Case C-13/16, Rīgas satiksme – our police data request is necessary for our legitimate interest [judgment 2017, ECLI:EU:C:2017:336]
If a taxi hits a bus and the taxi company tells the police who was in the taxi, then does EU data processing law stop that police data from being passed on to the bus company?
Background
On the streets of Riga, there was an accident involving a taxi and bus. The taxi company told the Latvian police who was in their vehicle.
The bus company ‘Rīgas satiksme’ wants compensation for the damage to its bus and to that end is trying to find a passenger in the taxi cab. The bus company has asked the police to disclose that information.
The legal question is whether EU data processing law stops the police from passing its police data on to a third party. A subsidiary issue is whether the police must take into account the fact that the passenger (the data subject) was a child.
The relevant EU legislation is Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ [1995] L281/31).
Article 7 governs the criteria ‘for making data processing legitimate’, and allows Member States to process data if:
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1).
Question Referred
According to the Curia website, the judges at Latvia’s Augstākā tiesa have asked:
Must the phrase ‘is necessary for the purposes of the legitimate interests pursued by the … third party or parties to whom the data are disclosed’, in Article 7(f) of Directive 95/46/EC […] of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, be interpreted as meaning that the National Police must disclose to Rīgas satiksme the personal data sought by the latter which are necessary in order for civil proceedings to be initiated? Is the fact that, as the documents in the case file indicate, the taxi passenger whose data is sought by the Rīgas satiksme was a minor at the time of the accident relevant to the answer to that question?
Update – 10 May 2016
The issue of personal information that has been given to one state body and perhaps released to a third party on the grounds of public policy, is also at stake in a fresh reference from the Slovak Supreme Court for Administrative Law; see further, Case C-73/16, Puškár – privacy requires removal from a tax office blacklist.
Outcome. By judgment of 4 May 2017 (ECLI:EU:C:2017:336) the Court ruled, in the words of the operative part: “Article 7(f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as not imposing the obligation to disclose personal data to a third party in order to enable him to bring an action for damages before a civil court for harm caused by the person concerned by the protection of that data. …” The full text is available on EUR-Lex and CURIA.
Comment
The CJEU currently has another interesting ‘car-crash’ case pending in its In-Tray; see further, Case C-413/15, Farrell (No.2) – identifying an emanation of the state.
This Rīgas satiksme case turns on the interpretation of Article 7(f) of the data processing Directive, which is also at stake in Case C-582/14, Breyer – seeing the logs from the trees in privacy law.
The CJEU’s Grand Chamber made passing reference to Article 7(f) in Case C-131/12, Google Spain – the right to be forgotten. On the ‘right to be forgotten’, there is now another reference to the CJEU; see further, Case C-398/15, Manni – data in public registers should be subject to the Google right to be forgotten.
Readers of EU Law Radar may also recall that there has been a recent reference from a court in Luxembourg that involves the rules governing a state authority’s ability to refuse to disclose tax information; see further, Case C-682/15, Berlioz Investment Fund – tax information exchanges not fishing expeditions.