CJ, 01-08-2022, nr. C-184/20

The Lietuvos Respublikos viešųjų ir privačių interesų derinimo valstybinėje tarnyboje įstatymas Nr. VIII-371 (Law No VIII-371 of the Republic of Lithuania on the reconciliation of public and private interests in the public service) of 2 July 1997 (Žin., 1997, No 67–1659), in the version in force at the material time (‘the Law on the reconciliation of interests’), has the aim, as stated in Article 1 thereof, of reconciling the private interests of persons working in the public service and the public interests of society, of ensuring that the public interest takes precedence when decisions are taken, of guaranteeing the impartiality of the decisions taken, and of preventing corruption from emerging and spreading in the public service.

Pursuant to Article 2(1) of the Law on the reconciliation of interests, the term ‘persons working in the public service’ covers, amongst others, persons who work in public associations or establishments that receive finance from the budget or from funds of the State or of a local authority and who are vested with administrative powers.

Article 3 of the Law on the reconciliation of interests, headed ‘Obligations of persons seeking to work, working or having worked in the public service’, provides in paragraphs 2 and 3:

Article 4 of the Law on the reconciliation of interests, headed ‘Declaration of private interests’, provides in paragraph 1:

As set out in Article 5 of the Law on the reconciliation of interests:

Article 6 of the Law on the reconciliation of interests, headed ‘Content of the declaration’, states:

Article 10 of the Law on the reconciliation of interests, headed ‘Public disclosure of data relating to private interests’, provides:

As laid down in Article 22 of the Law on the reconciliation of interests, headed ‘Authorities and public servants responsible for monitoring’:

Article 2(5) of the Law of the Republic of Lithuania on the reconciliation of public and private interests, in the version in force from 1 January 2020 (‘the Law on the reconciliation of interests as amended’), a provision which defines the term ‘persons working in the public service’, no longer refers, amongst such persons, to persons who work in public associations or establishments that receive finance from the budget or from funds of the State or of a local authority and who are vested with administrative powers.

Article 4(3) of the Law on the reconciliation of interests as amended states:

As set out in Article 2(8) of the Lietuvos Respublikos asmens duomenų teisinės apsaugos įstatymas Nr. I-1374 (Law No I-1374 of the Republic of Lithuania on the legal protection of personal data) of 11 June 1996 (Žin., 1996, No 63–1479), in the version in force until 16 July 2018:

By its questions, the referring court requests interpretation of the GDPR. In accordance with Article 99(2) thereof, the GDPR became applicable on 25 May 2018, the date with effect from which, by virtue of Article 94(1), it repealed Directive 95/46.

Consequently, the decision at issue in the main proceedings, which was adopted by the Chief Ethics Commission on 7 February 2018, was governed by Directive 95/46.

However, it is apparent from the documents before the Court that, by that decision, the Chief Ethics Commission alleged that the applicant in the main proceedings had failed to lodge a declaration of private interests, in breach of the Law on the reconciliation of interests. That being so, in the light of the information referred to in paragraph 50 of the present judgment and in the absence of anything to indicate that the applicant in the main proceedings lodged such a declaration before 25 May 2018, that is to say, the date on which the GDPR became applicable, the possibility remains that that regulation is applicable ratione temporis to the dispute in the main proceedings, a matter which is for the referring court to determine.

Furthermore, there is no need to distinguish between the provisions of Directive 95/46 and those of the GDPR referred to in the two questions referred for a preliminary ruling, as reformulated, since the purport of those provisions must be regarded as similar for the purposes of the interpretation that the Court is required to give in the present case (see, by analogy, judgment of 21 November 2013, Dixons Retail, C-494/12, EU:C:2013:758, paragraph 18).

Therefore, in order to provide useful answers to the questions submitted by the referring court, they should be examined on the basis of both Directive 95/46 and the GDPR.

By its first question, the referring court asks, in essence, whether Article 7(c) and (e) of Directive 95/46 and points (c) and (e) of the first subparagraph of Article 6(1) and Article 6(3) of the GDPR, read in the light of Articles 7 and 8 of the Charter, must be interpreted as precluding a national provision that provides for the placing online of personal data contained in the declaration of private interests that any head of an establishment receiving public funds is required to lodge with the national authority responsible for collecting such declarations and checking their content.

