The determination of the Court of Justice of the European Union to protect the EU’s fundamental right to data protection cannot be doubted. In Schrems the court invalidated the legal basis upon which thousands of firms were transferring EU personal data to the U.S., a judgment with implications for transatlantic trade. In Tele2 the court invalidated national laws that mandate the processing of personal data, a judgment with implications for the detection, investigation and prosecution of crime within the EU.  

The CJEU’s determination to uphold this fundamental right is combined with a strict approach to the application of EU data protection law. This approach was demonstrated by last November’s CJEU decision in Rotenberg v. Council, in which the CJEU did not adopt the “fruit of the poisonous tree” approach to breaches of EU data protection law. Such an approach would mean that the CJEU finding invalid any action resulting from a breach of EU data protection law.  Instead the CJEU adopted a more pragmatic approach which might be characterized as “fix it, move on, pay damages.” 

Rotenberg v. Council arose from Russia’s annexation of Crimea, following which the EU Council introduced sanctions targeted at certain individuals. One such individual was the applicant who was described as: “… a long-time acquaintance of President Putin and his former judo sparring partner." The initial decision alleged that the applicant controlled a company called Giprotransmost which “… has received a public procurement contract to conduct the feasibility study of the construction of a bridge from Russia to the illegally annexed Autonomous Republic of Crimea.” The applicant made submissions to the EU Council, which resulted in the contested references to Giprotransmost being deleted when EU sanctions were renewed 

The applicant challenged these sanctions before the CJEU on various grounds including “… that the publication by the Council of unsubstantiated, unfounded and incorrect allegations, seriously damaging to his reputation, and which allege that he is involved in cases of corruption and criminal conduct, breaches the principles of protection of personal data … ”  This was rejected by the CJEU which held that that: “… if the Council had processed personal data concerning the applicant’s shareholding in Giprotransmost in a way that was inconsistent with [EU data protection law] that could not lead to the annulment of … other … acts … were the applicant to succeed in proving that data was processed in that way, he could invoke an infringement of [EU data protection law] in the context of an action for damages.” Rotenberg v. Council is a straightforward application of EU data protection law: The applicant alleged that the EU Council had breached that law; the EU Council responded by deleting the contested data; the CJEU said move on, any residual consequences could be dealt with by an award of damages. 

Rotenberg v. Council has received surprisingly little attention, possibly reflecting its broad consistency with EU data protection law. The CJEU approach of fix it and move on is consistent with the principle of data minimization set out in Article 5 of the GDPR. As the CJEU has again made clear, the simplest way of avoiding a breach of EU data protection law is to avoid processing personal data in the first place. The CJEU’s reliance on damages as a remedy is consistent with Article 82 of the GDPR, which provides for the award for both material and non-material breaches of data protection law. And the strict approach that the CJEU took to the application of EU data protection law in Rotenberg v. Council is consistent with its earlier decision in YS. In that case, the CJEU had held that EU data protection law did not entitle a subject to access a legal opinion provided to the Dutch authorities in response to the subject’s application for residency.  The CJEU considered that the opinion related to the law that applied to the data subject, not to the data subject himself. In both cases the CJEU took a strict approach, excluding everything that is not personal data from the application of EU data protection law.

The significance of Rotenberg v. Council is its clear explanation of how the CJEU expects controllers should handle potential breaches of EU data protection law:  “fix it, move on, pay damages.”  Such clarity makes it easier for controllers to understand how to manage breaches of those laws; it will also make it easier for subjects to understand the remedies that they are entitled to.

Photo credit: Image provided by the Court of Justice of the European Union.