In a preliminary ruling procedure, the ECJ ruled that the Data Protection Directive (Directive 95/46/EC) does not preclude the disclosure of personal data of minors for the purpose of pursuing civil law claims (judgment of 04.05.2017 – C-13/16).

Personal data required for the pursuit of civil law claims

The case concerned a traffic accident in Riga.
An underage passenger got out of a cab without paying attention to the traffic situation.
With the door open, a trolleybus hit the door of the cab and was damaged.
The bus company demanded information about the underage passenger’s details from the authorities.
However, the authority refused to hand over the data, citing the European Data Protection Directive.

Art. 7 f of the Data Protection Directive does not establish an independent right to disclosure

The ECJ has now clarified that, in principle, no right to the disclosure of data can be derived from Art. 7 f of the Data Protection Directive.
Not even if this personal data is required to enforce claims under civil law.
Rather, the regulation only permits the processing of such data.

However, Art. 7 f of the Data Protection Directive does not preclude disclosure either

However, the provision in Art. 7 f of the Data Protection Directive does not preclude national regulations and claims for disclosure.
These may permit the disclosure of personal data for the purpose of enforcing civil law claims.
No special provisions apply with regard to the personal data of minors.
Only the minor’s need for protection must be taken into account when weighing up the interests.

Three criteria of the ECJ for the disclosure of personal data

In its decision, the ECJ also sets out three criteria that must be met cumulatively so that the disclosure of personal data does not violate the provisions of the Data Protection Directive.

1. The third party to whom the data is transmitted must have a legitimate interest.
2. The processing of personal data must be necessary to realize the legitimate interest of the third party.
3. The fundamental rights and freedoms of the data subject must not outweigh those of the third party.

Claim for restitution always follows from national regulations

However, merely fulfilling these requirements does not directly mean that there is a right to have the personal data handed over.
It merely means that the Data Protection Directive does not preclude the disclosure.

The right to disclosure of the personal data itself is always derived from the national regulations.
However, the principle of data minimization must also be observed here.
Only the data that is necessary for the pursuit of interests may be disclosed.