Oral disclosures of information amount to the processing of personal data

The General Data Protection Regulation (GDPR) sets out strict rules to ensure personal data is protected and used fairly, lawfully, and transparently. This article explores a recent European Court of Justice (ECJ) case considering whether an oral disclosure amounted to data processing under the GDPR.

The case

Endemol Shine is a Finnish television production company. The company made a request for information relating to potential criminal proceedings from a District Court regarding an individual who was involved in a competition that it was organising. The request for the information was such that it would be disclosed orally, however, the District Court decided that the company’s request for the oral disclosure of information should be refused because there was no legitimate reason for processing the data.

Endemol Shine appealed the District Court’s decision by arguing that the oral disclosure of information would not constitute the processing of personal data under GDPR, which states that data processing includes ‘collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data’.

Article 2 of the GDPR states its general application to the processing of data ‘other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system’.

The Finnish Court of Appeal requested a preliminary ruling from the ECJ as to whether an oral disclosure could constitute the processing of personal data and therefore, fall within the scope of the GDPR.

The ECJ ruled that the concept of data processing under Article 4(2) GDPR should be interpreted broadly and was wide enough to include the oral disclosure of personal data.

Under the UK’s predecessor to GDPR, it was previously thought that purely verbal communications were not covered.  This European case confirms that what amounts to data processing it wider under the GDPR than previous legislation.

Key considerations

The ECJ’s decision was based on the following key points:

• The GDPR covered oral disclosures of personal data because of the broad definition of ‘processing’. The ECJ noted that there was no outright distinction between oral or written disclosures and that by ignoring the application of the GDPR to oral disclosures, this would be incompatible with the objective of the legislation generally
• The oral disclosure of data may still fall out of the GDPR’s scope if the information does not form part of a filing system, however, this was not applicable in this case because the information requested was already contained in the District Court’s filing system.

Key implications for employers

The decision highlights that an organisation cannot evade the GDPR restrictions by making oral disclosures of personal information.

Although this EU case is not binding on UK courts, the UK GDPR mirrors the EU GDPR definitions and so organisations should be aware that oral disclosures may well be covered.

Employers should ensure that they have an adequate Data Protection policy (or policies) and training in place, to inform employees that oral disclosures of personal data may amount to processing of personal data.

If you have any questions about data protection and data subject access requests, or any other employment law issue, please contact a member of our Employment team.