Tribunal Administratif - N°46014
From GDPRhub
| Tribunal Administratif - N°46014 | |
|---|---|
 | |
| Court: | Tribunal Administratif (Luxembourg) |
| Jurisdiction: | Luxembourg |
| Relevant Law: | Article 5(1)(b) GDPR Article 6(1)(c) GDPR Article 6(1)(e) GDPR Article 6(4) GDPR Regulation 261/2004 Loi GD 8 Juin 1979 |
| Decided: | |
| Published: | 18.04.2023 |
| Parties: | Ryanair Ministre (Direction) de la Protection des Consommateurs |
| National Case Number/Name: | N°46014 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | French |
| Original Source: | Administration Tribunal (in French) |
| Initial Contributor: | Orla |
The Administrative Tribunal of Luxembourg held that a public authority cannot refuse to disclose personal data from its administrative file by solely invoking the requirement of data subject consent under Article 6(1)(a) GDPR.
English Summary
Facts
Between 30 January 2019 and 16 July 2019, the Luxembourg Minister of Consumer Protection (Minister), acting as the designated enforcement body for EU Regulation No. 261/2004 on air passenger rights, issued seven administrative decisions ordering Ryanair (the airline) to pay €250 compensation to each of the 37 passengers whose flights had been canceled by the airline.
On 14 January 2021, the airline sought to annul the seven decisions before the Luxembourgish Administrative Tribunal. When doing so, the airline sought to inform the passengers concerned of the ongoing case. However, the airline lacked sufficient information about the passengers to proceed with contacting them as the Minister had only provided the airline with some of the passenger’s surnames.
Thereby, in a letter of 25 January 2021, the airline sent a request for additional passenger information, full name and home address, to the Minister. When doing so, the airline invoked the obligation of administrative cooperation and file access under the Grand-Ducal Regulation of 8 June 1979.
On 12 February 2021, the Minister refused the airline’s request for additional information. The Minister stated that the passengers' details constituted personal data, and that transmitting them to the airline would require the prior consent of the data subjects. The Minister provided no further explanation or relied on no other legal basis under the GDPR to transfer the requested information.
On 12 May 2021, the airline filed an annulment action before the Administrative Tribunal against the Minister's refusal to provide additional passenger information. The Luxembourgish state and Minister did not submit any written defense within the statutory deadline, remaining passive throughout the proceedings.
Holding
On 18 April 2023, the Administrative Tribunal announced its decision.
On the Minister's decision of 12 February 2021: The Tribunal annulled the Minister's decision of 12 February 2021 (the refusal to provide additional passenger information). The Court found that the Minister's sole justification, that disclosure of passenger contact details required prior consent under the GDPR, was legally inadequate. The court observed that Article 6(1) GDPR provides six distinct legal bases for lawful processing, and that consent is not the only, or necessarily the most appropriate, basis available to a public authority.
In particular, the Court noted that the airline had specifically argued that the transfer could be grounded on Article 6(1)(e) GDPR (processing necessary for the performance of a public interest task or exercise of official authority) or on Article 6(1)(c) GDPR (processing necessary to comply with a legal obligation). The Minister had been designated as the authority responsible for enforcing Regulation No. 261/2004, collecting passenger complaints, and issuing binding decisions on airlines. The Court held that the collection and processing of passenger data was indispensable to that public mission, and that the compatibility of the further transfer with the original purpose had not been properly assessed under Article 5(1)(b) and Article 6(4) GDPR.
On the obligation of administrative transparency under Grand-Ducal Regulation of 8 June 1979: The court held that the State's failure to submit observations or a defense, combined with its refusal to share the administrative file, constituted a breach of the principle of transparency in administrative action. In the absence of any counter-arguments from the State, the court treated the airline's factual allegations as established.
