The Court of Justice has delivered its judgement on the preliminary reference requested by the Supreme Administrative Court of the Czech Republic. The case concerns the redaction of personal data, due to impossibility of notifying the data subjects, in the course of granting public access of official documents relating to contracts for the purchase of COVID-19 tests. The preliminary reference request advanced two questions: 1) Whether the personal details of a natural person acting on behalf of a legal entity, such as a signature and contact details, qualify as personal data under GDPR, and 2) whether national law can impose additional conditions, beyond those specified in the GDPR, that extend the scope of data protection, such as requiring public authorities to inform or consult individuals before disclosing their personal data.

As to the first question, the Court held that the communication of data such as the first name, surname, signature and contact details of a natural person, representing a legal person, falls within the concept of “processing”, within the meaning of Article 4(2) of the GDPR. Accordingly, the fact that the sole purpose of the communication of such data is to enable the identification of a natural person entitled to act on behalf of a legal person is irrelevant for the purposes of the classification of “treatment”, within the meaning of that provision.

Regarding the second question, the Court found that the absolute implementation of an obligation under national law to consult the data subject before any communication of personal data could give rise to a disproportionate restriction of the right of public access to official documents. The Court deemed that, in this case, the Ministry of Health gave its decision on the basis of mere practical impossibility, without having at any time attempted to reconcile the said interests.