Personal Data Protection: A Fundamental Right with Limits
Key Takeaway
The right to the protection of personal data is a fundamental right, with limits. The courts are frequently required to balance it against other fundamental rights, in accordance with the principle of proportionality.
In a decision issued on March 8, 2023, the French Cour de Cassation reaffirmed that while personal data protection is a fundamental right, it is not absolute. When it comes into conflict with another fundamental right, it must be weighed against that right in light of the principle of proportionality.
Such conflicts between data protection and other fundamental freedoms are not uncommon. A notable example is the judgment of the Paris Judicial Court dated June 30, 2021, in which the right to be forgotten was balanced against the right to information, once again highlighting the need to reconcile rights of equal legal standing.
Before examining the criteria used by the judges to determine which right should prevail, it is necessary to revisit the concept of fundamental rights and how the principle of proportionality has been applied in recent case law.
1. What Do We Mean by Fundamental Rights?
a) The sources of fundamental rights
There is no single, universally accepted definition of the concept of fundamental rights.
However, these rights are generally understood to derive from key legal instruments such as the 1789 Declaration of the Rights of Man and of the Citizen (Déclaration des droits de l’Homme et du Citoyen), the European Convention on Human Rights of November 4, 1950, the French Constitution, and the Charter of Fundamental Rights of the European Union of December 7, 2000. Several of these rights are also referenced in the GDPR.
These texts set out a range of rights and freedoms recognized as fundamental, whose protection is guaranteed by the State. They are commonly categorized into subjective rights, which are attached to individuals, and collective rights, which encompass liberties applicable to society as a whole.
Examples of subjective rights include the right to human dignity, the right to life, the right to physical integrity, the right to privacy, the right to personal data protection, freedom of thought, opinion, and religion, and equality before the law, including gender equality.
Fundamental freedoms include, among others, freedom of assembly, freedom of expression and information, freedom of association, principles of solidarity, access to justice, such as the right to an effective remedy, the presumption of innocence, and environmental rights.
b) The principle of proportionality: balancing competing fundamental rights
Even though these rights are all deemed fundamental, conflicts between them can arise, for instance, between the right to personal data protection (a subjective right) and the right to freedom of expression (a fundamental freedom). In such cases, the judge must determine which right should take precedence. This involves a balancing exercise, weighing the competing interests with the goal of either reconciling the rights or allowing one to prevail over the other, depending on the context. This assessment is always conducted on a case-by-case basis.
2. In Its Ruling of March 8, 2023, the French Cour de Cassation Gave Precedence to the Right to Evidence over the Right to Personal Data Protection
In a decision issued on March 8, 2023, the Cour de Cassation affirmed the primacy of the right to evidence and the defense of gender equality over the right to personal data protection. (1)
In this case, a woman who had served as Chief Operating Officer (COO) of Exane Derivatives, and later as Group Strategy and Projects Director at Exane, was dismissed on February 22, 2019. She alleged that she had been subject to unequal pay compared to male colleagues who held or had held the COO position. To substantiate her claims, she filed an emergency application with the French Labor Court (Conseil de prud’hommes) on October 31, 2019, seeking disclosure of comparative information from her former employers.
In a ruling dated December 3, 2020, the Paris Court of Appeal ordered Exane and Exane Derivatives to disclose to the claimant the pay slips of eight employees, covering specific periods. The order required the concealment of certain personal data, except for first and last names, job classification under the collective bargaining agreement, detailed monthly salary, and total gross annual compensation.
The former employers objected to the disclosure, arguing that the documents were confidential and that they had a duty to protect employee data under the General Data Protection Regulation (GDPR) of April 27, 2016. They also contended that, under Article 145 of the French Code of Civil Procedure, a judge may only order legally admissible evidentiary measures. They maintained that disclosing the pay slips would breach the GDPR and that the right to evidence could not justify infringing employees' privacy, especially since the claimant already possessed information that could create a presumption of discrimination.
To justify its ruling, the Court of Cassation applied the principle of proportionality, relying on:
1. Recital 4 of the GDPR, which states: “The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality”;
2. Article 145 of the French Code of Civil Procedure, which allows judges to order evidentiary measures to help a party establish the facts; and
3. Articles 6 and 8 of the European Convention on Human Rights, which recognize that the right to evidence may justify the disclosure of personal information if such disclosure is essential to the exercise of that right and the interference is proportionate to the aim pursued.
The Court held that disclosure of the requested documents was essential for exercising the right to evidence and proportionate to the goal pursued, namely the claimant’s right to equal treatment between men and women in employment and the workplace. Consequently, Exane and Exane Derivatives were ordered to produce the relevant employee pay slips in accordance with the appellate court’s ruling.
The Court of Cassation therefore rejected the appeal filed by Exane and Exane Derivatives.
3. The Paris Judicial Court Upheld the Right to Information over the Right to Personal Data Protection
In a judgment dated June 30, 2021, the Paris Judicial Court declined to apply the right to be forgotten, giving precedence instead to the right to information. (2)
In this case, a former executive of the Racing Club de Paris, who had been convicted in 2009 of breach of trust and misuse of company assets, requested in 2019, ten years after the facts, the deletion or, at minimum, the anonymization of an article published online by the newspaper 20 Minutes.
The newspaper refused, invoking freedom of expression and the public’s right to information. The former executive then brought proceedings against 20 Minutes before the Paris Judicial Court, seeking to have the article removed.
As in the aforementioned decision of the Cour de Cassation, the judges recalled the language of Recital 4 of the GDPR, which provides that the right to the protection of personal data is not absolute and must be balanced against other fundamental rights, in accordance with the principle of proportionality. The right to erasure (or “right to be forgotten”) is set out in Article 17 of the GDPR. This right must be weighed against the right to freedom of expression and information, as guaranteed notably by Article 10 of the European Convention on Human Rights.
20 Minutes is a press publisher engaged in journalism, such activity falling under the protection of freedom of expression. Under Article 17.3(a) of the GDPR, the right to erasure does not apply where the processing is necessary for exercising the right to freedom of expression and information. Applying the principle of proportionality, the judges held that removing or anonymizing the article, even though it was relatively old, would constitute an excessive restriction on the freedom of the press. The court therefore ruled in favor of the right to information over the right to be forgotten.
However, the judges emphasized the specific nature of press publishers, whose role in providing public information must be protected, unlike search engines, whose activity is limited to indexing publicly available content online.
(1) Cass. civ., ch. soc., 8 mars 2023, pourvoi n° 21-12.492
(2) TJ Paris, 17é ch. 30 juin 2021, M. X c. 20 Minutes France
Bénédicte DELEPORTE
Avocat
Deleporte Wentz Avocat
www.dwavocat.com
April 2023