In a recently published judgment, the Curia ruled that a private e-mail address containing the full name of a natural person qualifies as personal data. However, the unlawful processing of personal data does not automatically constitute a violation of the right to the protection of personal data in the absence of other elements.
The natural person concerned has used his personal e-mail address since 2004. The company concerned published an incorrect e-mail address as its electronic address, which was the same as the e-mail address of the natural person, except for one character (a dot). The dot between the names had not been recognised by senders as part of the e-mail address, so in several cases, e-mails sent to the company’s e-mail address were delivered to the natural person’s e-mail address.
In 2020, the person concerned became aware that the company was the addressee of the letters and informed the company’s legal representative of the situation, and sent a letter requesting the company to stop the infringement and pay financial compensation. The company had its e-mail address amended as an official contact address but did not comply with the person’s further requests. The person claimed that his right to privacy had been violated by the fact that, for years, he had been receiving unsolicited e-mails, which he was forced to tolerate and deal with, causing him constant discomfort. In his application, the person concerned asked the court to order the company to pay restitution.
Point 1 of Article 4 of the GDPR defines personal data as any information relating to an identified or identifiable natural person. According to the Curia, an e-mail address containing the full name of a natural person constitutes personal data, and this is not undermined by the fact that the person’s name is considered to be common in the country. The Curia has maintained its previous opinion as expressed in several decisions.
The provisions on the protection of personal rights provide legal protection against direct attacks on the personality of a natural person, which violate one of his or her personal rights deriving from human dignity. Consequently, the unlawful processing of personal data does not in itself, in the absence of an additional element, constitute a ground for the protection of personality.
By Rita Parkanyi, Partner, KCG Partner
