CEDH · CASELAW;JUDGMENTS;CHAMBER;ENG — 26 janvier 2017

.s800EAC49 { font-size:12pt } .sFE10DC93 { margin-top:0pt; margin-bottom:0pt; text-align:center } .s29100277 { font-family:Arial; font-weight:bold } .sBB9EE52A { font-family:Arial } .sA36B60A1 { font-family:Arial; font-style:italic } .s598389FB { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:14pt } .sF5E1C6CF { font-family:Arial; font-weight:bold; text-decoration:underline; color:#ff0000 } .s6CCEAD68 { font-family:Arial; font-weight:bold; color:#ff0000 } .sE208486F { font-family:Arial; color:#ff0000 } .s598389F8 { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:11pt } .s4ACA9207 { page-break-before:always; clear:both; mso-break-type:section-break } .s9793A85B { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt } .sCB9E0544 { margin-top:0pt; margin-bottom:0pt; text-align:left } .sB9D5CABB { width:28.35pt; display:inline-block } .sD3B63DAD { margin-top:36pt; margin-bottom:12pt; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s79DE5897 { margin-top:18pt; margin-left:17.85pt; margin-bottom:12pt; text-indent:-17.85pt; page-break-inside:avoid; page-break-after:avoid } .sA8776625 { margin-top:18pt; margin-left:29.2pt; margin-bottom:12pt; text-indent:-17.6pt; page-break-inside:avoid; page-break-after:avoid } .s72C8F48C { margin-top:12pt; margin-left:36.6pt; margin-bottom:6pt; text-indent:-15.05pt; page-break-inside:avoid; page-break-after:avoid } .sA20670C4 { margin-top:12pt; margin-left:48.75pt; margin-bottom:6pt; text-indent:-17pt; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s34D46E87 { margin-top:12pt; margin-bottom:6pt; text-align:center; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sF7A86111 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; font-size:10pt } .s4DDA3AA3 { font-family:Arial; font-weight:bold; font-style:italic } .sF3D840DC { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; font-size:8pt } .s59DEA84 { margin-top:12pt; margin-left:59.5pt; margin-bottom:6pt; text-indent:-17.85pt; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s4B8D41EE { font-family:Arial; font-size:10pt } .sB206C230 { margin-top:12pt; margin-left:68.65pt; margin-bottom:6pt; text-indent:-16.75pt; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sBB355983 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s583D00FA { margin-top:0pt; margin-left:17pt; margin-bottom:0pt; text-indent:-17pt } .s32563E28 { margin-top:0pt; margin-bottom:0pt } .s26FF04E7 { margin-top:0pt; margin-left:17.3pt; margin-bottom:0pt } .s4B243ECC { margin-top:12pt; margin-bottom:0pt; text-indent:14.2pt; page-break-inside:avoid; page-break-after:avoid } .sF7A4323 { margin-top:36pt; margin-bottom:0pt; text-align:left } .sBF964C40 { width:8.54pt; display:inline-block } .s9E304268 { width:190.42pt; display:inline-block } .sA2E62387 { width:204.97pt; display:inline-block } .s379BC09C { margin-top:36pt; margin-bottom:0pt; text-align:right } .s5E1364CA { margin-top:0pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s7ED160F0 { text-decoration:none } .s33165EBA { font-family:Arial; font-size:8pt; vertical-align:super; color:#0069d6 } .s66E9FC38 { font-family:Arial; font-size:8pt; vertical-align:super; color:#000000 } .sF6A12959 { width:33%; height:1px; text-align:left } .s2EB42ED2 { margin-top:0pt; margin-bottom:0pt; font-size:10pt } .s653E6C45 { font-family:Arial; font-size:6.67pt; vertical-align:super; color:#0069d6 }       FIFTH SECTION             CASE OF SURIKOV v. UKRAINE   (Application no. 42788/06)             JUDGMENT         STRASBOURG   26 January 2017   FINAL   26/04/2017   This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision. In the case of Surikov v. Ukraine, The European Court of Human Rights (Fifth Section), sitting as a Chamber composed of:   Angelika Nußberger, President,   Ganna Yudkivska,   André Potocki,   Faris Vehabović,   Síofra O’Leary,   Carlo Ranzoni,   Mārtiņš Mits, judges,   and Milan Blaško, Deputy Section Registrar, Having deliberated in private on 13 December 2016, Delivers the following judgment, which was adopted on that date: PROCEDURE 1.     The case originated in an application (no. 42788/06) against Ukraine lodged with the Court under Article   34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a Ukrainian national, Mr   Mikhail   Mikhaylovich Surikov (“the applicant”), on 29   September 2006. 2.     The applicant, who had been granted legal aid, was represented by Ms   V.A.   Sakhanskaya, a lawyer practising in Simferopol. The Ukrainian Government (“the Government”) were represented, most recently, by their acting Agent, Ms   O.   Davydchuk. 3.     The applicant alleged, in particular, that his employer had arbitrarily collected, retained, used and disseminated his mental-health data and that the domestic courts had failed to respond to his relevant arguments. 4.     On 17   October 2011 the application was communicated to the Government. THE FACTS I.     THE CIRCUMSTANCES OF THE CASE 5.     The applicant was born in 1962 and lives in Simferopol. A.     History of the applicant’s employment with the publisher Tavrida 6.     In 1990 the applicant graduated from the Ukrainian Printing and Publishing Institute with a diploma in technological engineering. 7.     On 23 August 1990 he was employed as a worker by the Tavrida State Publishing House (hereafter “Tavrida”). 8.     In June 1997 the applicant asked N., the director of Tavrida, to place him on the reserve list for promotion to an engineering position corresponding to his qualifications. 9.     Having received no follow-up, in 2000 the applicant applied for the second time. 10.     On 6 March 2000 this application was refused. 11.     