{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-710-23-62023cj0710","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-710-23-62023cj0710)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-15","fingerprint":"ewai:eu:8d311e","proof":"sha256:5d8fb865688b502ed40a7fe6407d9b22e9ca6960c33099d97a82b443667df9b2","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-710-23-62023cj0710","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62023CJ0710","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (First Chamber)","paragraphs":[]},{"title":"3 April 2025 (\n *1\n )","paragraphs":["para_4","para_5","para_6","para_7","para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_24"]},{"title":"2","paragraphs":["para_26"]},{"title":"Legal context","paragraphs":[]},{"title":"European Union law","paragraphs":[]},{"title":"3","paragraphs":[]},{"title":"Recitals 1, 4, 10, 14 and 154 of the GDPR state:","paragraphs":["para_31","para_32","para_33"]},{"title":"(4)","paragraphs":["para_35","para_36"]},{"title":"(10)","paragraphs":["para_38","para_39"]},{"title":"(14)","paragraphs":["para_41","para_42"]},{"title":"(154)","paragraphs":["para_44"]},{"title":"4","paragraphs":[]},{"title":"Article 1 of the GDPR, entitled ‘Subject matter and objectives’, provides, in paragraph 2:","paragraphs":["para_47"]},{"title":"5","paragraphs":[]},{"title":"Under Article 4 of the GDPR, entitled ‘Definitions’:","paragraphs":["para_50"]},{"title":"(1)","paragraphs":["para_52"]},{"title":"(2)","paragraphs":["para_54","para_55"]},{"title":"6","paragraphs":["para_57","para_58"]},{"title":"(a)","paragraphs":["para_60","para_61"]},{"title":"7","paragraphs":[]},{"title":"Article 6 of the GDPR, entitled ‘Lawfulness of processing’, provides:","paragraphs":["para_64"]},{"title":"(a)","paragraphs":["para_66"]},{"title":"(b)","paragraphs":["para_68"]},{"title":"(c)","paragraphs":["para_70"]},{"title":"(d)","paragraphs":["para_72"]},{"title":"(e)","paragraphs":["para_74"]},{"title":"(f)","paragraphs":["para_76","para_77","para_78","para_79"]},{"title":"(a)","paragraphs":[]},{"title":"Union law; or","paragraphs":[]},{"title":"(b)","paragraphs":["para_83","para_84","para_85"]},{"title":"8","paragraphs":["para_87","para_88"]},{"title":"Czech law","paragraphs":[]},{"title":"9","paragraphs":["para_91"]},{"title":"10","paragraphs":["para_93"]},{"title":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"11","paragraphs":["para_96"]},{"title":"12","paragraphs":["para_98"]},{"title":"13","paragraphs":["para_100"]},{"title":"14","paragraphs":["para_102"]},{"title":"15","paragraphs":["para_104"]},{"title":"16","paragraphs":["para_106"]},{"title":"17","paragraphs":["para_108","para_109","para_110"]},{"title":"(2)","paragraphs":["para_112"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"The first question","paragraphs":[]},{"title":"18","paragraphs":["para_116"]},{"title":"19","paragraphs":["para_118"]},{"title":"20","paragraphs":["para_120"]},{"title":"21","paragraphs":["para_122"]},{"title":"22","paragraphs":["para_124"]},{"title":"23","paragraphs":["para_126"]},{"title":"24","paragraphs":["para_128"]},{"title":"25","paragraphs":["para_130"]},{"title":"26","paragraphs":["para_132"]},{"title":"27","paragraphs":["para_134"]},{"title":"28","paragraphs":["para_136"]},{"title":"29","paragraphs":["para_138"]},{"title":"30","paragraphs":["para_140"]},{"title":"31","paragraphs":["para_142"]},{"title":"The second question","paragraphs":[]},{"title":"32","paragraphs":["para_145"]},{"title":"33","paragraphs":["para_147"]},{"title":"34","paragraphs":["para_149"]},{"title":"35","paragraphs":["para_151"]},{"title":"36","paragraphs":["para_153"]},{"title":"37","paragraphs":["para_155"]},{"title":"38","paragraphs":["para_157"]},{"title":"39","paragraphs":["para_159"]},{"title":"40","paragraphs":["para_161"]},{"title":"41","paragraphs":["para_163"]},{"title":"42","paragraphs":["para_165"]},{"title":"43","paragraphs":["para_167"]},{"title":"44","paragraphs":["para_169"]},{"title":"45","paragraphs":["para_171"]},{"title":"46","paragraphs":["para_173"]},{"title":"47","paragraphs":["para_175"]},{"title":"48","paragraphs":["para_177"]},{"title":"Costs","paragraphs":[]},{"title":"49","paragraphs":["para_180"]},{"title":"On those grounds, the Court (First Chamber) hereby rules:","paragraphs":["para_182","para_183","para_184","para_185","para_186","para_187","para_188","para_189"]}],"paragraphs":[{"text":"62023CJ0710","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (First