The name of an individual’s spouse considered special category of personal data

• Ireland

• Privacy, data protection and cybersecurity - GDPR

01-09-2022

The Court of Justice of the European Union ('CJEU') has ruled that personal data which may indirectly disclose an individual’s sexual orientation, such as the name of a spouse, cohabitee or partner, constitutes the processing of special categories of personal data under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').

The ruling arose in the context of a requirement under Lithuanian law for certain individuals to lodge a declaration of private interests and for such interests to be published on the internet. The Chief Ethics Commission found that OT, a director of an establishment in receipt of public funds, failed to lodge a declaration of private interests. In an action brought by OT to the courts, it was submitted that the declaration of private interests would adversely affect both his right to private life and that of other persons who would be mentioned in his declaration.

Key findings

1. It is possible to deduce the sexual orientation of an individual viz-a-viz the name of an individual’s spouse or partner

The CJEU found that the online publication of name-specific data relating to the declarant’s spouse, partner or cohabitee is liable to reveal certain sensitive aspects of the declarant’s private life including for example, their sexual orientation. The court noted that while the publication of such personal data are not, inherently, special categories of personal data for the purposes of the GDPR, the court took the view that “it is possible to deduce from the name-specific data relating to the spouse, cohabitee or partner of the declarant certain information concerning the sex life or sexual orientation of the declarant and his or her spouse, cohabitee or partner.”

2. No distinction to be made in the interpretation of the terms “revealing” and “concerning” under Article 9 GDPR

The CJEU provided commentary on the interpretation of the terms “revealing” and “concerning”, as such terms are used in Article 9 GDPR ¹ . While interpreting these terms, the court considered not only the wording of Article 9 GDPR but also its context and the objectives of the GDPR in order to determine whether data capable of revealing the sexual orientation of an individual, by means of an intellectual operation involving comparison or deduction, falls within the scope of special categories of personal data. The court held that a distinction being drawn between the terms “concerning” and “revealing” as used in Article 9 GDPR would not be consistent with the contextual interpretation of Article 9 GDPR.

3. Wide interpretation given to the term “special categories of personal data”

The CJEU noted that the objective of the GDPR confirms the wide interpretation to be given to the term “special categories of personal data”. As such, personal data which may indirectly reveal the sexual orientation of an individual must not be excluded from the definition of special category of personal data.

How can we help?

This ruling has the potential to have a far-reaching impact on organisations and it highlights the importance for organisations to understand the personal data that it collects and processes. Where any personal data collected by an organisation may directly or indirectly reveal special categories of personal data relating to an individual it is imperative for that organisation to ensure it has an appropriate legal basis for such processing. At Eversheds Sutherland LLP, we have a highly skilled data protection team who can provide assistance and advice on this and on all aspects of data protection law.

For more information, please contact;

Leona Chow, Solicitor - LeonaChow@eversheds-sutherland.ie