NSS - 4 Azs 246/2020-27
| NSS - 4 Azs 246/2020-27 | |
|---|---|
 | |
| Court: | NSS (Czech Republic) |
| Jurisdiction: | Czech Republic |
| Relevant Law: | Article 15 GDPR |
| Decided: | |
| Published: | |
| Parties: | |
| National Case Number/Name: | 4 Azs 246/2020-27 |
| European Case Law Identifier: | |
| Appeal from: | Městský soud v Praze (Czech Republic) 3 A 77/2020-67 |
| Appeal to: | Not appealed |
| Original Language(s): | Czech |
| Original Source: | NSS (in Czech) |
| Initial Contributor: | RP |
The Supreme Administrative Court held that a controller’s written refusal of an access request under national law qualifies as a reviewable decision and that a complaint to the DPA is not a mandatory remedy before going to court.
English Summary
Facts
On 16 October 2019, a data subject applied for a short-term Schengen visa at the Czech embassy in Cairo. The embassy rejected the application on 31 October 2019. It stated that one EU Member State considered the data subject a threat to public policy, internal security, public health or international relations.
On 15 November 2019, the data subject asked the Ministry of Foreign Affairs to review the refusal. On 3 February 2020, the Ministry rejected that request. It relied on a binding opinion issued by the Police of the Czech Republic, Directorate of the Alien Police Service. In this context, the Police acted as a controller of personal data.
On 28 February 2020, the data subject submitted an access request to the Police under Article 15 GDPR and under the Czech Act No. 110/2019 Coll., on the Processing of Personal Data (Zákon o zpracování osobních údajů). They asked the controller to confirm which Member State considered them a threat, what type of threat they allegedly posed, and for what specific reasons or conduct they were considered such a threat.
On 21 May 2020, the Police replied by letter. The controller stated that the Ministry of Foreign Affairs was responsible for issuing short-term visas and recommended that the data subject contact the Ministry’s Visa Department. The controller did not provide the requested information. The letter did not contain detailed reasoning and did not explain the available legal remedies.
The data subject brought an action before the Municipal Court in Prague (Městský soud v Praze). The court rejected the action as inadmissible. It held that the letter was not a “decision” within the meaning of § 65(1) of the Code of Administrative Justice (Soudní řád správní). In the court’s view, the letter did not create, change or definitively determine the data subject’s rights or obligations. The data subject then appealed to the Supreme Administrative Court (Nejvyšší správní soud).
Holding
On 18 November 2020, the Supreme Administrative Court (Nejvyšší správní soud) annulled the decision of the Municipal Court and referred the case back for further proceedings (4 Azs 246/2020-27).
The Supreme Administrative Court first examined whether a written reply to an access request under national law constituted a “decision” that could be reviewed by an administrative court. Under § 30(4) of the Czech Act on the Processing of Personal Data, a controller must inform the data subject in writing about the handling of their request. The controller must provide reasons unless it grants the request in full. The law also sets a time limit of 60 days and requires documentation of the procedure.
The Court explained that the concept of a “decision” under § 65(1) of the Code of Administrative Justice does not depend on the formal label used by the authority. Instead, courts must assess whether the act has the essential features of a decision. According to established case law, a reviewable decision is a formal expression of will by a public authority that authoritatively determines a person’s rights or obligations. The Court identified four key elements: the act must have a formalised structure; it must be issued within a legally regulated procedure; the authority must document that procedure; and the act must be addressed to a specific person.
The Court held that a written reply under § 30(4) of the Act met these conditions. The law regulated the procedure, imposed a deadline, required written notification and reasoning, and obliged the authority to keep records. The reply directly concerned the data subject’s statutory right of access. When a controller refuses access, it definitively determines that the data subject will not receive the requested personal data. Such a refusal therefore affects the scope of the data subject’s rights in a binding way.
