JOINT CONCURRING OPINION OF JUDGES O ’ LEARY AND MITS

1 . We agree with the finding of a violation of Article 8 of the Convention in the circumstances of the present case.

2 . The applicant ’ s employer, a state-owned company, retained data relating to his mental health, as they were obliged to do pursuant to domestic law, [1] and arbitrarily used and disclosed this data when considering his application for promotion. Such an interference with the right to privacy breaches Article 8 unless it is “in accordance with the law”, pursues one or more legitimate aims and is “necessary in a democratic society” for the achievement of one of those aims. [2]

3 . While the majority of our colleagues base their finding of a violation on the absence of any necessity for the interference (see §§ 83– 94 of the Chamber judgment), we fail to see, in the circumstances of the instant case, what is gained by proceeding to such an examination of necessity. The Chamber judgment only briefly examines the requi rement of lawfulness (see §§ 78- 81), albeit clearly highlighting the disagreement between the different national courts as regards the scope and meaning of domestic data protection law. It then goes on to transfer to the examination of necessity issues which essentially concern lawfulness (see, in particular, §§ 81 and 86), adding little, if anything, beyond what a proper examination of lawfulness would and should have contained.

4 . In our opinion, the judgment ought to have concentrated on the lawfulness of the interference and, in this regard, on the lack of foreseeability and the quality of the domestic legis lation within the meaning of the well-established case-law of the Court. Once this, the crux of the legal problem disclosed by the applicant ’ s complaint had been addressed, there was no need to proceed further.

5 . Pursuant to the Court ’ s well-established case-law, the phrase “in accordance with the law” in Article 8 § 2 of the Convention requires not only that the impugned measure needed to have some basis in domestic law, but also refers to the quality of the law in question, which should be adequately accessible and foreseeable as to its effects. [3] A rule is foreseeable if it is formulated with sufficient precision to enable any individual – if need be with appropriate advice – to regulate his conduct. [4] For domestic law to meet these requirements, it must afford adequate legal protection against arbitrariness and, accordingly, indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise. [5] The level of precision required of the domestic law ‒ which cannot provide for every eventuality – depends to a considerable degree on the content of the law in question, the field it is designed to cover and the number and status of those to whom it is addressed. [6] Moreover, it is not sufficient to provide a formal possibility of bringing adversarial proceedings to contest the application of a legal provision. Domestic courts must undertake a meaningful review of the authorities ’ actions affecting rights under the Convention in order to comply with the lawfulness requirement. [7]

6 . As indicated in the case file, the impugned data was contained in a certificate relating to the applicant ’ s dispensation from military duty pursuant to Article 5b of the 1973 Diseases and Handicaps Schedule. The human resources department and management of the state-owned company which employed the applicant were able to collect and retain that data on the basis of section 34 of the Military Service Act and Instruction no. 165. Use of this data in the context of the decision on the applicant ’ s promotion was, furthermore, based on the health and safety obligations of an employer under Articles 2 and 153 of the Labour Code. As such, it is clear that the collection and use of the data had a legal basis in domestic law.

7 . Pursuant to section 34 of the Military Service Act, [8] public and private entities employing individuals liable to be drafted for military service were obliged to keep records listing the personal details of such individuals. However, this section of the act described the purpose and competence of the relevant entities in a very general fashion. [9] Instruction no. 165 sought to detail the purpose and content of the military duty register as well as employers ’ duties thereunder. Nevertheless, although Section 19 of the latter provided that the data was to be kept in accordance with the procedure established for classified documents, it was published and publicly accessible. In addition, the provisions of Instruction no. 165 did not provide for a right to be informed of the processing of health-related data or a legal obligation to take decisions concerning the processing of such data by acquiring the data subject ’ s consent. [10] As regards the provisions of the Information Act of 1992, they too were relatively vague, providing, for example, that storage of data “shall not exceed the period necessary for a purpose established by law”. At least from the information available in the case file, it is difficult if not impossible to see how the various general and specific provisions touching on data protection interacted with one another, with the Information Act providing numerous exceptions to its protective rules “in cases envisaged by law”.