On an unspecified date in 2000 the applicant appealed to the Central District Court of Simferopol (hereinafter “the Central District Court”) seeking, in particular, to oblige his employer to consider him for an engineering position. 12.     During the proceedings, the defendant company submitted that its refusal was connected to the state of the applicant’s mental health. In particular, as was apparent from the information retained on the applicant’s personnel file, in   1981 he had been declared unfit for military service in peacetime in accordance with Article 5b of the then applicable 1973 Diseases and Handicaps Schedule issued by the Ministry of Defence of the Union of Soviet Socialist Republics (“the USSR”). In the summer of 1997 the human resources department had obtained from the military enlistment office a certificate stating that the applicant had indeed been dispensed under Article   5b, which read as follows: “psychosis and psychotic disorders connected to organic cerebral lesions with residual moderately manifested deviations in the mental sphere”. The defendant company further noted that as the applicant had not provided any subsequent information concerning his state of health, his appointment to an engineering position – which implied managerial responsibilities and supervision of other employees – was considered unwarranted. A copy of the certificate issued by the military enlistment office was provided to the court for examination during the public hearings. 13.     B., the applicant’s supervisor questioned by the court during the trial, submitted that the applicant had been a diligent employee. However, in his view he lacked the necessary personal skills to occupy a position with managerial responsibilities. In particular, occasionally the applicant had been involved in conflicts with his colleagues. All of them, when questioned by B., had suggested that they did not want to have the applicant as their supervisor. In view of the above and with regard being had to the reasons for the applicant’s dispensation from military service, in B.’s view the management had been correct in refusing the applicant’s application for promotion. 14.     On 17 August 2000 the court rejected the applicant’s claim, having found that promotion of employees was within the employer’s discretion and there was no legal basis for obliging the defendant company to arrange the applicant’s promotion by way of court proceedings in a situation such as that of the applicant. 15.     On 24 September 2000 this judgment was upheld by the Supreme Court of the Autonomous Republic of Crimea (“the ARC”) and became final. 16.     In 2002 Tavrida referred the applicant for a medical examination “with a view to determining [his] fitness for employment” as an engineer. 17.     On 5 September 2002 the applicant obtained a certificate signed by six medical specialists, including a psychiatrist and a neurologist from the local polyclinic attesting to his fitness for employment as an engineer. 18.     In August 2003 the applicant was appointed as a foreman and in April 2006 as an engineer-technologist. B.     Data protection proceedings against Tavrida 19.     In October 2000 the applicant instituted civil proceedings against Tavrida seeking damages and apologies from its management for his purported defamation resulting from the dissemination of information concerning the medical grounds for his dispensation from military service. He alleged, in particular, that the defendant company had had no right to enquire of the enlistment office in 1997 about the grounds for his dispensation, to use this information in deciding on his promotion and to disseminate it to his direct supervisor and other colleagues, as well as to communicate it to the court in the framework of the civil dispute. 20.     In January 2001 the applicant modified his claims, seeking to oblige the defendant company, in particular, to promote him to an engineering position and to pay him non-pecuniary damages for the purportedly unlawful processing of his health data, libel, and discrimination on the basis of health. 21.     On 23 January 2001 the Central District Court rejected the applicant’s claim as lacking legal basis. In particular, it noted that labour law did not prohibit employers from enquiring of military enlistment offices about their employees’ military service records. 22.     On 28 March 2001 the Supreme Court of the ARC quashed this judgment and remitted the case for a fresh consideration. It noted that pursuant to section 23 of the Information Act of 1992, health data constituted personal data and could only be collected with the applicant’s consent, unless otherwise envisaged by law. The trial court should have established whether it had been lawful to collect and use the applicant’s psychiatric health data in the manner and in the context in which it had been used; what the purpose of its processing had been and whether it had been justified, regard being had, in particular, to the fact that the data pertained to 1981. The court also noted that section   46 of the Information Act expressly restricted dissemination of confidential medical information. The trial court should have explored whether the enlistment office’s certificate contained confidential medical information and whether the fact that it had become known to other employees had caused damage to the applicant. 23.     In May 2002 the applicant further amended his claim, alleging that the defendant company had processed his health data in breach of: Article   32 of the Constitution of Ukraine; sections 23 and 46 of the Information Act; section 40 of the Legislative Guidelines concerning Protection of Health in Ukraine (“the Health Protection Guidelines”); and sections 3 and 6 of the Psychiatric Assistance Act. 24.     