The Court stressed that even if the controller failed to comply fully with the formal requirements, this did not change the legal nature of the act. The decisive question was whether the law envisaged a decision in this situation. Since the law required a written and reasoned outcome to an access request, the authority’s reply had to be treated as a decision, even if it took the form of a simple letter.
The Court also examined whether the data subject had to complain first to the Czech Data Protection Authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), before going to court. Under § 30(3) of the Act, the controller must inform the data subject that they may ask the DPA to verify the lawfulness of the processing or may lodge a complaint. However, the Court held that such a complaint was not a mandatory remedy. The DPA’s powers in this context were supervisory. A complaint to the DPA did not function as an appeal against the controller’s decision and did not suspend the time limit for bringing a court action. Therefore, the data subject did not need to exhaust this option before seeking judicial review.
The Supreme Administrative Court concluded that the Municipal Court had wrongly classified the controller’s reply as a non-reviewable act. The reply constituted a decision within the meaning of § 65(1) of the Code of Administrative Justice. The lower court had therefore unlawfully rejected the action.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Czech original. Please refer to the Czech original for more details.
Personal data protection: information on the processing of a request; decision; remedies Written information on the processing of a request for access to personal data provided by a public authority pursuant to Section 30(4) of Act No. 110/2019 Coll., on the processing of personal data, is a decision within the meaning of Section 65(1) of the Code of Civil Procedure and a complaint or initiative to the Office for Personal Data Protection against this decision are not proper remedies pursuant to Section 5 in conjunction with Section 68(a) of the Code. a) s. ř. s. (According to the judgment of the Supreme Administrative Court of 18. 11. 2020, ref. 4 Azs 246/2020-27) On 16. 10. 2019, the plaintiff submitted an application for a short-term Schengen visa for tourist purposes with multiple entries to the embassy in Cairo for the period 4. – 11. 12. 2019. The embassy, by a decision delivered to the plaintiff on 31. 10. 2019, rejected the application on the grounds that one of the Member States of the European Union considers the plaintiff to be a threat to public order, internal security, public health or international relations. On 15. 11. 2019, the plaintiff requested the Ministry of Foreign Affairs of the Czech Republic to reassess the reasons for not granting the visa. By decision dated February 3, 2020, the Ministry rejected this request, referring to the defendant's binding opinion. Subsequently, on 28 February 2020, the plaintiff requested the defendant, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation - hereinafter referred to as the "GDPR Regulation") and the Act on the Processing of Personal Data, to provide information on (i) which Member State(s) considers him to be a threat to public order, internal security, public health or the international relations of one or more Member States, (ii) specifically which of these threats he is considered to be, i.e. whether he is a threat to public order, internal security, public health or international relations and (iii) specifically for what reason (or due to what conduct) he is considered to be such a threat. The plaintiff challenged this letter by filing a lawsuit with the Municipal Court in Prague, which dismissed the lawsuit by its resolution of 21 July 2020, ref. 3 A 77/2020-67. In the justification for this resolution, the municipal court stated that the contested letter is not a decision under the Civil Procedure Code, since it did not establish, amend, cancel or bindingly determine the rights or obligations of the plaintiff. In the given case, the defendant was not inactive in the matter, but merely informed the plaintiff by letter of the possibility of further action. According to the municipal court, the letter is therefore an act of a public administration body, which, however, is not an administrative decision. The plaintiff (complainant) filed a cassation complaint against this resolution of the municipal court, in which he argued that, pursuant to Section 30(1) of the Act on the Processing of Personal Data, the defendant was obliged to decide on his request within 60 days. It is clear from the contested letter that the defendant does not intend to grant the request. The note must therefore be considered either as a negative decision or as a communication by which the defendant makes it clear that it refuses to decide on the matter. In the first case, the defendant's action would be subject to review by the administrative courts in proceedings on an action against an unlawful administrative decision, in the second case, the plaintiff could seek judicial review in proceedings on protection against the inaction of an administrative authority. In