Back in late January, some fellow whom posterity will not recall wrote a blog about the Opinion of AG Bobek in Case C-13/16 Rigas. This Opinion was notable chiefly because it said things which were obviously unlikely to have come from the European Court, things like using “common sense” to guide the interpretation and operation of Directive 95/46/EC. Some suspected it might be a fake. What, asked Panopticon, would the CJEU make of such free-wheeling mania? The wait is over.Happily, normal service is restored. The CJEU has issued its judgment (ECLI:EU:C:2017:336) and it is the very model of Eurocratic harmonised banality. It is at least quite a bit shorter than the Opinion.
The facts are worth noting, especially if you are Reg Varney fan. In Latvia, they have trolley buses. One day, a passenger in a taxi opened the taxi door and damaged the adjoining trolley bus. Having not been to Latvia (yet), Panopticon cannot absolutely confirm the size of trolley buses, but an enthralling Google image search indicates that they are much as you would expect: hard to miss. (Some appear to be painted in colours reminiscent of a particularly vivid episode of Fireman Sam.) Perhaps unsurprisingly, the trolley bus company wished to identify the passenger who had caused this damage to pursue its losses through civil litigation, because the taxi driver was not responsible.
It having been a quiet day in Riga that day, the police had attended and made a record of the people involved and taken statements. The bus company asked the police for their records. The police gave them the name of the individual but no further identifying information (and we infer from the judgment that the name was not sufficiently unique to be sufficient by itself, which at least rules out the involvement of Boaty McBoatface). The bus company sought a court order. But was disclosure necessary for the purposes of the company’s legitimate interests, and were such interests overridden by the interests or rights of the data subject, under Article 7(f) of the Directive. In other words, to be parochial, did condition 6(1) of Schedule 2 to the DPA apply?
The first question the Latvian Court asked was whether the legitimate interests imposed an obligation to disclose. Thankfully, the CJEU managed to answer that one confidently and without even looking at its notes: Article 7(f) does not itself set out an obligation, but just expresses the possibility of processing: at [26]. This falls foursquare into Sybil Fawlty’s specialist Mastermind subject (see Keane v ICO & Home Office & MPS [2016] UKUT 461 (AAC) at [41]).
The CJEU then went on to make the point that nor does Article 7(f)necessarily preclude disclosure: at [27]. It means, in other words, what it says. The Court set out the three elements of the test it provides for: pursuit of a legitimate interest; the need to process; and that the fundamental rights do not take precedence. The CJEU then confirmed, as has been long applied in this jurisdiction, that the bus company’s private interest in civil action to recover its losses was undoubtedly a legitimate interest in the relevant sense: at [29]. That is a helpful confirmation.
It also considered that disclosure was necessary, because the company could not otherwise identify the data subject: at [30]. The CJEU did not engage with the arguments, recorded at [19], that the company could have obtained the information using other procedures. Presumably this is because the CJEU did not consider those alternatives to be relevant ones, although it would have been nice if it had said so. Perhaps where it all ends up in the same place – getting personal data from the police – the precise legal form of the route taken to get there is less significant. One other passing comment on [30] is the language of “strictly necessary“, which is not consistent with the judgment of Lady Hale in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 at [27], although it cites as an authority a CJEU decision which Lady Hale expressly considers does not require a strictness test.
As for the proportionality balance, the CJEU makes the blindingly helpful observation that it all depends on the facts: at [31]; but that the extent to which the information is also available in public sources is relevant to the exercise: at [32]. (Probably it does not mean that that is the only thing that is relevant. Doubtless it was mentioned only because the data subject’s address, which was the main item sought, would be in a telephone directory somewhere if you knew where to look for it.) At [32], the CJEU did emphasise that the age of the data subject was also relevant, although one assumes it meant in the context of children rather than accepting that an old person shouldn’t be able to object because it wouldn’t affect them for as long a period. Nonetheless, the Court agreed with the AG that just because the company might want to sue a minor, or someone responsible for a minor, that wouldn’t mean disclosure was inappropriate.
And that, in just over 30 paragraphs, was that. Hopefully the next stop on the data protection trolley bus route will be more exciting. Hold very tight please!
Christopher Knight