On 17 May 2002 the Central District Court rejected the applicant’s claim, having requalified it in law as falling within the ambit of Article 7 of the Civil Code of Ukraine of 1963 as in force at the material time and found that the defendant company could not be held liable under that provision for having disseminated defamatory statements. It also noted that the information obtained by the defendant company from the enlistment office, could not qualify as “confidential medical information”, as it contained a reference to the standardised grounds for dispensation from military service rather than a personalised medical diagnosis. 25.     On 19 February 2003 the Court of Appeal of the ARC (formerly the Supreme Court of the ARC; hereinafter “the Court of Appeal”) quashed this judgment and remitted the case for a fresh consideration. It noted, in particular, that the Central District Court had arbitrarily requalified the applicant’s claims as falling within the ambit of Article 7 of the Civil Code rather than addressing his arguments concerning the breach of the legal provisions to which he had referred. It further instructed the District Court to take into account the ruling of the Constitutional Court of Ukraine of 30   October   1997 in the case of Ustymenko in interpreting applicable legislation. 26.     On 23 July 2003 the Central District Court took a fresh decision rejecting the applicant’s claims, referring, again, to Article   7 of the Civil Code and having found that there was nothing unlawful either in Tavrida’s or its director’s personal conduct with respect to the processing of the disputed information. Without referring to any legal provisions, the court noted that the director had been authorised to know the reasons for the applicant’s dispensation from military service, as this information had been a part of the personnel record compiled and kept by employers in the ordinary course of business. Discussion of the relevant information with some other company employees had been carried out in good faith: it had only happened in the context of taking a decision on whether the applicant could be appointed to a position with increased responsibilities, including staff management. In doing so, the director had acted within the limits of managerial discretion. 27.     The applicant appealed against this decision. He submitted, in particular, that the information concerning the standardised grounds for his dismissal in 1981 had not been specific enough to serve as a basis for determination of whether or not he could be employed as an engineer in 1997; and that in any case it had been outdated. Should his employer have had any doubts concerning his psychiatric health, it could have asked the applicant to provide a current medical certificate of fitness for work. He further noted that the court had not addressed his arguments under Article   32 of the Constitution of Ukraine, the Information Act and other legal provisions to which he had referred. In addition, the applicant noted that the Central District Court had not cited any references to any legal provisions entitling employers to enquire without their employees’ consent about the reasons for their dispensation from military service, and to have them recorded in their personnel files. In the applicant’s view, this information was not pertinent to his ability to perform engineering duties. The court had also not assessed whether it had been justifiable to communicate the information concerning the applicant’s dispensation to third parties. 28.     On 1 December 2003 the Court of Appeal rejected the applicant’s appeal, upholding the final conclusions reached by the Central District Court, but having amended the reasoning. In particular, it found that Tavrida had been an improper defendant in the applicant’s case, as the applicant’s complaint in substance had concerned the conduct of N. (its director); K. (the human resources officer); and B. (the applicant’s supervisor) acting in their capacity as individuals. The Court of Appeal did not cite any legal provisions in substantiation of its conclusions. 29.     The applicant appealed on points of law arguing that N., K. and B. had been acting in their official capacities when processing his health data, thus the defendant company had been vicariously liable for their actions. He further noted that in any event the court had had the authority to summon the proper defendants in the case, rather than dismissing it, and that both the trial and the appeal courts had never considered his main arguments on the merits. 30.     On 29 May 2006 the Supreme Court of Ukraine refused the applicant’s application for leave to appeal on points of law. C.     Data protection proceedings against Tavrida’s officers 31.     In July 2006 the applicant instituted civil proceedings challenging, in particular, the lawfulness of the actions of N., K. and B. with respect to the processing of his health data. 32.     On 30 November 2006 the Kyivskiy District Court of Simferopol rejected the applicant’s claim as unsubstantiated. The court acknowledged that the disputed data qualified as “confidential information” falling within the ambit of section 23 of the Information Act. At the same time, it noted that the scope of individual involvement of each of the defendants in collecting and processing this information was not entirely clear. In any event, this processing had been lawful, as according to applicable law, the human resources departments were obliged to keep the military duty records of their staff on file and to synchronise them with the military enlistment offices. The communication of the relevant information by the human resources officer to the company director in connection with deciding on the applicant’s promotion had also been justified, because managers had been entitled to be apprised of their employees’ health, such information being necessary for ensuring a safe working environment. The defendants had obtained access to the disputed information in accordance with the law and processed it for the sole purpose of deciding on the applicant’s promotion; this processing had been carried out in good faith and so had not been unlawful. 