UOOU (Czech Republic) - UOOU-05284/19-47

UOOU (Czech Republic) - UOOU-05284/19-47
Authority:	UOOU (Czech Republic)
Jurisdiction:	Czech Republic
Relevant Law:	Article 5 GDPR Article 6(1)(f) GDPR Article 7 GDPR Article 9 GDPR Article 10 GDPR Law no. 110/2019 Coll.
Type:	Complaint
Outcome:	Other Outcome
Started:
Decided:	28.05.2021
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	UOOU-05284/19-47
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Czech
Original Source:	UOOU (in CS)
Initial Contributor:	ea

The Czech DPA ordered a new first-tier decision of a case because in its earlier decision it did not properly carry out the balancing test in Article 6(1)(f) GDPR. It also held that the new decision should consider the application of Article 10 GDPR.

English Summary

Facts

The data controller published the data subject’s personal data on his Facebook profile. The personal data consisted of a partially anonymised criminal court decision revealing that the data subject committed the criminal offence of false accusation. It contained the data subject’s name and surname, place of birth, permanent address, details concerning the criminal offence committed by her, and a name of her Facebook profile which included her photograph and additional details relating to her criminal offence.

The DPA asked the data controller to remove the relevant Facebook post. The data controller failed to do so. The DPA, both at first instance and on appeal, subsequently held that the data controller infringed Article 5, 6, 7 or 9 GDPR. It also issued a fine of CZK 10,000 (approximately €410). The data controller then filed a request for a judicial review of the decision.

Holding

The City Court of Prague set aside the decision and remitted the matter back to the DPA. It reasoned that the DPA, in holding that Article 6(1)(f) GDPR did not constitute a legal basis for the processing of personal data, did not attempt to balance the data controller’s legitimate interests and the data subject’s fundamental rights against each other. The DPA appellate body subsequently ordered a new first-tier decision. It clarified that the first-tier decision-maker should determine the legitimate interests of the data controller or third parties (such as being a “societal watchdog”) and whether the Facebook post was a suitable and necessary measure to achieve that aim. The first-tier DPA body should then also consider whether Article 10 GDPR was violated.

Comment

Interestingly, the original first-tier DPA decision referred to a violation of Article 5, 6, 7 or 9 GDPR. It seems that Article 10 GDPR was not considered. This is perhaps why the court and subsequent DPA appellate body decision focused primarily on Article 6(1)(f) GDPR rather than Article 10 GDPR in their decisions.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Czech original. Please refer to the Czech original for more details.

