Case C‑13/16

Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde

v

Rīgas pašvaldības SIA ‘Rīgas satiksme’

(Request for a preliminary ruling
from the Augstākās tiesas Administratīvo lietu departaments)

(Reference for a preliminary ruling — Directive 95/46/EC — Article 7(f) — Personal data — Conditions for the lawful processing of personal data — Concept of ‘necessity for the realisation of the legitimate interests of a third party’ — Request for disclosure of personal data of a person responsible for a road accident in order to exercise a legal claim — Obligation on the controller to grant such a request — No such obligation)

Summary — Judgment of the Court (Second Chamber), 4 May 2017

1.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Conditions for the lawful processing of personal data — Realisation of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed — Concept of legitimate interests — Interest of a third party in obtaining the personal information of a person who damaged their property in order to sue that person — Included

(European Parliament and Council Directive 95/46, Art. 7(f))

2.        Approximation of laws — Protection of individuals with regard to the processing of personal data — Directive 95/46 — Conditions for the lawful processing of personal data — Realisation of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed — Obligation on the controller to disclose to a third party, upon his request, personal data in order to enable him to bring an action — None — Disclosure of that data on the basis of national law — Lawfulness

(European Parliament and Council Directive 95/46, Art. 7(f))

1.      See the text of the decision.

(see para. 29)

2.      Article 7(f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as not imposing the obligation to disclose personal data to a third party in order to enable him to bring an action for damages before a civil court for harm caused by the person concerned by the protection of that data. However, Article 7(f) of that directive does not preclude such disclosure on the basis of national law.

However, as the Advocate General pointed out in points 82 to 84 of his Opinion and subject to the determination to be carried out in that respect by the national court, it does not appear to be justified, in circumstances such as those at issue in the main proceedings, to refuse to disclose to an injured party the personal data necessary for bringing an action for damages against the person who caused the harm, or, where appropriate, the persons exercising parental authority, on the ground that the person who caused the damage was a minor.

(see paras 33, 34, operative part)