33.     The applicant appealed against this decision, alleging, inter alia , that using (in 1997 and 2000) the information concerning the reasons for his dispensation from military service in 1981 with a view to deciding on his promotion had been excessive; that the relevant information had been outdated, incomplete and impertinent; and that should his employer have wanted to check his health status, it should have referred him to a specialised medical commission. 34.     On 24 January 2007 the Court of Appeal rejected the applicant’s appeal. 35.     On 23 May 2007 the Supreme Court rejected a further application by the applicant for leave to appeal on points of law. II.     RELEVANT DOMESTIC LAW AND INTERNATIONAL MATERIALS A.     Relevant domestic law and practice 1.     Relevant legal provisions and case-law concerning protection of personal data and confidentiality of medical information (a)     Constitution of Ukraine of 1996 36.     Article 32 of the Constitution of Ukraine, which is the relevant provision, reads as follows: Article 32 “No one shall be subject to interference in his or her personal and family life, except in cases envisaged by the Constitution of Ukraine. The collection, storage, use and dissemination of confidential information about a person without his or her consent shall not be permitted, except in cases determined by law, and only in the interests of national security, economic welfare and human rights. ... Everyone is guaranteed judicial protection of the right to rectify incorrect information about himself or herself and members of his or her family, and of the right to demand that any type of information be expunged, and also the right to compensation for material and moral damages inflicted by the collection, storage, use and dissemination of such incorrect information.” (b)     Civil Code of Ukraine of 1963 (repealed with the effect of 1 January 2004) 37.     The text of Article   7 of the Civil Code of Ukraine of 1963, in force at the material time, in so far as relevant, can be found in the Court’s judgment in the case of Ukrainian Media Group v. Ukraine (no.   72713/01, §   23, 29 March 2005). (c)     Law of Ukraine “On Information” (Information Act) no.   2657-XII of 2   October 1992 38.     The relevant provisions of the Information Act, as worded in the material time, read as follows: Section 23.     Information concerning a person “Information concerning a person is a complex of documented or publicly acclaimed pieces of information about a person. The main data concerning a person (personal data) are nationality, education, family status, religious convictions, state of health, as well as address, date and place of birth. ... The collection of information concerning a person without [the subject’s] prior permission is prohibited except for in cases envisaged by law ...” Section 31.     Access of citizens to information concerning them “Citizens shall be entitled to: - know at the moment of collection of information, what data pertaining to their person and for what purpose is collected; how, by whom, and for what purpose it is used; - to access information concerning themselves, file objections concerning its accuracy, completeness, pertinence, etc.; State bodies and organisations, ... information systems of which contain information about citizens, shall be obliged to ... take measures with a view to prevention of unauthorised access to it. ... Prohibited shall be access of third parties to information concerning another person, collected in accordance with applicable legislation by the State bodies, organisations and officials. Storage of information concerning citizens shall not exceed the period necessary for a purpose established by law. ... Necessary amount of data concerning citizens, which may be obtained by lawful means, must be as limited as possible and may be used only for a legally established purpose. Refusal of access to such information or its concealment, unlawful collection, use, storage or disclosure may be challenged in a court of law.” Section 46     Prohibition of abuse of the right to information “... There should be no dissemination of confidential medical information ... except for in cases envisaged by law.” (d)     Law of Ukraine “On Legislative Guidelines concerning Protection of Health in Ukraine (“the Health Protection Guidelines”) no. 2801-XII of 19   November   1992 39.     Section 40 of the aforementioned Act reads as follows: Section 40.     Confidential Medical Information “Medical staff and other persons who, in connection with the execution of their professional or official duties, have become apprised of a disease, medical certification, examination, and their results; [as well as] of aspects of the intimate and family spheres of life of a citizen, shall not have the right to disseminate this information, other than in cases envisaged by law ...” (e)     Law of Ukraine “On Psychiatric Assistance” (“Psychiatric Assistance Act”) no. 1489-III of 22 February 2000 40.     The relevant provisions of the aforementioned Act read as follows: Section 3.     