It should be noted at the outset that, under Article 1(1) of Directive 95/46, read in conjunction with recital 10 thereof, and Article 1(2) of the GDPR, read in conjunction with recitals 4 and 10 thereof, that directive and that regulation have the objective in particular of ensuring a high level of protection of the fundamental rights and freedoms of natural persons with respect to the processing of personal data; that right is also recognised in Article 8 of the Charter and is closely connected to the right to respect for private life, enshrined in Article 7 of the Charter.

To that end, Chapter II of Directive 95/46 and Chapters II and III of the GDPR set out the principles governing the processing of personal data and the rights of the data subject which the processing must observe. In particular, all processing of personal data was required, before the GDPR was applicable, to comply with the principles relating to data quality and the criteria for making data processing legitimate set out in Articles 6 and 7 of that directive and, once the GDPR was applicable, to comply with the principles relating to processing of data and the conditions governing lawfulness of processing listed in Articles 5 and 6 of that regulation (see, to that effect, judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 96, and of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes), C-175/20, EU:C:2022:124, paragraph 50).

In the present instance, Article 10(1) of the Law on the reconciliation of interests provides that the Chief Ethics Commission is to publish on its website the information set out in the declarations of private interests which are submitted by the public officials referred to in that provision and the content of which is defined in Article 6(1) of that law, with the exception of the information listed in Article 10(2) thereof.

It should be pointed out, in that regard, that the questions referred to the Court relate solely to the publication, on the Chief Ethics Commission's website, of the information set out in the declaration of private interests that the head of an establishment receiving public funds is required to lodge, and not to the obligation to declare in itself or to the publication of a declaration of interests in other circumstances.

Where information intended to be published on the Chief Ethics Commission's website relates to natural persons identified by their forename and surname, it constitutes personal data, within the meaning of Article 2(a) of Directive 95/46 and Article 4(1) of the GDPR, and the fact that that information was provided in the context of the declarant's professional activity does not mean that it cannot be so characterised (judgment of 9 March 2017, Manni, C-398/15, EU:C:2017:197, paragraph 34 and the case-law cited). Furthermore, the operation of loading personal data on an internet page constitutes processing, within the meaning of Article 2(b) of Directive 95/46 and Article 4(2) of the GDPR (see, to that effect, judgment of 1 October 2015, Weltimmo, C-230/14, EU:C:2015:639, paragraph 37), in respect of which the Chief Ethics Commission is the controller, within the meaning of Article 2(d) of Directive 95/46 and Article 4(7) of the GDPR (see, by analogy, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 101).

That having been explained, it should be examined whether Article 7 of Directive 95/46 and Article 6 of the GDPR, read in the light of Articles 7 and 8 of the Charter, preclude publication on the internet of part of the personal data set out in the declaration of private interests that any head of an establishment receiving public funds is required to lodge, such as the publication provided for in Article 10 of the Law on the reconciliation of interests.

Article 7 of Directive 95/46 and the first subparagraph of Article 6(1) of the GDPR set out an exhaustive and restrictive list of the cases in which processing of personal data can be regarded as lawful. Thus, in order to be capable of being regarded as such, processing must fall within one of the cases provided for in those provisions (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 99 and the case-law cited).

Under Article 7(e) of Directive 95/46 and point (e) of the first subparagraph of Article 6(1) of the GDPR, which are mentioned by the referring court in its first question, processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is lawful. In addition, under Article 7(c) of that directive and under point (c) of the first subparagraph of Article 6(1) of that regulation, a provision to which that court referred in the grounds of its request for a preliminary ruling, processing that is necessary for compliance with a legal obligation to which the controller is subject is also lawful.

Article 6(3) of the GDPR specifies, in respect of those two situations where processing is lawful, that the processing must be based on EU law or on Member State law to which the controller is subject, and that that legal basis must meet an objective of public interest and be proportionate to the legitimate aim pursued. Since those requirements constitute an expression of the requirements arising from Article 52(1) of the Charter, they must be interpreted in the light of the latter provision and must apply mutatis mutandis to Article 7(c) and (e) of Directive 95/46.

