Czech Republic: The Office for Personal Data Protection “repents”

10.11.2017

It all started on 21 November 2011, when an electric bike was stolen from a shop of the ekolo.cz s.r.o company in Prague. The perpetrator was captured on camera during the theft. The victim of the robbery then posted a snapshot from the CCTV camera recording on the Facebook social network, with the request to share it for the purpose of capturing the offender. And it really helped the police quickly find the stolen goods and detain the perpetrator. However, the case did not end there, but rather only just began at this point, in terms of personal data protection.

At the end of 2011, on the initiative of the perpetrator, proceedings were initiated with the Office for Personal Data Protection (“Office”) against ekolo just because of publishing a camera snapshot without the prior consent of the perpetrator. Another fact for which the Office’s investigation was conducted was that ekolo did not notify the Office of its intention to process personal data via CCTV (notification obligation). Then came a rather interesting decision. The Office ordered ekolo to pay a fine of CZK 5,000, plus the costs for proceedings, in the amount of CZK 1,000. The reason was primarily that ekolo, by publishing the image, violated its obligations governed by data protection regulation.

Ekolo did not agree with the decision, and filed a so-called remonstrance (rozklad) against it, which the Chairman of the Office rejected on 19.4.2012.

On ekolo’s initiative, there followed proceedings at the Municipal Court in Prague, which reviewed the decision of the Chairman of the Office. In its judgment of 19 May 2015, the court annulled the Chairman’s decision, because they considered that the decisions of the Office and its Chairman lacked proper justification on why such disclosure constitutes a breach of obligation. The Court determined that the information captured by ekolo’s CCTV system is indeed personal data, and that this data is processed by ekolo. It is processed to the extent necessary to protect property, which is, under certain circumstances, a legitimate purpose for processing data without the consent of the data subject (here, the perpetrator of the theft). In this respect, it is necessary to carry out the so-called proportionality test, which is to determine whether the violation of privacy (of the perpetrator) by publishing his pictures is disproportionate to the protected interest of the data controller (ekolo). The court carried out this test, which, of course, should have been carried out properly by the Office at the first instance, and came to the conclusion that the protection of property should, in this case, prevail over the protection of the perpetrator’s privacy. However, the Office was not satisfied with the decision, and challenged the court’s judgment by a cassation complaint, in which they argued that taking pictures without the consent of the perpetrator was fine, but the problem arose at the time of the publication of the photograph on the Facebook. Only the police were entitled to publish it, in the opinion of the Office.

The Supreme Administrative Court agreed with the Municipal Court as to the fact that personal data processing was involved. Otherwise, they were surprisingly in agreement with the Office’s opinion, and stated that the purpose of operating CCTV systems is not to make records for future disclosure, but only for eventual transmission or transfer to investigative bodies. Ekolo would need prior consent from the perpetrator if they wanted to publish his personal data themselves. This conclusion is formally and legally defensible, but in terms of simple logic it is debatable. It is clear that consent would be very difficult to obtain in this case, and practically it would mean that publishing pictures could never be allowed.

The Supreme Administrative Court did not deviate from the decision-making practice, which also resulted from previous rulings of the European Court of Human Rights and the Constitutional Court of the Czech Republic. But ekolo did not intend to give up, because they considered this practice absurd, and filed a constitutional complaint. However, the Constitutional Court ruled it out on 5 September 2017 as manifestly unjustified, because, in their opinion, the constitutionally guaranteed rights of ekolo were not interfered with. The Court reiterated their view that in such cases, it is not necessary to carry out a proportionality test. The condition of necessity in the use of means to fulfil the protection of the interests of the processor of personal data is not fulfilled. The Constitutional Court considered that the objectives could equally well be achieved by handing the image over to the police. However, due to the statistics of police investigations of similar minor thefts, this argument can be discussed at great length. There are also “heretical” views that the police would probably not investigate at all. This seemed to be the close of the case. The legal public at times pointed out that, in this case, the old Latin principle Ex iniuria ius non oritur (i.e. a right does not arise from wrongdoing) took a beating again.

However, in October this year, a new surprise came. The new Chairwoman of the Office for Personal Data Protection, who took up office only after the cassation complaint was filed, appeals for the need to interpret the law in the context of perceiving justice in society. In its public communique the Office assures the company that its decision-making practice is gradually evolving, and that there would be no fine imposed on ekolo under current management. In the same statement, the Office also asserts that, in order to acquire, or respectively publish, a recording, it is not necessary to acquire the consent of a person suspected of theft. That sounds reasonable. Unfortunately, the above-mentioned judgments of all levels show something different. Therefore, other cases similar to ekolo’s can be expected. All one can do is to cross one’s fingers and hope for a little common sense.