8 . It is worth noting that, as regards data processing in Ukraine, the Ukrainian Constitutional Court had held, in a decision of 1997, that the applicable law on information processing contained “poorly defined, contradictory provisions and loopholes which negatively affect the protection of the constitutional rights and freedoms of a human and a citizen” and that “the national legislation is not comprehensive in determining the relevant procedures concerning the mental state of individuals”. [11]

9 . The Court ’ s case-law states that the nature of health-related data requires it not to be used for any other purpose than that envisaged by the law. [12] As indicated previously, section 34 of the Military Act and Instruction no. 165 oblige employers, both public and private, to keep a standardised reference of the military duty register with respect to each employee ’ s eligibility for military duty. The purpose is thus to ensure employees ’ compliance with their military duty as stated in section 10 of Instruction no. 165, not to attest to their subsequent fitness for promotion in non-military employment for an undisclosed and/or unlimited period of time. However, as the Chamber judgment recognises in its subsequent examination of the necessity of the interference, the loosely regulated access to and use of the sensitive data in the instant case was the result of the general set-up of the legislation and led to a quasi-automatic entitlement of employers, whether public or private, to obtain and subsequently store sensitive health-related data (see §§ 85 – 86 of the judgment).

10 . Other provisions of Instruction no. 165 stipulate that the employer has a duty to synchronise regularly the records with those of the military enlistment offices and citizens have a duty to inform the competent authorities of any changes in their health status. The applicant ’ s employer was able to access and use the old data without any prior assessment of whether that data would be “potentially decisive”, “relevant” or “of importance” to the decision on the applicant ’ s promotion. [13] The applicant repeated several times during the domestic proceedings that the data relied on was both outdated and imprecise. It would therefore appear that the impugned legislative framework did not provide procedures that adequately regulated the use and destruction of confidential data. [14]

11 . The decisions of the domestic courts also seem to provide for the disclosure and use of data for purposes unrelated to the original purpose for its collection. Articles 2 and 153 of the Labour Code afforded the employer great discretion with regard to the use and disclosure of health-related data on the basis that employees shall be entitled to and employers shall create a healthy and safe working environment. The broad discretion thereby conferred on employers was not capable, without appropriate safeguards, of protecting sensitive data from being disseminated to and ultimately by third parties, such as the applicant ’ s colleagues. [15]

12 . In the light of the above considerations, we consider that the applicable Ukrainian rules which permitted, even mandated, the possession of information by employers relating to the grounds for dispensation from military service of its employees, were not formulated with sufficient precision regarding the retention, disclosure and use of health-related data, resulting in a lack of foreseeability. Neither did those rules describe and circumscribe with sufficient clarity the scope of the discretion conferred on the competent authorities and the manner in which that discretion had to be exercised. This centrality of (un)lawfulness to the Court ’ s finding of a violation of Article 8 is evident in the content and construction of the judgment itself, with §§ 84 to 89 and § 91 referring repeatedly and clearly to issues which go to an absence of quality and a lack of foreseeability in the domestic legal framework.

13 . We are not suggesting that it was not open to the Chamber to proceed to an analysis of necessity, transferring the concerns about the quality of the applicable law to that analysis. This is something which the Court has done on other occasions in Article 8 cases. [16] In addition, since Ukrainian data protection law has since been amended, the passage of time since the lodging of the applicant ’ s case meant that concentrating on lawfulness would have led to the declaration of a purely historical violation of Article 8 without any guidance to national authorities and courts regarding how to comply in future with the principle of proportionality in similar cases which might arise under the new, amended legislation.

14 . That being said, the passage of time must not alter the Court ’ s identification of where the crux of the legal problem lies in any given case. In addition, the subsequent amendment of Ukrainian data protection rules constituted further proof, if indeed that was required, of a lawfulness problem at the material time. The Court has frequently recognised, as indicated previously, that domestic law may be couched in vague terms and that the interpretation and application of such terms are questions of practice. It is precisely the role of domestic courts to dissipate interpretational doubts and it is precisely that which the domestic courts had difficulty doing in the instant case, as is clear from the toing and froing between the Central District Court, the Court of Appeal and the Supreme Court. [17] Those courts themselves highlighted the shortcomings in the applicable domestic legislative framework, as did the Constitutional Court in the Ustymenko case referred to above.

15 . Another reason for concentrating on the central problem of lawfulness in a case like this – albeit a purely pragmatic one – is the need for the Court, when possible, to itself act with the requisite degree of economy when faced with a choice of methodology. It has practised such restraint on other occasions when it has held that once it has examined the main legal questions raised in an application, there may be no need in the circumstances of a particular case to give a separate ruling on any remaining complaints. [18] With 75,250 applications pending before the Court, greater recourse to the “ Câmpeanu technique”, where possible, is likely to be of considerable benefit to applicants in the medium and long-term. In the instant case, not only did the Chamber, unnecessarily in our view, not concentrate on the central problem of lawfulness under Article 8 of the Convention, but it also proceeded to find a violation of Article 6 of the Convention due to the inadequacy of the response of the domestic courts to the applicants ’ complaints (see §§ 96-103 and 93 of the Chamber judgment). One of the factors examined in the context of necessity under Article 8 thus became the central and only plank of the examination under Article 6, despite the fact that the inadequacy of the domestic courts ’ response was, in any event, linked to the inadequacy of the domestic legal framework on which the Court should have concentrated in the first place. The identification of two separate violations which stemmed from the same problem was not, in our view, necessary.