Presumption of mental health “Each individual shall be considered as having no mental disorders until the presence of such a disorder is established on the grounds of and according to the procedure established by this Act and other laws of Ukraine.” Section 6.     Confidentiality of data concerning an individual’s state of mental health and provision of psychiatric assistance “Members of medical staff ... and persons, who, in connection to their studies or performance of professional, official, public or other duties have become apprised that an individual suffers from a mental disorder, ... as well as of other data concerning the state of an individual’s mental health [or] his or her private life, may not disclose this data, except in accordance with ... this section. ... The documents that comprise information concerning the state of a person’s mental health and provision to him or her of psychiatric aid must be stored in compliance with requirements which secure the confidentiality of this information. The provision of the originals of these documents and the making of copies can be carried out only in cases established by law. ...” (f)     Ruling of the Constitutional Court of Ukraine of 30 October 1997 in the case concerning official interpretation of sections 3, 23, 31, 47, 48 of the Information Act and section 12 of the Law of Ukraine “On the Prosecutor’s Office” (case of K.G. Ustymenko , no. 18/203-97) 41.     The relevant parts of the aforementioned Ruling read as follows: “... 2.     ... analysis of the application of the law [and analysis] of the evidence presented in the current constitutional complaint gives grounds for stating that the applicable law on information processing contains poorly defined, contradictory provisions and loopholes which negatively affect the protection of the constitutional rights and freedoms of a human and a citizen. ..., part two of Article   32 of the Constitution of Ukraine bans the collection, storage, use and dissemination of confidential information concerning a person without his or her consent, except in cases determined by law, and only in the interests of national security, economic welfare and human rights. However, national legislation is not comprehensive in determining the [relevant procedures], in particular, as concerns the mental state of an individual ... The legislation of Ukraine has not been harmonised with the European personal data protection standards in connection with the accession of Ukraine to the Council of Europe ... Based on the above, ... the Constitutional Court holds: 1.     Part four of section   23 of the Information Act shall be understood as prohibiting not only collection, but also storage, use and dissemination of confidential information concerning a person without his/her prior consent, except in cases, established by law, and only in the interests of national security, economic welfare and human rights and freedoms. Confidential information shall include, in particular, personal details (education, family status, religious convictions, state of health, date and place of birth, financial standing and other personal data) ...” 2.     Relevant domestic law concerning employers’ duty to create a safe working environment for their employees and to maintain military duty register (a)     Code of the Labour Laws of Ukraine (Labour Code) of 1971 42.     The relevant provisions of the Labour Code as worded at the material time read as follows: Article 2.     Basic labour rights of the employees “... Employees shall be entitled to ... a healthy and safe working environment ...” Article 153.     Creation of safe and non-harmful working environment “... Creation of a safe and non-harmful working environment shall be vested in the owner or the authority empowered by him or her ...” (b)     Law of Ukraine “On Military Duty and Mandatory Military Service”(the Military Service Act) no. 2232-XII of 25 March 1992 43.     Pursuant to section 35 of the aforementioned Act, as adopted in 1992, public and private entities employing individuals liable to be drafted for military service or to be called up were under an obligation to keep records listing the personal details of such individuals. The executives of such entities bore personal responsibility for the proper organisation of such record-keeping. Following revision of this Act on 18 June 1999, the same obligation was envisaged in the new section 34. (c)     Instruction on maintenance of a military register of persons liable for military service and call-up in the enterprises, institutions, organisations and educational facilities approved by Order of the Minister of Defence of Ukraine no.   165 of 27   June   1995 (Instruction no.   165) 44.     Pursuant to section 10 of the above Instruction (repealed by Order of the Minister of Defence of Ukraine no.   660 of 15 December 2010), employers were obliged to maintain the register of their employees liable for military service and call-up (military duty register) for the purpose of “ensuring ... compliance by the citizens of Ukraine with their military duty ...”. 45.     In accordance with sections 13 and 19, this register was made up of a structured filing system comprised of the standardised personnel record cards of employees categorised with respect to their military duty eligibility. The standardised text of such cards was provided in the annex. 46.     In accordance with section 14, basic entries onto the personnel cards were to be copied from the individual military identification and registration documents, such as the “military identification card” ( військовий квиток ) issued by the authorities to citizens liable for military duty. 47.     