NS - 33 Cdo 347/2023
From GDPRhub
| NS - 33 Cdo 347/2023 | |
|---|---|
 | |
| Court: | NS (Czech Republic) |
| Jurisdiction: | Czech Republic |
| Relevant Law: | Article 6(1)(c) GDPR Article 6(1)(f) GDPR § 90 zákona č. 127/2005 Sb |
| Decided: | 27.09.2023 |
| Published: | 12.06.2025 |
| Parties: | |
| National Case Number/Name: | 33 Cdo 347/2023 |
| European Case Law Identifier: | ECLI:CZ:NS:2023:33.CDO.347.2023.1 |
| Appeal from: | |
| Appeal to: | Dismissed as manifestly unfounded Ústavní soud (Czech Republic) II. ÚS 3464/23 |
| Original Language(s): | Czech |
| Original Source: | Nejvyšší soud (in Czech) |
| Initial Contributor: | ap |
The Supreme Court confirmed that national provisions provide for a legal basis (i.e. legal obligation) for a public communications network to store call data for billing purposes.
English Summary
Facts
In 2019, the data subject brought a complaint to the Czech Telecommunications Office regarding the billing of telephone calls from January 6 to February 5 2019. The company providing the publicly available electronic service network did not provide information on outgoing calls on 15 January (compared to other days in which calls were made), and did not provide information on incoming calls. The Czech Telecommunications Office upheld the data subject’s complaint. The case was appealed by the company to the District Court in Bruntál (January 2022) and the Regional Court in Ostrava (September 2022). Both Courts dismissed the appeals, and the case was brought to the Supreme Court on September 2023.
The company argued that retaining data on incoming calls for a specified period was not in the scope of the Czech Electronic Communications Act, and that the data processed was personal data covered by “special legislation” (the GDPR is not mentioned here, however, the Court then includes the GDPR and ePrivacy Directive in its reasoning).
Holding
The Court upheld the reasoning of the Court of Appeal, and stated that the company had the authorisation and obligation to keep the processed data on outgoing and incoming calls. Furthermore, it bore the burden of proof in disputes on the provision of services. This was especially important for the user to verify whether the billed amount corresponds to the volume of data and whether the data was provided correctly.
On the application of the GDPR, the Court upheld the reasoning of the Court of Appeal supported by an opinion of the Czech DPA. According to the Court, the processing of incoming call data is personal data, however, the company is entitled to process and store the data for a limited period under legal obligation (Article 6(1)(c) GDPR) and legitimate interests (Article 6(1)(f) GDPR). This is also the case on processing for the extent necessary to provide services and for billing and payments, even if it relates to a person other than the data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Czech original. Please refer to the Czech original for more details.
Summary text of the decision The Supreme Court dismissed the plaintiff's appeal. I. Procedure so far 1. The Bruntál District Court, by its judgment of 27 January 2022, file no. 16 C 57/2021-53, dismissed the action by which the plaintiff sought the annulment of the decision of the Czech Telecommunications Office, Department for the North Moravian Region, of 6 May 2019, file no. ČTÚ-7 193/2019-638/VII. Vyř.-MaK, and the decision of the Chairperson of the Council of the Czech Telecommunications Office of 22 December 2020, file no. ČTÚ-49 224/2019-603, and ordered the plaintiff to pay the defendant CZK 6,534 in compensation for the costs of the proceedings. In administrative proceedings governed by the principle of negotiation (here, a dispute with a user of a publicly available electronic communications service regarding payment of the price for the service provided) – the court of first instance argues – the plaintiff (entrepreneur), who bears the burden of proof, is obliged to claim and prove that she provided the service to the extent corresponding to the price she charged and which was valid at the time the service was provided (Section 141(4) of Act No. 500/2004 Coll., Administrative Procedure Code, as amended, Section 64(1), Section 90(3) of Act No. 127/2005 Coll., on electronic communications and on amendments to certain related acts /Act on electronic communications/, as amended, hereinafter referred to as “Act No. 127/2005 Coll.”). The statement of outgoing calls is not capable of proving the connection and execution of outgoing telephone calls. Even though Act No. 127/2005 Coll. does not result in an obligation to keep statements of incoming calls for the billing of electronic communications services, which are, however, necessary for the billing of the services provided, the entrepreneur is obliged (and "for the protection of its rights" is also entitled) to keep for the period specified in Section 90, paragraph 3 of Act No. 127/2005 Coll., i.e. "for the entire duration of the proceedings on the objection against the settlement of a complaint filed by the subscriber or user", operational data pursuant to Section 90, paragraph 1 of Act No. 127/2005 Coll., i.e. "any data processed for the purposes of transmitting a message in an electronic communications network or for its billing". 2. By judgment of 9. 9. 