> ## Content Index
> Fetch the complete content index at: https://www.thedelatorrereview.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# ASNEF: When Member States Cannot Rewrite the Lawful Bases for Processing
- URL: https://www.thedelatorrereview.com/asnef-when-member-states-cannot-rewrite-the-lawful-bases-for-processing/
- Published: 2011-11-24T02:20:00.000Z
- Updated: 2026-09-13T02:56:47.000Z
- Description: ASNEF established that Member States cannot rewrite EU lawful bases for processing or predetermine the legitimate-interest balance. The CJEU held that legitimate interests require a case-specific assessment of necessity and the individual’s competing rights and freedoms.
- Author: Lydia
- Tags: Court of Justice of the European Union (CJEU), Caselaw, Legitimate Interests, Lawful Basis, Balancing Test, Data Protection Directive, Directive 95/46/EC, Data Protection Law, Human Rights / Fundamental Rights

Joined Cases C-468/10 and C-469/10 | Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) and Federación de Comercio Electrónico y Marketing Directo (FECEMD) v Administración del Estado | Court of Justice of the European Union | Third Chamber | 24 November 2011

> **Practice Takeaways**: ① **The lawful bases are exhaustive.** Member States cannot create new lawful bases or add requirements that alter the scope of those provided by EU law. ② **Legitimate interest has two cumulative conditions.** The processing must be necessary for a legitimate interest, and that interest must not be overridden by the data subject’s rights and freedoms. ③ **Balancing must remain case specific.** National law may guide the analysis, but it cannot categorically dictate the outcome for an entire class of processing. ④ **Whether data are already public can matter—but it is not dispositive.** Public availability may affect the weight of the privacy interference, but it cannot replace the required balancing. ⑤ **Member States may clarify; they may not rewrite.** National measures may specify how EU rules operate, but not add conditions that narrow or expand the lawful bases themselves. ⑥ **Article 7(f) had direct effect.** The Court held that the provision was sufficiently precise and unconditional to be relied upon before national courts against the State. 

---

Can a Member State make a lawful basis for processing **more restrictive** than EU data-protection law allows?

That was the central question in *ASNEF*.

Spanish law permitted processing based on legitimate interests without consent only where, among other things, the personal data appeared in **publicly accessible sources**. Article 7(f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46) contained no such requirement.

The Court held that Article 7 set out an **exhaustive and restrictive list** of the circumstances in which personal data could lawfully be processed. Member States could clarify those conditions, but they could not add requirements that changed their scope. 

The Court also emphasized that legitimate interests require a **case-specific balancing** of the controller’s interests against the rights and freedoms of the data subject. National law could provide guidance for that balancing, but it could not categorically predetermine its outcome for whole classes of data.

## What Happened

Spain transposed Directive 95/46 through **Organic Law 15/1999** and later adopted **Royal Decree 1720/2007**.

Under the Spanish rules, personal data could be processed without the data subject’s consent on the basis of legitimate interests only in specified circumstances. One route required the data to come from **“sources accessible to the public.”** Those sources were defined narrowly and included such things as electoral rolls, certain telephone directories, professional lists, newspapers, official bulletins, and the media. (Judgment, paras. 8–14.)

ASNEF and FECEMD challenged provisions of the Royal Decree, arguing that Spanish law had added a requirement not found in Article 7(f) of Directive 95/46: that the data appear in public sources. (Judgment, paras. 15–17.)

The Tribunal Supremo agreed that the validity of the Spanish rules depended on the interpretation of Article 7(f). It therefore asked the CJEU two questions:

- First, could national law require that personal data come from public sources before legitimate interests could justify processing without consent?
- Second, did Article 7(f) have **direct effect**? (Judgment, paras. 18–23.)

## Why the Case Matters

*ASNEF* is important for two related reasons.