In accordance with section 15 employers were to enter on the personnel cards of their employees, among other data, the information concerning their fitness for military service. If an employee had been declared unfit for military service in peacetime, the relevant entry had to include a reference to the Article of the applicable Diseases and Handicaps Schedule issued by the Minister of Defence, on the basis of which this employee had been dispensed from military service. 48.     In accordance with section 19, the military duty register was to be kept in accordance with the procedures established for classified (secret) documents. 49.     Pursuant to section 20, both public and private employers were obliged to demand military service eligibility documents from their prospective employees, and could not employ a person whose relevant status or documents had not been regularised. 50.     Various provisions of the Instruction also stipulated a duty of employers to synchronise regularly their records with those of the military enlistment offices and a duty of citizens liable for military service to inform the competent authorities of any changes in their status, including health status. (d)     Order of the Ministry of Defence of the USSR no.   185 of 3   September   1973 51.     In accordance with Article   5b of the Schedule of health disorders and physical handicaps (“the Diseases and Handicaps Schedule”) annexed to the above order enacted in 1973, individuals certified by specialised medical commissions as suffering from “ psychosis and psychotic disorders connected to organic cerebral lesions with residual moderately manifested disorders in the mental sphere ” were declared unfit for military service in peacetime and fit for noncombatant service in wartime. 52.     On 9 September 1987 the aforementioned Order was replaced by Order of the Ministry of Defence of the USSR no.   260, which included a new Diseases and Handicaps Schedule. Following Ukraine achieving independence, on various subsequent dates new Schedules were issued by the orders of the Minister of Defence of Ukraine. B.     Relevant Council of Europe materials 53.     Convention ETS No.   108 of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data (“the Data Protection Convention”) was adopted on 28 January 1981 and subsequently ratified by all Council of Europe member States. 54.     This Convention was signed by Ukraine on 29 August 2005 and ratified on 30 September 2010. 55.     Its relevant provisions read as follows: Article 3.     Scope “1.     The Parties undertake to apply this Convention to automated personal data files and automatic processing of personal data in the public and private sectors. 2.     Any State may ... give notice by a declaration addressed to the Secretary General of the Council of Europe: ... c.     that it will also apply this Convention to personal data files which are not processed automatically. ...” Article 5.     Quality of data “Personal data undergoing automatic processing shall be: a.     obtained and processed fairly and lawfully; b.     stored for specified and legitimate purposes and not used in a way incompatible with those purposes; c.     adequate, relevant and not excessive in relation to the purposes for which they are stored; d.     accurate and, where necessary, kept up to date; ...” Article 6.     Special categories of data “Personal data ... concerning health ... may not be processed automatically unless domestic law provides appropriate safeguards ...” Article 7.     Data security “Appropriate security measures shall be taken for the protection of personal data stored in automated data files against accidental or unauthorised destruction or accidental loss as well as against unauthorised access, alteration or dissemination.” Article 10.     Sanctions and remedies “Each Party undertakes to establish appropriate sanctions and remedies for violations of provisions of domestic law giving effect to the basic principles for data protection set out in this chapter.” C.     Other relevant international materials 1.     The European Union law 56.     Charter of Fundamental Rights of the European Union (2000/C 364/01) proclaimed on 7 December 2000, which came into force on 1   December 2009 includes right to the protection of personal data among the fundamental rights. Article   8 of the Charter provides, in particular, as follows: Article 8.     Protection of personal data “1.     Everyone has the right to the protection of personal data concerning him or her. 2.     Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. ...” 57.     Directive 95/46/EC of the European Parliament and of the Council of the European Union on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“the EU Data Protection Directive”) of 24 October 1995 provides that the object of national laws in this area is notably to protect the right to privacy as recognised both in Article   8 of the Convention and the general principles of EU law. The Directive defines personal data as “any information relating to an identified or identifiable natural person” (Article 2(a)) and asks for the member States to prohibit processing of personal data concerning “health” among other things (Article 8(1)). 58.     As of 25 May 2018 the Directive will be replaced by Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This regulation was adopted on 27   April 2016 with a view to ensuring further harmonisation of the data protection legal framework within the European Union member States. According to Article 9, paragraph 1 of the Regulation, processing of data concerning health shall be prohibited, unless such processing falls within one of the exceptions listed in paragraph 2. Notably, processing of health data for the assessment of the working capacity of an employee shall be allowed when those data would be processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies (see Article   9 paragraph 2 point   (h), and paragraph 3). 