Bank Austria: Employee Privacy Rights Do Not Belong to the Company

Case T-198/03 | Court of First Instance of the European Communities | Second Chamber | 30 May 2006

Practice takeaways: ① Regulation 45/2001 protected natural persons, not legal persons such as Bank Austria. ② A company cannot simply invoke the data-protection rights of its employees as its own. ③ Information identifying natural persons may nevertheless require protection when the Commission publishes a competition decision. ④ Professional secrecy extends beyond traditional business secrets. ⑤ Transparency is the starting point for publication of Commission decisions, subject to data protection, confidentiality, professional secrecy, and other specific protections. ⑥ The Commission may publish more than the minimum “main content” of a competition decision if the additional information is not protected from disclosure.

Bank Austria addressed an important boundary in EU data-protection law: can a company invoke rules protecting personal data to prevent publication of information that may identify its employees?

The Court of First Instance said no. Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (Regulation 45/2001) protected individuals with regard to the processing of personal data. Bank Austria, as a legal person, was outside the class of persons the Regulation was intended to protect and therefore could not rely on alleged violations of its employees’ data-protection rights to challenge publication.

But the judgment goes further. It also explains how data protection fits within the Commission’s broader obligations of transparency and professional secrecy when publishing competition decisions.

A note on legal persons under pre-GDPR national law: The holding should not be read to mean that legal persons could never receive data-protection protection in Europe at the time. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46 or the Data Protection Directive) defined personal data by reference to an identified or identifiable natural person, but some Member States extended their national implementing laws beyond the Directive’s scope to cover legal persons as well. Italy, for example, historically did so. Bank Austria addressed a different regime: Regulation 45/2001, governing processing by EU institutions and bodies. The Court’s holding was that Bank Austria, as a legal person, was not among the persons that Regulation 45/2001 was intended to protect. (Judgment, para. 95.)

Background

The dispute arose from the European Commission’s investigation of the Austrian banking cartel known as the “Lombard Club.” In June 2002, the Commission found that Bank Austria Creditanstalt AG (Bank Austria) and several other Austrian banks had participated in a cartel involving the fixing of deposit and borrowing rates and imposed fines on the participating banks. (Judgment, para. 5.)

Bank Austria challenged the amount of its fine. Separately, it objected to the Commission’s proposed publication of a non-confidential version of the infringement decision. It asked the Commission to remove portions concerning events in 1994 and to replace other sections with language proposed by the bank. (Judgment, paras. 6–12.)

The Commission’s Hearing Officer ultimately rejected the objection, concluding that the version intended for publication contained no information entitled to confidential treatment under Community law. Bank Austria then sought annulment of that decision. (Judgment, paras. 13–15.)

Its challenge raised several issues involving the Commission’s authority to publish its decisions, professional secrecy, and—most relevant here—EU data-protection law.

Why the case matters

The judgment is more useful when read as distinguishing three related questions:

• whether information concerning a company is protected from publication;
• whether information concerning identifiable natural persons may be protected; and
• whether the company itself has standing to invoke those individuals’ data-protection rights.

The answer to the third question was decisive. Even assuming that publication implicated personal data concerning Bank Austria employees, that did not make Regulation 45/2001 a source of rights for Bank Austria itself.

At the same time, the Court made clear that the Commission could not simply disregard personal-data protections when publishing its decisions. The Hearing Officer had an obligation to consider Regulation 45/2001 where information about natural persons was involved. (Judgment, paras. 32–35.)

Key holding

The Court reached several connected conclusions.

• A legal person could not invoke Regulation 45/2001 as though it protected the company itself. The Regulation protected individuals with regard to processing of personal data, and Bank Austria did not belong to that protected class. (Judgment, para. 95.)
• Bank Austria could not cure that problem simply by pointing to its relationship with its employees. Its asserted obligations toward directors and employees under Austrian law were insufficient to establish a personal interest allowing it to rely on a violation of Regulation 45/2001. (Judgment, para. 96.)
• Personal-data protections nevertheless mattered to the Commission's publication decision. When deciding what information could be released publicly, the Hearing Officer had to ensure compliance with Regulation 45/2001 where information concerning natural persons was involved. (Judgment, paras. 32–35.)
• Professional secrecy extended beyond business secrets. Information could be protected from public disclosure even where it did not qualify for the particularly strong protection afforded to business secrets. (Judgment, paras. 28–35.)
• Transparency remained the general rule. The Commission was not confined to publishing only the minimum “main content” of its competition decisions. It could publish a fuller non-confidential version so long as disclosure was consistent with professional secrecy and other applicable protections. (Judgment, paras. 67–79.)

The Court’s analysis

1. Professional secrecy extends beyond business secrets

• The Court held that professional secrecy protects more than traditional business secrets. Before publication, the Hearing Officer had to consider whether information was protected by other rules of Community law, including Regulation 45/2001 where natural persons were concerned. (Judgment, paras. 28–35.)

