Legitimate Interests Concept Contained in Data Protection Directive Does Not Encompass an Obligation

• 08/05/2017
• Articles

On 4 May 2017, the Court of Justice of the European Union (“ECJ”) handed down a judgment in which it addresses the concept of legitimate interests contained in Article 7(f) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“Data Protection Directive”) (Case C-13/16 Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA "Rīgas satiksme”).

The case, which was referred to the ECJ by the Latvian Supreme Court, Administrative Division, concerns a dispute between the Latvian national police and a trolleybus company, Rīgas satiksme (“RS”), operating in Riga. RS had challenged the police’s decision to disclose only the first name and surname, but not the identification number and/or address of a minor known to the police to have caused damage to one of RS’s trolleybuses. RS considered that information to be necessary for the purpose of bringing civil proceedings. The police based its decision on the grounds that it did not have permission under national law to supply all of the requested information to a third party. The Latvian Supreme Court decided to stay the proceedings and refer two preliminary questions to the ECJ regarding the interpretation of Article 7(f) of the Data Protection Directive, and the relevance of the fact that the data subject was a minor at the time of the accident.

Article 7(f) Data Protection Directive

The ECJ first held that it was clear from the Data Protection Directive and the wording of its Article 7 that Article 7(f) of the Data Protective Directive does not in itself set out an obligation, but only expresses the possibility of processing data for the purposes of the legitimate interests pursued by a third party. However, such a communication is permitted in the event that it is made on the basis of national law and is in accordance with the three cumulative conditions laid down in Article 7(f) of the Data Protection Directive.

First, as for the requirement that the third party pursue a legitimate interest, the Court held that bringing an action to attain redress for damaged property qualifies as such.

Second, regarding the requirement that the processing should be necessary to pursue the legitimate interest, the Court held that this condition is fulfilled in the present case because, in the absence of disclosure, it would be impossible to identify the person against whom the action should be brought.

Third, as regards the condition requiring that the legitimate interest be balanced against the opposing rights and interests at issue, the ECJ emphasised that this determination would depend in principle on the specific circumstances of the case.

Minors as Data Subjects

With regard to the second preliminary question concerning the age of the data subject, the ECJ noted that this may be one of the factors that should be taken into account in the context of balancing the interests of the data subject with the other interests at stake. However, the ECJ added that, in the present case, it is not justified to refuse disclosure of the requested information on the mere ground that the data subject is a minor.

In conclusion, the legitimate interest requirement in Article 7(f) of the Data Protection Directive cannot provide a legal basis on which to compel a data controller to disclose personal data. However, it will not preclude the disclosure of personal data to a third party in order to enable that party to bring an action for damages before a civil court for harm caused by the data subject, if such a possibility is provided for under national law.