- First, it defines the limits of **Member State discretion** in EU data-protection law. Directive 95/46 allowed Member States some room to specify how its rules operated, but that flexibility did not permit them to change the substance of the lawful bases for processing.
- Second, the case provides an early and important statement of how **legitimate-interest balancing** must work. The Court rejected a categorical rule that effectively decided the balance in advance. Whether processing disproportionately interferes with the individual’s rights depends on the circumstances of the particular case.

That framework remains central under the GDPR. [***What Are “Legitimate Interests” Under the GDPR?***](https://www.thedelatorrereview.com/what-are-legitimate-interests-under-the-gdpr/) explains the modern three-part analysis under Article 6(1)(f): identifying a legitimate interest, determining whether the processing is necessary to achieve it, and balancing that interest against the rights and freedoms of the individuals concerned. It also discusses the role of reasonable expectations, safeguards, and the Legitimate Interests Assessment (LIA).

That makes *ASNEF* an important foundation for the Court’s later judgment in [***Breyer: When an IP Address Becomes Personal Data***.](https://www.thedelatorrereview.com/breyer-when-an-ip-address-becomes-personal-data/) In *Breyer*, the Court relied directly on *ASNEF* to reject German rules that similarly prevented certain legitimate interests from being considered and balanced on a case-by-case basis.

## The Key Holding

The Court held that Article 7(f) of Directive 95/46 precluded national rules that, in addition to the conditions contained in EU law, required personal data to appear in public sources before processing could be based on legitimate interests.

The Spanish rule therefore went beyond permissible clarification and instead **altered the scope of the EU lawful basis**. (Judgment, paras. 32–39, 49.)

The Court also held that Article 7(f) had **direct effect**, because it was sufficiently precise and imposed an unconditional obligation. (Judgment, paras. 50–55.)

## The Court’s Analysis

### 1\. EU Data-Protection Law Sought More Than Minimum Harmonization

The Court began with the purpose of Directive 95/46.

Differences between Member State data-protection rules could interfere with the internal market and impede cross-border flows of personal data. The Directive therefore sought an equivalent level of protection throughout the EU while maintaining a high level of protection for individuals. (Judgment, paras. 25–29.)

From that objective, the Court concluded that the Directive did not establish merely minimum harmonization. Its harmonization was **“generally complete.”** (Judgment, para. 29.)

That mattered because Member States could not simply make the lawful bases more restrictive whenever they preferred.

### 2\. Article 7 Contained an Exhaustive List of Lawful Bases

Article 7 provided that personal data **“may be processed only if”** one of the listed grounds applied.

The Court treated that language as decisive.

The lawful bases constituted an ***“exhaustive and restrictive list”*** of the situations in which processing could be lawful. Member States therefore could not add new grounds or impose additional requirements that changed the scope of the existing ones. (Judgment, paras. 30–32.)

> **Practice Tip:** **A Member State cannot make up a seventh lawful basis—or rewrite one of the existing six.** National rules may implement and clarify EU law, but they cannot add conditions that materially change when a lawful basis is available.

### 3\. Clarification Is Permitted; Amendment Is Not

Article 5 of the Directive allowed Member States to determine more precisely the conditions under which processing was lawful.

But that discretion had limits.

The Court drew a distinction between:

- national rules that clarify one of the lawful bases; and
- national rules that add requirements and thereby amend its scope.

Only the first were permissible. (Judgment, paras. 33–36.)

Spain’s public-source requirement fell into the second category.

### 4\. Legitimate Interest Has Two Cumulative Conditions

The Court then broke Article 7(f) into two requirements.

- First, the processing must be **necessary for the legitimate interests** pursued by the controller or a third party.
- Second, those interests must **not be overridden by the interests or fundamental rights and freedoms of the data subject**. (Judgment, paras. 37–38.)

Spain could not add a third condition requiring the data to have come from a public source.

> **Practice Tip:** **Legitimate interest is not “legitimate purpose plus anything national law wants to add.”** The legal test is necessity plus balancing. Additional national conditions cannot alter that structure unless EU law itself authorizes them.