2. Transparency was the rule, subject to confidentiality

• The Court rejected Bank Austria’s argument that the Commission could publish only the “main content” of its decision. Openness was the general rule, subject to professional secrecy and other protections against disclosure. (Judgment, paras. 67–70, 75–79.)
• Information qualified for professional secrecy where it was known only to a limited number of persons, disclosure could cause serious harm, and the interests threatened were objectively worthy of protection. That assessment required balancing confidentiality against the public interest in openness. (Judgment, para. 71.)

3. Data protection protected individuals—not Bank Austria

• Bank Austria argued that publication could identify employees who participated in anti-competitive meetings and therefore violate Regulation 45/2001. (Judgment, para. 93.)
• The Court rejected the claim because the Regulation protected individuals with regard to personal-data processing. Bank Austria, as a legal person, did “not belong to the circle of persons which the regulation is intended to protect.” (Judgment, para. 95.)
• This did not mean employee information was unprotected. The Hearing Officer still had to consider Regulation 45/2001 when publishing information about natural persons. (Judgment, paras. 32–35.)

4. The bank could not invoke its employees’ rights

• Bank Austria argued that potential employee claims and its obligations under Austrian employment law gave it an interest in invoking Regulation 45/2001. The Court found those assertions insufficient. (Judgment, para. 96.)

The employees could have data-protection interests, but Bank Austria could not treat those rights as its own.

The personal-data dimension

A corporate document may contain personal data. A competition decision concerning a corporation may contain personal data. And information describing corporate conduct may identify directors, employees, or other natural persons.

Those individuals may have data-protection interests even though the organization itself does not.

Information relating to people associated with a company is not the same thing as information relating to the company itself.

That is precisely why the two parts of the judgment fit together. The Court required the Hearing Officer to respect Regulation 45/2001 when considering disclosure of information concerning natural persons, while simultaneously refusing to allow Bank Austria to invoke those individuals’ protections as its own. (Judgment, paras. 32–35, 93–97.)

Practice Tip: Protecting personal data and protecting the corporation are not the same legal question.

What the Court did—and did not—decide

The Court did decide that:

• Regulation 45/2001 protected individuals in relation to the processing of personal data;
• Bank Austria, as a legal person, was outside the circle of persons protected by that Regulation;
• the bank had not established a personal interest allowing it to invoke alleged violations of its employees’ data-protection rights;
• the Hearing Officer nevertheless had to consider applicable data-protection rules before authorizing public disclosure of information concerning natural persons;
• professional secrecy could protect information beyond traditional business secrets; and
• the Commission could publish more than the minimum content of a competition decision where the additional information was not protected from disclosure.

The Court did not decide that:

• information appearing in corporate records can never be personal data;
• employees or directors identified in Commission decisions have no data-protection rights;
• information concerning a legal person can never receive protection under other confidentiality or professional-secrecy rules;
• all information obtained during a competition investigation may automatically be published; or
• data protection is irrelevant when EU institutions publish information concerning companies.

Bank Austria under today’s GDPR framework

The GDPR defines personal data in Article 4(1) as information relating to an “identified or identifiable natural person.” Recital 14 is even more explicit: the GDPR concerns the protection of natural persons and “does not cover the processing of personal data which concerns legal persons” as such.

For EU institutions themselves, Regulation (EU) 2018/1725 replaced Regulation 45/2001 and likewise defines personal data by reference to an identified or identifiable natural person.

Bank Austria is sometimes reduced to a broader proposition that legal persons are not protected by EU data-protection law. More precisely, the Court held that Bank Austria, as a legal person, was not among the persons protected by Regulation 45/2001, the data-protection regime applicable to EU institutions and bodies in 2006. (Judgment, para. 95.)

The central lesson of Bank Austria remains relevant: an organization may possess or process enormous amounts of personal data, and information concerning its personnel may itself be protected personal data, but the organization does not thereby become a data subject.

Conclusion

Bank Austria established a simple but important boundary around EU data-protection law.

The fact that a Commission decision concerning a corporation may identify its employees does not give the corporation the employees’ data-protection rights. Regulation 45/2001 protected natural persons, and Bank Austria could not invoke those protections as its own. (Judgment, paras. 93–97.)

At the same time, the judgment should not be read as making corporate proceedings a data-protection-free zone. The Commission remained responsible for protecting personal data and other confidential information before publication.

Put simply: the people behind a company may be data subjects. The company itself is not.

Sources

Court judgments, procedural notices, summaries, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database.

Search Case T-198/03 on InfoCuria

• Court of First Instance of the European Communities, Second Chamber, Case T-198/03, Bank Austria Creditanstalt AG v Commission of the European Communities, Judgment of 30 May 2006, ECLI:EU:T:2006:136.

Related reading from The de la Torre Review

• “Esch-Leonhardt: When a Personnel File Becomes Data Processing.” A useful companion to Bank Austria because it approaches the distinction from the other direction: information maintained by an organization about an identifiable employee falls within data-protection law precisely because it relates to a natural person. Read the Article.
• “Österreichischer Rundfunk: When Salary Transparency Meets the Right to Privacy.” Examines the competing interests involved when information concerning employees and their remuneration is subject to public disclosure, illustrating the broader tension between transparency and protection of personal data that also appears in Bank Austria. Read the Article.