ECJ, Directive 95/46/EC – Protection of Personal Data: Concept of “necessity for the realisation of the legitimate interests of a third party”

On May 4, 2017 has been published the judgment of the ECJ In Case C?13/16, Valsts policijas Rīgas re?iona pārvaldes Kārtības policijas pārvalde v/ Rīgas pa?valdības SIA “Rīgas satiksme” (Request for a preliminary ruling).

In this case, the major issue was to determine whether the concept of “necessity for the realisation of the legitimate interests of a third party” sets out or not an obligation for disclosure of personal data of a person responsible for a road accident, in order to exercise a legal claim.

According to the Court:

?(…)

25. In accordance with Article 5 of Directive 95/46, it is for the Member States to specify, within the limits of the provisions of that directive, the conditions under which the processing of personal data is lawful. Article 7 of that directive, which lays down the principles relating to the legitimacy of such processing, provides in that regard that ‘Member States shall provide that [it] may be processed only if’ one of the situations listed exhaustively by that provision exists. Under Article 7(f), such processing may be carried out where it is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection under Article 1(1) of Directive 95/46.

26. It is accordingly clear from the scheme of Directive 95/46 and from the wording of Article 7 thereof that Article 7(f) of Directive 95/46 does not, in itself, set out an obligation, but expresses the possibility of processing data such as the communication to a third party of data necessary for the purposes of the legitimate interests pursued by that third party. As the Advocate General stated in points 43 to 46 of his Opinion, such an interpretation may also be deduced from other EU instruments touching upon personal data (see, to that effect, as regards the processing of personal data in the electronic communications sector, judgment of 29 January 2008, Promusicae, C?275/06, EU:C:2008:54, paragraphs 54 and 55).

27. However, it should be pointed out that Article 7(f) of Directive 95/46 does not preclude such communication, in the event that it is made on the basis of national law, in accordance with the conditions laid down in that provision.

28. In that regard, Article 7(f) of Directive 95/46 lays down three cumulative conditions so that the processing of personal data is lawful, namely, first, the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the fundamental rights and freedoms of the person concerned by the data protection do not take precedence. (…)?.