A taxi driver stopped his vehicle at the side of the road when a a trolleybus passed alongside and the passenger sitting in the back seat of the taxi opened the door, which scraped against and damaged the trolleybus. The taxi driver was initially held responsible for the accident, and the trolley bus company sought compensation from the insurance company covering the civil liability of the owner of the taxi. However, that insurance company informed the company that it would not pay any compensation on the basis that the accident had occurred due to the conduct of the passenger in that taxi, rather than the driver. The company, wishing to bring civil proceedings against the passenger, applied to the police asking for information concerning the person on whom an administrative penalty had been imposed following the accident, copies of the statements given by the taxi driver and the passenger, and the name, identity document number, and address of the taxi passenger. The police responded by granting the request in part, by providing the name of the taxi passenger but refused to provide the identity document number and address or the statements given by the people involved in the accident, based on the fact that documents in the case file in administrative proceedings leading to sanctions could be provided only to the parties to those proceedings. Under the Latvian law, a person could expressly request the status of victim in administrative proceedings leading to sanctions by the body or official responsible for examining the case, which the company did not do. The company brought an action before a Latvian court against the decision of the national police in so far as it refused to reveal the identity document number and address of the passenger involved in the accident. That court upheld the action and ordered the national police to provide the information relating to the identity document number and place of residence of that passenger. The police appealed to the Supreme Court, Administrative Division, Latvia, which stayed the proceedings and referred to the Court of Justice of the European Union for a preliminary ruling the question, inter alia, whether article 7(f) of Parliament and Council Directive 95/46/EC imposed the obligation to disclose personal data to a third party in order to enable him to bring an action for damages before a civil court for harm caused by the person by the protection of that data. Under article 7(f) member states had to provide that personal data could be processed only if, inter alia, processing was necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data were disclosed, except where such interests were overridden by the interests or fundamental rights and freedoms of the data subject which required protection.
On the reference—
Held, that article 7(f) of Parliament and Council Directive 95/46/EC laid down three cumulative conditions to ensure that the processing of personal data was lawful: (1) the pursuit of a legitimate interest by the data controller or third party to whom the data was disclosed; (2) the need to process personal data for the purposes of the legitimate interests pursued; and (3) that the fundamental rights and freedoms of the person concerned by the data protection did not take precedence. The interest of a third party in obtaining the personal information of a person who damaged their property in order to sue that person for damages could amount to a legitimate interest. Derogations and limitations in relation to the protection of personal data had to apply only in so far as was strictly necessary. In that regard, according to the information provided by the national court, communication of merely the first name and surname of the person who caused the damage did not make it possible to identify that person with sufficient precision enabling an action to be brought against him: for that purpose, it was necessary to obtain also the address and/or the identification number of that person. Accordingly, article 7(f) of Directive 95/46 did not impose the obligation to disclose personal data to a third party in order to enable him to bring an action for damages before a civil court for harm caused by a person by the protection of that data. However, article 7(f) did not preclude such disclosure on the basis of national law (judgment, paras 28, 29, 30, 34, operative part).
Productores de Música de España (Promusicae) v Telefónica de España SAU (Case C-275/06) [2008] ECR I-271, ECJ; Volker und Markus Schecke GbR v Land Hessen (Bundesanstalt für Landwirtschaft und Ernährung, joint party) (Joined Cases C-92/09 and C-93/09) [2012] All ER (EC) 127; [2010] ECR I-11063, ECJ; Institut professionnel des agents immobiliers (IPI) v Englebert (Case C-473/12) [2014] 2 CMLR 9, ECJ and Ryneš v Úřad pro ochranu osobních údajů (Case C-212/13) [2015] 1 WLR 2607, ECJ considered.
L Bemhens, agent, for the trolleybus company.
I Kalniņš and A Bogdanova, agents, for the Latvian Government.
J Vláčil and M Smolek, agents, for the Czech Government.
MJ García-Valdecasas Dorrego, agent, for the Spanish Government.
G Eberhard, agent, for the Austrian Government.
L Inez Fernandes, M Figueiredo and C Vieira Guerra, agents, for the Portuguese Government.
D Nardi and H Kranenborg and by I Rubene, agents, for the European Commission.