As regards the subsequent processing of the data transferred, the directive provides that a controller of data must inform the data subjects as to his own identity, the purpose of the processing, and any further information necessary to ensure the fair processing of the data. That further information includes the categories of data concerned and the existence of the right of access to and the right to rectify the data concerning him.
The Court observes that the National Health Insurance Fund’s processing of data transferred by the tax authority required informing the data subjects of the purposes of that processing and the categories of data concerned. In this case, the Health Insurance Fund had not provided that information.
The Court holds that EU law precludes the transfer and processing of personal data between two public administrative bodies without the persons concerned (data subjects) having been informed in advance.
(1) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L281, p.31).