Therefore, the Administrative Tribunal firstly, annulled the Minister's decision of 12 February 2021 and secondly, ordered the State of Luxembourg to pay Ryanair a procedural indemnity of €1,000 (reduced from the €5,000 requested), plus all costs of the proceedings.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Administrative Court No. 46014 of the Roll of the Grand Duchy of Luxembourg ECLI:LU:TADM:2023:46014 4th Chamber Filed on 12 May 2021 Public Hearing of 18 April 2023 Appeal filed by the Irish company ..., … (IE), against a decision of the Minister for Consumer Protection regarding data protection ___________________________________________________________________________ JUDGMENT Having regard to the application, registered under number 46014 of the Roll, filed with the Registry of the Administrative Court on 12 May 2021 by NautaDutilh Avocats Luxembourg SARL, registered on List V of the Luxembourg Bar Association, established and having its registered office at L-1233 Luxembourg, 2, rue Jean Bertholet, registered with the Luxembourg Trade and Companies Register under number B 189.905, represented by its Board of Directors currently in functions, represented for the purposes of these proceedings by Vincent Wellens, Attorney at Law, registered with the Luxembourg Bar Association, on behalf of the Irish company ..., established and having its registered office in ... (Ireland), registered in the Irish Companies Register under number 104547 and represented by its current Board of Directors, or failing that, by its legal representative, and having elected domicile at the office of its pre-qualified agent, located at 2, rue Jean Bertholet, L-1233 Luxembourg, seeking, according to its operative part, the annulment or the amendment of the decision of the Minister for Consumer Protection of February 12, 2021, refusing its request for information submitted on January 25, 2021; Having regard to the documents filed in the case, and in particular the contested decision; The reporting judge having been heard in his report, as well as Mr. Vincent Wellens in his oral argument at the public hearing of October 18, 2022. ___________________________________________________________________________ By letter from its legal representative dated January 25, 2020, the Irish company ..., hereinafter referred to as "the company ...", addressed the following request to the Minister for Data Protection, hereinafter referred to as "the Minister": "(...) Following complaints from several passengers (37) due to the cancellation of their flight, Your Ministry, in its capacity as the body designated pursuant to the provisions of European Regulation (EC) No 261/2004 of the European Parliament and of the Council of 11 February 2004 laying down common rules on compensation and assistance to passengers in the event of denied boarding and of cancellation or long delay of flights (Regulation 261/2004), adopted seven (7) decisions ordering ... to to pay each of these passengers the compensation of EUR 250.00 provided for in Article 7, paragraph 1 of this Regulation: 1. Decision of 30 January 2019 (flight …); 2. Decision of 13 May 2019 (flight …); 3. Decision of 14 June 2019 (flights … and …); 4. Decision of 24 June 2019 (flight … with passenger …); 5. Decision of 24 June 2019 (flight … with passenger …); 6. Decision of 1 July 2019 (flight …); 7. Decision of 16 July 2019 (flight …); As you may have noticed, ... has filed an application for annulment, which was lodged with the Administrative Court of Luxembourg on 14 January 2021. In order to avoid any procedural disputes, ... intends to notify This request was sent to the 37 passengers affected by the decisions. However, [the relevant authority] does not have all the necessary information to do so. In several cases, we do not even have the first names of the consumers in question. Therefore, I respectfully request, based on your obligation to cooperate and your obligation to provide the file, as stipulated by the Grand-Ducal Regulation of 8 June 1979 concerning the procedure to be followed by state and municipal administrations, that the following information be provided to us as soon as possible and no later than Friday, 29 January 2021: (i) the full names of the passengers who initiated the complaints underlying these decisions and (ii) their residential address. To assist you in this task, please find attached (Appendix – Passenger List) a list containing the information we currently have on these individuals, which you are responsible for completing (...). In response to the aforementioned request of 25 January 2021, the Minister replied as follows: February 12, 2021: “(...) We refer to your registered letter dated January 25, 2021, which we received on February 1, 2021, and to your email of February 11, 2021, in which you request, on behalf of your client, an Irish airline, the full names and addresses (the “contact details”) of the consumers affected by decisions issued by the Minister for Consumer Protection following flight cancellations. We note that you have filed an appeal for annulment against these decisions and that your application was lodged with the Administrative Court of Luxembourg on January 14. We also understand that your request is based on the fact that your client claims not to have the contact details of the passengers concerned, which are necessary to serve the application on each of them. We hereby inform you that we cannot comply with your request because these contact details constitute personal data and we we believe that their transmission to your firm requires their prior consent for this processing to be lawful (...). 