A (...Bebidas S.A) – Court Ruling (Portugal, 2022)

“A” brought an executive action against “B”. After this, an enforcement proceeding was started with an order to impound two vehicles. However, it became clear that it was impossible to impound the vehicles. After this, the pursuing creditor requested the controller to provide information about the journeys of these vehicles in question since a specific date. The controller is an entity responsible for collecting toll fees on highways with the use of an electronic system, thus monitoring the passage of vehicles at certain points installed on the road for this purpose. The controller is therefore able to register traffic and collects personal data from its clients. The controller is also responsible for the treatment of such data. The controller stated that it couldn't supply information concerning toll records (date, time and place) because this was part of the the concept of protection of privacy. These toll records could only be shared with the consent of data subjects, the owners of the cars. After this, the pursuing creditor requested the lifting of professional confidentiality from the controller so the record of the journeys of the cars could be disclosed, whic could result in the cars being seized. The Court held that those responsible for processing personal data, as well as those who, in the course of their duties, have knowledge of the personal data processed, are bound by professional secrecy, even after the end of their functions (Article 10 of Lei 58/2019), which directly mentions Article 38(5) GDPR. Lei 58/2019 is a national law for GDPR implementation). This duty of secrecy must give way to the duty to provide legally required information, particularly to the judicial authorities, and to the duties of the National Commission for Data Protection (Article 8 of Lei 58/2019). The Court held that the records collected by the controller are personal data which fall under the concept of protection of privacy and for which there is an obligation of confidentiality for the controller. The court considered the possibility of creating "individual driver profiles" with these records and held that this information is likely to limit the freedom of movement of clients of the controller and that this information could involve risks of intrusion in private life if strict mechanisms for processing, storage and access to the information are not established. The Court stated that this case presented a conflict between the duty of professional secrecy and the duty to cooperate with the administration of justice, which should be resolved through a judgment of proportionality through a judgment of weighting and coordination between these duties. In a balancing test of the interests at stake, the Court concluded that making the information available about the controller's clients and their private matters was not proportional in relation to the scope of the availibillity of the information.. The Court further stated a failure to obtain the information didn't jeopardize the applicant's interest in locating the vehicles. The success or failure of seizing the vehicles would not depend on the lifting of the profesional secrecy of the controller. The Court held that is was therefore not appropriate to lift the professional secrecy of the controller.