The communication of trade union affiliation data in the context of judicial proceedings, while they were initially collected solely for payroll management, constitutes a violation of the purpose limitation principle, even if the controller invokes the necessity to defend itself in court.

Facts and context

The Spanish data protection authority (AEPD) published a sanction decision against BIDA FARMA S.C. ANDALUZA, including the imposition of a fine of €20,000, for a breach of the purpose limitation principle.

The case originated from a ruling by the Spanish National Court, which highlighted the production by the company of a document revealing the trade union affiliation of 14 employees in the context of judicial proceedings to which they were not all parties.

Grounds for the decision

• Obligation of purpose limitation (Article 5(1)(b) of the GDPR): The authority found that the data relating to employees' trade union affiliation had been initially collected with their consent for the sole purpose of deducting the trade union contribution on their payslip. The communication of this sensitive data to the National Court constituted further processing for a different purpose, namely defending the company's interests in court. Referring to Recital 50 and Article 6(4) of the GDPR on purpose compatibility, the authority followed the reasoning of the National Court which had deemed this communication "unjustified" and not "strictly necessary." Consequently, even though the company invoked the exception provided for in Article 9(2)(f) of the GDPR (legal defense), the unnecessary nature of the communication led to qualifying the processing as a violation of the purpose limitation principle, in line with the restrictive interpretation of exceptions recalled by the CJEU (case C-667/21).

Authority's decision

Consequently, the authority imposed a fine of €20,000 on BIDA FARMA S.C. ANDALUZA. The company made a voluntary payment of a reduced amount of €16,000, which ended the procedure.

Lessons learned

This decision reminds that:

• Invoking the necessity to defend oneself in court (Article 9(2)(f) of the GDPR) to justify further processing of sensitive data does not exempt the controller from demonstrating the strictly necessary nature of this communication.
• The reuse of personal data for a new purpose, even if it seems legitimate, must be subject to a rigorous compatibility analysis under Article 6(4) of the GDPR, taking particular account of the nature of the data and the consequences for the data subjects.
• Consent obtained for a very specific purpose, such as payroll management, cannot serve as a legal basis for further processing of the same data for a completely distinct and initially unprovided purpose.