2.     OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (“the OECD Privacy Guidelines”) 59.     On 23 September 1980 the Organisation for Economic Co-operation and Development (“the OECD”) adopted the Recommendation of the Council concerning Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data (C(80)58/FINAL) reflecting the consensus among its member States that basic principles of fair personal information processing in the public and private sectors should be safeguarded in the national legislative frameworks. In 2013 the revised Guidelines were adopted. 60.     According to part 1, section 2 of the original Guidelines , they were intended to apply to personal data in both the public and private sectors, “which, because of the manner in which they are processed, or because of their nature or the context in which they are used, pose a danger to privacy and individual liberties”. The original Guidelines included the following basic principles, among others: Collection Limitation Principle “7.     There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.” Data Quality Principle “8.     Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date.” Purpose Specification Principle “9.     The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.” Use Limitation Principle “10.     Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with Paragraph 9 except: a)     with the consent of the data subject; or b)     by the authority of law.” Security Safeguards Principle “11.     Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data.” THE LAW I.     ALLEGED VIOLATION OF ARTICLE   8 OF THE CONVENTION 61.     The applicant complained that his employer had arbitrarily collected, retained, and used sensitive, obsolete and irrelevant data concerning his mental health in considering his application for promotion, and had unlawfully and unfairly disclosed this data to the applicant’s colleagues and to a civil court during a public hearing. The applicant relied on Article 8 of the Convention, which reads as follows: “1.     Everyone has the right to respect for his private ... life ... . 2.     There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.” A.     Admissibility 62.     The Government did not comment on the admissibility of the present complaint. 63.     The Court notes that this complaint is not manifestly ill-founded within the meaning of Article   35   §   3   (a) of the Convention. It further notes that it is not inadmissible on any other grounds. It must therefore be declared admissible. B.     Merits 1.     Submissions by the parties (a)     The applicant 64.     In his application and subsequent observations, the applicant noted that when taking up employment with Tavrida he had provided its human resources department with a copy of his military identification card for entering his data onto the military duty register maintained by the company, in accordance with the applicable law. This card had contained a reference to Article   5b of the Diseases and Handicaps Schedule issued in 1973, on the basis of which in 1981 the applicant had been declared unfit for military service in peacetime. No text from this Article had appeared on the above document. Tavrida had acted unlawfully in 1997 in obtaining the wording of this Article, which contained sensitive medical data, from the military enlistment office without the applicant’s knowledge or consent. It had also acted unlawfully in including this information in the applicant’s personnel file in spite of its retention patently having been excessive for the purposes for which it had been kept. Next, Tavrida had acted unlawfully in using this information for a new purpose, that is to say for assessing and turning down the applicant’s applications for promotion in 1997 and 2000, in spite of the fact that this information had been very old and of inadequate detail for determining the applicant’s fitness for the position he sought. Above all, Article   5b of the Diseases and Handicaps Schedule was insufficiently specific. It applied equally to persons suffering from very serious psychotic disorders and to those suffering from mild temporary conditions. In fact, the applicant had never been in a psychotic state. Making any conclusions concerning his mental health on the basis of the information contained in this Article had created a false appearance that he might have suffered from a very serious disorder. Should the applicant’s employer have been concerned about his mental health in terms of his promotion, it could have solicited more recent and specific information, in particular by referring the applicant to a medical commission for the assessment of his fitness for promotion. Having obtained such a referral in 2002, the applicant had duly passed the necessary assessment and had eventually been placed on the reserve list and then promoted to an engineering position. 65.     Lastly, the applicant complained that in the context of discussing his promotion applications, the information concerning the medical grounds for his dispensation from military service had been communicated, in breach of domestic medical confidentiality rules, to his co-workers, including B., his direct supervisor, and subsequently to the civil court in the course of a public hearing in context of the proceedings in which he had complained about the rejection of his promotion applications. Such disclosure had caused him mental suffering and had negatively affected his relationships with his colleagues. (b)     The Government 66.     