[1] See, in particular, section 34 of the Military Service Act described below.

[2] See M.N. and Others v. San Marino , no. 28005/12, § 71, 7 July 2015; and Amann v. Switzerland [GC], no. 27798/95, § 71, 16 February 2000.

[3] See, for example, in the specific context of Article 8 cases in the field of data protection, S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, § 95 , 4 December 2008 (retention of fingerprints and DNA information in cases where the defendant in criminal proceedings is acquitted or discharged); M.N. and Others v. San Marino , cited above, § 72 (information retrieved from banking documents copied and stored without safeguards); Malone v. the United Kingdom , 2 August 1984, §§ 66-68, Series A no. 82 (interception of communications and “metering" of telephones by or on behalf of the police); Rotaru v. Romania [GC], no. 28341/95, § 55, ECHR 2000-V (gathering, recording and archiving in secret files of information affecting national security without laying down limits on the exercise of those powers, which remained at the discretion of the authorities.); and Amann , cited above, § 56 (interception of a business-related telephone call to the applicant, an investigation of the applicant based on that call and the creation of a card on the applicant for the national security card index.).

[4] See also Silver and Others v. the United Kingdom , nos. 5947/72, 6205/73, 7052/75, 7061/75, 7107/75, 7113/75, § 88, 25 March 1983.

[5] See supra note 2 .

[6] See Delfi AS v. Estonia [GC], no. 64569/09, §§ 120-121, 16 June 2015, with further references; S. and Marper v. the United Kingdom , cited above , § 96, and Hasan and Chaush v. Bulgaria [GC], no. 30985/96, § 84, ECHR 2000-XI.

[7] Y.Y. v. Russia , no. 40378/06, § 50, 23 February 2016 ; Kryvitska and Kryvitskyy v. Ukraine , no. 30856/03, § 43, 2 December 2010; and C.G. and Others v. Bulgaria , no. 1365/07, §§ 42-49, 24 April 2008 .

[8] Before the introduction of amendments in 1999 , this obligation was prescribed by section 35 of the Military Service Act (see § 43 of the Chamber judgment).

[9] See, in this regard, L.H. v. Latvia , no. 52019/07 , § 52, 29 April 2014.

[10] See ibid . , § 53 and Z. v. Finland , no. 22009/93, § 101, 25 February 1997 , referring to W. v. the United Kingdom , 8 July 1987, § 64, Series A no. 121.

[11] Ruling of the Constitutional Court of Ukraine of 30 October 1997 in K.G. Ustymenko , case no. 18/203-97. See further references in §§ 25, 41 and 80 of the Chamber judgment.

[12] Gardel v. France , no. 16428/05, §§ 69-70, 17 December 2009.

[13] L.H. v. Latvia , cited above, § 58; M.S. v. Sweden , no. 20837/92, §§ 38, 42 and 43, 27 August 1997; and L.L. v. France , no. 7508/02, § 46, ECHR 2006-XI.

[14] L.H. v. Latvia , cited above, § 50; S. and Marper , cited above, § 99; Kruslin v. France , 24 April 1990, §§ 33 and 35, Series A no. 176-A; Rotaru v. Romania , cited above, §§ 57 ‑ 59; Weber and Saravia v. Germany (dec.), no. 54934/00, ECHR 2006-XI; Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria , no. 62540/00, §§ 75-77, 28 June 2007; and Liberty and Others v. the United Kingdom , no. 58243/00, §§ 62-63, 1 July 2008.

[15] L.H. v. Latvia , cited above, § 56 .

[16] See, for example, S. and Marper , cited above, § 99; and Avilkina and Others v. Russia , no. 1585/09, § 37, 6 June 2013, but contrast them with , for example, M.M. v. the United Kingdom , no. 240 29/07, § 207, 13 November 2012.

[17] See Delfi AS v. Estonia , cited above, §§ 121-122; and Kudrevičius and Others v. Lithuania [GC], no. 37553/05, 110, 15 October 2015 .

[18] See Centre for Legal Resources on Behalf of Valentin Câmpeanu v. Romania [GC], no. 47848/08, § 156, 17 July 2014 , with further references.