It should indeed be borne in mind that the fundamental rights to respect for private life and to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter, are not absolute rights, but must be considered in relation to their function in society and be weighed against other fundamental rights. Limitations may therefore be imposed, so long as, in accordance with Article 52(1) of the Charter, they are provided for by law, respect the essence of the fundamental rights and observe the principle of proportionality. Under the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. They must apply only in so far as is strictly necessary and the legislation which entails the interference must lay down clear and precise rules governing the scope and application of the measure in question (judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 105 and the case-law cited).

In the present instance, given that the publication, on the Chief Ethics Commission's website, of part of the personal data set out in the declaration of private interests that any head of an establishment receiving public funds is required to lodge results from a legislative provision of the Member State law to which the Chief Ethics Commission is subject, that is to say, from Article 10 of the Law on the reconciliation of interests, that processing is necessary for compliance with a legal obligation which is binding on that authority as controller and, therefore, falls within the situation envisaged in Article 7(c) of Directive 95/46 and point (c) of the first subparagraph of Article 6(1) of the GDPR. That being so, it is not necessary to determine whether that processing also falls within the situation envisaged in Article 7(e) of that directive and point (e) of the first subparagraph of Article 6(1) of that regulation.

Furthermore, since, as is apparent from paragraph 63 of the present judgment, Article 10 of the Law on the reconciliation of interests defines the scope of the limitation on the exercise of the right to the protection of personal data, the interference that it entails must be regarded as provided for by law, within the meaning of Article 52(1) of the Charter (see, to that effect, judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes), C-175/20, EU:C:2022:124, paragraph 54).

However, as has been stated in paragraph 69 of the present judgment, Article 10 of the Law on the reconciliation of interests, as the legal basis for the processing at issue in the main proceedings, must also fulfil the other requirements arising from Article 52(1) of the Charter and Article 6(3) of the GDPR, and in particular must meet an objective of public interest and be proportionate to the legitimate aim pursued.

In the present instance, it is apparent from Article 1 of the Law on the reconciliation of interests that, in adopting the principle of transparency of declarations of interest, that law seeks to ensure that the public interest takes precedence when decisions are taken by persons working in the public service, to guarantee the impartiality of those decisions, and to prevent situations of conflict of interests and the emergence and spread of corruption in the public service.

Such objectives, in that they seek to strengthen the safeguards for probity and impartiality of public sector decision makers, to prevent conflicts of interest and to combat corruption in the public sector, are undeniably objectives of public interest and, accordingly, legitimate.

Indeed, ensuring that public sector decision makers perform their duties impartially and objectively and preventing them from being influenced by considerations relating to private interests have the aim of guaranteeing the proper management of public affairs and public property.

Furthermore, combating corruption is an objective that the Member States have endorsed at both international and EU level.

In particular, at EU level, the Member States have acceded to the Convention on the fight against corruption involving officials of the European Communities or officials of Member States of the European Union, under which each Member State is required to adopt the necessary measures to ensure that both active and passive corruption involving officials is a criminal offence.

At international level, Article 1 of the United Nations Convention against Corruption states that the purposes of that convention are, inter alia, to promote and strengthen measures to prevent and combat corruption more efficiently and effectively, and to promote integrity, accountability and proper management of public affairs and public property. To that end, Article 7(4) of the convention provides that ‘each State Party shall, in accordance with the fundamental principles of its domestic law, endeavour to adopt, maintain and strengthen systems that promote transparency and prevent conflicts of interest’.

It follows from the foregoing considerations that the processing of personal data pursuant to the Law on the reconciliation of interests is intended to meet objectives of general interest recognised by the European Union, within the meaning of Article 52(1) of the Charter, and objectives that are of public interest and therefore legitimate, within the meaning of Article 6(3) of the GDPR.

Consequently, in accordance with those provisions, the objectives referred to in paragraphs 74 and 75 of the present judgment authorise limitations on the exercise of the rights guaranteed in Articles 7 and 8 of the Charter, provided in particular that the limitations genuinely meet those objectives and are proportionate to them.

That being so, it must be ascertained whether the placing online, on the Chief Ethics Commission's website, of part of the personal data contained in the declaration of private interests that any head of an establishment receiving public funds is required to lodge with that authority is appropriate for achieving the objectives of general interest defined in Article 1 of the Law on the reconciliation of interests and does not go beyond what is necessary in order to achieve those objectives (see, by analogy, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 109).

