Ministry of Industry and Trade of the Czech Republic – Court Ruling (Czech Republic, 2024)

A journalist (‘data subject’) demanded an apology in relation to himself and to the citizens of the Czech Republic (‘CZ’) from the Ministry of Industry and Trade of the CZ (‘controller’) as a compensation for the non-material damages suffered as a result of the incorrect transposition of Directive 2002/58 of the European Parliament and of the Council /EC of 12 July 2002 on the processing of personal data and the protection of privacy in the electronic communications sector (‘e-Privacy Directive’ or ‘Directive’). According to the Czech law transposing the Directive, operators of electronic communications and public networks must store a variety of user communication information for six months, primarily to aid in the investigation of criminal and misdemeanor activates. The incorrect transposition of the Directive allegedly led to the widespread collection and processing of operation and location data of users' the electronic communications. In this case, the data subject saw an interference with his rights to privacy and informational self-determination. Before filing the lawsuit, the data subject tried unsuccessfully to obtain the erasure of data stored on him through a mobile operator and later through the Czech DPA. The DPA stated that, in their opinion, it is indisputable that the national legislation issue (§ 97 paragraph 3 of Act No. 127/2005 Coll.) is not in accordance with Article 15 ePrivacy Directive. According to the Directive, Member States may enact laws to limit certain rights outlined in the Directive, including data retention, if it is necessary for national security, defense, public safety, or crime prevention, in line with EU principles. However, the complaint was rejected by the DPA. Nevertheless, the data subject brought the DPA's opinion to the controller's attention who rejected it claiming that this transposition of the Directive cannot be considered as 'improper official procedure' according to Act No. 82/1998 Coll., on liability for damage caused in the exercise of public authority. The data subject filed a lawsuit at the District Court of Prague 1 which rejected the request of the data subject for an apology. It concluded that the alleged damage caused by contradiction of national legislation and EU law is only a ‘potential damage not eligible for the legal protection’. The court added that the data subject was not entitled to file a lawsuit which concerns compensation for non-material damage to all citizens. The data subject filed an appeal against this decision. the Municipal Court in Prague confirmed the first instance decision. Finally, the data subject filed another appeal at the Supreme Court to resolve the questions on: # state responsibility for erroneous transposition of e-Privacy Directive # the question of the occurrence of non-material damage. To begin with, the Supreme Court confirmed the decision of the court of first instance on the part regarding the lack of legal standing for seeking protection of the public interest. Such protection is not afforded by civil law and a person cannot claim damages for people that are not taking part in the procedure. Regarding the state responsibility for the legislative activity, the Supreme Court referred to the joint cases C-46/93 and C-48/93, Brasserie du pêcheur SA, Factortame Ltd and others. The CJEU confirmed that a violation of directly effective standards thus results in state liability for damage. Consequently, Act No. 82/1998 Coll. shall be applied reasonably only where its rules are consistent with those of EU law or cover issues not addressed by EU law and as long as it does not hinder the individual’s rights to seek compensation for damages. The Supreme Court, therefore, recalled three conditions for the state to be liable for a violation of EU law, namely: # the violated rule of EU law grants rights to the injured parties # the violation of this rule is sufficiently serious # there is a direct causal link between this violation and the damage suffered by the injured parties In relation to the damage suffered, the Supreme Court concluded that the harm to data subjects may consist of a mere "loss of control" over their own data. This is the case even if there was no actual misuse of the data in question to the detriment of said persons. Thus, if a data subject seeking damages on this basis argues that he fears that his personal data will be misused in the future as a result of such a breach, the national court to which the case was brought must verify that this fear may be justified. Regarding the data retention period, the Supreme Court said that practice of the Czech law has been consistently ruled illegal by the Court of Justice of the EU (e.g. C-293/12 and C-594/12, Digital Rights Ireland Ltd, C-203/15 and C-698/15, Tele2 Sverige). It concluded that EU law prevents such legislative measures which, for the purpose of combating serious criminal activity and preventing a serious threat to public security, preemptively provide for widespread and indiscriminate storage of operational and location data. According to the CJEU, extensive storage of operational and location data is only allowed when there is a serious threat to national security. The storage order should only last as long as absolutely needed, with the chance of extending it and reviewed by a court or independent body. The Supreme Court thus indicated that the Czech legal regime governing data retention might infringe on the right to privacy and personal data protection, directing lower courts to further examine this issue. The decisions of the lower courts will indicate whether retention of traffic and location data may be shortened in the CZ. In the event that the courts conclude in subsequent proceedings that the national regulation in question does not comply with the conditions of the Directive as interpreted by the CJEU, it will be necessary to examine, in accordance with the decision of the CJEU in the case of Brasserie du pêcheur SA, Factortame Ltd and others, whether this violation was sufficiently serious to consider the CZ liable for violation of EU law.