2022, ref. no. 71 Co 109/2022-111, the Regional Court in Ostrava confirmed the decision of the court of first instance and awarded the defendant CZK 6,654 in compensation for the costs of the appeal proceedings. The Court of Appeal agreed that it is up to the plaintiff, who bears the burden of proof, to prove in the event of a complaint that calls were made on 15 January 2019 and 16 January 2019 (Section 64(1) of Act No. 127/2005 Coll.). The fact that the mobile numbers of the caller and the called party were connected and for how long this lasted is proven - among other things - by the statement of incoming calls, which is operational data for billing services (Section 90(1) of Act No. 127/2005 Coll.). The fact that – with exceptions – incoming calls are not charged does not change this. The plaintiff is therefore obliged and entitled to store (process) data on incoming calls for the period specified in Section 90, paragraphs 3 and 4 of Act No. 127/2005 Coll., without thereby violating Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation”), and Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 on the processing of personal data and the protection of privacy in the electronic communications sector (the “Directive on privacy and electronic communications”). II. Appeal and statement on it 3. In the appeal, in which she challenged the decision of the Court of Appeal, the plaintiff described the question of whether an entrepreneur providing a public communications network or a publicly available electronic communications service is obliged (authorised) to retain data on incoming calls “which are not subject to billing” for a specified period as having not yet been resolved in the decision of the Court of Appeal. According to the appellant, data on unbilled – incoming calls are not operational data to which the obligation to retain applies pursuant to Section 90(3) of Act No. 127/2005 Coll. The authorisation to process operational data necessary for billing the price for the service pursuant to Section 90(4) of Act No. 127/2005 Coll. applies only to such data that are necessary for billing. Such are not data on incoming calls that the operator does not charge the user (Section 64(2) of Act No. 127/2005 Coll.), regardless of the fact that they are personal data, to which special legal regulations apply. She proposed that the Court of Appeal annul the decisions of the courts of both instances and return the case to the court of first instance for further proceedings. 4. The defendant agreed with the decision of the Court of Appeal and proposed that the Court of Appeal dismiss the appeal. III. Admissibility of the appeal 5. The appeal is, pursuant to Section 237 of Act No. 99/1963 Coll., the Code of Civil Procedure, as amended (hereinafter referred to as the “Code of Civil Procedure”), admissible because the contested decision, which ends the appeal proceedings, depends on the resolution of the question whether an entrepreneur providing a public communications network or providing a publicly available electronic communications service is obliged (authorized) to store and process data on incoming calls for the purposes of billing for the service provided (Section 90 of Act No. 127/2005 Coll.), which has not yet been resolved in the decision of the Court of Appeal. 6. An incorrect legal assessment is an error by the court in applying the law to the established state of facts. An erroneous application is not only when the court used a different legal provision than the one it should have correctly used, or applied the correct legal provision but interpreted it incorrectly, or if he drew incorrect legal conclusions from the factual findings, but also if his legal assessment is incomplete (when formulating legal conclusions, he did not take into account all relevant facts that were available to him after evaluating the evidence). IV. Grounds for appeal 7. According to Section 64, paragraph 1 of Act No. 127/2005 Coll., a subscriber who is an end user or user of a publicly available electronic communications service is obliged to pay for the service provided at the price valid at the time of provision of this service. 8. According to Section 64, paragraph 2 of Act No. 127/2005 Coll., an entrepreneur providing an Internet access service or an interpersonal communication service based on numbers is obliged to provide, free of charge, at the choice of the subscriber who is an end user or user, an invoice for the services provided by type of service or a summary invoice for the services provided in one item. The price statement for the services provided by type of service also contains information on the basic conditions of the service provided, which are set out in the implementing legal regulation pursuant to paragraph 13. The price statement does not include items for calls or other electronic communications services that the subscriber who is the end user or user does not pay for, including calls to numbers for access to collect services and a breakdown of the use of the Internet access service and the use of voice services, which are charged in the form of a flat fee for a certain period of time. The price statement is not provided for prepaid cards. 9. According to Section 64, Paragraph 7 of Act No. 127/2005 Coll., the subscriber who is the end user or user has the right to file a complaint about the price statement or the publicly available electronic communications service provided. 10. According to Section 90 of Act No. 127/2005 Coll. Traffic data means any data processed for the purpose of transmitting a message over electronic communications networks or for its billing (paragraph 1). An undertaking providing a public communications network or providing a publicly available electronic communications service that processes and stores traffic data, including relevant location data, relating to a user or subscriber, must delete or anonymize them as soon as they are no longer needed for the transmission of the message, except in the cases specified in paragraphs 3 to 6. The obligation of a legal or natural person providing a public communications network or providing a publicly available electronic communications service to retain traffic and location data pursuant to Section 97 remains unaffected (paragraph 2). An undertaking providing a public communications network or providing a publicly available electronic communications service is obliged to retain traffic data of the service provided to the subscriber or user until the dispute has been resolved pursuant to Section 129(1). 