3. By application filed with the registry of the administrative court on May 12, 2021, registered under number 46014, the company ... filed an appeal seeking primarily the annulment and, in the alternative, the amendment of the aforementioned decision of the Minister of February 12, 2021, refusing to provide it with the requested contact information. It should be noted at the outset that the State did not submit a response within the statutory time limit, although the originating application was validly served on it by the registry on May 12, 2021. In accordance with the provisions of Article 6 of the Law of June 21, 1999, the court nevertheless rules with respect to all parties by a judgment having the effects of a contested decision, even if the defendant did not appear within the time limit stipulated by the law. Even if an applicant intends to primarily file an application for annulment and secondarily for review, the court is obligated to first examine the possibility of filing an application for review. Indeed, since Article 2 of the amended Law of 7 November 1996 on the organization of the administrative courts, hereinafter referred to as "the Law of 7 November 1996," stipulates that an application for annulment is admissible only with respect to decisions not subject to any other appeal under applicable laws and regulations, there is no need to rule on the application for annulment when an application for review is provided for by law.<sup>1</sup> Since no legal provision provides for an application for review concerning a decision to be taken by an administrative authority regarding the disclosure of documents and access to administrative files, the administrative court must declare itself incompetent to hear the subsidiary application for review. Therefore, only an application for annulment has jurisdiction. An appeal could validly be lodged against the contested decision of February 12, 2021, which remains admissible as it was filed in accordance with the prescribed form and time limits. In support of its appeal, and as a matter of fact, while recalling the facts and background as transcribed above, the appellant explains that it is an airline incorporated under Irish law, operating flights worldwide, although its principal activity is located within the territory of the European Union. It specifies that it is contesting the Minister's decisions requiring it to reimburse various passengers €250 in compensation in accordance with Regulation (EC) No 261/2004 of the European Parliament and of the Council of February 11, 2004, establishing common rules on compensation and assistance to passengers in the event of denied boarding and of cancellation or long delay of flights, and repealing Regulation (EEC) No 295/91, hereinafter referred to as "Regulation No 261/2004." 261/2004”, for the cancellation of their flight, as well as for some passengers the reimbursement of the new ticket purchased, respectively for refreshments upon presentation of supporting documents. In this context, the plaintiff argues that, in order to avoid any procedural dispute, following the filing of its legal appeal concerning the aforementioned decisions, it took the initiative of serving its originating application on each of the passengers, in their capacity as interested third parties within the meaning of Article 4 of the Law of 21 June 1999. However, having realized that it would not have all the necessary information to do so, as the aforementioned decisions were limited for some passengers to mentioning only their name without indicating their 1 Administrative Court, 4 December 1997, No. 10404 of the roll, Pas. adm. 2022, V° Appeal for review, No. 4 and the other references therein cited. First name, it would have seemed impossible to involve all these passengers without the Minister's cooperation. In law, the plaintiff first argues that there has been a violation of Article 6 of the Grand-Ducal Regulation of 8 June 1979 concerning the procedure to be followed by State and municipal administrations, hereinafter referred to as "the Grand-Ducal Regulation of 8 June 1979," in that the Minister allegedly violated the obligation to provide formal reasons, imposed on him by paragraph 2 of said article, in the event of a refusal to grant a request. The plaintiff maintains that the Minister, in his decision of 12 February 2021, relied on no legal grounds, merely making an assumption, namely that because the contact information requested by ... constituted personal data, consent from the passengers concerned would be required—an assumption which, moreover, is entirely false.At the public hearing of pleadings on October 18, 2022, the company ... stated that it was withdrawing its argument concerning a violation of Article 6 of the Grand-Ducal Regulation of June 8, 1979, and this was duly noted. The company ... then invoked a violation of Article 14 of the Grand-Ducal Regulation of June 8, 1979, which states: “Administrative decisions refusing to grant, in whole or in part, the requests of the parties or revoking or amending ex officio a decision that created or recognized rights must indicate the available remedies against them, the time limit within which the appeal must be lodged, the authority to which it must be addressed, and the manner in which it must be presented.” in that the Minister allegedly failed to mention the available remedies in his decision of February 12, 2021. It is well established that, in the event of non-compliance with Article 14 of the Regulation of June 8, 1979, if the decision does not indicate the available remedies against it, the time limit for filing an appeal, the authority to which it must be addressed, or the manner in which it must be submitted, no time limit for appealing the decision can begin to run.