view of the Constitutional Court's ruling of 14 August 2019, file no. II. ÚS 2398/18, in such a situation the Municipal Court was obliged to inform him of its different legal opinion and give him the opportunity to amend the action accordingly. The Supreme Administrative Court annulled the resolution of the Municipal Court in Prague and returned the case to it for further proceedings. Reasoning: (…) [10] In the case currently under consideration, the complainant filed a request for information about the processed personal data concerning him. The right of access to personal data is governed by the provisions of Sections 28 and 30 of the Personal Data Processing Act. [11] According to Section 28(1) of the Personal Data Processing Act, “at the request of the data subject, the administrative authority shall inform the data subject whether it processes personal data relating to him or her. If the administrative authority processes such data, it shall transmit them to the data subject and shall provide him or her with information on a) the purpose of the processing of personal data, b) the legal provisions on the basis of which it mainly processes such data, c) the recipients or categories of recipients, d) the expected retention period or the method of determining it, e) the right to request the correction, restriction of processing or erasure of personal data and f) the source of such data.” According to Section 28(2) of the Act on the Processing of Personal Data, “the administrative authority shall not comply with the request pursuant to Section 1, or shall comply only partially, if compliance would endanger a) the performance of the task in the area of preventing, searching for and detecting criminal activity, prosecuting criminal offences, executing sentences and protective measures, ensuring the security of the Czech Republic or ensuring public order and internal security, including the search for persons and objects, b) the course of proceedings concerning an offence, disciplinary offence or conduct that has the characteristics of an offence, c) the protection of classified information, or d) the legitimate interests of a third party.” According to Section 28(3) of the Act on the Processing of Personal Data, “if compliance with the request or notification of non-compliance with the request, including the justification, would endanger the request pursuant to Section 2, the administrative authority shall inform the data subject in the same way as those applicants whose personal data it does not process.” According to Section 28(4) of the Personal Data Processing Act, “the managing authority shall keep documentation on the reasons for the procedure pursuant to Sections 2 and 3, which it shall keep for at least 3 years”. [12] According to Section 30(1) of the Personal Data Processing Act, “the managing authority shall process a request pursuant to Section 28 or 29 without undue delay, but no later than 60 days from the date of its submission”. According to Section 30(2) of the Personal Data Processing Act, “if the administrative authority demonstrates that a request pursuant to Section 28 or 29 is manifestly unfounded or disproportionate, in particular because it is repeated in a short period of time in the same matter, it may not comply with the request.” According to Section 30(3) of the Personal Data Processing Act, “when processing a request pursuant to Section 28 or 29, the administrative authority shall inform the data subject of the possibility of a) requesting verification of the lawfulness of the processing of personal data through the Office and of the contact details of the Office, b) filing a complaint with the Office, and c) seeking judicial protection.” According to Section 30(4) of the Personal Data Processing Act, “the administrative authority shall inform the data subject in writing of the processing of a request pursuant to Section 28 or 29. The information on the processing of the request shall contain the justification, except in cases where the request is complied with in full. If the data subject is represented, the administrative authority may require that the signature on the written power of attorney be officially verified; official verification is not required if the power of attorney was granted before the administrative authority. " According to Section 30, Paragraph 5 of the Act on the Processing of Personal Data, "the provisions of Paragraph 3, Letters a) and b) shall not apply if the administrative authority is a court or a public prosecutor's office". [13] Although written information on the processing of a request for access to personal data provided pursuant to Section 30, Paragraph 4 of the Act on the Processing of Personal Data is not the result of administrative proceedings conducted pursuant to the Administrative Procedure Code or other procedural regulations, this does not automatically mean that it cannot be assessed as a decision within the meaning of Section 65, Paragraph 1 of the Code of Administrative Procedure. Such an act of an administrative authority, by which the rights and obligations of the claimant are established, amended, revoked or bindingly determined, namely according to the resolution of the enlarged panel of the Supreme Administrative Court of 10. 