ECJ Judgment of 22.06.2023, Case C‑579/21: No Disclosure of an Employee’s Identity

The ECJ answered four questions from the Administrative court of Eastern Finland on June 22nd. The underlying case involved a bank employee who was also a customer of the bank. He requested to obtain specific information on the processing of his personal identifiable information processed by the bank. In particular he wanted to receive detailed information about which bank employee in the bank had made inquiries/queries/requests about his personal data.

The Finnish DPA denied this request in a decision because he believed, that the request was aimed to give him access to the log files of employees who had processed his data.

Such data, according to their practice, did not relate to the affected person but to the employees who had processed that person’s data.

The customer filed a lawsuit against this decision in the referring court. The referring court then submitted questions for a preliminary ruling to the ECJ.

The referring court, with its first two questions, which the ECJ examined together, essentially sought to clarify whether Article 15(1) of the GDPR should be interpreted to mean that information about employees (especially their identity) involved in internal data processing must be disclosed. Additionally, the court asked if further details such as the timing and purposes of these internal data processing operations should be revealed.

The ECJ ruled that Article 15(1) of the GDPR should be interpreted as meaning that information concerning queries of a person’s personal data, particularly regarding the timing and purposes of these processes, constitutes information that the person can request from the controller under this provision. However, this provision does not provide such a right regarding information about the identity of the employees of this controller who have carried out these processes under his supervision and in accordance with his instructions, unless such information is essential to enable the affected person to effectively exercise the rights conferred on them by this regulation, provided that the rights and freedoms of these employees are taken into account.