The Government contended that the disputed conduct of the applicant’s employer had not constituted an interference with his rights guaranteed by Article 8. 67.     First of all, the information concerning the grounds for the applicant’s dispensation from military service had not been confidential. In particular, the Diseases and Handicaps Schedules had been published and publicly consultable. Pursuant to the applicable laws, in particular, section   34 of the Military Service Act and Military Register Maintenance Instruction no.   165, the applicant’s employer had been obliged to copy the information concerning the grounds for his dispensation contained on his military identification card onto his personnel record card for storage in the standardised filing system. The fact that the information entered initially had not used the exact wording of Article   5b was immaterial in this context, as the Diseases and Handicaps Schedules had been accessible by the public. By contacting the military enlistment office in 1997, Tavrida had simply confirmed the information which had already been provided by the applicant himself, rather than actually obtaining additional information. In the Government’s view, this situation was factually comparable to that examined by the Court in the case of N.F. v. Italy (no. 37119/97, ECHR   2001 ‑ IX). In particular, in that case the Court had found that the applicant’s complaint about disclosure by the press of his membership of a registered Freemason’s lodge had not affected his rights under Article 8, as that lodge’s members’ register had in any event been publicly consultable. 68.     The Government also noted that the disputed information had only become available to the human resources department of the applicant’s employer and to its director, who had been entitled to it under the applicable law. As regards any further dissemination, in their view, regard being had to the findings of the domestic courts, the relevant facts had not been proven. 69.     In addition to that, the Government also relied on the provisions of Articles 2 and 153 of the Labour Code, which outlined employees’ right to a safe and healthy working environment and their employers’ corresponding duty to ensure it. 2.     The Court’s assessment (a)     General principles 70.     On numerous occasions the Court has held that systematic storage and other use of information relating to an individual’s private life by public authorities entails important implications for the interests protected by Article   8 of the Convention and thus amounts to interference with the relevant rights (see, in particular, Rotaru v. Romania [GC], no.   28341/95, §   46, ECHR 2000 ‑ V; and S. and Marper v. the United Kingdom [GC], nos.   30562/04 and 30566/04, §   67, ECHR 2008). This is all the more true where the information concerns a person’s distant past (see Rotaru , cited above, §   43, and M.M. v. the United Kingdom , no.   24029/07, §   187, 13   November 2012) or when the processing affects highly intimate and sensitive categories of information, notably the information relating to physical or mental health of an identifiable individual (see, in particular, Z.   v.   Finland , 25 February 1997, § 95, Reports of Judgments and Decisions 1997 ‑ I; I. v. Finland , no.   20511/03, §   40, 17 July 2008; P. and S. v. Poland , no.   57375/08, § 128, 30   October   2012; L.H.   v.   Latvia , no.   52019/07, § 56, 29   April 2014; and Y.Y. v. Russia, no. 40378/06, §   38, 23 February 2016). 71.     The Court next reiterates that an interference breaches Article   8 unless it is “in accordance with the law”, pursues one or more of the legitimate aims referred to in paragraph 2 and is, in addition, “necessary in a democratic society” to achieve those aims (see, among other authorities, P.   and   S. v. Poland , cited above, §   94, and M.N. and Others v. San Marino , no.   28005/12, § 71, 7 July 2015). The Court reiterates from its well established case-law that the wording “in accordance with the law” requires the impugned measure both to have some basis in domestic law and to be compatible with the rule of law, that is to say to be accessible, foreseeable and accompanied by necessary procedural safeguards affording adequate legal protection against arbitrary application of the relevant legal provisions (see, among other authorities, S. and Marper , cited above, § 95, and M.N.   and Others, cited above, § 72). 72.     The function of clarification and interpretation of the provisions of domestic law belongs primarily to domestic judicial authorities. In order to protect a person against arbitrariness, it is not sufficient to provide a formal possibility of bringing adversarial proceedings to contest the application of a legal provision to his or her case. Domestic courts must undertake a meaningful review of the authorities’ actions affecting rights under the Convention in order to comply with the lawfulness requirement (see Y.Y., cited above, § 50). 73.     In addition to being lawful, the interference must also pursue a legitimate aim and be “necessary in a democratic society”. In determining whether the impugned measures were “necessary in a democratic society”, the Court will consider whether, in the light of the case as a whole, the reasons adduced to justify them were relevant and sufficient and the measures were proportionate to the legitimate aims pursued (see, for example, Peck v. the United Kingdom , no.   44647/98, § 76, ECHR 2003 ‑ I). In this latter respect the Court has noted that, regard being had to the fundamental importance of data protection for effective exerci