UOOU (Czech Republic) - UOOU-05284/19-47
From GDPRhub
| UOOU (Czech Republic) - UOOU-05284/19-47 | |
|---|---|
 | |
| Authority: | UOOU (Czech Republic) |
| Jurisdiction: | Czech Republic |
| Relevant Law: | Article 5 GDPR Article 6(1)(f) GDPR Article 7 GDPR Article 9 GDPR Article 10 GDPR Law no. 110/2019 Coll. |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | |
| Decided: | 28.05.2021 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | UOOU-05284/19-47 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Czech |
| Original Source: | UOOU (in CS) |
| Initial Contributor: | ea |
The Czech DPA ordered a new first-tier decision of a case because in its earlier decision it did not properly carry out the balancing test in Article 6(1)(f) GDPR. It also held that the new decision should consider the application of Article 10 GDPR.
English Summary
Facts
The data controller published the data subject’s personal data on his Facebook profile. The personal data consisted of a partially anonymised criminal court decision revealing that the data subject committed the criminal offence of false accusation. It contained the data subject’s name and surname, place of birth, permanent address, details concerning the criminal offence committed by her, and a name of her Facebook profile which included her photograph and additional details relating to her criminal offence.
The DPA asked the data controller to remove the relevant Facebook post. The data controller failed to do so. The DPA, both at first instance and on appeal, subsequently held that the data controller infringed Article 5, 6, 7 or 9 GDPR. It also issued a fine of CZK 10,000 (approximately €410). The data controller then filed a request for a judicial review of the decision at the City Court of Prague.
Holding
The City Court of Prague set aside the decision and remitted the matter back to the DPA. It reasoned that the DPA, in holding that Article 6(1)(f) GDPR did not constitute a legal basis for the processing of personal data, did not attempt to balance the data controller’s legitimate interests and the data subject’s fundamental rights against each other. The DPA appellate body subsequently ordered a new first-tier decision. It clarified that the first-tier decision-maker should determine the legitimate interests of the data controller or third parties (such as being a “societal watchdog”) and whether the Facebook post was a suitable and necessary measure to achieve that aim. The first-tier DPA body should then also consider whether Article 10 GDPR was violated.
Comment
Interestingly, the original first-tier DPA decision referred to a violation of Article 5, 6, 7 or 9 GDPR. It seems that Article 10 GDPR was not considered. This is perhaps why the court and subsequent DPA appellate body decision focused primarily on Article 6(1)(f) GDPR rather than Article 10 GDPR in their decisions.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Czech original. Please refer to the Czech original for more details.
DECISION Chairman of the Office for Personal Data Protection as an appellate body competent pursuant to § 10 and § 152 paragraph 2 of Act No. 500/2004 Coll., the Administrative Procedure Code, decided pursuant to the provisions of § 152 para. and), § 152 paragraph 5 and § 90 paragraph 1 letter b) of Act No. 500/2004 Coll., Administrative Procedure Code, as follows: Decision of the Office for Personal Data Protection ref. UOOU-05284 / 19-20 of 2 June 2020 is annulled and the case is returned to the administrative authority of the first instance for a new hearing. Justification I. Definition of the matter (1) The basis for proceedings in the matter of suspicion of committing an offense pursuant to § 62 para. b) Act No. 110/2019 Coll., on the processing of personal data, in connection with the unauthorized by publishing the criminal order on the Facebook profile "XXXXXX" available on the Internet address XXXXXX, the file material was collected on the basis of complaints received by the Office for protection of personal data (hereinafter referred to as the "Office"), concerning possible breaches of processing of personal data by the accused, XXXXXX, with its registered office at XXXXXX (hereinafter referred to as the “accused”). (2) It was clear from the file that the accused placed on 17 January 2020 at 21:53 a post on your Facebook profile with a copy of a partially anonymized criminal an order issued against XXXXXX, which continued to contain her personal data to the extent name, surname, place of birth, city of permanent residence, information relating to to her offense of false accusation and the name of the Facebook profile "XXXXXX", on which a photograph with her likeness was placed, as well as information related to her misdemeanor. (3) On the basis of the above, the Office first notified the accused of a breach of the Regulation Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of persons with regard to the processing of personal data and on the free movement of such data and on cancellation Directive 95/46 / EC (hereinafter "the General Regulation") and called on it to remedy the illegal situation. On this The defendant responded to the summons by a letter dated 10 March 2020, in which he informed the Office that the incriminated post at that address has been permanently deleted, correcting it and this claim was verified by the Office. However, a follow-up investigation was carried out on On 15 April 2020, on the basis of the complaint received, it was found that the contribution in question was at the defendant's Facebook profile remains publicly available. OFFICE FOR PERSONAL DATA PROTECTION Lt. Col. Sochora 27, 170 00 Prague 7 tel .: 234 665 111, fax: 234 665 444 posta@uoou.cz, www.uoou.cz 2/3 (4) Subsequently, therefore, the administrative body of the first instance issued an order ref. UOOU-05284 / 19-15 of April 27, 2020, by which the conduct of the accused was qualified as a misdemeanor pursuant to Section 62 (1) letter b) of Act No. 110/2019 Coll. and at the same time a fine of CZK 10,000 was imposed on the accused. However, the order was subsequently revoked due to the defendant's opposition. (5) The result of the ongoing infringement proceedings was the issuance of a decision no. UOOU- 05284 / 19-20 of 2 June 2020 reaffirming the accused of committing an offense offense according to § 62 par. 1 let. b) of Act No. 110/2019 Coll. and was fined CZK 10,000 because he violated some of the basic principles for the processing of personal data according to Articles 5 to 7 or 9 of the General Regulation, which he committed as a personal data controller XXXXXX by placing it on publicly from 17 January 2020 and at least until 15 April 2020 accessible Facebook profile post