So far as concerns, first of all, the question whether publication on the Chief Ethics Commission's website of personal data contained in declarations of private interest is appropriate for achieving the objective of general interest defined in Article 1 of the Law on the reconciliation of interests, it should be pointed out that the placing online of some of the personal data contained in the declarations of private interests of public sector decision makers, in that it enables the existence of possible conflicts of interest liable to influence the performance of their duties to be revealed, is such as to induce them to act impartially. Thus, such implementation of the principle of transparency is capable of preventing conflicts of interest and corruption, of increasing the accountability of public sector actors and, therefore, of strengthening citizens' trust in their actions.

Accordingly, the measure at issue in the main proceedings appears appropriate for contributing to the achievement of the objectives of general interest that it pursues.

As regards, next, the requirement of necessity, it is apparent from recital 39 of the GDPR that that requirement is met where the objective of general interest pursued cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter, since derogations and limitations in relation to the principle of protection of such data must apply only in so far as is strictly necessary (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 110 and the case-law cited). Consequently, it should be ascertained in the present instance whether the objective of preventing conflicts of interest and corruption in the public sector by reinforcing the probity and impartiality of public officials might reasonably be achieved just as effectively by other measures less restrictive of the rights to respect for private life and to the protection of personal data of heads of establishments receiving public funds.

That assessment must be carried out in the light of all the matters of fact and law specific to the Member State concerned — such as the existence of other measures designed to prevent conflicts of interest and combat corruption, and the scale of such conflicts and of the phenomenon of corruption within the public service — and of the nature of the information at issue and the importance of the duties carried out by the declarant, in particular his or her hierarchical position, the extent of the powers of public administration with which he or she may be vested and the powers that he or she has in relation to the commitment and management of public funds.

In the present instance, first, it should be noted that, as can be gathered from paragraph 43 of the present judgment, the referring court seems to take the view that the obligation to declare private interests to the organs referred to in Articles 5 and 22 of the Law on the reconciliation of interests and the checking by those organs of compliance with that obligation and of the declaration's content would enable the objectives pursued by that law, namely preventing conflicts of interest and combating corruption in the public sector, to be achieved just as effectively.

According to the explanations provided by the referring court, one of the main arguments put forward by the Chief Ethics Commission in the main proceedings to justify publication of the declarations of private interest is the fact that it does not have sufficient human resources to check effectively all the declarations that are submitted to it.

However, it must be pointed out that a lack of resources allocated to the public authorities cannot in any event constitute a legitimate ground justifying interference with the fundamental rights guaranteed by the Charter.

The question also arises as to whether it is strictly necessary, in order to achieve the objectives of general interest referred to in Article 1 of the Law on the reconciliation of interests, that heads of establishments receiving public funds be, like the other categories of functions covered by the list in Article 10(1) of that law, subject to the public disclosure that that law prescribes.

In that regard, the Lithuanian Government has stated before the Court that the obligation to provide a declaration of impartiality, to which those heads are subject under national law, is sufficient to achieve the objectives of the Law on the reconciliation of interests and that, therefore, application of Article 10 of that law to them, which was required until the Law on the reconciliation of interests as amended entered into force on 1 January 2020, went beyond what is strictly necessary in the light of those objectives.

Second, even if publication of the private data at issue in the main proceedings were to prove necessary in order to achieve the objectives pursued by the Law on the reconciliation of interests, it is to be noted that a potentially unlimited number of persons may consult the personal data at issue. However, it is not apparent from the documents before the Court that the Lithuanian legislature, when adopting that provision, examined whether publication of those data on the internet without any restriction of access is strictly necessary or whether the objectives pursued by the Law on the reconciliation of interests might be achieved just as effectively if the number of persons able to consult those data is limited.

Third, in any event, it is to be borne in mind that the condition relating to the necessity of processing must be examined in conjunction with the ‘data minimisation’ principle, enshrined in Article 6(1)(c) of Directive 95/46 and Article 5(1)(c) of the GDPR, under which personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (see, to that effect, judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 48).

Therefore, only data the publication of which is actually capable of strengthening the safeguards for probity and impartiality of public officials, preventing conflicts of interest and combating corruption in the public sector may be subject to processing of the kind provided for in Article 10(1) of the Law on the reconciliation of interests.