Chamber)","paragraph_id":"para_2"},{"text":"3 April 2025 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4 – Definitions – Article 6 – Lawfulness of processing – Article 86 – Public access to official documents – Data concerning the representative of a legal person – Case-law of a national court imposing an obligation to inform and consult the data subject prior to disclosure of official documents containing such data)","paragraph_id":"para_4"},{"text":"In Case C‑710/23,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Nejvyšší správní soud (Supreme Administrative Court, Czech Republic), made by decision of 1 November 2023, received at the Court on 22 November 2023, in the proceedings","paragraph_id":"para_6"},{"text":"L.H.","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"Ministerstvo zdravotnictví,","paragraph_id":"para_9"},{"text":"THE COURT (First Chamber),","paragraph_id":"para_10"},{"text":"composed of F. Biltgen, President of the Chamber, T. von Danwitz (Rapporteur), Vice-President of the Court, A. Kumin, I. Ziemele and S. Gervasoni, Judges,","paragraph_id":"para_11"},{"text":"Advocate General: J. Richard de la Tour,","paragraph_id":"para_12"},{"text":"Registrar: A. Calot Escobar,","paragraph_id":"para_13"},{"text":"having regard to the written procedure,","paragraph_id":"para_14"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_15"},{"text":"–","paragraph_id":"para_16"},{"text":"the Czech Government, by L. Březinová, M. Smolek and J. Vláčil, acting as Agents,","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"the European Commission, by A. Bouchagiar and P. Ondrůšek, acting as Agents,","paragraph_id":"para_19"},{"text":"having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,","paragraph_id":"para_20"},{"text":"gives the following","paragraph_id":"para_21"},{"text":"Judgment","paragraph_id":"para_22"},{"text":"1","paragraph_id":"para_23"},{"text":"This request for a preliminary ruling concerns the interpretation of point 1 of Article 2 and Article 6(1)(c) and (e) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ 2016 L 119, p. 1 ; ‘the GDPR’).","paragraph_id":"para_24"},{"text":"2","paragraph_id":"para_25"},{"text":"The request has been made in proceedings between L.H. and Ministerstvo zdravotnictví (Minister of Health, Czech Republic) concerning the latter’s decision not to disclose to L.H. certain information concerning representatives of legal persons, referred to in contracts for the purchase of COVID-19 screening tests, and in certificates relating to those tests.","paragraph_id":"para_26"},{"text":"Legal context","paragraph_id":"para_27"},{"text":"European Union law","paragraph_id":"para_28"},{"text":"3","paragraph_id":"para_29"},{"text":"Recitals 1, 4, 10, 14 and 154 of the GDPR state:","paragraph_id":"para_30"},{"text":"‘(1)","paragraph_id":"para_31"},{"text":"The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the “Charter”) and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.","paragraph_id":"para_32"},{"text":"…","paragraph_id":"para_33"},{"text":"(4)","paragraph_id":"para_34"},{"text":"The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionali …","paragraph_id":"para_35"},{"text":"…","paragraph_id":"para_36"},{"text":"(10)","paragraph_id":"para_37"},{"text":"In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member …","paragraph_id":"para_38"},{"text":"…","paragraph_id":"para_39"},{"text":"(14)","paragraph_id":"para_40"},{"text":"The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.","paragraph_id":"para_41"},{"text":"…","paragraph_id":"para_42"},{"text":"(154)","paragraph_id":"para_43"},{"text":"This Regulation allows the principle of public access to official documents to be taken into account when applying this Regulation. Public access to official documents may be considered to be in the public interest. Personal data in documents held by a public authority or a public body should be abl …","paragraph_id":"para_44"},{"text":"4","paragraph_id":"para_45"},{"text":"Article 1 of the GDPR, entitled ‘Subject matter and objectives’, provides, in paragraph 2:","paragraph_id":"para_46"},{"text":"‘This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.’","paragraph_id":"para_47"},{"text":"5","paragraph_id":"para_48"},{"text":"Under Article 4 of the GDPR, entitled ‘Definitions’:","paragraph_id":"para_49"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_50"},{"text":"(1)","paragraph_id":"para_51"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;","paragraph_id":"para_52"},{"text":"(2)","paragraph_id":"para_53"},{"text":"“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;","paragraph_id":"para_54"},{"text":"…’","paragraph_id":"para_55"},{"text":"6","paragraph_id":"para_56"},{"text":"Article 5 of the GDPR, entitled ‘Principles relating to processing of personal data’, provides:","paragraph_id":"para_57"},{"text":"‘1.   