3 or until the end of the period during which the billing of the price or the provision of the electronic communications service may be legally challenged or the payment may be recovered (paragraph 3). An entrepreneur providing a public communications network or providing a publicly available electronic communications service may process the operational data necessary for billing the price for the service provided to the subscriber or user for access only until the end of the period during which the payment may be recovered (paragraph 4). 11. According to Section 129, Section 3 of Act No. 127/2005 Coll., if an entrepreneur providing publicly available electronic communications services does not comply with a complaint filed pursuant to Section 64, Section 7 to 9, the participant or user is entitled to file a motion with the Office to initiate proceedings on an objection to the settlement of the complaint without undue delay, but no later than 1 month from the date of delivery of the settlement of the complaint or the futile expiry of the deadline for its settlement (Section 64, paragraph 10), otherwise the right to raise an objection shall lapse. Filing an objection shall not affect the obligation under Section 64, paragraph 1, but in justified cases the Office is entitled, at the request of the participant or user, to decide that by filing an objection, the fulfilment of the obligation under Section 64, paragraph 1 shall be postponed until the decision on the objection becomes legally effective. This decision cannot be appealed. 12. Article 6 of the General Data Protection Regulation (“Lawfulness of processing”) provides: 1/ Processing is lawful only if at least one of the following conditions is met and only to the appropriate extent: a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; b) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; c) processing is necessary for compliance with a legal obligation to which the controller is subject; d) processing is necessary for the protection of the vital interests of the data subject or of another natural person; e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the exercise of their tasks. 2/ Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation concerning processing to comply with points (c) and (e) of paragraph 1 by specifying more precisely the specific requirements for processing and other measures to ensure lawful and fair processing, including in other specific situations in which processing takes place, as set out in Chapter IX. 3/ The basis for processing pursuant to points (c) and (e) of paragraph 1 shall be laid down in: (a) Union law; or (b) Member State law to which the controller is subject. The purpose of the processing shall be based on that legal basis or, in the case of processing referred to in point (e) of paragraph 1, the processing shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This legal basis may contain specific provisions for adapting the application of the rules of this Regulation, including general conditions governing the lawfulness of processing by the controller, the type of personal data to be processed, the data subjects concerned, the entities to which the personal data may be disclosed and the purpose of such disclosure, purpose limitation, storage period and individual processing operations and processing techniques, as well as other measures to ensure lawful and fair processing, such as measures for specific situations in which processing takes place other than those provided for in Chapter IX. Union or Member State law must meet an objective of public interest and be proportionate to the legitimate aim pursued. 4/ Where processing for a purpose other than that for which the personal data were collected is not based on the consent of the data subject or on Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to secure the objectives referred to in Article 23(1) of the GDPR, 1, the controller shall take into account, in order to determine whether processing for another purpose is compatible with the purposes for which the personal data were initially collected, inter alia: a) any link between the purposes for which the personal data were collected and the purposes of the intended further processing; b) the circumstances in which the personal data were collected, in particular as regards the relationship between the data subjects and the controller; c) the nature of the personal data, in particular whether special categories of personal data pursuant to Article 9 or personal data relating to criminal convictions and offences pursuant to Article 10 are being processed; d) the possible consequences of the intended further processing for the data subjects; e) the existence of appropriate safeguards, which may include encryption or pseudonymisation. Article 6 of the Directive on privacy and electronic communications (‘Traffic data’) provides: 1/ Traffic data relating to subscribers and users processed and stored by the operator of a public communications network or by the provider of a publicly available electronic communications service shall be erased or made anonymous as soon as they are no longer necessary for the transmission of the communication, without prejudice to paragraphs 2, 3 and 5 of this Article and Article 15(1). 2/ Traffic data necessary for the purposes of billing and determining interconnection charges may be processed. Such processing shall be permitted only until the end of the period during which the bill can be legally challenged or the right to payment can be asserted. 