The Court of Justice of the European Union ('CJEU') issued, on 1 August 2022, its preliminary ruling in OT v Vyriausioji tarnybinės etikos komisija (Chief Official Ethics Commission, Lithuania) (Case C-184/20) referred to it by the Regional Administrative Court of Lithuania. In particular, the CJEU clarified that personal data liable to indirectly disclose the special categories of a natural person constitutes processing of special categories of personal data for the purpose of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). 

Background to the decision 

More specifically, the CJEU stated that the case questions concerned a decision of the Chief Official Ethics Commission of Lithuania finding that OT had failed to fulfil its obligation to lodge a declaration of private interests in breach of Article 10(1) of the Law on the reconciliation of interests, Law No VIII-371 of 2 July 1997. In this regard, the CJEU noted that the following questions have been referred:

• Must Article 6(1)(e) of the GDPR on processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, with regard to Article 6(3) of the same, be interpreted as precluding a national provision that provides for the placing online of personal data contained in the declaration of private interests that any head of an establishment receiving public funds is required to lodge with the national authority responsiblefor collecting such declarations and checking their content?
• Must the prohibition of the processing of special categories of personal data established in Article 9(1) of the GDPR, in light of Article 9(2) of the same and particularly Article 9(2)(g), be interpreted as meaning that national law may not require the disclosure of data relating to declarations of private interests which may disclose personal data, including data regarding a person's political views, trade union membership, sexual orientation, and other personal information?

Findings of the CJEU 

Ultimately, with regard to the first question referred to it, the CJEU found that Article 6(1) and (3) of the GDPR in light of other relevant EU legal instruments, must be interpreted as precluding national legislation that provides for the online publication of the declaration of private interests that any head of an establishment receiving public funds is required to lodge, in so far as, in particular, that publication concerns name-specific data relating to their spouse, cohabitee or partner, or to persons who are close relatives of the declarant, or are known by them among other things. 

Moreover, with regard to the second questions referred to it, the CJEU found that Article 9(1) of the GDPR must be interpreted as meaning that the publication of personal data on the authority's public website that discloses indirectly the sexual orientation of a natural person constitutes processing of special categories of personal data under the GDPR. 

You can read a summary of the judgment here.