On September 12, 2024, the Court of Justice of the European Union (CJEU) published its judgment ECLI:EU:C:2024:745 in Cases C-17/22 and C-18/22 regarding the lawfulness of processing for the performance of a contract to which the data subject is a party.

Background

In particular, the case concerns a preliminary ruling of Articles 6(1)(b) and 6(1)(f) of the General Data Protection Regulation (GDPR). Specifically, the case concerns whether Articles 6(1)(b) and 6(1)(f) of the GDPR must be interpreted as meaning that the processing of personal data, which consists of disclosing information, at the request of a partner of an investment fund, which may be regarded as being necessary for the performance of a contract to which the data subjects are parties or for the purposes of legitimate interests pursued by the controller or by a third party.

Findings of the CJEU

The CJEU outlined that Article 6(1)(b) of the GDPR should be interpreted as meaning that the processing of personal data, which consists of disclosing information on all the partners with indirect shareholdings in an investment fund, as necessary, for the performance of the contract pursuant to which the partners have purchased such shareholdings, only on condition that the processing is objectively indispensable for a purpose that is integral to the contractual obligations intended for those same partners, with the result that the main subject matter of the contract could not be achieved if that processing were not to occur.

Further, the CJEU noted that Article 6(1)(b) of the GDPR be interpreted as meaning that such processing be regarded as necessary for the purposes of legitimate interests pursued by a third party, only on condition that the processing is strictly necessary to achieve such a legitimate interest and that, the interests or fundamental rights and freedoms do not override that legitimate interests.

Finally, the CJEU stipulated that Article 6(1)(c) of the GDPR be interpreted as the processing of personal data is justified where it is necessary for compliance with a legal obligation to which the controller is subject, as stated by the case law of that Member State. On condition that the case law is clear and precise, that its application is foreseeable for those persons subject to it, and that it meets an objective of public interest and is proportionate to it.

You can read the judgment here.