3/ For the purposes of marketing electronic communications services or for the provision of value-added services, the provider of publicly available electronic communications services may process the data referred to in paragraph 1 only to the extent necessary and for the period necessary for such services or marketing, provided that the subscriber or user to whom the data relate has given his consent. Subscribers or users must be able to withdraw their consent to the processing of traffic data at any time. 4/ The service provider must inform the subscriber or user of the types of traffic data that will be processed for the purposes referred to in paragraph 2 and for how long; in the case of processing carried out for the purposes referred to in paragraph 3, this information must be provided before consent is obtained. 5/ The processing of traffic data pursuant to paragraphs 1, 2, 3 and 4 must be limited to persons acting on behalf of operators of public communications networks and providers of publicly available electronic communications services and who are involved in billing or traffic management, customer requests, fraud detection, marketing of electronic communications services or the provision of value-added services, and must be limited to the extent necessary for the purposes of those activities. 6/ Paragraphs 1, 2, 3 and 5 shall apply without prejudice to the possibility of informing the relevant entities about the traffic data in accordance with the applicable legal regulations with the aim of resolving disputes concerning in particular interconnection or billing. 13. The Court of Appeal based itself on the facts that the court of first instance had taken over from the proceedings before the administrative authority. 14. The defendant complained about the billing of telephone calls No. 4802642619 for the billing period from 6. 1. 2019 to 5. 2. 2019. He had reservations about an outgoing call made on 16. 1. 2019 at 18:07:08 for 7200 seconds to one telephone number and about an outgoing call made on 15. 1. 2019 at 14:56:48 for 1578 seconds to another telephone number. The Czech Telecommunications Office, Department for the North Moravian Region, by decision of 6. 5. 2019, ref. no. ČTÚ-7 193/2019-638/VII. Vyř.-MaK, granted the defendant's objection to the settlement of the complaint (reduced the payment for services by CZK 141.61 excluding value added tax). The Chairperson of the Council of the Czech Telecommunications Office, by decision of 22 December 2020, file no. ČTÚ-49 224/2019-603, rejected the plaintiff's appeal and confirmed the decision. The plaintiff submitted only the outgoing call statement from 16 January 2019, the outgoing call statement from 15 January 2019, and did not provide any incoming call statements for both of the above-mentioned telephone numbers. The fact that the telephone call took place, i.e. the caller's number was connected to the called number, is proven by the outgoing and incoming call statement. 15. The plaintiff did not dispute that in a dispute over the billing of services provided to the defendant, she is obliged to claim and prove that the calls took place. Moreover, the Supreme Court has already ruled on this in its judgment of 27 August 2013, file no. stamp 21 Cdo 2058/2012, stated: "Each of the parties to the dispute referred to in the provision of Section 129(1) of the Electronic Communications Act (i.e. a dispute between a person performing a communication activity on the one hand, and a party or user on the other hand, which concerns the obligations imposed by the Electronic Communications Act or on its basis) must, depending on the hypothesis of the substantive law norm according to which the matter is to be assessed, assert facts and indicate evidence on the basis of which the administrative authority (court) will be able to decide in its favor (burden of assertion and burden of proof). A party who has not indicated the evidence necessary to prove his claims bears any adverse consequences in the form of such a decision of the administrative authority (court), which will be based on the state of facts established on the basis of other evidence provided. The same consequences also apply to the party who has proposed evidence of the truth of his claims, but the assessment of the evidence provided by the administrative authority (court) the conclusion was that the evidence did not confirm the truth of the factual allegations of the participant. The law defines the so-called burden of proof (Section 141, paragraph 4 of the Administrative Procedure Code, Section 120, paragraph 3 of the Code of Civil Procedure) as the procedural responsibility of the participant for the outcome of the proceedings, if it is determined by the result of the evidence taken. The procedural meaning of the burden of proof stands out above all in such an evidentiary situation, when the active participants fully fulfill their obligation to state and their obligation to provide evidence. Its true aim is to enable the administrative authority (court) to issue a decision even in those cases where a certain fact, decisive in the dispute, has not been (in the sense that it usually could not have been) proven, i.e. in cases where the results of the evaluation of the evidence do not allow the administrative authority (court) to accept either a conclusion about the truth of this fact, or a conclusion that it is false. Even in these cases (so-called evidentiary shortage), the administrative authority (court) must decide to the detriment of the participant in whose interest it was, according to the material the right to prove the alleged fact. It follows from the substantive law contained in the provision of Section 64(1) of the Electronic Communications Act that, in a dispute with a subscriber or user of a publicly available electronic communications service regarding payment of the price for the service provided, the person providing electronic communications services has the burden of alleging that it provided the subscriber (user) with a publicly available electronic