Personal data shall be:","paragraph_id":"para_58"},{"text":"(a)","paragraph_id":"para_59"},{"text":"processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);","paragraph_id":"para_60"},{"text":"…’","paragraph_id":"para_61"},{"text":"7","paragraph_id":"para_62"},{"text":"Article 6 of the GDPR, entitled ‘Lawfulness of processing’, provides:","paragraph_id":"para_63"},{"text":"‘1.   Processing shall be lawful only if and to the extent that at least one of the following applies:","paragraph_id":"para_64"},{"text":"(a)","paragraph_id":"para_65"},{"text":"the data subject has given consent to the processing of his or her personal data for one or more specific purposes;","paragraph_id":"para_66"},{"text":"(b)","paragraph_id":"para_67"},{"text":"processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;","paragraph_id":"para_68"},{"text":"(c)","paragraph_id":"para_69"},{"text":"processing is necessary for compliance with a legal obligation to which the controller is subject;","paragraph_id":"para_70"},{"text":"(d)","paragraph_id":"para_71"},{"text":"processing is necessary in order to protect the vital interests of the data subject or of another natural person;","paragraph_id":"para_72"},{"text":"(e)","paragraph_id":"para_73"},{"text":"processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;","paragraph_id":"para_74"},{"text":"(f)","paragraph_id":"para_75"},{"text":"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.","paragraph_id":"para_76"},{"text":"…","paragraph_id":"para_77"},{"text":"2.   Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.","paragraph_id":"para_78"},{"text":"3.   The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:","paragraph_id":"para_79"},{"text":"(a)","paragraph_id":"para_80"},{"text":"Union law; or","paragraph_id":"para_81"},{"text":"(b)","paragraph_id":"para_82"},{"text":"Member State law to which the controller is subject.","paragraph_id":"para_83"},{"text":"The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That leg …","paragraph_id":"para_84"},{"text":"…’","paragraph_id":"para_85"},{"text":"8","paragraph_id":"para_86"},{"text":"Article 86 of the GDPR, entitled ‘Processing and public access to official documents’, in Chapter IX of that regulation, which contains the provisions on specific processing situations. That article provides:","paragraph_id":"para_87"},{"text":"‘Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation.’","paragraph_id":"para_88"},{"text":"Czech law","paragraph_id":"para_89"},{"text":"9","paragraph_id":"para_90"},{"text":"The zákon č. 106/1999 Sb., o svobodném přístupu k informacím (Law No 106/1999 on free access to information) imposes an obligation on public authorities to disclose information to the natural or legal person on request.","paragraph_id":"para_91"},{"text":"10","paragraph_id":"para_92"},{"text":"Under Paragraph 8a(1) of that law, the party responsible for providing information may disclose information relating to a natural person’s personality, personal sphere, private life and personal data only in accordance with the rules governing the protection thereof.","paragraph_id":"para_93"},{"text":"The dispute in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_94"},{"text":"11","paragraph_id":"para_95"},{"text":"L.H. lodged a request with the Ministry of Health for information concerning the identification of persons who had signed contracts for the purchase of COVID-19 screening tests concluded by that ministry, as well as certificates relating to those tests and demonstrating that they may be used on the territory of the European Union.","paragraph_id":"para_96"},{"text":"12","paragraph_id":"para_97"},{"text":"That ministry partially granted L.H.’s request and sent him the certificates relating to those tests, redacting the information relating to the natural persons who had signed those certificates on behalf of the legal persons concerned, including the forename, surname, signature and position held by …","paragraph_id":"para_98"},{"text":"13","paragraph_id":"para_99"},{"text":"L.H. brought an action for annulment of the Ministry of Health’s