If a taxi hits a bus and the taxi company tells the police who was in the taxi, then does EU data processing law stop that police data from being passed on to the bus company?
On the streets of Riga, there was an accident involving a taxi and bus. The taxi company told the Latvian police who was in their vehicle.
The bus company ‘Rīgas satiksme’ wants compensation for the damage to its bus and to that end is trying to find a passenger in the taxi cab. The bus company has asked the police to disclose that information.
The legal question is whether EU data processing law stops the police from passing its police data on to a third party. A subsidiary issue is whether the police must take into account the fact that the passenger (the data subject) was a child.
The relevant EU legislation is Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ  L281/31).
Article 7 governs the criteria ‘for making data processing legitimate’, and allows Member States to process data if:
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1 (1).
According to the Curia website, the judges at Latvia’s Augstākā tiesa have asked:
Must the phrase ‘is necessary for the purposes of the legitimate interests pursued by the … third party or parties to whom the data are disclosed’, in Article 7(f) of Directive 95/46/EC […] of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, be interpreted as meaning that the National Police must disclose to Rīgas satiksme the personal data sought by the latter which are necessary in order for civil proceedings to be initiated? Is the fact that, as the documents in the case file indicate, the taxi passenger whose data is sought by the Rīgas satiksme was a minor at the time of the accident relevant to the answer to that question?
The CJEU currently has another interesting ‘car-crash’ case pending in its In-Tray; see further, Case C-413/15, Farrell (No.2) – identifying an emanation of the state.
This Rīgas satiksme case turns on the interpretation of Article 7(f) of the data processing Directive, which is also at stake in Case C-582/14, Breyer – seeing the logs from the trees in privacy law.
The CJEU’s Grand Chamber made passing reference to Article 7(f) in Case C-131/12, Google Spain – the right to be forgotten.
On the ‘right to be forgotten’, there is now another reference to the CJEU; see further, Case C-398/15, Manni – data in public registers should be subject to the Google right to be forgotten.
Readers of EU Law Radar may also recall that there has been a recent reference from a court in Luxembourg that involves the rules governing a state authority’s ability to refuse to disclose tax information; see further, Case C-682/15, Berlioz Investment Fund – tax information exchanges not fishing expeditions.
Update – 10 May 2016
The issue of personal information that has been given to one state body and perhaps released to a third party on the grounds of public policy, is also at stake in a fresh reference from the Slovak Supreme Court for Administrative Law; see further, Case C-73/16, Puškár – privacy requires removal from a tax office blacklist.
Update – 23 October 2016
The Second Chamber is due to hear this case on 24 November 2016.
Update – 17 December 2016
There is a privacy law aspect in the background of a Dutch preliminary reference about court orders and the enforcement of IP rights; see further, Case C-644/16, Synthon – resisting its impounded documents being inspected by a rival.
Update – 24 December 2016
The Opinion of Advocate General Bobek is due to be given to the Second Chamber on 26 January 2017.
Update – 26 January 2017
The issue of a person’s action giving rise to criminal and civil liability is at stake in Case C-537/16, Garlsson Real Estate – ne bis in idem.