In the present instance, it is clear from Article 10(2) of the Law on the reconciliation of interests, and from the explanations provided by the referring court in response to the request by the Court for information, that the majority of the data that have to be set out in the declaration of private interests, pursuant to Article 6(1) of that law, are intended to be published on the Chief Ethics Commission's website, with the exception, inter alia, of the data subjects' personal identification number.

Whilst, with a view to preventing conflicts of interest and corruption in the public sector, it may be appropriate to require information enabling the declarant to be identified and information relating to the activities of the declarant's spouse, cohabitee or partner to be set out in the declarations of private interests, the public disclosure, online, of name-specific data relating to the spouse, cohabitee or partner of a head of an establishment receiving public funds, and to close relatives, or other persons known by the declarant, liable to give rise to a conflict of interests, seems to go beyond what is strictly necessary. As the Advocate General has observed in point 66 of his Opinion, it does not appear that the objectives of public interest pursued could not be achieved if, for the purposes of publication, reference were solely made generically to a spouse, cohabitee or partner, as the case may be, together with the relevant indication of the interests held by those persons in relation to their activities.

Nor does it appear that the systematic publication, online, of the list of the declarant's transactions the value of which is greater than EUR 3 000 is strictly necessary in the light of the objectives pursued.

Finally, it must be borne in mind that an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective of general interest against the rights at issue (judgment of 5 April 2022, Commissioner of An Garda Síochána and Others, C-140/20, EU:C:2022:258, paragraph 52). Consequently, for the purpose of assessing the proportionality of the processing at issue in the main proceedings, it is necessary to measure the seriousness of the interference with the fundamental rights to respect for private life and to the protection of personal data that that processing involves and to determine whether the importance of the objective of general interest pursued by the processing is proportionate to the seriousness of the interference.

In order to assess the seriousness of that interference, account must be taken, inter alia, of the nature of the personal data at issue, in particular of any sensitivity of those data, and of the nature of, and specific methods for, the processing of the data at issue, in particular of the number of persons having access to those data and the methods of accessing them (judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, paragraph 57).

In the present instance, first, the public disclosure, online, of name-specific data relating to the declarant's spouse, partner or cohabitee, or to persons who are close relatives of the declarant, or are known by him or her, liable to give rise to a conflict of interests, and mention of the subject of transactions the value of which is greater than EUR 3 000 are liable to reveal information on certain sensitive aspects of the data subjects’ private life, including, for example, their sexual orientation. Furthermore, since it envisages such public disclosure of name-specific data relating to persons other than the declarant in his or her capacity as a public sector decision maker, the processing of personal data that is provided for in Article 10 of the Law on the reconciliation of interests also concerns persons who do not have that capacity and in respect of whom the objectives pursued by that law are not imperative in the same way as for the declarant.

The seriousness of such an infringement may still be increased by the cumulative effect of the personal data that are published as in the main proceedings, since combining them enables a particularly detailed picture of the data subjects' private lives to be built up (see, to that effect, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 128).

Second, it is not in dispute that that processing has the effect of making those personal data freely accessible on the internet to the whole of the general public and, accordingly, to a potentially unlimited number of persons.

Consequently, that processing is liable to enable those data to be freely accessed by persons who, for reasons unrelated to the objective of general interest of preventing conflicts of interest and corruption in the public sector, seek to find out about the personal, material and financial situation of the declarant and the members of his or her family (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 118).

Thus, as the Advocate General has observed in point 78 of his Opinion, publication of those data is liable, for example, to expose the persons concerned to repeated targeted advertising and commercial sales canvassing, or even to risks of criminal activity.

Therefore, processing, such as that at issue in the main proceedings, of the personal data referred to in paragraph 100 of the present judgment must be regarded as constituting a serious interference with the fundamental rights of data subjects to respect for private life and to the protection of personal data.

The seriousness of that interference must be weighed against the importance of the objectives of preventing conflicts of interest and corruption in the public sector.

