Case C-801/26, Jurcki – toll road data kept past their time
A toll operator needs journey data to check that drivers paid. The question is what happens when it keeps them for longer than the law says, because the charge can still be claimed.
Facts
AAA BBB is challenging, before the Wojewódzki Sąd Administracyjny w Łodzi (Regional Administrative Court, Łódź), a decision of the Director of the Tax Administration Chamber in Łódź concerning an additional charge for using a toll motorway. The data relied on identify a vehicle’s journey: the registration number, the date, time and place of the journey, and data allowing the existence or validity of a motorway ticket to be checked. According to the questions, those data were stored and used after the specific national retention period for them had expired, the only justification being the general limitation period for the obligation to pay the additional charge. The data may have come from automated number plate recognition, from the central register of vehicles and drivers or from another system before being integrated into the electronic toll collection system. (Jurcki is a fictitious name given by the Court.)
Questions Referred
1. Must Article 5(1)(a), (c), and (e), Article 6(1)(c) and (e), Article 6(2) and (3), and Article 23(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), be interpreted as precluding an interpretation of national law according to which a public authority may store and use personal data identifying a vehicle’s journey on a toll motorway, including the vehicle registration number, the date, time and place of the journey, and data enabling the presence or validity period of a motorway ticket to be verified, after the expiry of a specific national retention period for such data, where the sole justification for continued processing is the general limitation period for the obligation to pay an additional charge?
2. Must Article 5(1)(a), (c), and (e), as well as Article 6(1)(c) and (e) and 6(3) of Regulation 2016/679, be interpreted as meaning that, for the purpose of assessing the lawfulness of the continued storage and use of personal data by a public authority, the decisive factor is the original technical source of the data, such as an automated number plate recognition system, the Centralna Ewidencja Pojazdów i Kierowców (Central Register of Vehicles and Drivers) or another IT system, or is the decisive factor that, after being retrieved, those data were integrated into the electronic toll collection system and are subsequently stored and used in that system for the purpose of verifying the obligation to pay the toll and enforcing the additional charge?
3. If the answer is that the continued storage or use of such data after the expiry of a specific national retention period is incompatible with Regulation 2016/679, must Article 5(1)(a) and (e), Article 6(1)(c) and (e) and Article 6(3) of that regulation, together with Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union, be interpreted as meaning that the national court is required to refuse to accept such data as a sufficient basis for upholding a decision imposing or confirming the obligation to pay an administrative additional charge?
Sources
OJ notice C/2026/5612 (EUR‑Lex) · Case file on CURIA · Regulation (EU) 2016/679 · Prokuratuur, C‑746/18 (ECLI:EU:C:2021:152)
Comment
The first question sets two national rules against each other: a retention period specific to the data, and a general limitation period for the charge the data are used to prove. The GDPR’s storage-limitation principle in Article 5(1)(e) requires data to be kept “for no longer than is necessary for the purposes for which the personal data are processed”. Where the processing rests on a legal obligation or a public task under Article 6(1)(c) or (e), Article 6(3) leaves the Member State to lay down the basis, which “may contain specific provisions”, including on “storage periods”. The Polish legislature did lay down a specific period. The question is whether an authority may extend it by pointing to a general provision on a different subject. If it may, the specific period protects little, since the limitation period for the charge will usually be longer.
The second question asks whether the answer changes with the origin of the data. One reading, which the question puts to the Court, is that once data from number plate cameras or the vehicle register are absorbed into the toll system, they become toll data and follow the toll system’s rules. That would let the choice of database decide how long data may be kept.
The third question is the one with the widest reach. The GDPR does not say what a court should do with evidence derived from unlawful processing. In criminal proceedings, the Court held in Prokuratuur (C‑746/18) that, “as EU law currently stands”, the admissibility and assessment of evidence obtained by data retention contrary to EU law is in principle for national law, subject to equivalence and effectiveness. An administrative charge for an unpaid toll is not a criminal case, and the referring court asks whether the GDPR and Article 47 of the Charter require it to set such data aside.