### 5\. The Balancing Must Be Case Specific

The second limb of Article 7(f) required the competing rights and interests to be weighed against each other.

The Court emphasized that this balancing depends ***“on the individual circumstances of the particular case.”*** (Judgment, para. 40.)

The analysis also had to take account of the significance of the data subject’s rights under Articles 7 and 8 of the Charter: respect for private life and protection of personal data. (Judgment, paras. 40–43.)

Member States could establish **guidelines** to assist with that balancing. What they could not do was decide the outcome categorically in advance. (Judgment, paras. 46–48.)

### 6\. Public Availability Can Matter Without Being Determinative

The Court did not say that the distinction between public and non-public data was irrelevant.

On the contrary, **it recognized that processing information taken from non-public sources may interfere more seriously with the individual’s rights** because information about the person’s private life becomes known to the controller and potentially to third parties. (Judgment, paras. 44–45.)

That factor could therefore be weighed in the legitimate-interest balance.

What Spain could not do was turn it into an absolute rule.

> **Practice Tip:** **Public availability is a factor, not a lawful basis.** Whether information is already public may affect the weight of the individual’s privacy interests, but it does not by itself determine whether legitimate-interest processing is lawful.

### 7\. National Law Cannot Predetermine the Balance

This is perhaps the most important practical holding in *ASNEF*.

A national rule stops being a permissible clarification when it **“definitively” prescribes the result of the balancing exercise** for categories of personal data and prevents a different result based on the particular circumstances. (Judgment, para. 47.)

The Spanish rule did exactly that: data outside public sources were categorically excluded from legitimate-interest processing.

The Court therefore held that Article 7(f) precluded the rule. (Judgment, paras. 48–49.)

### 8\. Article 7(f) Had Direct Effect

The second question concerned whether individuals could rely directly on Article 7(f) before national courts.

The Court applied the usual test: provisions of a directive may have direct effect where they are **unconditional and sufficiently precise** and the Member State has failed to implement them correctly. (Judgment, para. 51.)

Article 7(f) satisfied that standard.

Although it required balancing, the Court held that its two cumulative conditions were sufficiently defined and that the provision imposed an unconditional obligation. (Judgment, paras. 52–55.)

## What the Court Did—and Did Not—Decide

The Court **did** hold that the lawful bases in Article 7 of Directive 95/46 formed an exhaustive and restrictive list.

It **did** hold that Member States could not impose additional requirements that changed the scope of those lawful bases.

It **did** hold that legitimate interests require a balancing of competing interests and fundamental rights in light of the circumstances of the particular case.

And it **did** hold that Article 7(f) had direct effect.

But the Court **did not** hold that Member States have no role in implementing EU data-protection law.

They could still provide **clarifications and guidelines** within the limits of the Directive. (Judgment, paras. 33–36, 46.)

The Court also **did not** hold that data obtained from non-public sources must be treated the same as publicly available data. It expressly recognized that processing non-public information may interfere more seriously with the individual’s rights and therefore deserves greater weight in the balancing exercise. (Judgment, paras. 44–45.)

And the Court **did not** decide that processing based on legitimate interests was automatically lawful. The required necessity and balancing analysis still had to be performed.

## The Advocate General

Unlike many of the cases in this series, **no Advocate General’s Opinion was delivered in *ASNEF***. The Court proceeded to judgment after hearing the Advocate General, without a written Opinion. (Judgment, introductory procedural history *"having decided, after hearing the Advocate General, to proceed to judgment without an Opinion"*.)

## *ASNEF* Today

*ASNEF* was decided under Directive 95/46, but its central principles remain highly relevant under the GDPR.

Article 6(1) GDPR continues to provide the lawful bases for processing, including **legitimate interests** under Article 6(1)(f). That provision similarly permits processing where it is necessary for the legitimate interests pursued by the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject.

The GDPR gives Member States specific powers to legislate in certain defined areas, but *ASNEF* remains an important warning against using national law to **rewrite the structure of EU lawful-processing rules** where the Regulation does not authorize that result.

