CJEU, Judgment of 1 August 2022, C-184/20, Vyriausioji tarnybinės etikos komisija
Exhaustive character of Article 6(1) GDPR; publication of declarations of interests on the internet; scope of the special categories under Article 9 GDPR.
1 Overview
Lithuanian anti-corruption law required the heads of publicly funded establishments to submit a declaration of interests, which was published on the internet. The Court examined the lawfulness of that data processing against the standard of the GDPR.
Reference: CJEU, judgment of 1 August 2022, C-184/20, OT/Vyriausioji tarnybinės etikos komisija
2 Exhaustive character of the list of grounds for lawful processing
The Court confirms that Article 6(1) GDPR contains an exhaustive and restrictive list of the cases in which the processing of personal data can be regarded as lawful. Member States may not introduce additional grounds for lawful processing.
3 Proportionality and data minimization
The mandatory publication on the internet of the personal data of all persons required to submit a declaration infringes the principle of data minimization. The processing goes beyond what is necessary and is not justified by an overriding public interest in the prevention of corruption.
4 Extension of the concept of the special categories
The Court further makes clear that personal data from which sensitive information can be derived indirectly (for instance as to sexual orientation) are themselves data within the meaning of Article 9 GDPR. The decision considerably extends the practical scope of Article 9 GDPR.
About the author
About the author
This article was written by Dr. Thomas Helbing, specialist lawyer for IT law in Munich.
Since 2020 and continuously through today (2026), Handelsblatt has recognized Dr. Helbing as one of "Germany's Best Lawyers" in IT law and data protection law.
According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the leading lawyers for data protection and IT law and is listed among the top 100 lawyers in Germany (2024/25). Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.
His professional background covers the full spectrum of IT and technology law practice. He began his career at a major international law firm, then gained in-house experience at a DAX-listed company, and is himself an entrepreneur and founder of several digital ventures. He also has hands-on programming experience, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.
For many years, his clients have included technology companies and SaaS providers, leading German research institutions and a systemically important German bank. His advisory focus lies in particular on GDPR compliance, the data economy, SaaS, AI regulation and IT contract law.
CJEU, Judgment of 24 September 2019, C-136/17, GC and Others/CNIL
De-listing requests against search engine operators; normative precedence of data protection and privacy in the case of name-based searches, particular requirements in the case of sensitive data.
CJEU, Judgment of 4 July 2023, C-252/21, Meta Platforms/Bundeskartellamt
Landmark decision on Article 6(1)(b) and (f) GDPR in the online context: "objectively indispensable" rather than merely "useful"; interaction with Article 9 GDPR.