In that regard, the Court considers it useful, for the purpose of pointing out the importance within the European Union of the objective of combating corruption, to take into consideration the content of the report of the Commission to the Council and the European Parliament of 3 February 2014 entitled ‘EU Anti-Corruption Report’ (COM(2014) 38 final), according to which corruption — which impinges on good governance, sound management of public money, and competitive markets — hampers economic development, undermines democracy and damages social justice and the rule of law, and is capable of undermining the trust of citizens in democratic institutions and processes. The report states that the whole of the European Union is affected by that phenomenon, to a greater or lesser extent depending on the Member State.

Similarly, the Criminal Law Convention on Corruption adopted by the Council of Europe refers to corruption in its fourth recital as a ‘[threat to] the rule of law, democracy and human rights [which] undermines good governance, fairness and social justice, distorts competition, hinders economic development and endangers the stability of democratic institutions and the moral foundations of society’.

In the light of the foregoing, it is undeniable that combating corruption is of great importance within the European Union.

In that context, the weighing of the interference resulting from the publication of personal data contained in the declarations of private interest against the objectives of general interest of preventing conflicts of interest and corruption in the public sector involves taking into consideration, inter alia, the fact and the extent of the phenomenon of corruption within the public service of the Member State concerned, so that the result of the weighing up to be carried out of those objectives, on the one hand, and a data subject's rights to respect for private life and to the protection of personal data, on the other, is not necessarily the same for all the Member States (see, by analogy, judgment of 24 September 2019, Google (Territorial scope of de-referencing), C-507/17, EU:C:2019:772, paragraph 67).

Furthermore, as follows from paragraph 86 of the present judgment, for the purpose of that balancing exercise, account must be taken inter alia of the fact that the general interest in personal data being published may vary according to the importance of the duties carried out by the declarant, in particular his or her hierarchical position, the extent of the powers of public administration with which he or she may be vested and the powers that he or she has in relation to the commitment and management of public funds (see, by analogy, judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 81).

That having been explained, it must be found that the publication online of the majority of the personal data contained in the declaration of private interests of any head of an establishment receiving public funds, such as that at issue in the main proceedings, does not meet the requirements of a proper balance. In comparison with an obligation to declare coupled with a check of the declaration's content by the Chief Ethics Commission the effectiveness of which it is for the Member State concerned to ensure by endowing that body with the means necessary for that purpose, such publication amounts to a considerably more serious interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter, without that increased interference being capable of being offset by any benefits which might result from publication of all those data for the purpose of preventing conflicts of interest and combating corruption.

Nor is there anything in the documents before the Court to indicate that safeguards against the risks of abuse, such as the risks referred to in paragraphs 103 and 104 of the present judgment, are provided for by the national legislation applicable to the dispute in the main proceedings.

As regards, however, the data relating to the membership of the declarant — or, without being name-specific, to the membership of the declarant's spouse, cohabitee or partner — of undertakings, establishments, associations or funds, to their activities as self-employed persons and to the legal persons of which they are members, it must be held that transparency as to whether or not such interests exist enables citizens and economic operators to have an accurate picture of the financial independence of the persons who are vested with decision-making power in the management of public funds. Furthermore, the data concerning gifts received, other than from close relatives, the value of which exceeds EUR 150 are capable of revealing the existence of acts of corruption.

Subject to the requirement to strike a fair balance in the light of the extent of the declarant's decision-making power, and provided that the principle of data minimisation is observed, the publication of such data contained in the declaration of interests may be justified by the benefits which, by strengthening the safeguards for probity and impartiality of public officials, such transparency brings in respect of the prevention of conflicts of interest and the combating of corruption.

In the light of all the foregoing considerations, the answer to the first question is that Article 7(c) of Directive 95/46 and point (c) of the first subparagraph of Article 6(1) and Article 6(3) of the GDPR, read in the light of Articles 7, 8 and 52(1) of the Charter, must be interpreted as precluding national legislation that provides for the publication online of the declaration of private interests that any head of an establishment receiving public funds is required to lodge, in so far as, in particular, that publication concerns name-specific data relating to his or her spouse, cohabitee or partner, or to persons who are close relatives of the declarant, or are known by him or her, liable to give rise to a conflict of interests, or concerns any transaction concluded during the last 12 calendar months the value of which exceeds EUR 3 000.