Its balancing principle also survives.

Legitimate interest is not satisfied merely because the controller can articulate a legitimate objective. The processing must be necessary, and the controller must weigh that interest against the individual’s rights and freedoms in light of the actual circumstances.

That is why *ASNEF* later became central to *Breyer*. There, the Court relied on *ASNEF* in holding that national legislation could not categorically prevent website operators from invoking the legitimate interest of maintaining the security and continued functioning of their websites.

## Conclusion

*ASNEF* was nominally about a Spanish rule requiring data to come from public sources.

But the case established a much broader principle about the architecture of EU data-protection law.

Member States may **implement, clarify, and provide guidance**. They may not alter the substantive scope of the lawful bases established by EU law.

And where EU law requires a balancing of competing interests, national law cannot simply decide the result in advance.

That is the lasting lesson of *ASNEF*:

**Legitimate interest is a case-specific balancing exercise. National law may shape how that balance is assessed—but it cannot eliminate the balance itself.**

## Sources and Useful Reading

### Sources

CJEU judgments and related case materials are available through [**InfoCuria**](https://infocuria.curia.europa.eu/tabs/tout?lang=EN&ref=thedelatorrereview.com&searchTerm=ASNEF&sort=SCORE-DESC), the Court of Justice of the European Union’s official case-law database. The case can be located using **Joined Cases C-468/10 and C-469/10, ASNEF and FECEMD v Administración del Estado**.

- Court of Justice of the European Union, Third Chamber, Joined Cases C-468/10 and C-469/10, *Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) and Federación de Comercio Electrónico y Marketing Directo (FECEMD) v Administración del Estado*, Judgment of 24 November 2011, ECLI:EU:C:2011:777.
- The Court proceeded **without an Advocate General’s Opinion** in these joined cases.

### Useful Reading from *The De La Torre Review*

- **What Are “Legitimate Interests” Under the GDPR?** — Provides the modern Article 6(1)(f) framework for the balancing principle at the center of *ASNEF*. It explains the three-part Legitimate Interests Assessment—**purpose, necessity, and balancing**—as well as reasonable expectations, safeguards, documentation, and accountability. [Read the Article.](https://www.thedelatorrereview.com/what-are-legitimate-interests-under-the-gdpr/)
- **Breyer: When an IP Address Becomes Personal Data** — Applies *ASNEF*’s approach to legitimate interests. Relying on *ASNEF*, the Court held that Member States cannot categorically exclude particular legitimate interests from consideration where EU law requires those interests to be balanced against the rights and freedoms of the data subject. [Read the Article.](https://www.thedelatorrereview.com/breyer-when-an-ip-address-becomes-personal-data/)
- **Schecke: Transparency Does Not Automatically Trump Data Protection** — Provides important Charter context for *ASNEF*. The Court relied on *Schecke* in emphasizing that the rights to privacy and data protection under Articles 7 and 8 of the Charter must be taken seriously in the legitimate-interest balancing exercise. [Read the Article.](https://www.thedelatorrereview.com/schecke-transparency-does-not-automatically-trump-data-protection/)
- **Lindqvist: When a Parish Website Became Data Processing** — Provides part of the harmonization framework underlying *ASNEF*. The Court relied on *Lindqvist* in explaining that Directive 95/46 sought an equivalent and high level of protection throughout the EU and generally complete harmonization of national data-protection rules. [Read the Article.](https://www.thedelatorrereview.com/lindqvist-when-a-parish-website-became-data-processing/)
- ***Österreichischer Rundfunk: When Salary Transparency Meets the Right to Privacy*** — Provides an earlier statement of the requirement that personal-data processing comply both with data-quality principles and with one of the lawful-processing grounds established by EU law. [Read the Article.](https://www.thedelatorrereview.com/rundfunk-when-salary-transparency-meets-the-right-to-privacy/)

![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/09/ChatGPT-Image-Jul-4--2026-at-04_44_14-PM-22.png)