Said ruling, regardless of its importance and overall usefulness, does not, in any way whatsoever, eliminate the requirement for consent of the affected party, either to transfer their data to third parties, or make use of it in any way. Some news media have interpreted that the ruling annuls a Data Protection Act regulation, specifically Art. 10.2.b) and that consent, the cornerstone of the data protection system, had become superfluous and was no longer an essential requirement.
Nothing could be further from the truth: the Supreme Court ruling serves to uphold the so-called “direct effect” of Art. 7.f) of the Data Protection Directive (95/46/EC), which occurs when any of the provisions of a Directive is sufficiently clear and unconditional and, furthermore, has been incorrectly adapted to internal law, such as occurred with the annulled Data Protection Act regulation.
As a consequence, the provision of the Directive regarding legitimate interest applied directly and means that when using or transferring data to third parties, legitimate interest serves as a basis for said transfer and that, taking the various fundamental rights of the circumstances along with fundamental right to data protection into account, legitimate interest can be inferred.
It is worth recalling that not all commercial interest involves legitimate interest when dealing with personal data. Therefore, and although we regret raining on the parade of those who were rubbing their hands together in anticipation, the system of consent does not change – quite the contrary – we shall have to ponder the occurrence of legitimate interest as an exception.
For further information, please contact Belén Arribas: [email protected]