decision to disclose before the Městský soud v Praze (Municipal Court, Prague, Czech Republic) in so far as it redacted that information. The court upheld that action, holding that the Ministry could not refuse, as a matter of principl …","paragraph_id":"para_100"},{"text":"14","paragraph_id":"para_101"},{"text":"The Ministry of Health brought an appeal on a point of law against the decision of the Městský soud v Praze (Municipal Court, Prague) before the Nejvyšší správní soud (Supreme Administrative Court, Czech Republic), which is the referring court. According to that ministry, the failure to inform the n …","paragraph_id":"para_102"},{"text":"15","paragraph_id":"para_103"},{"text":"In that context, the referring court asks, in the first place, whether the data at issue in the main proceedings constitute ‘personal data’ within the meaning of point 1 of Article 4 of the GDPR. In the light of recital 14 of that regulation, it would be inclined to take the view that such informati …","paragraph_id":"para_104"},{"text":"16","paragraph_id":"para_105"},{"text":"In the second place, should the Court take the view that the data at issue in the main proceedings constitute personal data, the referring court is uncertain as to whether the relevant national case-law, which requires the controller, to which a request for disclosure of those data has been made, to …","paragraph_id":"para_106"},{"text":"17","paragraph_id":"para_107"},{"text":"It was in those circumstances that the Nejvyšší správní soud (Supreme Administrative Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:","paragraph_id":"para_108"},{"text":"‘(1)","paragraph_id":"para_109"},{"text":"Does the disclosure of the first name, surname, signature and contact information of a natural person as the director or responsible representative of a legal person, made exclusively for the purpose of identification of the (person authorised to represent a certain) legal person … constitute processing of “personal data” of the natural person concerned, pursuant to [point 1 of Article 4] of the GDPR, and thus fall within the scope of [that regulation]?","paragraph_id":"para_110"},{"text":"(2)","paragraph_id":"para_111"},{"text":"Can national law, including settled case-law, render the application by an administrative authority of a directly applicable EU regulation, namely Article 6(1)(c) or (e) of the GDPR, conditional on compliance with other conditions that do not follow from the text of the regulation itself but which, …","paragraph_id":"para_112"},{"text":"Consideration of the questions referred","paragraph_id":"para_113"},{"text":"The first question","paragraph_id":"para_114"},{"text":"18","paragraph_id":"para_115"},{"text":"By its first question, the referring court asks, in essence, whether points 1 and 2 of Article 4 of the GDPR must be interpreted as meaning that the disclosure of the first name, surname, signature and contact details of a natural person representing a legal person constitutes processing of personal data, even if that disclosure is made for the sole purpose of enabling the identification of the natural person authorised to act on behalf of that legal person.","paragraph_id":"para_116"},{"text":"19","paragraph_id":"para_117"},{"text":"As a preliminary point, it should be noted that, according to the information provided by the referring court, the legal persons which issued the certificates at issue in the main proceedings are established in third countries, namely China and the United Kingdom. Although such legal persons may, un …","paragraph_id":"para_118"},{"text":"20","paragraph_id":"para_119"},{"text":"Having made that preliminary remark, it should be recalled that, under point 1 of Article 4 of the GDPR, ‘personal data’ means ‘any information relating to an identified or identifiable natural person’. A ‘natural identifiable person’, within the meaning of that provision, is ‘one who can be identif …","paragraph_id":"para_120"},{"text":"21","paragraph_id":"para_121"},{"text":"According to settled case-law, the use of the expression ‘any information’ in the definition of the concept of ‘personal data’ in that provision reflects the aim of the EU legislature to assign a wide scope to that concept, which potentially encompasses all kinds of information, not only objective b …","paragraph_id":"para_122"},{"text":"22","paragraph_id":"para_123"},{"text":"Thus, information relating to the identity of identified or identifiable natural persons who, as a body