VUSRH - Usž-670/21-2

VUSRH - Usž-670/21-2

Court:	VUSRH (Croatia)
Jurisdiction:	Croatia
Relevant Law:	Article 4(1) GDPR Article 15(3) GDPR
Decided:	13.10.2020
Published:
Parties:
National Case Number/Name:	Usž-670/21-2
European Case Law Identifier:
Appeal from:	Administrative Court in Zagreb UsI-2457/19-14
Appeal to:
Original Language(s):	Croatian
Original Source:	VSRH (in Croatian)
Initial Contributor:	Lejla Rizvanovik

The High Administrative Court of the Republic of Croatia rejected the plaintiff's appeal against the judgement of the Administrative Court in Zagreb for committing a procedural violation.

English Summary

Facts

The plaintiff points out that in this particular case about the controller's obligations regarding an Access Request, he proposed to submit a preliminary question to the Court of Justice of the European Union. He proposes that the High Administrative Court annul the first-instance judgment, uphold the plaintiff's claim and annul the defendant's decision. He seeks reimbursement of the costs of the appeal proceedings.

Holding

The plaintiff filed an appeal against the judgment for substantial violation of the rules of court procedure, erroneously and incompletely established facts in the dispute and erroneous application of substantive law. In making such a claim, the first-instance court did not explain and specify on the basis of which it concludes that all credit documentation should be considered personal data, nor did it correlate with the notion of personal data from Art. (4)(1) GDPR on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The erroneous and incompletely established factual situation was committed by the court failing to establish all the circumstances of the case, and in particular failing to establish precisely what is considered personal data and why it considers all credit documentation to be personal data. The court also erred in finding that providing the respondent with a copy of the requested documentation does not adversely affect the rights and freedoms of other individuals, emphasizing that other individuals do not mean the processing manager himself. The first-instance court only states this position in the reasoning of the judgment, without explaining on the basis of which it came to such a conclusion and from which it follows that such an interpretation of the said Article of the General Data Protection Regulation should be considered valid. It also maintains that the substantive law has been erroneously applied accordingly, for all the reasons stated during the administrative dispute.

In response to the appeal, the respondent fully disputes the allegations as unfounded, for the reasons stated during the administrative dispute and finally proposes that the High Administrative Court dismiss the appeal in its entirety as unfounded and uphold the judgment rejecting the plaintiff's claim for annulment. It follows from the file that the first-instance court, in determining the factual situation in the dispute, in addition to the facts established by itself, took into account the facts established in the procedure of making the disputed decision.

The inspection of the case file submitted to this Court with the appeal shows that the respondent's decision upheld the request of the interested person to establish a violation of the right to protection of personal data and found that disabling the exercise of access to personal data; the plaintiff violated Art. (15)(3) GDPR and ordered the plaintiff to allow the interested person to exercise the right of access to credit documents or personal data. In the opinion of this Court, the defendant's decision is based on law and this Court considers that the defendant's finding that by denying the exercise of the right of access to personal data, ie credit documentation of the interested person, violation of Art. (15)(3) of the General Regulation on Personal Data Protection.

The person concerned requested that he be given access to his personal data by providing a copy of his personal data as provided for in Art. (15)(3) GDPR. This provision does not give the controller free choice when providing copies of the personal data being processed, but is a duty and obligation that the controller must provide. This provision stipulates that in any case the controller is obliged to provide a copy of personal data being processed, which in relation to this case means that the plaintiff (a bank - name not available at the moment) is obliged to provide a copy of documents containing personal data and thus provide access to personal data or credit documents which contains personal information.

Other objections raised by the plaintiff in the appeal, this Court finds unfounded and without prejudice to the different resolution of the administrative matter in question, especially because these are objections raised by the plaintiff in the proceedings before the trial court, which the trial court manifested, and whose conclusions this Court fully agrees with.

