A Pakistani national, the plaintiff – Court Ruling (Germany, 2023)

A Pakistani national residing in Germany (the data subject) is suspected of having killed a person together with his brother and other persons in Pakistan, where he is wanted by warrant. This created an alert on the Schengen Information System (SIS) stating that he should be denied entry into the Schengen zone. The data subject upon travelling to Italy was arrested at the border to be extradited to Pakistan. Pakistan however, failed to submit an extradition document despite Italy's requests. Therefore, the arrest was revoked by the Italian Court of Appeal in Brescia. Based on this, the data subject argued that he was now innocent and requested the deletion of the alert on the SIS system under Article 17(1)(d) GDPR.This is because Article 53(1) Regulation (EU) 2018/1861 which governs the operation of the SIS system refers to the GDPR and allows data subjects to invoke their rights under it, even if they are not for example an EU national. The reason for the data subject invoking the GDPR is that Article 53(1) Regulation (EU) 2018/1861 which governs the operation of the SIS system, refers to the GDPR and allows data subjects to invoke their rights under it when their data is processed by the system. The Federal Police Headquarters of Germany rejected the request for deletion multiple times. The alert was lawful and according to national law, data of foreigners who are the subject of an alert for refusal of entry can be stored on the basis of public safety. The voiding of the arrest warrent in Italy could not be held to override this public safety. The extradition had failed for formal reasons rather than because the data subject was innocent. The arrest warrant issued by Interpol Pakistan had not been withdrawn and therefore, there was still a valid reason to hold the alert in the SIS system. The data subject appealed the decision to the German Court in Potsdam arguing, among other reasons, that his rights had been infringed and that the data should be deleted because it had been unlawfully processed. The court held that the data subject's request was unfounded and dismissed it. The requirements of Article 17(1)(d) GDPR are not met as the data was processed lawfully. First, data processing is only unlawful if there is neither the consent of the data subject nor any other legal basis for it. In this case, the Federal Police Headquarters has a legal basis under the Federal Police Act. This Act states that Member States shall keep an alert if the prescence of a third-country national constitutes a threat to public safety. There is a threat to public safety if there are reasonable grounds to suspect that a third-country national has committed a serious criminal offense. Second, the Court on the facts decided that there were reasonable grounds to suspect that the applicant was involved in a murder in Pakistan (a serious criminal offence). The warrant issued by Pakistan sufficiently individualises the data subject, substantiates the accusation with the time of the crime, the place of the crime, the victim and witnesses and therefore, justifies the conclusion that the suspicion in the data subject's case is well-founded. Third, there is no legal obligation on the Federal Police Headquarters to question the facts of the arrest warrant in Pakistan. The assumption of a threat to the public is based on an "individual assessment" by the Member State. When determining whether there is reasonable suspicion and thus a threat to public order, the authority has a broad scope of discretion.