constituted pursuant to law, or as members of such a body, are authorised to represent a company in dealings with third parties constitutes ‘personal data’ within the meaning of point 1 of Article …","paragraph_id":"para_124"},{"text":"23","paragraph_id":"para_125"},{"text":"As the Commission observed, that interpretation cannot be invalidated by recital 14 of the GDPR. The second sentence of that recital refers, inter alia, to the ‘name’ and ‘contact details’ of the legal person, and not that of natural persons acting in the name of or on behalf of a legal person.","paragraph_id":"para_126"},{"text":"24","paragraph_id":"para_127"},{"text":"In the present case, it should be noted that the first name and surname of an identified or identifiable natural person constitute personal data within the meaning of point 1 of Article 4 of the GDPR. The same applies to the signature of a natural person (see, to that effect, judgment of 4 October 2024, Agentsia po vpisvaniyata, C‑200/23 , EU:C:2024:827 , paragraph  136 ).","paragraph_id":"para_128"},{"text":"25","paragraph_id":"para_129"},{"text":"As regards the other contact details at issue in the main proceedings, it is for the referring court to ascertain, in the light of the case-law referred to in paragraph 21 above, whether those contact details are linked to an identified or identifiable natural person.","paragraph_id":"para_130"},{"text":"26","paragraph_id":"para_131"},{"text":"As to the concept of ‘processing’, within the meaning of point 2 of Article 4 of the GDPR, that provision defines it as meaning ‘any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organ …","paragraph_id":"para_132"},{"text":"27","paragraph_id":"para_133"},{"text":"Thus, it is apparent from the expression ‘any operation’ that the legislature intended to give that concept a broad scope, which is corroborated by the non-exhaustive nature, expressed by the phrase ‘such as’, of the operations listed in that provision, which include disclosure by transmission, diss …","paragraph_id":"para_134"},{"text":"28","paragraph_id":"para_135"},{"text":"In any event, there is nothing in the wording of point 2 of Article 4 of the GDPR to suggest that the EU legislature intended those operations to be classified as ‘processing’ according to their purpose.","paragraph_id":"para_136"},{"text":"29","paragraph_id":"para_137"},{"text":"That interpretation is consistent with the objective pursued by the GDPR, as is set out in Article 1 thereof and in recitals 1 and 10 thereof, consisting, inter alia, in ensuring a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privac …","paragraph_id":"para_138"},{"text":"30","paragraph_id":"para_139"},{"text":"In the present case, the disclosure of data such as the first name, surname, signature and contact details of a natural person representing a legal person falls within the concept of ‘processing’ within the meaning of point 2 of Article 4 of the GDPR. As is apparent from paragraphs 27 to 29 above, t …","paragraph_id":"para_140"},{"text":"31","paragraph_id":"para_141"},{"text":"In the light of the foregoing considerations, the answer to the first question is that points 1 and 2 of Article 4 of the GDPR must be interpreted as meaning that the disclosure of the first name, surname, signature and contact details of a natural person representing a legal person constitutes proc …","paragraph_id":"para_142"},{"text":"The second question","paragraph_id":"para_143"},{"text":"32","paragraph_id":"para_144"},{"text":"By its second question, the referring court asks, in essence, whether Article 6(1)(c) and (e) of the GDPR must be interpreted as precluding national case-law which requires a controller, being a public authority responsible for reconciling public access to official documents with the right to the protection of personal data, to inform and consult the natural person concerned prior to the disclosure of official documents containing such data.","paragraph_id":"para_145"},{"text":"33","paragraph_id":"para_146"},{"text":"In accordance with the objective pursued by the GDPR, as recalled in paragraph 29 above, any processing of personal data must, inter alia, comply with the principles relating to the processing of such data set out in Article 5 of that regulation and satisfy the lawfulness conditions listed in Article 6 of that regulation (judgment of 9 January 2025, Mousse, C‑394/23 , EU:C:2025:2 , paragraph  22 and the case-law cited).","paragraph_id":"para_147"},{"text":"34","paragraph_id":"para_148"},{"text":"In