Comment

The plaintiff filed a complaint arguing about the controller's obligations regarding an Access Request and for substantial violation of the rules of court procedure in the Administrative Court in Zagreb.

The judgment of the Administrative Court in Zagreb is upheld.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Croatian original. Please refer to the Croatian original for more details.

- 1 - Business number: Usž-670 / 21-2

Business number: Usž-670 / 21-2

U I M E R E P U B L I K E H R V A T S K E

VERDICT

The High Administrative Court of the Republic of Croatia in a panel composed of judges of that Court dr. sc. Sanja Otočan, president of the council, Sanja Štefan and Ante Galić, members of the council and senior court advisor Lana Štok, recorder, in the administrative dispute of plaintiff S. dd, Z., represented by DK's attorney Personal Data Protection Agency, Z., for the protection of personal data, deciding on the plaintiff's appeal against the judgment of the Administrative Court in Zagreb, business number: UsI-2457 / 19-14 of 13 October 2020, at the session of the Council held on 13 May 2021 .

p r e s u d i o j e

I. The plaintiff's appeal is rejected and the judgment of the Administrative Court in Zagreb, business number: UsI-2457 / 19-14 of 13 October 2020, is upheld.
II. The plaintiff's request for reimbursement of the costs of the appeal proceedings is rejected.

