Article 8 - Protection of personal data
Key facts of the case:
The case No.2018-18-01 has been initiated on the basis of an application submitted by person B. It is noted in the application that on 4 August 2018 the applicant had eight demerit points registered in the State Register of Vehicles and Drivers. In accordance with the contested norm (Article 141 (2) of the Road Traffic Law), this information is generally accessible. The applicant considered that it violates his right to inviolability of private life enshrined in Article 96 of the Satversme (the Constitution).
On 4 June 2019, the Constitutional Court adopted a decision on referring a question to the Court of Justice of the European Union (hereinafter CJEU) for a preliminary ruling. The Constitutional Court established that in the present case there were doubts, whether the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter – Regulation 2016/679) and of the Directive of the European Parliament and of the Council of 17 November 2003 2003/98/EC on the re-use of public sector information, which had been amended by the Directive of the European Parliament and the Council of 26 June 2013 2013/37/EU (hereinafter the amended Directive – Directive 2003/98/EC) prohibited the Member States from establishing the status of a generally accessible information for the information on the registered demerit points for drivers of vehicles, thus allowing processing of the respective personal data through disclosure, and to transfer these personal data for re-use.
On 22 June 2021 the CJEU delivered the decision in case C-439/19. It held that: 1. Article 10 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as applying to the processing of personal data relating to penalty points imposed on drivers of vehicles for road traffic offences. 2. The provisions of Regulation (EU) 2016/679, in particular Article 5(1), Article 6(1)(e) and Article 10 thereof, must be interpreted as precluding national legislation which obliges the public body responsible for the register in which penalty points imposed on drivers of vehicles for road traffic offences are entered to make those data accessible to the public, without the person requesting access having to establish a specific interest in obtaining the data. 3. The provisions of Regulation (EU) 2016/679, in particular Article 5(1), Article 6(1)(e) and Article 10 thereof, must be interpreted as precluding national legislation which authorises the public body responsible for the register in which penalty points imposed on drivers of vehicles for road traffic offences are entered to disclose those data to economic operators for re-use. 4. The principle of primacy of EU law must be interpreted as precluding the constitutional court of a Member State, before which a complaint has been brought challenging national legislation that proves, in the light of a preliminary ruling given by the Court of Justice, to be incompatible with EU law, from deciding, in accordance with the principle of legal certainty, that the legal effects of that legislation be maintained until the date of delivery of the judgment by which it rules finally on that constitutional complaint.
On 13 November 2021 the Constitutional Court of Latvia delivered decision in the case No.2018-18-01. It found that Article 141 (2) of the Road Traffic Law as much as it provides that demerit points registered in the State Register of Vehicles is generally accessible is incompatible with Article 96 of the Constitution from the moment of its entry into force.
Key legal question raised by the Court:
The key legal questions raised by the courts was is national legal regulation providing that penalty points imposed on drivers of vehicles are generally accessible is compatible with Article 96 (right to protection of the private life) of the Constitution interpreted in the light of binding internaitonal law, in particular, Regulation 2016/98 implementing Article 8 of the CFREu.
Outcome of the case:
On 13 November 2021 the Constitutional Court of Latvia delivered decision in the case No.2018-18-01. It found that Article 141 (2) of the Road Traffic Law as much as it provides that demerit points registered in the State Register of Vehicles is generally accessible is incompatible with Article 96 of the Constitution from the moment of its entry into force. It means that Latvian national legal regulation with regard to this particular aspect was incompatible with Article 8 of the CFREU and Regulation 2016/679
According to Article 6(1) of the TEU the EU recognizes the rights, freedoms and principles set forth by the Charter of the Fundamental rights of the EU (further – the Charter) and the Charter has the same legal status as the TEU and TFEU. In addition, according to Article 6(3) of the TEU and Article 52(3) of the Charter the fundamental rights guaranteed by the Convention [author – the ECHR] and deriving from common constitutional tradition of the Member States has to be considered as general principles of the EU law and scope and meaning of the rights provided by the Charter corresponds to rights guaranteed by the Convention. Taking into account this the Constitutional Court concludes that the Charter in its substance contains general principles of the EU law (see for example, the decisions of the CJEU in cases C-295/12P „Telefónica un Telefónica de España/Komisija” paras. 40 and 41; C-426/16 „Liga van Moskeeën en Islamitische Organisaties Provincie Antwerpen u.c.” paras 38–40). Article 8(1) of the Charter provides that Everyone has the right to the protection of personal data concerning him or her. This provision is based, among other, on Article 16 of the TFEU, Article 8 of the Convention and Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. In addition, taking into account the fact that as from 25 May 2018 Directive 95/46/EC has been repealed according to Article 94 of Regulation 2016/679, the references to Directive 95/46/EC have to be considered as references to Regulation 2016/679 and Article 8 of the Charter is connected with Regulation 2016/679 (see also the decision of the CJEU in joined cases C-465/00, C-138/01 and C-139/01 „Österreichischer Rundfunk u.c.” para 68). Therefore the conditions according to which right to the protection of personal data as general principle of the EU law as enshrined in Article 8 of the Charter are provided by both – Directive 95/46/EC and Regulation 2016/679 ( see Recital 10 of Directive 95/46/EC and Eecitals 1, 2 and 4 of Regulation 2016/679; see also the CJEU decision in joined cases C-465/00, C-138/01 and C-139/01 „Österreichischer Rundfunk u.c.” para.68). It follows from the case-law of the CJEU that right to protection of personal data as a general principle of the EU law is guaranteed mainly by ensuring that processing of personal data complies with, firstly, principle of data quality as provided by Article 6 of Directive 95/46/EC and Article 5 of Regulation 2016/679, and, secondly, one of the criteria for making data processing legitimate as provided by Article 7 of directive and Article 6 of regulation (see CJEU decision in joined cases C-465/00, C-138/01 un C-139/01 „Österreichischer Rundfunk u.c.” para.65 and decision in case C-496/17 „Deutsche Post” para.57). Respective provisions of Directive 95/46/EC and Regulation 2016/679 provides in concrete manner principles of the processing of personal data such as legality, loyalty, legitimacy, minimisation, precision, restriction of keeping longer than necessary.
