Out-Law / Your Daily Need-To-Know

CJEU: Personal data use permission applies throughout EU

16 Mar 2017, 12:32 pm

A telephone subscriber who gives permission for his or her data to be published in one state has in fact given permission for use in all member states, the Court of Justice of the European Union (CJEU) has said.

The EU's "highly harmonised" regulatory framework means it is possible to be sure that subscribers' personal data will be subject to the same rules across all member states, the CJEU, Europe's highest court, said.

The Court issued a judgment relating to a Belgian company, European Directory Assistance (EDA), which offers directory enquiry services accessible from Belgian territory.

EDA had asked three companies that assign telephone numbers in the Netherlands for data on their subscribers, based on an obligation under Dutch law which is a transposition of the European Universal Service Directive.

The companies, Tele2, Ziggo and Vodafone Libertel, refused, saying that they were not required to give the data to an organisation based in another member state.

The Administrative Court of Appeal for Trade and Industry, Netherlands asked the CJEU for a ruling on whether the companies were required to pass on the data, and also on whether it is necessary to give subscribers a choice as to whether their data can be passed on.

In answer to the first question, the CJEU said that the Universal Service Directive covers all reasonable requests for data made by organisations based in any member state for the purposes of providing publicly available enquiry services and directories. This data should be made available, and in a non-discriminatory manner, it said.

The directive makes no distinction between the request being made from within the same member state or from another state, the CJEU said. That is compatible with the objective of the directive, which is to ensure the availability throughout the EU of good quality publicly available services through effective competition and choice, it said.

On the question of whether subscribers should be able to choose where their data is made available, the Court referred to previous case law which shows that if a subscriber has been told by a provider that personal data may be passed to a third party with a view to it being published in a public directory, renewed consent is not needed unless the data is going to be used for another purpose, it said.