Rationale

1. By the Judgment of the Administrative Court in Zagreb, business number: UsI-2457 / 19-14 of 13 October 2020, the claim was rejected in order to annul the decision of the defendant class: UP / I-041-02 / 19-10 / 28, registration number: 567-02 / 14-19-01 of 17 June 2019 and the plaintiff's request for reimbursement of the costs of the administrative dispute in the amount of HRK 9,375.00.
2. The plaintiff filed an appeal against the said judgment for substantial violation of the rules of court procedure, erroneously and incompletely established facts in the dispute and erroneous application of substantive law. In the appeal, the plaintiff essentially reiterates the plaintiff's allegations. He alleges that the first-instance court committed a substantial violation of the rules of court procedure because it did not declare itself on all the objections raised by the plaintiff during the dispute. First of all, the first-instance court committed a procedural violation because it failed to address the plaintiff's objection that the entire credit documentation did not represent the personal data of the respondents. In making this claim, the first instance court did not explain and specify on the basis of which it concludes that all credit documentation should be considered personal data, nor did it correlate with the notion of personal data from Article 4 (1) of Regulation (EU) 2016/679 and the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (hereinafter: the General Data Protection Regulation). The erroneous and incompletely established factual situation was committed by the court failing to establish all the circumstances of the case, and in particular failing to establish precisely what is considered personal data and why it considers all credit documentation to be personal data. The court also erred in finding that providing the respondent with a copy of the requested documentation does not adversely affect the rights and freedoms of other individuals, emphasizing that other individuals do not mean the processing manager himself. The first-instance court only states this position in the reasoning of the judgment, without explaining on the basis of which it came to such a conclusion and from which it follows that such an interpretation of the said Article of the General Data Protection Regulation should be considered valid. It also maintains that the substantive law has been erroneously applied accordingly, for all the reasons stated during the administrative dispute. He points out that in this particular case he proposed to submit a preliminary question to the Court of Justice of the European Union. He proposes that the High Administrative Court annul the first-instance judgment, uphold the plaintiff's claim and annul the defendant's decision. He seeks reimbursement of the costs of the appeal proceedings.
3. In response to the appeal, the respondent fully disputes the allegations as unfounded, for the reasons stated during the administrative dispute and finally proposes that the High Administrative Court dismiss the appeal in its entirety as unfounded and uphold the judgment rejecting the plaintiff's claim for annulment.
4. The appeal is unfounded.
5. Examination of the challenged first-instance judgment in accordance with the provisions of Article 73, paragraph 1 of the Administrative Disputes Act (Official Gazette 20/10, 143/12, 152/14, 94/16 and 29/17; hereinafter: ZUS), this Court found that there are no grounds for appeal against the judgment.
6. It follows from the file that the first-instance court, in determining the factual situation in the dispute, in addition to the facts established by itself, took into account the facts established in the procedure of making the disputed decision.
7. Insight into the case file submitted to this Court with the appeal shows that the defendant's decision upheld the request of the interested person to establish a violation of the right to protection of personal data and found that disabling the exercise of access to personal data or credit documentation In connection with the loan agreement No. 727952, the plaintiff violated Article 15 (3) of the General Data Protection Regulation and ordered the plaintiff to allow the interested person to exercise the right of access to credit documents or personal data in accordance with Article 15 (3) of the General Regulation. data protection in relation to the request of the interested person to the plaintiff on September 19, 2018, relating to the loan agreement number 727952 within 15 days and to notify the defendant of the same.
8. In the opinion of this Court, the defendant's decision is based on law and this Court considers that the defendant's finding that by denying the exercise of the right of access to personal data, ie credit documentation of the interested person, violation of Article 15 (3) of the General Regulation on Personal Data Protection.
9. Namely, the provision of Article 15, paragraph 3 of the General Regulation on the Protection of Personal Data stipulates that the controller shall provide a copy of the personal data being processed. For all copies requested by the respondent, the controller may charge a reasonable fee based on administrative costs, if the respondent submits the request electronically and unless the respondent requests otherwise, the information shall be provided in the usual electronic form.
10. According to this Court, the respondent is not only entitled to receive confirmation from the controller whether personal data relating to him are being processed, but if such personal data are being processed, he has the right to access personal data and to obtain information, inter alia, on processed personal data, the purpose of processing, storage period, export to third countries and so on. The applicant's right is to be able to control at any time whether his data have been processed in a lawful manner, ie. in the present case, it is not necessary to prove the purpose for which the applicant is seeking access to his personal data. The court of first instance correctly found that the defendant did not order the plaintiff any new data processing but only enabling access to existing credit documents and in this case obtaining copies of the requested documents does not adversely affect the rights and freedoms of other individuals under Article 15 (4). General regulations on the protection of personal data, because other individuals do not mean the controller himself. Therefore, the reference to legal opinions and judgments, rendered in different factual circumstances, does not affect the different solution of this administrative matter, since the first instance court considered all allegations on which the parties base their claims and objections and based on all presented evidence and their assessment determined to judge the merits of the claim.
11. The trial court correctly applied the substantive law to the facts thus established and rejected the claim. Namely, in the present case, the person concerned requested that he be given access to his personal data by providing a copy of his personal data as provided for in Article 15 (3) of the General Data Protection Regulation. This provision does not give the controller free choice when providing copies of the personal data being processed, but is a duty / obligation that the controller must provide. This provision stipulates that in any case the controller is obliged to provide a copy of personal data being processed, which in relation to this case means that the plaintiff (bank) is obliged to provide a copy of documents containing personal data and thus provide access to personal data or credit documents which contains personal information.
12. Other objections raised by the plaintiff in the appeal, this Court finds unfounded and without prejudice to the different resolution of the administrative matter in question, especially because these are objections raised by the plaintiff in the proceedings before the trial court, which the trial court manifested, and whose conclusions this Court fully agrees with.
13. The decision of the first-instance court on the cost of the administrative dispute rendered on the basis of Article 79 para. 4 of the ZUS is also correct, given that the plaintiff lost the dispute in its entirety.
14. Since there are no reasons why the plaintiff challenges the first-instance judgment, nor the reasons which the Court monitors ex officio under Article 73 § 1 of the ZUS, this is an appeal under Article 74 § 1 of the ZUS. rejected as unfounded and the first instance verdict upheld.
15. Since the plaintiff's appeal was rejected, his claim for reimbursement of the costs of the appeal was rejected in accordance with the provisions of Article 79 § 4 of the ZUS.

In Zagreb, May 13, 2021.
President of the Council
dr.sc. Sanja Otočan, acting