Atbilstoši Līguma par Eiropas Savienību 6.panta 1.punktam Eiropas Savienība atzīst tiesības, brīvības un principus, kas izklāstīti Eiropas Savienības Pamattiesību hartā (turpmāk –Harta), un Hartai ir tāds pats spēks kā Līgumam par Eiropas Savienību un Līgumam par Eiropas Savienības darbību. Turklāt saskaņā ar minētā panta 3.punktu un Hartas 52.panta 3.punktu pamattiesības, kas garantētas Konvencijā un kas izriet no dalībvalstu kopīgajām konstitucionālajām tradīcijām, ir uzskatāmas par Eiropas Savienības vispārējiem tiesību principiemun Hartā ietverto Konvencijā garantētajām tiesībām atbilstošo tiesību nozīme un apjoms ir tāds pats kā Konvencijā noteiktajām tiesībām.Ievērojot minēto, Satversmes tiesa secina, ka Hartā pēc būtības ir ietverti arī Eiropas Savienības vispārējie tiesību principi (sk.,piemēram, Eiropas Savienības Tiesas 2014.gada 10.jūlija sprieduma lietā C-295/12P „Telefónica un Telefónica de España/Komisija” 40. un 41.punktu un 2018.gada 29.maija sprieduma lietā C-426/16 „Liga van Moskeeën en Islamitische Organisaties Provincie Antwerpen u.c.” 38.–40.punktu). Hartas 8.panta 1.punkts noteic, ka ikvienai personai ir tiesības uz savu personas datu aizsardzību. Šis pants ir balstīts uz citstarp Līguma par Eiropas Savienības darbību 16.pantu, Konvencijas 8.pantu un Eiropas Parlamenta un Padomes 1995.gada 24.oktobra direktīvu 95/46/EK par personu aizsardzību attiecībā uz personas datu apstrādi un šādu datu brīvu apriti. Turklāt, ņemot vērā to, ka atbilstoši Regulas2016/679 94.pantam no 2018.gada 25.maija Direktīva 95/46/EK tika atcelta un atsauces uz šo direktīvu ir uzskatāmas par atsaucēm uz Regulu2016/679, Hartas 8.pants ir saistīts arī ar Regulu 2016/679. Tādējādi nosacījumi, ar kādiem īstenojamas personas tiesības uz savu personas datu aizsardzību kā Eiropas Savienības vispārējstiesību princips, kas ietverts Hartas 8.pantā, bija paredzēti gan Direktīvā95/46/EK, gan Regulā2016/679 (sk.Direktīvas95/46/EK ievada 10.apsvērumuunRegulas2016/679 ievada 1., 2.un 4.apsvērumu; sk.arī Eiropas Kopienu Tiesas 2003.gada 20.maija sprieduma apvienotajās lietās C-465/00, C-138/01 un C-139/01 „Österreichischer Rundfunk u.c.” 68.punktu). No Eiropas Savienības Tiesas judikatūras izriet, ka Hartas 8.pantā ietvertās personas tiesības uz savu datu aizsardzību kā Eiropas Savienības vispārējs tiesību princips tiek nodrošinātas galvenokārt tādējādi, ka jebkurai personas datu apstrādei ir jāatbilst, pirmkārt, Direktīvas95/46/EK 6.pantā vai Regulas2016/679 5.pantā minētajiem datu kvalitātes principiem un, otrkārt, vienam no šīs direktīvas 7.pantā vai šīs regulas 6.pantā norādītajiem principiem, saskaņā ar kuriem datu apstrāde atzīstama par likumīgu (sk.Eiropas Kopienu Tiesas 2003.gada 20.maija sprieduma apvienotajās lietās C-465/00, C-138/01 un C-139/01 „Österreichischer Rundfunk u.c.” 65.punktu un Eiropas Savienības Tiesas 2019.gada 16.janvāra sprieduma lietā C-496/17 „Deutsche Post” 57.punktu). Minētajās Direktīvas 95/46/EK un Regulas 2016/679 normās ir konkretizēti tādi personas datu apstrādes principi kā likumīgums, godprātība, pārredzamība, nolūka ierobežojumi, datu minimizēšana, precizitāte, glabāšanas ierobežojums, kā arī pārskata tbildība.