7. 2018, ref. 9 As 79/2016-41, No. 3779/2018 Coll. NSS, "is to a certain extent a formalized expression of the will of an administrative (supervisory) authority, which contains the requirements stipulated by law. The formal features of a decision within the meaning of Section 65 of the Code of Administrative Procedure as features defining the necessary characteristics of the reviewed act […] result from those parts of Part One of Part Two of the Code of Administrative Procedure that concern, for example, the time conditions for filing a lawsuit (notification of the decision as a fundamentally written act) or the characteristics that this act must necessarily have in order to withstand review (reviewability; requirements that exclude that it would be a null and void act). These formal features (cf. in particular Sections 71, 72 and 76 of the Code of Administrative Procedure) are therefore: i) the prescribed formalized form of the act, which usually contains a statement and justification; ii) the fact that the act is issued within the framework of a formalized procedure, although it may not be a procedure within the meaning of the Code of Administrative Procedure or the tax code. of the procedure; iii) documentation is taken of the course and outcome of the procedure, iv) the resulting act is notified to the parties to the proceedings (cf. L. Jemelka, M. Podhrázký, P. Vetešník, J. Zavřelová, D. Bohadlo, P. Šuránek.: Soudní řád správní. Komentář. 1st ed. Prague: C. H. Beck, 2013, pp. 487-521)”. [14] The act of the administrative authority taken against the data subject pursuant to Section 30(4) of the Act on the Processing of Personal Data meets all of these four basic conditions, or formal features of a decision pursuant to Section 65(1) of the Act on the Processing of Personal Data. It is issued in at least a somewhat formalized procedure regulated in Sections 28 and 30 of the Act on the Processing of Personal Data, which must be completed within sixty days of the submission of the application (the second condition of the cited case law). Furthermore, it has a specific addressee, who is the applicant for access to his/her personal data and to whom the information is delivered in written form (fourth condition). It is also a materialized act containing specified requirements, which are the justification and instructions on the possibility of requesting the Office for Personal Data Protection to verify the lawfulness of the processing of personal data, filing a complaint with it or seeking judicial protection (first condition). Finally, documentation is kept on the progress and outcome of the application for access to personal data, which must be kept for a specified period (third condition). [15] Therefore, the conclusion of the municipal court that the act contested by the action is not capable of interfering with the rights of the applicant and thus does not constitute a decision within the meaning of Section 65(1) of the Code of Civil Procedure cannot be upheld. The written information provided pursuant to Section 30(4) of the Act on the Processing of Personal Data is, in its consequences, practically a negative decision on the application for access to personal data. It is clear that if the administrative authority had granted such a request, the complainant would have been fully satisfied and would have no reason to file an administrative action against such a decision. By the said act, although it is not explicitly designated as a decision nor is it the result of proceedings conducted under the Administrative Procedure Code, the defendant authoritatively decided on the complainant's request for access to the personal data it processes in relation to him. [16] Furthermore, there is nothing to suggest that the data subject would have to contact the Office for Personal Data Protection in connection with the processing of his request for access to personal data before filing an action against an act of an administrative authority pursuant to Section 30(4) of the Act on the Processing of Personal Data. The third paragraph of the same provision does not consider a request for verification of the lawfulness of the processing of personal data or a complaint filed with that office as a proper remedy in the proceedings leading to written information on the processing of a request filed pursuant to Section 28 of the Act on the Processing of Personal Data. In addition, the Office for Personal Data Protection, pursuant to Section 54(2) of the Act on the Processing of Personal Data, "in relation to the processing of personal data pursuant to Title III, unless it concerns the processing of personal data carried out by courts and public prosecutors' offices, a) supervises compliance with the obligations set out by law in the processing of personal data, b) verifies the lawfulness of the processing of personal data at the initiative of the data subject pursuant to Section 31, c) receives initiatives and complaints regarding violations of the obligations set out by law in the processing of personal data and informs about their handling." The powers of the Office for