<sup>2</sup> While the contested decision does indeed fail to indicate the applicable remedies, the plaintiff cannot, given that she has filed an application initiating proceedings seeking the reversal and, in the alternative, the annulment of the contested decision, and which was filed within the time limit theoretically stipulated by law, and is therefore admissible ratione temporis, derive any right from the absence of information on the remedies, since this omission had no consequences, and she cannot claim any prejudice. The argument based on a violation of Article 14 of the aforementioned Grand-Ducal Regulation of 8 June 1979 must therefore be dismissed. Finally, it argues that the contested decision violates Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the “GDPR”. 2 French Council of State, 16 January 1985, Weirich, case number 7427 5 In this regard, the applicant relies on Article 6(1) of the GDPR, which establishes six legal bases on which a data controller is authorized to base the processing of personal data. Based on the guidelines stipulating that only the most appropriate legal basis for the purpose pursued by the data controller should be used, it considers that it would not be possible to combine legal bases for the same purpose. Thus, even if the consent of the data subjects could indeed constitute a legal basis under Article 6(1) of the GDPR, it could only serve as a legal basis for the envisaged processing of personal data in the absence of a more appropriate legal basis. One of the legal bases provided for in Article 6 of the GDPR is the pursuit by the data controller of a task carried out in the public interest or in the exercise of official authority, and would therefore specifically target the processing of personal data implemented by public authorities for their respective public purposes within the framework of the public interest tasks entrusted to them, which must be defined by Union or national law. She concludes that the Minister, designated under Articles L.311-4 and L.311-9 of the Consumer Code as the body responsible for the application of Regulation No. 261/2004, empowered to receive complaints from air passengers in accordance with Article 16(2) of Regulation No. 261/2004, and, where appropriate, to establish the existence of a violation of said Regulation and to order, by decision, the air carrier to comply with it, the collection and processing of passengers' personal data for the purpose of administering their complaint, based on Regulation No. 261/2004, would be essential in view of the public interest mission entrusted to the Minister. The applicant further argues that this reasoning is corroborated by the complaint form provided by the European Union, which does not require consent from air passengers for such processing, even though the lawfulness of the processing is based on a valid legal basis. The applicant also notes that the processing of data by which the Minister discloses the contact details of passengers, third parties with an interest in the proceedings, so that she can serve them with the application filed with the administrative court, is entirely compatible with the public mission pursued by the Minister. Therefore, in accordance with the principles of purpose limitation set out in Article 5(1)(b) and Article 6(4) of the GDPR, a specific legal basis for this processing cannot be required of the Minister. To admit the contrary would be completely absurd and would prevent her not only from submitting her observations regarding the complaints notified to her, but also from complying with the relevant decisions of the Minister, while also preventing her from having an effective remedy against decisions adopted by the Minister that are detrimental to her. Furthermore, a breach of her obligation to notify interested third parties of her appeal, pursuant to Article 4 of the Law of 21 June 1999, could be raised at any time during the proceedings on the merits, without her being able to rectify the situation should the Administrative Court order their intervention. The applicant also intends to argue that the lawfulness of the processing could even be based on Article 6(1)(c) of the GDPR, namely processing that 6 is necessary for compliance with a legal obligation to which the controller is subject. This ultimately leads one to consider that the Minister's position is all the more inexplicable given that, in other cases, he has readily provided details of the passengers involved. The State has not taken a position in the present dispute because it failed to file a response within the legal time limits. As a preliminary matter, regarding the subject of the appeal, it must first be noted that the Minister's decision of February 12, 2021, denies the company... access to its entire administrative file, and more specifically, the information concerning the passengers who filed complaints against it and who are the reason for the decisions issued by the