By its second question, the referring court asks, in essence, whether Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR must be interpreted as meaning that the publication, on the website of the public authority responsible for collecting and checking the content of declarations of private interests, of personal data that are liable to disclose indirectly the political opinions, trade union membership or sexual orientation of a natural person constitutes processing of special categories of personal data, for the purpose of those provisions.

Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR provide for the prohibition, inter alia, of processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of data concerning a natural person's sex life or sexual orientation. According to the heading of those articles, these are special categories of personal data, and such data are also categorised as ‘sensitive data’ in recital 34 of that directive and recital 10 of that regulation.

In the present instance, although the personal data the publication of which is mandatory pursuant to Article 10(1) of the Law on the reconciliation of interests are not, inherently, sensitive data for the purpose of Directive 95/46 and the GDPR, the referring court takes the view that it is possible to deduce from the name-specific data relating to the spouse, cohabitee or partner of the declarant certain information concerning the sex life or sexual orientation of the declarant and his or her spouse, cohabitee or partner.

That being so, it should be determined whether data that are capable of revealing the sexual orientation of a natural person by means of an intellectual operation involving comparison or deduction fall within the special categories of personal data, for the purpose of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR.

According to settled case-law, for the purpose of interpreting a provision of EU law it is necessary to consider not only its wording but also its context and the objectives of the legislation of which it forms part (judgment of 21 December 2021, Bank Melli Iran, C-124/20, EU:C:2021:1035, paragraph 43 and the case-law cited).

Article 8(1) of Directive 95/46 states that Member States are to prohibit the processing of personal data ‘revealing’ racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of data ‘concerning’ health or sex life. Article 9(1) of the GDPR provides that, inter alia, processing of personal data ‘revealing’ racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of data ‘concerning’ health or data ‘concerning’ a natural person's sex life or sexual orientation, are to be prohibited.

As the Advocate General has observed, in essence, in point 85 of his Opinion, whilst the use, in those provisions, of the verb ‘reveal’ is consistent with the taking into account of processing not only of inherently sensitive data, but also of data revealing information of that nature indirectly, following an intellectual operation involving deduction or cross-referencing, the preposition ‘concerning’ seems, on the other hand, to signify the existence of a more direct and immediate link between the processing and the data concerned, viewed inherently.

Such an interpretation, which would result in a distinction being drawn according to the type of sensitive data at issue, would not, however, be consistent with a contextual analysis of those provisions, in particular with Article 4(15) of the GDPR, according to which ‘data concerning health’ are personal data related to the physical or mental health of a natural person, including the provision of health care services, which ‘reveal’ information about his or her health status, and with recital 35 of that regulation, which states that personal data concerning health should include all data pertaining to the health status of a data subject which ‘reveal’ information relating to the past, current or future physical or mental health status of the data subject.

Furthermore, a wide interpretation of the terms ‘special categories of personal data’ and ‘sensitive data’ is confirmed by the objective of Directive 95/46 and the GDPR, noted in paragraph 61 of the present judgment, which is to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular of their private life, with respect to the processing of personal data concerning them (see, to that effect, judgment of 6 November 2003, Lindqvist, C-101/01, EU:C:2003:596, paragraph 50).

The contrary interpretation would, moreover, run counter to the purpose of Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR, namely to ensure enhanced protection as regards processing which, because of the particular sensitivity of the data processed, is liable to constitute, as follows from recital 33 of Directive 95/46 and recital 51 of the GDPR, a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, guaranteed by Articles 7 and 8 of the Charter (see, to that effect, judgment of 24 September 2019, GC and Others (De-referencing of sensitive data), C-136/17, EU:C:2019:773, paragraph 44).

Consequently, those provisions cannot be interpreted as meaning that the processing of personal data that are liable indirectly to reveal sensitive information concerning a natural person is excluded from the strengthened protection regime prescribed by those provisions, if the effectiveness of that regime and the protection of the fundamental rights and freedoms of natural persons that it is intended to ensure are not to be compromised.

In the light of all the foregoing considerations, the answer to the second question is that Article 8(1) of Directive 95/46 and Article 9(1) of the GDPR must be interpreted as meaning that the publication, on the website of the public authority responsible for collecting and checking the content of declarations of private interests, of personal data that are liable to disclose indirectly the sexual orientation of a natural person constitutes processing of special categories of personal data, for the purpose of those provisions.