Last month on 7 March 2024 the Court of Justice of the EU (CJEU) passed down its judgment in the case of Endemol Shine.
The case arose when Endemol Shine (a production company) contacted a Finnish court requesting information relating to an individual’s criminal record. The request was made orally. The Finnish court denied the request on the basis that it was processing personal data without any legal justification. Endemol Shine disputed this and eventually the question reached the CJEU.
The CJEU was asked to consider (amongst other questions) whether oral disclosure of personal data constitutes processing of personal data.
The CJEU confirmed that the definition of processing in Article 4 GDPR should be construed widely to ensure a high level of protection for individuals and to avoid the circumvention of the application of GDPR by making oral disclosures. The court held that processing covers oral disclosure where the data forms part or is intended to form part of a filing system, which is also interpreted widely and in the case in question, covered the court’s register of persons.
This is a useful reminder that sharing information orally is not a get out of jail free card when it comes to GDPR, and caution must be exercised.
The full judgment can be found here.