Minister, which are the subject of the dispute pending before the Administrative Court, registered under number 45509. Regarding the communication of administrative files and access to them, the Grand-Ducal Regulation of 8 June 1979 stipulates, in Article 11, that "Every person subject to administrative action has the right to full access to the file relating to their administrative situation whenever this is affected, or is likely to be affected, by an administrative decision taken or in the process of being taken. (...) The decision taken by the Administration at their request is subject to appeal before the competent court." Article 12 further stipulates that "Any person affected by an administrative decision that is likely to infringe upon their rights and interests is also entitled to obtain access to the information on which the Administration has based, or intends to base, its decision." Article 13 of the aforementioned Grand-Ducal Regulation of 8 June 1979 sets out various circumstances under which disclosure of documents may be refused, and stipulates that: “In all cases, disclosure of documents may be refused if: - important public interests require that secrecy be maintained; - important private interests, particularly those of parties with opposing interests, require that secrecy be maintained, or when the documents contain information that may constitute an infringement of the privacy of other persons; - there is an imminent danger and the decision cannot be delayed. The document whose consultation has been refused to the party may only be used against that party if the authority has previously communicated to it in writing the essential content relating to the case and given it the opportunity to submit its observations.” The court must reiterate that, in administrative litigation, the burden of proof is shared between the plaintiff and the defendant. Thus, while the administrative rules of evidence primarily place the burden of proof on the applicant, who must effectively challenge and refute the content and legality of the contested administrative act, the administration, i.e., the defendant, cannot remain purely passive. The silence of administrative authorities and the refusal of access to administrative files cannot imply that the burden of proof falls solely on the applicant or that the administrative judge is prevented from exercising their review 7 of the factual elements. On the contrary, such attitudes constitute flagrant violations of the principle of transparency in administrative action.3 Since the State party failed to submit its observations within the legally prescribed time limit, the court considers that the facts alleged in the originating application, which are not contradicted by the documents produced in the case, are to be considered established, insofar as the applicant provides evidence and indications capable of supporting its claims, it being specified in this regard that an administrative file was filed in this case containing only the application of the company ... dated January 25, 2021, and the Minister's decision of refusal dated February 12, 2021.The court must then note that the Minister, in his decision of 12 February 2021, merely invoked the need for consent from the passengers concerned, without providing any detailed explanation as to whether this consent was refused, or the reasons that would prevent him, if applicable, from overriding such a request for consent. In the absence of any statement from the State clarifying the grounds for the contested decision, it must be concluded that the Minister failed to explain whether the refusal was justified by one of the conditions of Article 13 of the Grand-Ducal Regulation of 8 June 1979, or why the processing of the data in question might not fall within the scope of Article 6(1)(e) or (c) of the GDPR, as argued by the applicant. It follows that the Minister's decision of February 12, 2021, is subject to annulment for being neither factually nor legally justified, without the need to further analyze the other arguments raised by the applicant. The company ... further requests an award of €5,000 in legal costs pursuant to Article 33 of the Law of June 21, 1999. In view of the outcome of the litigation, the essentially passive stance of the State, and the fact that the applicant had to retain legal counsel to support its claim, the court sets this legal cost at €1,000. For these reasons, the Administrative Court, Fourth Chamber, ruling with respect to all parties; declares itself incompetent to hear the subsidiary appeal for review; The Court accepts the main application for annulment in form; on the merits, declares it justified; therefore, annuls the decision of the Minister for Consumer Protection of 12 February 2021; 3 Administrative Court, 10 January 2005, No. 18134 of the roll, confirmed on this point by the Administrative Court, 21 February 2006, No. 19322C of the roll, Pas. adm. 2022, V° Contentious Procedure, No. 843 (2nd part). 8 orders the State of the Grand Duchy of Luxembourg to pay the applicant procedural costs of €1,000; orders the State to pay the costs and expenses of the proceedings. So judged and pronounced at the public hearing of April 18, 2023, by: Olivier Poos, First Judge, Emilie Da Cruz De Sousa, Judge, Laura Urbany, Judge in the presence of the Clerk, Marc Warken. c. Marc Warken c. Olivier Poos Certified true copy Luxembourg, April 18, 2023 The Clerk of the Administrative Court