communications service in the scope and quality corresponding to the price it charged him for the service and which was valid at the time the service was provided, and the burden of proof in terms of proving this allegation. It follows from the burden of allegation and the burden of proof defined in this way that it is not sufficient for the person providing electronic communications services to claim and prove what the measured volume of data transmitted during the provision of data services to the subscriber (user) was, but that this person must – in order to succeed in the dispute – claim and also prove what was the content of the data service provided (what data the subscriber or user received via the data service). Based on the fact what data was provided to the subscriber (user), it is possible to verify not only the correctness of the billed volume (amount) of data measured by the person providing electronic communications services, but also whether the data service was provided properly (cf. e.g. Section 94(2) of the Electronic Communications Act)". In the circumstances of the case at hand, the Supreme Court emphasized that “[E]vidence to prove the plaintiff’s claim about the content of the data service provided could have been not only records of so-called URL addresses (about the addresses of websites visited by the subscriber during the data connection), which the plaintiff could (without thereby – as the Court of Appeal correctly concluded – violating the provisions of Article 10 of the Charter of Fundamental Rights and Freedoms) process as operational data necessary for billing the price for the service provided until the end of the period during which the billing of the price could be legally challenged or the payment could be recovered (cf. Section 90(1) and (3) of the Electronic Communications Act), but also other means of evidence by which it was possible to determine the content of the data service provided to the subscriber and which are exemplified in the provisions of Section 51(1) of the Administrative Procedure Code and Section 125, first sentence, of the Code of Civil Procedure. Since the plaintiff’s obligation to assert what was the content of the data service billed participant, in proceedings before an administrative authority or in proceedings before the courts (from the point of view of the consequences of failure to comply with this obligation, it is not significant that he could not objectively comply with it, because he deleted his records of the content of the data service provided), and because he could not also comply with the burden of proof corresponding to this claim, the conclusion of the Court of Appeal, according to which it cannot be concluded that the transfer of the billed volume of data to the benefit of the participant actually took place, is in accordance with the law. 16. The obligation of the operator – a legal or natural person providing a public communications network or providing a publicly available electronic communications service – to retain operational and location data for the needs of the state, or the authorities listed in Section 97(3)(a) to (e) of Act No. 127/2005 Coll. (data retention) is not at issue in the present case. For this reason, the plaintiff’s reference to the plenary findings of the Constitutional Court of 22 March 2011, file number Pl. ÚS 24/10, and of 14 May 2019, file number Pl. ÚS 45/17, concerning the provisions of Section 97 of Act No. 127/2005 Coll., is worthless. V. Conclusion 17. The processing and storage of operational data for the purposes of transmitting messages via electronic communications networks and billing for services provided, including their liquidation (deletion) or anonymization, are regulated by the provisions of Section 90, paragraphs 2, 3 and 4 of Act No. 127/2005 Coll. The entrepreneur is obliged (authorized) to store processed data on outgoing and incoming calls proving that the called number was connected and for how long the connection lasted, regardless of whether the calls were made in the network of one operator or between the networks of different operators, for the period specified in the provisions of Section 90, paragraphs 3 and 4 of Act No. 127/2005 Coll. (in this case, until the judgment of the Regional Court in Ostrava of 9 September 2022, file no. 71 Co 109/2022-111 enters into force). It follows that operational data processed for the purposes of billing for services provided within the meaning of Section 90(1) of Act No. 127/2005 Coll. also includes data on incoming calls. 18. The obligation (authorization) to process and store data on incoming calls to numbers called by entities other than the complainant for the purposes of billing is related to the question of whether such an obligation (exercise of a right) is not in conflict with the protection of personal data. The Court of Appeal – correctly – agreed with the opinion of the Office for Personal Data Protection of 31 August 2022. Data on an incoming call is personal data “through which a natural person can be … easily identified … it is almost always possible to link a telephone number with a number of other data on a natural person”. The operator (plaintiff) is, according to Act No. 110/2019 Coll., on the processing of personal data, is entitled (for a limited period of time) to process and store such personal data to the extent necessary for the provision of services and for the purposes of billing and payments for the connection, even if they relate to a person other than the complaining person (cf. Article 6(1)(c/, f/ of the General Data Protection Regulation, Article 6 of the Directive on Privacy and Electronic Communications). 19. Since the issue for which the appeal was admitted was resolved correctly by the Court of Appeal, the Supreme Court dismissed the plaintiff's appeal (Section 243d(a/ of the Code of Civil Procedure).
