44. The United Kingdom contends that Article 450(1)(j) of the CR Regulation infringes Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’), addressing respectively respect for private and family life and protection of personal data, along with the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. (33) Article 450(1)(j) of the CR Regulation allows the Member State or the competent authorities to require disclosure of more detailed information on remuneration than that required by Article 450(l)(i) of the regulation in the form of the total remuneration for each member of the management body or senior management. It is not disputed by the Council or the Parliament that disclosure of remuneration information in accordance with the contested provision would amount to processing of personal data, thus falling within the ambit of EU data protection law.
45. In my opinion, Article 450(1)(j) of the CR Regulation, read in combination with recital 99 thereof, complies with the principles elaborated by the Court in Volker und Markus Schecke and Eifert. (34) Recital 99 of the CR Regulation states that both Directive 95/46 and Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (35) ‘should be fully applicable to the processing of personal data for the purposes of this Regulation’.
46. In Volker und Markus Schecke and Eifert it was held that the institutions had failed to properly balance the objectives of contested provision in that case against the rights which natural persons are recognised as having under Articles 7 and 8 of the Charter in terms of privacy and data protection. (36)
47. In the case at hand it is relevant that the impugned provision is not applicable to all so-called material risk takers but only to management or senior management, and it does not lead to any automatic disclosure of protected personal data. In fact, Article 450(1)(j) of the CR Regulation imposes no automatic obligation to require such disclosure. It simply vests the Member States or competent authority with discretion to do so. As noted above, recital 99 of the regulation binds the Member States to comply with EU data protection legislation when considering any demand for such information. To this I would add Articles 7 and 8 of the Charter given that a demand for the further information mentioned in Article 450(1)(j) of the CR Regulation would undoubtedly amount to an implementation of EU law with the meaning of Article 51 of the Charter. (37) Thus, in my opinion, and contrary to the apparent concerns of the United Kingdom, Article 450(1)(j) of CR Regulation imposes no automatic preeminence of the objective of transparency over the protection of personal data that would be in conflict with the above mentioned case-law of the Court.