A (...Bebidas S.A) – Court Ruling (Portugal, 2022)

“A” brought an executive action against “B”. After this, an enforcement proceeding was started with an order to impound two vehicles. However, it became clear that it was impossible to impound the vehicles. After this, the pursuing creditor requested the controller to provide information about the journeys of these vehicles in question since a specific date. The controller is an entity responsible for collecting toll fees on highways with the use of an electronic system, thus monitoring the passage of vehicles at certain points installed on the road for this purpose. The controller is therefore able to register traffic and collects personal data from its clients. The controller is also responsible for the treatment of such data. The controller stated that it couldn't supply information concerning toll records (date, time and place) because this was part of the the concept of protection of privacy. These toll records could only be shared with the consent of data subjects, the owners of the cars. After this, the pursuing creditor requested the lifting of professional confidentiality from the controller so the record of the journeys of the cars could be disclosed, whic could result in the cars being seized. The Court held that those responsible for processing personal data, as well as those who, in the course of their duties, have knowledge of the personal data processed, are bound by professional secrecy, even after the end of their functions (Article 10 of Lei 58/2019), which directly mentions Article 38(5) GDPR. Lei 58/2019 is a national law for GDPR implementation). This duty of secrecy must give way to the duty to provide legally required information, particularly to the judicial authorities, and to the duties of the National Commission for Data Protection (Article 8 of Lei 58/2019). The Court held that the records collected by the controller are personal data which fall under the concept of protection of privacy and for which there is an obligation of con