that regard, Article 5(1)(a) of the GDPR provides that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.","paragraph_id":"para_149"},{"text":"35","paragraph_id":"para_150"},{"text":"Article 6(1)(c) of the GDPR provides that processing may be lawful if and to the extent that it is necessary for compliance with a legal obligation to which the controller is subject. Under Article 6(1)(e) of that regulation, such processing may also be lawful if and to the extent that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.","paragraph_id":"para_151"},{"text":"36","paragraph_id":"para_152"},{"text":"According to Article 6(2) of the GDPR, Member States may maintain or introduce more specific provisions to adapt the application of the rules of that regulation with regard to processing for compliance with Article 6(1)(c) and (e) of the GDPR by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations, referred to in Chapter IX of the GDPR.","paragraph_id":"para_153"},{"text":"37","paragraph_id":"para_154"},{"text":"Article 6(3) of the GDPR provides that the basis for the processing referred to in Article 6(1)(c) and (e) is to be defined, as the case may be, by EU or Member State law to which the controller is subject. The relevant legal basis must meet an objective of public interest and be proportionate to th …","paragraph_id":"para_155"},{"text":"38","paragraph_id":"para_156"},{"text":"It should also be noted that, as regards public access to official documents, Article 86 of the GDPR, which forms part of Chapter IX thereof, provides that personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in t …","paragraph_id":"para_157"},{"text":"39","paragraph_id":"para_158"},{"text":"That article must be read in the light, first, of recital 4 of the GDPR, which states, inter alia, that the right to the protection of personal data is not an absolute right, second, of recital 154 of that regulation, from which it is apparent, inter alia, that public access to official documents ma …","paragraph_id":"para_159"},{"text":"40","paragraph_id":"para_160"},{"text":"Although, as is apparent from recital 10 of the GDPR, Member States have the power to maintain or introduce national provisions to further specify the application of the rules of that regulation, they must nevertheless use their discretion under the conditions and within the limits provided for by t …","paragraph_id":"para_161"},{"text":"41","paragraph_id":"para_162"},{"text":"Furthermore, in accordance with the principle of proportionality, Member States must ensure that the practical consequences, in particular of an organisational nature, arising from the additional requirements which they have laid down are not excessive (see, to that effect, judgment of 21 December 2023, Krankenversicherung Nordrhein, C‑667/21 , EU:C:2023:1022 , paragraph  67 ).","paragraph_id":"para_163"},{"text":"42","paragraph_id":"para_164"},{"text":"In the present case, the processing at issue in the main proceedings may fall within point (c) as well as point (e) of Article 6(1) of the GDPR, since it is imposed on the controller by Law No 106/1999 on free access to information, in the performance of a task carried out in the public interest con …","paragraph_id":"para_165"},{"text":"43","paragraph_id":"para_166"},{"text":"That being said, where the information requested contains personal data, that law provides that such data may be disclosed only in compliance with the legislation relating to the protection of those data, which, as the referring court observes, includes the GDPR. It is apparent from the order for re …","paragraph_id":"para_167"},{"text":"44","paragraph_id":"para_168"},{"text":"As regards the compatibility of national case-law, such as that at issue in the main proceedings, with the GDPR, it should be noted that, under the provisions referred to in paragraphs 36 and 37 above, Member States may introduce specific provisions to ensure lawful and fair processing in specific p …","paragraph_id":"para_169"},{"text":"45","paragraph_id":"para_170"},{"text":"Consequently, Article 6(1)(c) and (e) of the GDPR does not preclude, in principle, national case-law which lays down an obligation to inform and consult the data subject before any disclosure of personal data concerning him or her. Such an obligation is such as to ensure lawful, fair and transparent …","paragraph_id":"para_171"},{"text":"46","paragraph_id":"para_172"},{"text":"Nevertheless, in