The European Court of Justice (ECJ) has given a preliminary ruling that legal analysis is not personal data.
Everyone has the right of access to personal data that has been collected concerning them, and the right to have it rectified (Article 8(2), Charter of Fundamental Rights of the European Union) (Article 8(2)).
The Data Protection Directive (95/46/EC) (the Directive) defines “personal data” as any information relating to an identified or identifiable natural person (data subject) (Article 2(a) the Directive) (Article 2(a)). Article 12 of the Directive provides data subjects with a right of access to their own personal data. Data subjects can apply for rectification, erasure or blocking of their personal data where the processing does not comply with the Directive; for example, if the data is incomplete or inaccurate.
When assessing an application for lawful residence, the Dutch immigration and naturalisation service, INS, will consider a minute containing data about the applicant and a legal analysis of that data.
Y, M and S applied for lawful residence in the Netherlands. The I granted M a residence permit for a fixed period as an asylum seeker and S an ordinary residence permit for a fixed period on the ground of dramatic circumstances, but refused Y’s application. Y, M and S made data subject access requests for a copy of the full minute containing the legal analysis that underpinned the I’s decisions.
The Dutch courts referred questions about personal data to the ECJ.
The ECJ held that, although the legal analysis in the minute may contain personal data, it does not in itself constitute personal data.
Some data contained in the minute and the legal analysis, including the applicant’s name, date of birth, nationality, gender, ethnicity, religion and language, are personal data under Article 2(a). However, the legal analysis is not information relating to the applicant for a residence permit. At most, it is information about the relevant authority’s assessment and application of the relevant law to the applicant’s situation.
Extending the right of access to the legal analysis of a residence permit would not serve the Directive’s purpose of guaranteeing the protection of the applicant’s right to privacy with regard to the processing of data relating to them. It would only guarantee a right of access to administrative documents, which is not covered by the Directive.
To comply with the right of access in Article 12(a) of the Directive and Article 8(2), it is sufficient for the applicant to be provided with a full and comprehensive summary of all of the personal data in the minute and, where relevant, the legal analysis, in a form that allows him to become aware of those data and to check that they are accurate and processed in accordance with the Directive. This will enable the data subject to obtain, depending on the circumstances, the rectification, erasure or blocking of their data by the data controller.
When processing data subject access requests it is important to identify the different types of data involved, in order to assess whether each type falls within the definition of personal data. Legal analysis is not personal data.
Although in this case (involving Dutch law) it was sufficient to provide a data subject with a full and comprehensive summary of all of their personal data in an intelligible form, some countries including the UK have implemented the Directive in a manner which does provide for the right to a full copy of personal data.
Case: Y.S. (Judgment of the Court)  EUECJ C-141/12.
First published in the September 2014 issue of PLC Magazine and reproduced with the kind permission of the publishers. Subscription enquiries 020 7202 1200.