CJEU - C 507/13 / Opinion

Key facts of the case:

(Supervision of credit institutions and investment firms – Action for annulment – Directive 2013/36/EU – Articles 94(1)(g) and 94(2) and Article 162(1) and (3) – Setting of ratios between the fixed and variable components of the remuneration payable to employees of credit institutions and investment firms whose professional activities have a material impact on the institution’s risk profile – Regulation 575/2013 – Articles 450(1)(d)(i) and (j) and 521(2) – Disclosure of certain information appertaining to remuneration – Choice of legal basis – Principles of proportionality, subsidiarity and legal certainty – Ultra vires – Protection of personal data – Customary international law – Extra-territorial effect of Article 94(1)(g) of Directive 2013/36/EU)

Results (sanctions) and key consequences of the case:

125. Since, according to my proposed solution, the United Kingdom has been unsuccessful and the Council and the European Parliament have applied for costs, the United Kingdom must be ordered to pay the costs in accordance with Article 138(1) of the Rules of Procedure. On the other hand, the Commission, as an intervener, must bear its own costs in accordance with Article 140(1) of the Rules of Procedure.

VI – Conclusion

126. In the light of the foregoing observations, I propose that the Court should dismiss the action, order the European Commission to bear its own costs, and order that the United Kingdom of Great Britain and Northern Ireland pay the costs of the Council and European Parliament.
Paragraphs referring to EU Charter

44. The United Kingdom contends that Article 450(1)(j) of the CR Regulation infringes Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’), addressing respectively respect for private and family life and protection of personal data, along with the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. (33) Article 450(1)(j) of the CR Regulation allows the Member State or the competent authorities to require disclosure of more detailed information on remuneration than that required by Article 450(l)(i) of the regulation in the form of the total remuneration for each member of the management body or senior management. It is not disputed by the Council or the Parliament that disclosure of remuneration information in accordance with the contested provision would amount to processing of personal data, thus falling within the ambit of EU data protection law.

45. In my opinion, Article 450(1)(j) of the CR Regulation, read in combination with recital 99 thereof, complies with the principles elaborated by the Court in Volker und Markus Schecke and Eifert. (34) Recital 99 of the CR Regulation states that both Directive 95/46 and Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (35) ‘should be fully applicable to the processing of personal data for the purposes of this Regulation’.

46. In Volker und Markus Schecke and Eifert it was held that the institutions had failed to properly balance the objectives of contested provision in that case against the rights which natural persons are recognised as having under Articles 7 and 8 of the Charter in terms of privacy and data protection. (36)

47. In the case at hand it is relevant that the impugned provision is not applicable to all so-called material risk takers but only to management or senior management, and it does not lead to any automatic disclosure of protected personal data. In fact, Article 450(1)(j) of the CR Regulation imposes no automatic obligation to require such disclosure. It simply vests the Member States or competent authority with discretion to do so. As noted above, recital 99 of the regulation binds the Member States to comply with EU data protection legislation when considering any demand for such information. To this I would add Articles 7 and 8 of the Charter given that a demand for the further information mentioned in Article 450(1)(j) of the CR Regulation would undoubtedly amount to an implementation of EU law with the meaning of Article 51 of the Charter. (37) Thus, in my opinion, and contrary to the apparent concerns of the United Kingdom, Article 450(1)(j) of CR Regulation imposes no automatic preeminence of the objective of transparency over the protection of personal data that would be in conflict with the above mentioned case-law of the Court.