Finland: Issued Interim Ruling in Public Lawsuit Involving Oral Transfer of Personal Data (Endemol Shine Finland Oy v Finland/Case C‑740/22)

On 7 March 2024, the European Court of Justice (CJEU) issued an interim ruling in a public lawsuit involving the oral transfer of personal data (Endemol Shine Finland Oy v Finland). The interim ruling followed the request from the Court of Appeal of Eastern Finland submitted on 30 November 2022. Endemol Shine Finland sought to verify the criminal record of an individual involved in one of their competitions by making an oral request to a district court in Finland for information on any ongoing or completed criminal proceedings against that person. The request was denied on the grounds that disclosing such information would involve processing personal data. The CJEU was asked to clarify if an oral transfer of personal data constitutes processing of personal data within the meaning of Article 2(1) and Article 4(2) of the General Data Protection Regulation (GDPR). Additionally, the CJEU was asked to determine if public access to official documents can be reconciled with the right to protection of personal data by allowing information on criminal convictions or offences of a natural person to be obtained from a court's register of persons without restriction where a request is made to transfer the information orally to the applicant. In this context, it also posed the question if it is relevant whether the applicant is a company or a private individual. The CJEU noted that the oral disclosure of information on possible ongoing or completed criminal proceedings to which a natural person has been subject constitutes processing of personal data under Article 4(2) of the GDPR. The court further clarified that with regard to the sensitivity of data relating to criminal convictions, the fundamental rights of data subjects to respect of private life and protection of personal data prevail over the public’s interest in having access to official documents. In that regard, it is irrelevant whether the person requesting access to data relating to criminal convictions is a commercial company or a private individual or whether such data is disclosed in writing or orally.