Court case 9946/2022 – Court Ruling (Spain, 2022)

This ruling started by the appeal that the data subject submitted to the High Court of Justice of Catalonia against the resolution of the Police Directorate General in which the data subject was suspended from their duties due to a serious violation. On the 5th of April of 2019, the data subject was assigned one shift which finished at 7. The data subject is a police officer who works at the Border Inspection post at Barcelona airport and that day, around 4:25 manifested feeling sick and having migraines which was written down in a statement that was handed over to the Inspector to finally leave their place of work. However, it was later discovered that the data subject went back to the airport at 6:25, took a flight to Tenerife and that the purchase of the ticket was done the 28 of March of that year. The resolution challenged states that the data subject deliberately faked their sickness to be able to take that plane and to leave their place of work which is foreseen in the Law regarding the disciplinary regimen of the National Police (Ley Orgánica 4/2010, de 20 de mayo, del Régimen Disciplinario del Cuerpo Nacional de la Policía) as a serious violation. The defendant claimed, among other things, the nullity of the resolution due to the unlawfulness of the evidence since the access to the data regarding the boarding of the flight was done in violation of their fundamental right to privacy and data protection and the presumption of innocence and, alternatively, the data subject claimed that the sanction was disproportionate. The High Court took into consideration a resolution of the present case by the Spanish DPA in which the authority upheld the complaint submitted by the data subject for the unlawful collection of their data regarding the boarding of that flight. Additionally, the Court considers that such collection could have been legal within a disciplinary proceeding -as in the present case- if the Police would have performed such investigative steps by the competent authority, however, the police officer who was in charge of asking for the information directly to the airline belonged to the ‘Foreigners’ and ‘Reaction’ groups lacking the competency required by the national law regarding Public Administration Common Proceeding (Ley 39/2015, de 1 de octubre, del Procedimiento Administrativo Común de las Administraciones Públicas), which obliges the investigative body to be vested with investigative and inspection authority before authorizing such investigative steps. In this regard, the Court highlighted that the principle of proportionality is of great importance since this would allow the intervention of public powers in a fundamental right (privacy and data protection). Also, the Court stated that this obligation is key since the collected data constitute incriminating evidence and the information obtained is personal data. Finally, about the proportionality test, the Court listed its requirements: Such intervention must be adequate to achieve the purpose; it must be necessary, in the sense that there is no alternative less intrusive for the data subject; and it must be proportionate, meaning that it should not lead to the excessive sacrifice of the right nor it should undermine the substance of the right. This last requirement aims to avoid the achievement of the public interest at the expense of individuals’ rights. In the present case, the Court considered that there were other measures that the Police could have put in place to achieve the same result, for instance, access to CCTV cameras (with constitutional guarantees), however, these options were not even assessed. Thus, in this case, the right to privacy and data protection suffers an excessive sacrifice according to the purpose which is the application of disciplinary measures. For these reasons, the High Court upheld the appeal and declared the resolution null.