the light of the case-law referred to in paragraphs 40 and 41 above, an absolute application of that obligation could give rise to a disproportionate restriction on public access to official documents. It is conceivable that, for various reasons, informing and/or consulting the data …","paragraph_id":"para_173"},{"text":"47","paragraph_id":"para_174"},{"text":"In the present case, subject to verification by the referring court, the Ministry of Health appears to have based its decision not to disclose all the information requested on that practical impossibility alone, without having made any attempt to reconcile interests.","paragraph_id":"para_175"},{"text":"48","paragraph_id":"para_176"},{"text":"In the light of all the foregoing considerations, the answer to the second question is that Article 6(1)(c) and (e) of the GDPR, read in conjunction with Article 86 of that regulation, must be interpreted as not precluding national case-law which requires a controller, being a public authority respo …","paragraph_id":"para_177"},{"text":"Costs","paragraph_id":"para_178"},{"text":"49","paragraph_id":"para_179"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_180"},{"text":"On those grounds, the Court (First Chamber) hereby rules:","paragraph_id":"para_181"},{"text":"1.","paragraph_id":"para_182"},{"text":"Points 1 and 2 of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)","paragraph_id":"para_183"},{"text":"must be interpreted as meaning that the disclosure of the first name, surname, signature and contact details of a natural person representing a legal person constitutes processing of personal data. The fact that that disclosure is made for the sole purpose of enabling the identification of the natural person authorised to act on behalf of that legal person is irrelevant in that regard.","paragraph_id":"para_184"},{"text":"2.","paragraph_id":"para_185"},{"text":"Article 6(1)(c) and (e) of Regulation 2016/679, read in conjunction with Article 86 of that regulation,","paragraph_id":"para_186"},{"text":"must be interpreted as not precluding national case-law which requires a controller, being a public authority responsible for reconciling public access to official documents with the right to the protection of personal data, to inform and consult the natural person concerned prior to the disclosure …","paragraph_id":"para_187"},{"text":"[Signatures]","paragraph_id":"para_188"},{"text":"(\n *1\n ) Language of the case: Czech.","paragraph_id":"para_189"}],"word_count":5699,"cites":["C-604/22","C-200/23","C-398/15","C-740/22","C-394/23","C-37/20","C-601/20","C-34/21","C-667/21"],"sha256":"f48774335ad89f4bc03cc8052d5e38c6609db317d8941fe041d502f5f1fbd6e4","source_url":"https://publications.europa.eu/resource/celex/62023CJ0710.ENG.xhtml.ECR_62023CJ0710_EN_01.html","fetched_at":"2026-09-30T20:25:39.898+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-710-23-62023cj0710","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-710-23-62023cj0710","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-710-23-62023cj0710","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-710-23-62023cj0710","verification":{"stored_sha256":"f48774335ad89f4bc03cc8052d5e38c6609db317d8941fe041d502f5f1fbd6e4","recomputed_sha256":"f48774335ad89f4bc03cc8052d5e38c6609db317d8941fe041d502f5f1fbd6e4","intact":true,"checked_at":"2026-10-15T07:25:55.328Z"}},"hash":"sha256:5d8fb865688b502ed40a7fe6407d9b22e9ca6960c33099d97a82b443667df9b2","version":"legal-2026-10-15","expires":"2026-10-16T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-15+legal-2026-10-15+2026-10-15T06:23:03","content_hash":"sha256:5d8fb865688b502ed40a7fe6407d9b22e9ca6960c33099d97a82b443667df9b2","revalidate_after":"2026-10-15T08:25:55.938Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-710-23-62023cj0710","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-710-23-62023cj0710"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-710-23-62023cj0710"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-710-23-62023cj0710"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-710-23-62023cj0710","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-5581dded8faaafd8791c67b972d9a555","response_hash":"sha256:5d8fb865688b502ed40a7fe6407d9b22e9ca6960c33099d97a82b443667df9b2"}},"freshness":{"freshness_class":"live","as_of":"2026-11-02T23:41:17.389Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-710-23-62023cj0710&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":12882}}