The Court of Justice of the European Union issued a judgment on 7 March 2024 regarding the oral sharing of criminal data. In it, the Court confirms that the oral provision of personal data falls within the scope of the General Data Protection Regulation (GDPR) as soon as this data is included in a file or intended for it.

Background

Endemol Shine Finland ("Endemol") is one of the largest Finnish production houses and is part of an international group. As part of its activities, Endemol asked a Finnish court to orally provide it with information regarding any pending or closed criminal cases against an individual who would participate in a competition for a job. The intention was to check his criminal antecedents. This request was within the framework of the Finnish law on the openness of procedures.

The court refused the request as, in its view, the oral provision of the information would constitute the processing of personal data concerning criminal convictions and offences. Under the GDPR, this personal data may only be processed under the supervision of an authority or when provided for in a law that also provides appropriate safeguards.

Endemol then appealed because, according to it, the oral communication would not constitute 'the processing of personal data'. The Finnish Court of Appeal then asked the Court of Justice whether an oral communication of personal data also falls within the scope of the GDPR.

Is an oral communication data processing?

The Court of Justice first clarifies that the concept of 'processing' has a particularly broad scope under the GDPR. This is evident, among other things, from the fact that the definition includes a non-exhaustive list of examples of possible operations. This list includes 'providing by means of transmission, dissemination or "otherwise making available"' of personal data. Moreover, no form requirement is imposed. Consequently, the oral provision of personal data is also a processing of personal data, just like the written or digital provision is.

Does oral communication fall within the scope of the GDPR?

However, the oral communication of personal data is not automated processing. Consequently, the communication must be 'included in a file' or 'intended to be included in a file' to fall within the scope of the GDPR.

The Court states that it would appear to it that the data that Endemol requests are included in a file that is kept by the court. Consequently, the oral communication of it would also fall within the scope of the GDPR. The court would indeed have to have a legal basis to orally communicate the data to Endemol.

Admissibility of the request to submit an extract from the criminal record

The above judgment may also have consequences for the situation where employers orally request personal data from (potential) employees. For example, it sometimes happens that employers need to verify a candidate's judicial past without the law explicitly providing for this.

This has led to a pragmatic solution, put forward by the Privacy Commission, predecessor of the Data Protection Authority, in an advisory opinion of 11 February 2002, in which the employer asks the candidate to show an extract from the criminal record at the job application, but does not take notes of this in writing in any way. In principle, there is not even a question of oral communication here.

At first sight, the above judgment of the Court of Justice seems to have no consequences for the situation where an employer asks the employee to submit or orally explain an extract from the criminal record as long as the data is not further processed in a file in any way.

The conditions of Collective Labour Agreement No. 38 concerning recruitment and selection must of course still be respected, and therefore the employer may in principle not request information that is not relevant to the performance of the function.

Increased attention to oral communication of personal data

Requesting an extract from the criminal record is not a simple task in practice. Therefore, it is advisable for companies to follow a clear process for this. The above judgment indicates that heightened attention is necessary when personal data is being orally communicated. This is not only relevant for criminal data, but for all personal data.

In addition, it is advisable to inform your own employees that they cannot just orally provide personal data.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.