DPA case UOOU-05284/19-47 – Order (Czech Republic, 2021)

The data controller published the data subject’s personal data on his Facebook profile. The personal data consisted of a partially anonymised criminal court decision revealing that the data subject committed the criminal offence of false accusation. It contained the data subject’s name and surname, place of birth, permanent address, details concerning the criminal offence committed by her, and a name of her Facebook profile which included her photograph and additional details relating to her criminal offence. The DPA asked the data controller to remove the relevant Facebook post. The data controller failed to do so. The DPA, both at first instance and on appeal, subsequently held that the data controller infringed Article 5, 6, 7 or 9 GDPR. It also issued a fine of CZK 10,000 (approximately €410). The data controller then filed a request for a judicial review of the decision at the City Court of Prague. The City Court of Prague set aside the decision and remitted the matter back to the DPA. It reasoned that the DPA, in holding that Article 6(1)(f) GDPR did not constitute a legal basis for the processing of personal data, did not attempt to balance the data controller’s legitimate interests and the data subject’s fundamental rights against each other. The DPA appellate body subsequently ordered a new first-tier decision. It clarified that the first-tier decision-maker should determine the legitimate interests of the data controller or third parties (such as being a “societal watchdog”) and whether the Facebook post was a suitable and necessary measure to achieve that aim. The first-tier DPA body should then also consider whether Article 10 GDPR was violated.