On Thursday 4 May, the European Court of Justice decided that in the Rīgas satiksme (C-13/16) case, the police can, if allowed under national law, communicate the data to a third party, of the person against whom this third party would like to take to court.
At the end of 2012 in Riga, a trolley bus owned by the Latvian Rīgas satiksme company was damaged when a taxi passenger (a child) was opening the vehicle door. The company wanted to file a legal case against the passenger to obtain compensation for the damages suffered. It approached the police, which had made an accident report, to request information about this person. The police communicated the surname and forename of the passenger to the company but refused to provide their ID number or address. In an effort to ensure that the police provided it with the missing information, Rīgas satiksme took the matter to the Latvian courts.
As part of the referral for a preliminary ruling under the terms of the 95/46 directive on data protection, the European Court of Justice was requested by the Latvian court to determine whether European legislation compels the body responsible for processing data (the police) to communicate personal data to a third-party. The directive does not oppose personal data being communicated to a third party if it is allowed under national law either.
Three cumulative conditions must, however, be met: the communication of the data must form part of the pursuit of a legitimate interest; the communication of the data must be necessary to the accomplishment of this legitimate interest and the fundamental right of the person concerned by the data protection must not prevail.
In this case in point, the Court considers that the three conditions have been met. The interest of the Rīgas satiksme company is to obtain personal data concerning a person who has damaged their property (the taxi passenger) and to take this person to court to obtain compensation as a legitimate interest (first condition). It appears necessary to obtain the address and/or the ID number in order to identify the person responsible for the damages (second condition). From the point of view of respecting fundamental rights, it does not appear justified to refuse part of the communication of the personal data necessary to file a case for compensation against the person responsible for the damages or their parents on the grounds that the person responsible is a minor (third condition). (Original version in French by Mathieu Bion)