with a copy of a partially anonymized criminal an order of 8 January 2020 issued against XXXXXX, which contained her personal data in the range of name, surname, place of birth, city of permanent residence and name Facebook profile "XXXXXX", which contains a photo with her portrait and also information relating to her offense of false accusation. (6) Decision no. UOOU-05284 / 19-20 of 2 June 2020 was then a decision President of the Office Ref. UOOU-05284 / 19-36 of 19 August 2020 confirmed. However the accused subsequently turned to the Municipal Court in Prague with a lawsuit seeking annulment the latter decision of the President of the Office, in which the Municipal Court in Prague ruled Ref. 14 A 1 / 2021-40 of 20 April 2021 complied. (7) In the grounds of the judgment in question, the Municipal Court in Prague stated in particular that Article 6 (1) (a) f) a general regulation, the application of which the Office in the contested excludes the decision, regulates the lawfulness of the processing of personal data if “it is necessary for for the purposes of the legitimate interests of the administrator concerned or of a third party, except where before interests take precedence over the interests or fundamental rights and freedoms of the data subject in need of protection personal data, in particular if the data subject is a child ". The cited provision therefore allows to give priority to the rights of others over the data subject's right to the protection of personal data, however, again on the basis of the specific ratio of these conflicting rights. In this case it was therefore necessary to carry out a so-called balance test, ie a de facto proportionality test for two in a collision existing rights, namely the right of the data subject to the protection of personal data on the one hand and the public to be informed about criminal proceedings through the accused in the role of the so-called "Social watchdog" on the other hand. Since the Office's assessment of the above conditions for the lawfulness of the processing of personal data in administrative decisions did not deal with and limited itself to stern statements that the processing of personal data for example pursuant to Article 6 (1) (a) f) of the general regulation would be possible, resp. that the accused title for the processing of personal data under this provision does not prove, however, without He explained convincingly and, above all, in a verifiable manner why it could not be considered in this case, let alone carry out a proportionality test in the above sense the decision is a defect of unreviewability for lack of reasons. II. Assessment by the appellate body (8) The Office is the opinion of the Municipal Court in Prague expressed in the judgment no. 14 A 1 / 2021- 40 of 20 April 2021 bound (see § 78 para. 5 of Act No. 150/2002 Coll., Administrative Procedure Code). (9) Furthermore, it should be recalled that the appellate body with regard to the provisions of § 152 para. 6 letter a) and § 90 par. 1 let. c) of Act No. 500/2004 Coll., as the accused would be in danger of harm 3/3 Due to the loss of the opportunity to appeal, he does not have legitimacy to take the case decided that the decision of the administrative body of the first instance ref. UOOU-05284 / 19-20 of On 2 June 2020, it was amended in accordance with the requirements of the judgment of the Municipal Court in Prague ref. 14 A 1 / 2021-40 of April 20, 2021. (10) For the above reasons, the Appellate Body therefore ruled as set out in the operative part of this notice decision. (11) In the subsequent proceedings, the administrative authority of the first instance should therefore comply with the requirements Judgment of the Municipal Court in Prague Ref. 14 A 1 / 2021-40 of 20 April 2021 to carry out the so-called balance test as required by Article 6 (1) (a) (f) a general regulation comparing the two conflicting rights, ie the right to inform the public about the outcome of criminal proceedings on the one hand, and the right to personal data on the other, and then to issue new ones decision. In the opinion of the Appellate Body, it can then be used for its implementation the argumentation of the Municipal Court in Prague contained in the judgment no. 5 and 138/2014 of 2 October 2017. More specifically, the first instance administrative body should first determine what they are the legitimate interests of the accused or third parties in the disclosure of the personal data in question, resp. whether they correspond to the role of the so-called "social watchdog" and whether these interests are possible through the publication in question, or whether the objective pursued would not be means can be achieved that are less intrusive on the data subject's rights for the protection of personal data. However, the basis for these considerations must also be to determine to what extent degree or whether the accused can be granted the role of a so-called "social watchdog", by others in other words, whether and to what extent and for what reason it acts in the public interest and thus contributes public debate or whether the accused is acting in a private interest. Subsequently, it will be necessary consider to what extent the interference with the right to protection of personal data in question is proportionate, ie if the seriousness of the infringement of a fundamental right in a given specific situation is outweighed by the significance the objective pursued is not whether the victim brought about in the form of a restriction of a fundamental right is not received disproportionate to the benefits that the restriction has brought. In this context, it will also be necessary in accordance with recital 47 of the General Regulation, the reasonable expectations of the person concerned must also be taken into account the data subject on the basis of his relationship with the accused (controller), it will also be necessary to consider in so far as the publication in question corresponds to the provisions of Article 10 of the General Regulation governing the processing of personal data relating to criminal and criminal convictions acts. Relevant case law will also need to be taken into account, in particular judgments of the European Court of Human Rights in the case of Magyar Jeti Zrt v. Hungary of 4 December 2018 No. 11257/16, in the cases of M.L. and W.W. v. Germany of 28 June 2018 Nos 60798/10 and 65599/10 and in the case of Høiness v. Norway of 19 March 2019 No. 43624/14. Instruction: Pursuant to the provisions of Section 91 (1) of the Act, this decision shall be challenged No. 500/2004 Coll., Administrative Procedure Code, cannot be revoked. Prague, May 28, 2021 Mgr. Jiří Kaucký chairman (electronically signed)
