No additional requirements may be imposed as regards matters that have been totally harmonized by the European Union

Background

On 24 November the Court of Justice of the European Union (CJEU) issued its judgment on several preliminary rulings concerning Spanish legislation on personal data protection. The judgment deals with a delicate issue: the conditions necessary for a company to be able to process these data without the need to obtain the consent of data subjects.

The National Association of Financial Credit Institutions (ASNEF) and the Spanish Federation of E-Commerce and Direct Marketing (FECEMD) decided to bring the legislation which implemented the rules on personal data contained in Directive 95/46/EC into our national legal order to court. They considered this national legislation to be incompatible with European Union law as it established additional requirements, which were not provided for in the Directive, for the processing of personal data without the consent of the data subject.

Indeed, whereas the Directive permits this processing as long as (a) the data are not specially protected, (b) the processing is necessary to satisfy a legitimate interest of the person responsible for it and (c) it does not infringe fundamental rights of the data subject, the Spanish regulation added moreover that the data must have appeared previously in a source available to the public. Once the matter was brought to the Supreme Court, this tribunal decided to stay the proceedings and to refer the case to the CJEU for a preliminary ruling.

Conclusions of the CJEU

The CJEU considered that the Directive undertakes an exhaustive harmonization of the matter, and it confers an unconditional and precise right to process this type of data without the consent of the data subject in the terms established in the Directive itself. The CJEU concluded, therefore, that a national law imposing additional requirements is incompatible with European Union law.

This is not an isolated case

The judgment of the CJEU is a strong reprimand against the temptation of using national legislation to go beyond the limits marked by the legislator of the European Union. And this sort of excess is not infrequent. A few days ago the Spanish Agency for Medicinal Products and Medical Devices published a circular in which it insists that in order to cease the marketing of a medicinal product, authorization must be requested from this body and that the reasons for such cease must be specified in detail. Such requirement comes into conflict with European Union law which confers an unconditional and precise right to cease the marketing by merely notifying the authorities at least two months in advance and that only requires a report on the volume of sales and product prescriptions. It would be very useful thus if the Spanish authorities reconsidered their position in this matter before anybody ends up bringing the case before the CJEU.