(1)(d) of Directive 95/46.

[Signatures]

* Language of the case: French.

Judgment of 7 Nov 2013, C-473/12 (IPI)