DECISION
Chairman of the Office for Personal Data Protection as an appellate body competent pursuant to § 10 and § 152
paragraph 2 of Act No. 500/2004 Coll., the Administrative Procedure Code, decided pursuant to the provisions of § 152 para. and),
§ 152 paragraph 5 and § 90 paragraph 1 letter b) of Act No. 500/2004 Coll., Administrative Procedure Code, as follows:
Decision of the Office for Personal Data Protection ref. UOOU-05284 / 19-20 of 2 June 2020
is annulled and the case is returned to the administrative authority of the first instance for a new hearing.
Justification
I. Definition of the matter
(1) The basis for proceedings in the matter of suspicion of committing an offense pursuant to § 62 para. b)
Act No. 110/2019 Coll., on the processing of personal data, in connection with the unauthorized
by publishing the criminal order on the Facebook profile "XXXXXX" available on the Internet
address XXXXXX, the file material was collected on the basis of complaints received by the Office for
protection of personal data (hereinafter referred to as the "Office"), concerning possible breaches of
processing of personal data by the accused, XXXXXX, with its registered office at XXXXXX (hereinafter referred to as the “accused”).
(2) It was clear from the file that the accused placed on 17 January 2020 at 21:53
a post on your Facebook profile with a copy of a partially anonymized criminal
an order issued against XXXXXX, which continued to contain her personal data
to the extent name, surname, place of birth, city of permanent residence, information relating to
to her offense of false accusation and the name of the Facebook profile "XXXXXX", on which
a photograph with her likeness was placed, as well as information related to her
misdemeanor.
(3) On the basis of the above, the Office first notified the accused of a breach of the Regulation
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
persons with regard to the processing of personal data and on the free movement of such data and on cancellation
Directive 95/46 / EC (hereinafter "the General Regulation") and called on it to remedy the illegal situation. On this
The defendant responded to the summons by a letter dated 10 March 2020, in which he informed the Office that
the incriminated post at that address has been permanently deleted, correcting it
and this claim was verified by the Office. However, a follow-up investigation was carried out on
On 15 April 2020, on the basis of the complaint received, it was found that the contribution in question was at
the defendant's Facebook profile remains publicly available.
OFFICE FOR PERSONAL DATA PROTECTION
Lt. Col. Sochora 27, 170 00 Prague 7
tel .: 234 665 111, fax: 234 665 444
posta@uoou.cz, www.uoou.cz
2/3
(4) Subsequently, therefore, the administrative body of the first instance issued an order ref. UOOU-05284 / 19-15 of
April 27, 2020, by which the conduct of the accused was qualified as a misdemeanor pursuant to Section 62 (1)
letter b) of Act No. 110/2019 Coll. and at the same time a fine of CZK 10,000 was imposed on the accused.
However, the order was subsequently revoked due to the defendant's opposition.
(5) The result of the ongoing infringement proceedings was the issuance of a decision no. UOOU-
05284 / 19-20 of 2 June 2020 reaffirming the accused of committing an offense
offense according to § 62 par. 1 let. b) of Act No. 110/2019 Coll. and was fined
CZK 10,000 because he violated some of the basic principles for the processing of personal data according to
Articles 5 to 7 or 9 of the General Regulation, which he committed as a personal data controller XXXXXX
by placing it on publicly from 17 January 2020 and at least until 15 April 2020
accessible Facebook profile post with a copy of a partially anonymized criminal
an order of 8 January 2020 issued against XXXXXX, which contained her
personal data in the range of name, surname, place of birth, city of permanent residence and name
Facebook profile "XXXXXX", which contains a photo with her portrait and also
information relating to her offense of false accusation.
(6) Decision no. UOOU-05284 / 19-20 of 2 June 2020 was then a decision
President of the Office Ref. UOOU-05284 / 19-36 of 19 August 2020 confirmed. However
the accused subsequently turned to the Municipal Court in Prague with a lawsuit seeking annulment
the latter decision of the President of the Office, in which the Municipal Court in Prague ruled
Ref. 14 A 1 / 2021-40 of 20 April 2021 complied.
(7) In the grounds of the judgment in question, the Municipal Court in Prague stated in particular that
Article 6 (1) (a) f) a general regulation, the application of which the Office in the contested
excludes the decision, regulates the lawfulness of the processing of personal data if “it is necessary for
for the purposes of the legitimate interests of the administrator concerned or of a third party, except where before
interests take precedence over the interests or fundamental rights and freedoms of the data subject in need of protection
personal data, in particular if the data subject is a child ". The cited provision therefore allows
to give priority to the rights of others over the data subject's right to the protection of personal data,
however, again on the basis of the specific ratio of these conflicting rights. In this case
it was therefore necessary to carry out a so-called balance test, ie a de facto proportionality test for two in a collision
existing rights, namely the right of the data subject to the protection of personal data on the one hand and
the public to be informed about criminal proceedings through the accused in the role of the so-called
"Social watchdog" on the other hand. Since the Office's assessment of the above
conditions for the lawfulness of the processing of personal data in administrative decisions
did not deal with and limited itself to stern statements that the processing of personal data for example
pursuant to Article 6 (1) (a) f) of the general regulation would be possible, resp. that the accused title
for the processing of personal data under this provision does not prove, however, without
He explained convincingly and, above all, in a verifiable manner why it could not be considered
in this case, let alone carry out a proportionality test in the above sense
the decision is a defect of unreviewability for lack of reasons.
II. Assessment by the appellate body
(8) The Office is the opinion of the Municipal Court in Prague expressed in the judgment no. 14 A 1 / 2021-
40 of 20 April 2021 bound (see § 78 para. 5 of Act No. 150/2002 Coll., Administrative Procedure Code).
(9) Furthermore, it should be recalled that the appellate body with regard to the provisions of § 152 para. 6
letter a) and § 90 par. 1 let. c) of Act No. 500/2004 Coll., as the accused would be in danger of harm
3/3
Due to the loss of the opportunity to appeal, he does not have legitimacy to take the case
decided that the decision of the administrative body of the first instance ref. UOOU-05284 / 19-20 of
On 2 June 2020, it was amended in accordance with the requirements of the judgment of the Municipal Court in Prague ref. 14
A 1 / 2021-40 of April 20, 2021.
(10) For the above reasons, the Appellate Body therefore ruled as set out in the operative part of this notice
decision.
(11) In the subsequent proceedings, the administrative authority of the first instance should therefore comply with the requirements
Judgment of the Municipal Court in Prague Ref. 14 A 1 / 2021-40 of 20 April 2021 to carry out the so-called
balance test as required by Article 6 (1) (a) (f) a general regulation comparing the two
conflicting rights, ie the right to inform the public about the outcome of criminal proceedings
on the one hand, and the right to personal data on the other, and then to issue new ones
decision. In the opinion of the Appellate Body, it can then be used for its implementation
the argumentation of the Municipal Court in Prague contained in the judgment no. 5 and 138/2014 of 2 October
2017. More specifically, the first instance administrative body should first determine what they are
the legitimate interests of the accused or third parties in the disclosure of the personal data in question,
resp. whether they correspond to the role of the so-called "social watchdog" and whether these interests are possible
through the publication in question, or whether the objective pursued would not be
means can be achieved that are less intrusive on the data subject's rights
for the protection of personal data. However, the basis for these considerations must also be to determine to what extent
degree or whether the accused can be granted the role of a so-called "social watchdog", by others
in other words, whether and to what extent and for what reason it acts in the public interest and thus contributes
public debate or whether the accused is acting in a private interest. Subsequently, it will be necessary
consider to what extent the interference with the right to protection of personal data in question is proportionate, ie
if the seriousness of the infringement of a fundamental right in a given specific situation is outweighed by the significance
the objective pursued is not whether the victim brought about in the form of a restriction of a fundamental right is not received
disproportionate to the benefits that the restriction has brought. In this context, it will also be necessary
in accordance with recital 47 of the General Regulation, the reasonable expectations of the person concerned must also be taken into account
the data subject on the basis of his relationship with the accused (controller), it will also be necessary to consider
in so far as the publication in question corresponds to the provisions of Article 10 of the General Regulation
governing the processing of personal data relating to criminal and criminal convictions
acts. Relevant case law will also need to be taken into account, in particular
judgments of the European Court of Human Rights in the case of Magyar Jeti Zrt v. Hungary of
4 December 2018 No. 11257/16, in the cases of M.L. and W.W. v. Germany of 28 June 2018
Nos 60798/10 and 65599/10 and in the case of Høiness v. Norway of 19 March 2019 No. 43624/14.
Instruction: Pursuant to the provisions of Section 91 (1) of the Act, this decision shall be challenged
No. 500/2004 Coll., Administrative Procedure Code, cannot be revoked.
Prague, May 28, 2021
Mgr. Jiří Kaucký
chairman
(electronically signed)