Personal Data Protection are therefore only supervisory and supervisory in the field of personal data protection. An initiative or complaint to this office is therefore not a proper remedy filed within the meaning of Section 5 in conjunction with Section 68(a) of the Act against information on the handling of a request for access to personal data and is only a means aimed at exercising the supervisory powers of the office, which do not automatically have the effects of a motion to initiate proceedings. The applicant is therefore not obliged to submit a complaint to the Office for Personal Data Protection before filing an action against the said decision of the administrative authority. This is only his right, which he may or may not exercise, without this having any effect on the binding nature of the decision pursuant to Section 30(4) of the Personal Data Processing Act. Any exercise of this right logically does not have any effect on the running of the period for filing an action against the decision of the administrative authority laid down in Section 72(1) of the Personal Data Processing Act, which begins to run upon delivery of information to the applicant on the processing of his application filed pursuant to Section 28 of the Personal Data Processing Act. [17] Although it would therefore be more appropriate from a practical point of view to file a proper appeal with the Office for Personal Data Protection against an act carried out pursuant to Section 30(4) of the Act on the Processing of Personal Data, by which a request for access to personal data was not fully complied with, it cannot be denied that the legislator did not use such an opportunity and, when transposing the GDPR into national law, only listed the means of remedying this procedure of the administrative authority, without adapting them to the relevant institutions of the Czech legal order. [18] It can therefore be summarized that the written information on the processing of a request for access to personal data provided pursuant to Section 30(4) of the Act on the Processing of Personal Data is a decision within the meaning of Section 65(1) of the Code of Civil Procedure, while a complaint or initiative to the Office for Personal Data Protection against this decision are not proper appeals pursuant to Section 5 in conjunction with Section 68(a) of the Code of Civil Procedure. a) s. ř. s. [19] The Supreme Administrative Court also reached the same conclusion in its judgment of 9 August 2018, ref. 9 Azs 49/2018-50, in relation to information on the processing of a request for the disclosure of personal data relating to the applicant, which was provided pursuant to Section 83(5) of Act No. 273/2008 Coll., on the Police of the Czech Republic, as amended until 23 April 2019, under similar conditions as in the Act on the Processing of Personal Data. [20] In the case under consideration, the defendant's note of 21 May 2020 did not contain all the necessary information on the processing of the request submitted pursuant to Section 28 of the Personal Data Processing Act, as, contrary to Section 30(3) and (4) of the same Act, it lacked justification and instructions on the possibilities of gaining access to personal data relating to the complainant. Furthermore, this request was not processed within sixty days of its submission, in accordance with Section 30(1) of the Personal Data Processing Act. In addition, the defendant referred the complainant to another administrative authority without indicating any of the reasons listed in Section 28(2) of the Personal Data Processing Act for which he could not be granted access to the requested personal data. However, the Supreme Administrative Court consistently holds the opinion in its case law that "the assessment of the fulfillment of the concept of a decision within the meaning of Section 65(1) of the Code of Administrative Procedure [...] must be assessed from the perspective of how it is assumed by the legal regulation, not from the perspective of whether the assumed aspects were actually fully fulfilled in a specific case. It is therefore still necessary to insist that even a mere note or communication from an administrative authority can be assessed as a decision within the meaning of Section 65(1) of the Code of Administrative Procedure in a situation where the law assumes the issuance of a decision." (cf. e.g. judgment of 29 January 2015, ref. 7 As 234/2014-32). Despite the aforementioned shortcomings of the act of the administrative authority contested by the action, it is thus clear that this is a decision pursuant to Section 65(1) of the Code of Administrative Procedure, which did not grant the complainant's request for access to some of his personal data. [21] For the reasons stated, the Municipal Court erred when it did not consider the defendant's note of 21 May 2020, contested in the action, to be a decision within the meaning of Section 65(1) of the Code of Civil Procedure and dismissed the action against it as inadmissible. The contested resolution of the Municipal Court is therefore unlawful and the ground for the cassation complaint referred to in Section 103(1)(e) of the Code of Civil Procedure is satisfied.
