The case began when L.H. requested to be provided with information on the individuals who had signed contracts to purchase COVID-19 screening tests on behalf of the Czech Ministry of Health, as well as certificates showing that the tests could be used within the European Union. The ministry provided the certificates but deleted the names, signatures, professional titles and contact details of the individuals concerned with reference to data protection and the obligation under national law to inform the person concerned before such data is published.

As stated above, the Court concluded that the disclosure of information on individuals acting on behalf of a legal entity constitutes the processing of personal data even if the purpose is only to identify the person who is authorized to act in the legal capacity of the entity in question. The Court also considered that national law requiring a public body to inform and consult the persons concerned before public documents containing personal data are disclosed is compatible with the GDPR, subject to the fact that such obligation does not make the disclosure impossible and does not constitute an excessive burden that could result in disproportionate restriction on public access to those documents.

The ruling underlines the importance of a balance between legitimate transparency in public sector work and the protection of personal data and sets a precedent for the implementation of rules on access to data in the European Economic Area.

Judgement of the Court.